So how will a bank, credit union or other financial services provider know if it has violated the law?

Like Citibank, Discover Bank and others, the institutions will know when the CFPB issues an enforcement action or consent order. The CFPB has also said that even if a financial services provider complies with all consumer financial protection laws, it could still be charged with violating UDAPP.

As a result of these broad guidelines, the CFPB has already issued several enforcement actions that have produced almost $2 billion in fines and restitution orders. Additionally, financial services providers have spent billions trying to interpret UDAAP, develop compliance policies and procedures and train employees.

If credit unions believe they are safe because they don't practice the same lending and collection actions as big banks such as Citibank, they are wrong. NAFCU issued an alert to members on the topic earlier this week, and the ways in which credit unions could violate UDAAP are very troubling.

According to the CFPB's Supervision and Examination Manual and consent orders, an act or practice is unfair when it meets the following three-part test: It causes or is likely to cause substantial injury to consumers; the injury is not reasonably avoidable by consumers; and, substantial injury is not outweighed by countervailing benefits.

NAFCU rightly points out the key phrase here is substantial injury. Normally, substantial injury means monetary harm. However, according to the CFPB, substantial injury can occur without monetary harm. For example, emotional harm could qualify as substantial injury and could be determined by such subjective measures as excessive collection calls.

A recent consent order from the CFPB cited collection activities that included calls to work numbers, the disclosure of consumer debts to non-liable third parties and calls to consumers after being notified they were represented by legal counsel.

What is considered excessive? Five calls? 25 calls? What constitutes debt disclosure to third parties? What if legal counsel doesn't accept or return calls?

The CFPB has not issued specific regulation or guidance on the matter. That means some snot nosed millennial at the CFPB who doesn't think he needs to repay his student loans, and was probably never disciplined by his parents, could use subjective measures to determine if your credit union's collection practices caused substantive injury, and there's nothing you can do about it.

Another gem in the three-prong test is the loosey goosey definition of acts or practices that are unfair because they prevent consumers from reasonably avoiding injury. That includes the requirement that institutions give consumers all the information they may need to make a rational and reasonable decision.

In other words, according to NAFCU's bulletin, if information has been hidden, omitted, withheld or presented inaccurately, it could hinder the consumer's decision-making process. However, the CFPB refuses to define exactly what information needs to be provided.

Credit unions can bury their heads in the sand and tell themselves that because they can't afford to pay millions of dollars in fines, the CFPB probably won't come after them. Like a poor person at low risk of an IRS audit, that might be true.

However, the fact that the CFPB could pursue credit unions for violations of UDAAP based upon commonplace lending and collection practices should keep the entire community up at night.