How Dealership Compliance Programs Mitigate F&I and Data Risk

Opening

Hey, if you missed us live, you can listen to us wherever you get your podcast.

Introduction and background in the car business

Hello there, this is Ian Nethercot from the big town of Hanover, Maryland. I just finished a soda con, and I have a wonderful guest brought to us by a good friend of mine, Jim. But it's Terry, is it pronounced Dortch, is that how you pronounce it, Terry?

It's Dortch.

D. Okay, is it a German name? I'm assuming it is.

D.

Oh, fantastic. Yeah, I have some heritage myself. So if you could tell me a little bit more about you and what you do, go ahead whenever you're ready.

Well, myself, I've been in the car business since I was 14 years old, so a long time.

Wow, congrats.

Started in a wash rack as a kid, for a short period of time. Left it, went into the college, got a degree, went back into the car business, and I've been in it ever since. Currently, I run a compliance company that works with auto dealers nationwide. We work with the different compliance areas within the dealership and create processes and procedures so that they can comply with all the different regulations that exist.

How Gramm-Leach-Bliley led to a compliance business

Fantastic. So 14, wow, I thought I was in the car this long time. And actually I interviewed Ed Roberts from Boart Ford at the show here, and he was talking about how he started as a technician, that he was homeless at the time, and very thankful for that. He's been in the business a long time, but that was very interesting. So how did you move from a car business to compliance? I'm just curious.

Well, I was in retail. I worked retail for almost 20 years, and there was a company at the time out there called Half a Car. Anybody in the car business has been around for a while, we probably know them, they're the ones that basically created the whole leasing platform. And they started out with Ford, had a contract with Ford, and they kept bugging me to come to work for him, so I did. Went to work for them and worked for them for about a year or so, and during that time I had a dealer that kept asking me about this new law that was coming out about Gramm-Leach-Bliley. And so we started talking a little bit about it, I didn't know a whole lot, did some investigation, realized there was no way in hell that the car dealers were ever going to comply with it, and created a business around it because it was just too complicated for them, you know, their business was to sell cars, parts, and service.

So they're not as detail-oriented in some pieces as they could be, is that what you're saying?

Well, some of it, yeah.

Benefits of mitigating legal and reputational risk

Yeah, we had a lot of discussions over the last, call it five months, on AI for car dealers, and there's a couple people I interviewed over the last four or five days talking about AI for car dealers, and when they get caught in the weeds with algorithms and stuff, sometimes I kind of go, yeah, how does that go for you with the car dealer audience? But what I, if a car dealer can't focus on something like this but they still need the help, how do you bridge that gap? But more importantly, what's the benefit for the car dealer who wants to work with you, for example?

Well, there's huge benefits, there's several of them. The major benefit is that it's going to prevent any type of, or mitigate any type of action brought against them, either governmental, so FTC, CFPB, state AGs, as well as any civil type of action, because of any type of data breach. There's also F&I issues that need to be addressed, things of that nature. So there's a ton of benefit from it, especially in today's world where we're kind of a litigious society.

Yeah, unfortunately.

Yeah, can't escape it. So being that it's litigious, and everything with this whole process, what we do is help to create a program to mitigate all of that.

So if they don't like lawyers for the wrong reasons, it's a good conversation, is that what you're saying?

Exactly, they don't want to see the bad guy lawyers calling them up going, hey, did you know it's gonna cost you X.

So do they have to understand what you do, or is it something that you can handle for him? I mean, how does that work?

Oh no, we could take it from square one all the way through.

True.

And they don't have to understand it, but obviously anytime you're going to implement any kind of a program or a process, you need to understand the fundamentals of it. We come in, we explain all of that, we provide a host of things. I mean, we have over a hundred courses in our e-library, so that trains all the different employees in the dealership. So there's all kinds of different ways to bring the information to them, and most of them in today's world are pretty aware of it anyway.

Yeah, I would assume they'd want to avoid those costs, right, and maybe some negative press, not that press is the same, it's...

Yeah, the negative press and the fines, and there's just a whole host of, the negative press could probably kill you as much as anything, really.

Yeah, you know, especially because you're a retail organization, and in a retail marketplace, the consumer kind of dictates what happens.

