InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
CFPB finalizes rule to change its supervision designation procedures for nonbanks
On April 16, the CFPB issued a procedural rule to change how the Bureau will designate nonbanks for supervision. Under the CFPA, the CFPB was authorized to supervise a nonbank covered person if the Bureau had reasonable cause to determine if the nonbank covered person was engaged in financial services-related conduct that posed a risk to consumers. In 2013, the CFPB issued a rule providing procedures to govern supervisory designation proceedings under this authority; in 2022, the CFPB published a final rule amending the procedural rule to allow it to publicize its resolution of any contested designation proceeding (covered by InfoBytes here). In late February 2024, the CFPB transitioned to a new organizational structure for its supervision and enforcement work, and this rule will reflect the technical changes of the new structure in the context of supervisory designation proceedings.
According to the Bureau, there were small differences between two separate provisions under the 2013 rule that allowed nonbanks to consent to the CFPB’s exercise of supervisory authority. The new procedural rule will combine these provisions and clarify a few points of distinction from the two original provisions, including (i) a consent agreement does not constitute an admission; and (ii) supervision durations following consent agreements can be negotiated on a case-by-case basis, instead of applying a default duration of two years.
Regarding the Supervision Director’s notice of reasonable cause, the rule will expand the possible methods of delivery to include other methods that are “reasonably calculated to give notice.” Additionally, the rule states that the initiating official may withdraw a notice, and that they may file a written reply to the notice recipient’s response, neither of which was not contemplated under the previous rule. The Bureau said these changes could allow for more transparency in the decision-making process.
Concerning a supplemental oral response, the Bureau noted under the previous rule, a respondent nonbank entity presented supplemental oral responses to the Associate Director for Supervision, Enforcement, and Lending. In light of the elimination of the Associate Director position pursuant to a recent reorganization that split the Division of Supervision, Enforcement, and Fair Lending into a Division of Enforcement and a Division of Supervision, the rule provided that the Director of the Bureau will assume the Associate Director’s adjudicative roles and supervision-related functions. Therefore, the Director will be responsible for issuing a decision and order subjecting an entity to the Bureau’s supervision or terminating a proceeding.
The rule further stipulated that (i) an additional time limit for mail and delivery services are no longer warranted, since email would be “generally instantaneous”; (ii) there will be a 13,000-word limit for the proceeding filings; (iii) any changes to time or word limits can be decided between the initiating official and the respondent with a notice to the Director and will be subject to change by the Director.
Regarding the confidentiality of proceedings, the rule maintained a process for the CFPB to decide whether to publicly release final decisions and orders, including orders entered as a result of respondent failing to file a response and therefore defaulting. The Bureau did note, however, consent agreements entered into between the initiating official and the respondent will not be subject to public release under the rule.
The rule also established an issue exhaustion requirement, requiring respondents to raise arguments they have in their written response to the Bureau to avoid waiving the argument in future proceedings. The Bureau will invite public comments which must be submitted 30 days after publication in the Federal Register, although the rule will be exempt from the notice-and-comment rulemaking requirements under the APA as a rule of agency organization, procedure, or practice. The rule will be effective upon publication to the Federal Register, and it will apply to proceedings pending on the effective date, unless the Director determined that it will be “not practicable.”
Massachusetts’ attorney general issues AI guidance related to state UDAP law
On April 16, the Attorney General for Massachusetts (AG) released an advisory notice on how developers, suppliers and users of artificial intelligence (AI) should avoid “unfair and deceptive” practices to comply with consumer protection laws. The AG noted how AI systems could pose consumer harms, including through bias, lack of transparency, and data privacy issues – since consumers often lack the ability to avoid or test the “appropriateness” of AI systems forced upon them. Chapter 93A of Massachusetts law, the Massachusetts Consumer Protection Act, protected consumers against “unfair and deceptive” practices, the definition of which has changed over time. In addition to the consumer protection law, the AG highlighted several other state and federal consumer protections, including the ECOA, to bolster her advisory.