Yeah, they, the consumer might not already have a good opinion of car dealers, not to beat anyone up, but you don't want that to get worse. I get what you're saying, I mean, I did an interview with a gentleman from Ford Direct and a dealer, and the first question was, oh, you're not putting this out yet, right, we gotta review it for compliance and legal and everything else, that was kind of funny.

Said everything right.

Yeah, yeah, yeah, yeah, we said stuff but we're not sure that's what we want to say yet, that was interesting. And I even had companies going, oh yeah, I'm here at a convention to sell services, but a salesperson can't talk to you on video, we gotta check with people on that.

So what's the biggest upside, like if you...

If you're comparing a dealer that said, "I don't want your services" versus one that did, what's the biggest upside in your opinion for them? Like, what's some success stories you could share?

On-site audits of shop safety and F&I deals

Well, I mean, there's a ton of them. I mean, there's anything from... compliance encompasses so many different areas, right? You've got your shop, so all the OSHA, EPA aspects of it. Yep. You know, we had an incident a few years back where a technician actually was trying to... the safety features on his rack, and the rack fell on him. So, you know, that's a... well, wasn't minute to him, but I mean, those are those don't happen often, but they do happen. And then you've got the other end of it where you've got the rogue F&I manager who's over here selling nefarious products that really don't have any value, and they're slamming it into a deal that they've structured in the F&I office or at the desk, right? So there's a host of different things that occur within a dealership, or that can occur, that need to be monitored and reeled in. And here, if you look at most dealer principals, or CEOs, or anybody within those organizations, they're not on the day-to-day, they're not sitting on the floor, desk in a deal, or working the F&I desk or anything like that. So there needs to be a second set of eyes that come in and kind of go through all of that to make sure that they're following those things, so that there can't be any kind of repercussions or ramifications from any type of activity that is nefarious.

Right, well here's... so what we do is, when we first come in, we come in and we spend a day to a day and a half in a store, and we're gonna actually live there for that day and a half. We're gonna walk through, watch them desk their deals, we're gonna do an actual audit, the jacket audit, deal jacket audit. We'll pick, you know, a half a dozen deals for each manager, from each manager, we'll audit those deals, go through, see how they structured them. And being from the retail world, we understand that a little bit better than most, right? So we're able to go through and pick out the little nuances and the things that we know are flags, and then we come back and we say, "Yeah, let's create processes and procedures with your management team so that we can mitigate this." Let's eliminate these issues. If we can figure out a process or a procedure within the dealership that eliminates that or prohibits these things from happening, then we've done our job here, and we've been able to set ourselves up for... and again, this whole concept of compliance and the protection that we're creating is basically setting the dealer up so he can wage an affirmative defense.

Right, any type of litigation that's brought against you, right. That's ultimately what we're trying to do. So you're not trying to turn them into a lawyer or teach them the law school books or anything like that. You're just saying, hey, these are potholes or landmines that you might want to avoid, and more importantly, here's the process that you should be following.

Like, remember working back in the day, we'd photocopy driver's licenses, and then there'd be stacks of these photocopies somewhere that were like sitting on the copy machine. I don't know, that's maybe a risk. Yeah, yeah, right next to the credit app. Yeah, you know, like, I don't know, having a copy of someone's driver's license floating around a car dealership, probably not very good. But one story that I think will make you laugh, and might also make dealers a little bit concerned. I worked with a Nissan store in the... Tacoma, Washington, so I was working on the service drive, and we were training a tool that could collect credit card information and sell products from a tablet. So they had an internal Wi-Fi network that captured all that data. The challenge they had was that network was a wide-open network that was moving credit card information. So once I figured this out, I said, "Well, who's the IT guy?" And the guy's name was Vlad — not to be confused with Vlad the Impaler. And I had him come down, and I said, "Hey, what's the deal?" He goes, "Oh, nothing's secure." I said, "Okay, nothing's secure, so you think it's a good idea to have a wide-open credit card network with customer information flowing through the air in a car dealership, right, while your customers are sitting in the waiting room on their phones like this?" Yeah. So I want to do something right now, secure the network. I mean, if you have a problem... you know, I can bring the dealer down, I think we could have a bigger conversation which might involve you being removed permanently. But how long has this been going on? I was like, wow, like, the fact that you think everything's hackable means that it's wide open. I was like, wow, that's crazy.