The AG’s advisory construed Chapter 93A to apply to AI, clarifying that the following practices may qualify as “unfair or deceptive”: (i) a company falsely advertising the quality of its AI systems; (ii) a company suppling a defective or impractical AI system; (iii) a company misrepresenting the reliability or safety of its AI system; (iv) a company putting an AI system up for sale in breach of warranty, meaning that the system was unfit for the purpose for which it was sold; (v) a company using multimedia content to impersonate or deceive (such as using a deep fake, voice cloning, or chatbots within fraud); (vi) or a company failing to comply with other Massachusetts’ statutes.
CFPB approves of Illinois’ new regulations on appraisal discrimination
On April 9, the CFPB released a comment letter supporting the Illinois Department of Financial and Professional Regulation’s decision to propose three rules prohibiting discrimination related to appraisals. The CFPB interpreted and issued rules under ECOA and would enforce its requirements. Illinois’ three proposed rules (38 IAC 345.280(c)(1)(A); 38 IAC 185.280(c)(1)(A); and 38 IAC 1055.240(c)(1)) would all update the Illinois code to prohibit discrimination under ECOA or the FHA, including a provision to deny loan applications where they should have been granted due to discrimination. “Discrimination against applications on a prohibited basis in violation, for example of the [ECOA] or [FHA], including… relying on giving force or effect to discriminatory appraisals to deny loan applications where the covered financial institution knew or should have known of the discrimination[.]” The CFPB commented in their letter that these provisions accurately described ECOA. The CFPB also noted that TILA’s Appraisal Independence Rule, which it has rulemaking authority under, does not conflict with a lender’s obligations to comply with civil rights laws including ECOA.
5th Circuit reverses District Court’s decision to transfer credit card late fee case
On April 5, the U.S. Court of Appeals for the Fifth Circuit held that the U.S. District Court for the Northern District of Texas lacked jurisdiction to transfer a case challenging a CFPB rulemaking to the U.S. District Court for the District of Columbia. The 5th Circuit’s decision did not examine whether the transfer order was proper, but rather whether the court had jurisdiction to enter it. As previously covered by InfoBytes, the U.S. District Court for the Northern District of Texas granted the CFPB a change of venue on March 28 because only one of the six plaintiffs resided in Fort Worth. The 5th Circuit found that the lower court erred by granting the CFPB’s motion to change venues instead of ruling on the plaintiffs’ motion for preliminary injunction. The plaintiffs filed a writ of mandamus and argued the lower court “abused its discretion” by transferring the case while the plaintiffs’ appeal was outstanding, and that the lower court did not have jurisdiction to order the transfer. The 5th Circuit agreed and ruled that once a party appeals a district court’s decision, the district court “has zero jurisdiction to do anything” to change the case. The 5th Circuit granted the plaintiffs’ petition of mandamus, vacated the district court’s transfer order, and ordered the district court to reopen the case.
This case has been brought by multiple trade organizations to challenge the CFPB’s attempt to alter the structure and amount of credit card late fees through its alleged authority under the CARD Act, as covered by InfoBytes here.
CFPB reports on consumer reporting companies' compliance violations
On April 8, the CFPB released its Supervisory Highlights on consumer reporting companies (CRC) and furnishers from April to December 2023. With respect to CRCs, the CFPB found deficiencies related to (i) placing identity theft blocks on consumer reports, (ii) blocking adverse items identified by a consumer as the result of human trafficking, and (iii) the accuracy of information in consumer reports.
For identity theft, the CFPB noted that some CRCs automatically declined to implement identity theft blocks based on overly broad, disqualifying criteria that did not support a reasonable determination, in violation of the FCRA. CRCs also failed to properly notify these customers that they declined these identity blocks.
Regulation V required CRCs to block adverse items of information identified by a consumer from human trafficking. While CRCs must block these items within four business days of such request, the CFPB found CRCs either failed to timely block these items or that CRCs blocked some, but not all such items.
In failing to ensure the maximum possible accuracy of consumer reports, the CFPB found that CRCs (i) inadequately monitored dispute metrics that may suggest a furnisher would not a reliable source of information about consumers, and (ii) failed to implement procedures to ensure the accuracy of information provided by unreliable furnishers and continued to include such information in reports.