Onboarding process, timelines, and dealer size fit

But obviously a dealer sometimes might be a little bit intimidated by someone who says, "I'm with compliance," or "I'm here to help fix the problem," "I'm here to train your staff on what to do or not to do." How easy is it for them to say, "Listen, I don't know, but I know there's a risk, how do I get started"? Like, how easy is that to do?

Oh, simple. All they got to do is say, "Hey, we realize that we need to do something, let's put something together," and we handle pretty much everything from there. All we're going to do is we request very little from them, other than a list of their employees, their roles within the dealership, so that we can assign them certain coursework and things like that. And then we do everything electronically, we have a dashboard that everybody logs into that can access everything, we create all their manuals for them, we basically do everything A to Z for them. And then we sit down and, you know, we'll come in on a quarterly basis and we audit them, and then we take these findings and we sit down with their management team after each...

Audit or after each visit, we outline everything that needs to be addressed and things that we need to accomplish so that when we come back next quarter, then we review all that.

So a dealer, let's just say a dealer has anywhere from one store to 300 stores, is there sort of a sweet spot that you'd recommend? Is it any store? Does it matter if they have locations, say, in Canada, the US, and Mexico, or Europe? I mean, what do you focus on?

Mexico I'm not so much, no. I get it. But US and Canada we're good. I mean it's all basically, yeah, and we're national, you know, we're a national company, so we can handle anything. We can handle the larger groups, the smaller groups. Our sweet spot, if you were to say there's a sweet spot, is probably the guy that owns, you know, five to seven stores. He's too big to run under the radar, too small to internalize it, right. That type of thing. But that doesn't mean that, you know, there's some big ones out there, there's 30, 40 store groups that they don't want to internalize it, they don't want that headache, not to mention the liability, right. You know, if you really stop and think about it, do you want the fox guarding the hen house? I mean, you'd rather have a third party that you can throw some blame at, right?

Yeah, I'm from the government, I'm here to help you, kind of scenario.

Yeah, yeah, I get it. Yeah, yeah, yeah, I'm policing my own people, yeah, I get it.

So how quickly could a dealer who, say, engages with your services want to turn this around and be compliant and mitigate risk? Like, how quickly do you think that would normally happen? I mean, you're the expert, I'm just asking the question.

Well, here, first of all, I don't want to throw any, nobody's ever going to be compliant, right? There's not a dealer out there that's ever going to be compliant, right? So again, all we're going to be able to do is mitigate as much of that risk as we can and create that scenario where we can wage that affirmative defense, right. We can do that relatively quickly. We can come in and within 90 days have their personnel trained, have, you know, have their manuals created, have processes in place and things to start that audit trail so that now we can mitigate those risks, right. So it could be done relatively quickly. And especially since there's not a lot of hands-on that we need from them, we do need to interview each one of their managers so we can understand the flow of information and how everything works within their departments, but other than that there's not a whole lot of needed, you know, communication or back and forth with them. So it shouldn't disrupt their lifestyle, right?

Attrition, buy-sell deals, and state-by-state nuances

Thanks for that. So in the car business, obviously sometimes we have turnover, would that be something that you would work with them initially and then later it's like, oh yeah, Bobby's gone, Jane's gone, Fred's gone, now we got to start again, or is that just something that you would do as normal course of business?

Yeah, that's just set up, yeah, we understand that. In the car business, attrition is probably your biggest issue.

Yep, right, yeah, in some cases 80 to 90% attrition.

So that's why I'm asking, but more especially in the sales department, you probably don't have as much service.

Yeah, but your sales department is turning pretty quick.

Yeah, I mean, I wouldn't think CFOs change very much, or even owners change all that much. Let's, even GMs as a rule, you know, they change, but not as often as, but your salespeople, your F&I managers, those guys turn quite a bit sometimes.

So what about if a dealer, I mean, we did interview a company that helps dealers buy businesses. Is this a benefit to that dealer who, say, is wanting to sell their business and wants to be compliant before, is sort of a value add, or is this also a discussion when they get bought that might be a bigger discussion? I mean, what's your experience there?