With respect to furnishers, the CFPB similarly found deficiencies in accuracy, dispute investigation, and identity theft requirements. Specifically, CFPB examiners found that furnishers reported incomplete or inaccurate information for several months or even years after determining the information was incomplete or inaccurate. Additionally, furnishers that received direct disputes both continued to report such information and failed to notify CRCs of the disputed information. The report also noted that furnishers who received proper identity theft reports continued to furnish information regarding the consumer before confirming the accuracy of the information with the consumer.
CFPB focuses on in-game video game market and its consumer protection issues
On April 4, the CFPB released a report titled “Banking in video games and virtual worlds” that examined the gaming industry and the consumer financial systems that affect it. The Bureau’s report identified three key findings: (i) a network of financial products and services has entered the gaming industry to leverage and support the transfer of gaming assets and currency; (ii) the increased value of these assets has led to an increase of hacking attempts, account theft, scams, and unauthorized transactions; and (iii) the consumer data collected by gaming companies was bought, sold, and traded between companies, which can pose a risk to gaming customers. As a result, the CFPB will intend to monitor these issues in gaming and other such non-traditional markets to ensure companies comply with federal consumer financial protection laws.
The report noted that the proliferation of gaming and the evolution of the industry to offering in-game purchases and gaming assets has created the need for an infrastructure to enable fiat currency to flow into and out of games and virtual worlds. This can include transactions within the game, trading virtual items with other players, buying products on secondary markets, converting gaming assets to traditional currency, withdrawals of that currency, and/or using third parties to convert and withdraw the currency. As a result, companies have established financial products and services that increasingly resemble traditional financial products, like loans, payment processing, and money transmission.
In addition to the gaming economy creating a relatively new and unregulated financial marketplace, the Bureau identified additional risks similar to those found in the traditional market surrounding fraud, identity theft, money laundering, and privacy. For example, the report noted that these highly valuable gaming assets have made player accounts vulnerable to phishing and hacking attempts as well as unauthorized transactions. However, efforts by the FTC or CFPB to address complaints related to this activity have been met with a “buyer beware” approach by gaming companies.
Further, gaming companies collect a significant amount of data on players as a way to personalize the experience. However, the companies use this data to monetize gameplay to entice more spending as well as buy, sell and trade this data. The report noted that (i) the use of personal data can result in highly individualized pricing and (ii) the storage and transfer of consumer data poses privacy risks for gamers. In light of these various issues, the CFPB plans to work with other agencies to monitor both these non-traditional financial products and services as well as the companies that collect and sell sensitive consumer data.
Seventeen State Attorneys General comment on CFPB overdraft proposal
State attorneys general (AGs) from 17 states recently sent a letter to the CFPB endorsing its proposed rule to amend TILA. The 17 states included New York as principal, California, Colorado, Connecticut, Delaware, the District of Columbia, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, North Carolina, Oregon, Pennsylvania, and Washington. As previously covered by InfoBytes, the proposed amendments would treat overdraft credits as loans, which would make them subject to consumer protections.
The AGs argued that the historical basis for excluding overdraft fees from TILA protections would be obsolete due to how the fees are assessed, the high fee amount, and the large number of overdraft transactions. The AGs wrote that closing the loophole would protect consumers by providing customers with disclosures so they can better understand the cost and enable them to comparison shop. The AGs supported a benchmark fee of $3, which is the lowest fee amount proposed by the CFPB, and argued that even a $6 fee would “undercount the volume of transactions generating a fee post-enactment” of the proposed rule. Finally, the AGs urged the CFPB to extend the proposed rule to both “very large financial institutions” (those with more than $10 billion in assets) and small financial institutions.
CFPB Director speaks on new and proposed rules for data brokers
On April 2, the Director of the CFPB, Rohit Chopra, delivered a speech at the White House Office of Science and Technology Policy highlighting President Biden’s recent Executive Order (EO) to Protect Americans’ Sensitive Personal Data and how the CFPB will plan to develop rules to regulate “data brokers” under FCRA. As previously covered by InfoBytes, the EO ordered several agencies, including the CFPB, to better protect Americans’ data. Chopra highlighted how the EO not only covered data breaches but also regulated “data brokers” that ingest and sell data. According to the EO, “Commercial data brokers… can sell [data] to countries of concern, or entities controlled by those countries, and it can land in the hands of foreign intelligence services, militaries, or companies controlled by foreign governments.”