Well, I think it works both ways, right. I mean, there is somewhat of a value add when you're doing it, they're going to ask you, because it depends too on how, is it, are they buying a corporation, are they buying the assets, right, so it depends on how the buy-sell is, how the agreement is written, because there may be exposure, right. So if the selling dealer has had any issues in the past with whatever, from a compliance standpoint, the buyer doesn't want to absorb that, right. So it does help that if they know that there's not an issue there that they have to worry about or concern themselves with. And then the flip side of it is, too, that after the sale is done, they want to see how clean they really are, and they're going to probably dig deeper into their due diligence and trying to figure out how to create and go forward.

What about state to state, um, laws, is that an issue, or is that something you feel that dealers don't get? Let's just say they had locations in five states, for example, would they not necessarily understand the nuances and need your help with there as well, or to some extent?

Yes, we're going to lend a little bit of education there, but by the same token, if a dealer's doing business in a state, he's going to know what's going on there, or he should know, right, because he's going in there to do business. So he needs to, so he's going to be pretty aware of what's happening. That doesn't mean that there aren't some nuances, which there are, there's a lot of different, you know, each state has different rules on how to handle text messages, and each state has different, you know, states have different rules on emails and things like that. So there's different little nuances that you have, but most of the time the dealers will figure that out, or they'll resort to what they think is a common national type, you know, parameter of what they should be doing.

And what about companies that

Are you on the used car side at scale, or just a small, small regional used car deal group? Would you work with them as well, or are you mostly for new?

Absolutely. Actually, we just signed a guy in North Carolina yesterday. He sells like 15 cars a month, now they're Highline cars. You know, but he's a very small guy, it's him and three other people in there, but he wanted to be compliant. So he signed up a contract with us to do his stuff. So yeah, there's a market for that. It's not huge, it just depends on the guy and who the used car guy is.

Yeah, the reason I bring that up is I was at NIADA last year, and there's a lot of independent car dealers at various sizes, but more importantly, they tend to be a little bit more shoot-from-the-hip than a franchise dealer, so they're interesting cats. And I'm sure compliance is probably not their wheelhouse.

It's not on their priority list. It's not like "how can I get the bigger gorilla," it's more on their list, right? Your cash flows are different.

Advice on vetting compliance vendors and contact info

Yeah, yeah, yeah. All right, well, how can someone reach out to you? Like, where would they find you? Are you on LinkedIn? Do you have a website? Is there an email?

On LinkedIn, you can Google my name and it comes up with 8,000 different other things that I've done over, you know, in the car business. And you can go to our website, autorisknow. You can call me directly, 815-345-3629. We have, I mean, there's a hundred, there's all kinds of ways to get a hold of us.

Fantastic. So obviously you're happy to answer questions about the process and how that works and what the time frame is and that kind of stuff. Any final thoughts on compliance and risk from a, I guess, a former car industry veteran who now helps car dealers? We know they all need a lot of help. Any final advice there?

Yeah, you know, the only advice I would tell car dealers right now is, when it comes to compliance, take some time and vet who you're doing business with. Make sure that you're getting what you pay for, buy the right product, and make sure you're accomplishing what you're trying to accomplish. But it's that way with any vendor, though, that a dealer has to go out and try to do business with. But more so with compliance companies, because most dealers don't really understand all the complexities that roam, you know, that are within that. They understand the sales end of it, they can sell you a car all day long, right? But when it comes to this stuff, it's just not their bailiwick, right? That's not their thing.

So ChatGPT can't make that decision for them, is that what you're saying?

Yeah, ChatGPT isn't working. Yeah, "I need a solution, can I have ChatGPT do it?" No, no.

Yeah, not yet. All right, well, thanks very much for taking the time today. We'll have details below in terms of how to reach out, and of course if there's any questions, feel free to reach out to me as well, it's [email protected]. And if you are looking for compliance help, and you want someone who's not only an expert but a former industry insider, so he understands and speaks to car lingo, definitely reach out and get help before those bad lawyers show up and you have costs.

And I think that the best practice, unfortunately, sometimes dealers, fear is a good motivator, even though it should be "we're prepared." Sometimes it's, yeah, "I don't want to lose a bunch of money," so yeah, I kind of need help.

All right, well, have yourself a great day, and thanks for taking time, really appreciate it.

And it's been a blast, appreciate it.

Yeah, anytime, my friend.

All right, thanks very much.

Hey, if you miss us live, you can listen to us wherever you get your podcast.