Consistent with the EO, the CFPB will plan to propose rules this year that will regulate “data brokers,” as per its authority under FCRA. Specifically, the proposed rules would include data brokers within the definition of “consumer reporting agency”; further, a company’s sale of consumer payment or income data would be considered a “consumer report” subject to requirements, like accuracy, customer disputes, and other provisions prohibiting misuse of the data.
CFPB reports on the relationship between discount points and interest rates
On April 5, the CFPB issued a report on the relationship between trends in discount points and interest rates. The report used HMDA data between Q1 of 2019 and Q3 of 2023 when interest rates were at “record-highs” and before the Federal Reserve announced its intention to lower interest rates. The CFPB found that (i) the majority of borrowers paid discount points, (ii) more borrowers paid discount points as interest rates increased, and (iii) borrowers with low credit scores were even more likely to pay discount points. Delving deeper into the data, 87 percent of borrowers with cash-out refinances paid discount points (up from 61 percent in 2021), and borrowers with cash-out refinance loans paid twice the number of discount points compared to other borrowers (with a median of 2.1 points per loan). Additionally, almost 77 percent of FHA borrowers with a credit score below 640 paid discount points compared to 65 percent of all FHA borrowers. Considering these trends, the CFPB will plan to monitor the use of discount points and weigh the advantages against the potential risks to borrowers.
District Court rules against CFPB on Prepaid Rule disclosure requirement
On March 28, the U.S. District Court for the District of Columbia (D.D.C.) ruled in favor of a fintech digital wallet provider by granting its motion for summary judgment, denying the CFPB’s cross-motion, and vacating the CFPB’s Prepaid Rule’s short-form disclosure requirements for digital wallets. The suit focused on the applicability of the Prepaid Rule’s short-form disclosure requirements to digital wallet products. The plaintiff sued the CFPB, arguing the CFPB’s Prepaid Rule was arbitrary and capricious because, unlike for general-purpose reloadable (GPR) products, the CFPB failed to provide a “well-founded, non-speculative reason for subjecting digital wallets” to the Prepaid Rule’s short-form disclosure regime.
The CFPB’s Prepaid Rule mandated that pre-acquisition fee disclosures, which were intended to apply to GPR cards, be required for digital wallets––i.e., digital wallet providers would be required to provide consumers with a pre-acquisition fee disclosure in a formatted “short form.” While the judge agreed that this makes sense as applied to GPR products, digital wallet products were fundamentally different from GPRs and were not primarily “used to access funds or to function as a substitute checking account.” While the CFPB’s Advanced Notice of Proposed Rulemaking, did not initially include digital wallets, in the final Prepaid Rule, the CFPB included digital wallets for three reasons: (1) the CFPB reasoned that the Prepaid Rule should apply to digital wallets since digital wallets can carry funds (just like GPRs), and the fee structure “may not hold true in the future”; (2) the CFPB argued that the Prepaid Rule filled a regulatory gap for digital wallets; and (3) the CFPB claimed it “cast a wide net” on purpose to avoid a “patchwork regime.”
In response, the plaintiff argued that the disclosure requirement was arbitrary and capricious due to the Bureau having no rational justification for including digital wallets in the Prepaid Rule. Further, it was arbitrary and capricious because the CFPB did not comply with its role under Dodd-Frank by assessing the costs and benefits of the Rule. Finally, the plaintiff argued that the short-form disclosure regime violated the First Amendment.
While declining to rule on First Amendment issues, the court held that the CFPB lacked a “rational justification” for subjecting digital wallets to the Prepaid Rule’s short-form disclosure requirement, agreeing that the CFPB’s requirement was arbitrary and capricious, and that it had no basis for including digital wallets because they were materially different products. The judge also found the CFPB’s cost-benefit analysis (as mandated by Dodd-Frank) was deficient, as the “general” cost-benefit analysis did not fit for digital wallets.