CFPB Takes Aim at Data Brokers in Proposed Rule Amending FCRA

On December 3, the CFPB announced a proposed rule to enhance oversight of data brokers that handle consumers’ sensitive personal and financial information. The proposed rule would amend Regulation V, which implements the Fair Credit Reporting Act (FCRA), to require data brokers to comply with credit bureau-style regulations under FCRA if they sell income data or certain other financial information on consumers, regardless of its end use.

Should this rule be finalized, the CFPB would be empowered to enforce the FCRA’s privacy protections and consumer safeguards in connection with data brokers who leverage emerging technologies that became prevalent after FCRA’s enactment.

What are some of the implications of the new rule?

  • Data Brokers are Now Considered CRAs. The proposed rule defines the circumstances under which companies handling consumer data would be considered CRAs by clarifying the definition of “consumer reports.” The rule specifies that data brokers selling any of four types of consumer information—credit history, credit score, debt payments, or income/financial tier data—would generally be considered to be selling a consumer report.
  • Assembling Information About Consumers Means You are a CRA. Under the rule, an entity is a CRA if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, validating; or contributing to or altering the content of such information. This view is in step with the Bureau’s recent Circular on AI-based background dossiers of employees. (See our prior discussion here.)
  • Header Information is Now a Consumer Report. Under the proposed rule, communications from consumer reporting agencies of certain personal identifiers that they collect—such as name, addresses, date of birth, Social Security numbers, and phone numbers—would be consumer reports. This would mean that consumer reporting agencies could only sell such information (typically referred to as “credit header” data) if the user had a permissible purpose under the FCRA.
  • Marketing is Not a Legitimate Business Need. The proposed rule emphasizes that marketing is not a “legitimate business need” under the FCRA. Accordingly, CRAs could not use consumer reports to decide for an advertiser which consumers should receive ads and would not be able to send ads to consumers on an advertiser’s behalf.
  • Enhanced Disclosure and Consent Requirements. Under the FCRA, consumers can give their consent to share data. Under the proposed rule, the Bureau clarified that consumers must be provided a clear and conspicuous disclosure stating how their consumer report will be used. It would also require data brokers to acknowledge a consumer’s right to revoke their consent. Finally, the proposed rule requires a new and separate consumer authorization for each product or service authorized by the consumer. The Bureau is focused on instances where a customer signs up for a specific product or service, such as credit monitoring, but then receives targeted marketing for a completely different product.

Comments on the rule must be received on or before March 3, 2025.

Putting It Into Practice: With the release of the rule so close to the end of Director Chopra’s term, it will be interesting to see what a new administration does with it. We expect a new CFPB director to scale back and rescind much of the informal regulatory guidance that was issued by the Biden administration. However, some aspects of the data broker rule have bipartisan support so we may see parts of it finalized in 2025.

CFPB Imposes $95 Million Fine on Large Credit Union for Overdraft Fee Practices

On November 7, 2024, the CFPB ordered one of the largest credit unions in the nation to pay over $95 million for its practices related to the imposition of overdraft fees. The enforcement action addresses practices from 2017 to 2022 where the credit union charged overdraft fees on transactions that appeared to have sufficient funds, affecting consumers including those in the military community, in violation of the CFPA’s prohibition on unfair, deceptive, and abusive acts or practices.

The Bureau alleges that the credit union’s practices, particularly in connection with its overdraft service, resulted in nearly $1 billion in revenue from overdraft fees over the course of five years. According to the Bureau, the credit union unfairly charged overdraft fees in two ways. First, it charged overdraft fees on transactions where the consumer had a sufficient balance at the time the credit union authorized the transaction, but then later settled with an insufficient balance. The Bureau noted that these authorize-positive/settle-negative violations have been a focus of federal regulators since 2015, and were the subject of a CFPB circular in October 2022. Second, when customers received money though peer-to-peer payment networks, the credit union’s systems showed the money as immediately available to spend. However, the credit union failed to disclose that payments received after a certain time of the day would not post until the next business day. Customers who tried to use this apparently available money were then charged overdraft fees

In addition to monetary fines, the CFPB’s order prohibits the credit union from imposing overdraft fees for authorize-positive, settle negative transactions, and also in cases where there was a delayed crediting of funds from peer-to-peer payment platforms.

The monetary penalties the consent order imposes consist of $80 million in consumer refunds for wrongfully charged overdraft fees and a $15 million civil penalty to be paid to the CFPB’s victims relief fund.

Putting It Into Practice: This order aligns with federal and state regulators’ recent focus on overdraft fees in a broader initiative to eliminate allegedly illegal “junk fees” (a trend we previously discussed herehere, and here). For companies operating in the financial sector or providing peer-to-peer payment services, this enforcement action serves as a critical reminder of the need for transparency and adherence to consumer financial protection laws. Regular audits of fee practices and disclosures can help identify and rectify potential compliance issues before they escalate. Companies aiming to impose overdraft or other types of fees should review agency guidance enforcements to ensure their internal policies and business practices do not land them in hot water.

Listen to this post

Lawsuit Challenges CFPB’s ‘Buy Now, Pay Later’ Rule

On Oct. 18, 2024, fintech trade group Financial Technology Association (FTA) filed a lawsuit challenging the Consumer Financial Protection Bureau’s (CFPB) final interpretative rule on “Buy Now, Pay Later” (BNPL) products. Released in May 2024, the CFPB’s interpretative rule classifies BNPL products as “credit cards” and their providers as “card issuers” and “creditors” for purposes of the Truth in Lending Act (TILA) and Regulation Z.

The FTA filed its lawsuit challenging the CFPB’s interpretative rule in the U.S. District Court for the District of Columbia. The FTA alleges that the CFPB violated the Administrative Procedure Act’s (APA) notice-and-comment requirements by imposing new obligations on BNPL providers under the label of an “interpretive rule.” The FTA also alleges that the CFPB violated the APA’s requirement that agencies act within their statutory authority by ignoring TILA’s effective-date requirement for new disclosure requirements and imposing obligations beyond those permitted by TILA. The FTA also contends that the CFPB’s interpretive rule is arbitrary and capricious because it is “a poor fit for BNPL products,” grants “insufficient time for BNPL providers to come into compliance with the new obligations” imposed by the rule, and neglects “the serious reliance interests that [the CFPB’s] prior policy on BNPL products engendered.”

In a press release announcing its lawsuit, the FTA said the BNPL industry would welcome regulations that fit the unique characteristics of BNPL products, but that the CFPB’s interpretive rule is a poor fit that risks creating confusion for consumers. “Unfortunately, the CFPB’s rushed interpretive rule falls short on multiple counts, oversteps legal bounds, and risks creating confusion for consumers,” FTA President and CEO Penny Lee said. “The CFPB is seeking to fundamentally change the regulatory treatment of pay-in-four BNPL products without adhering to required rulemaking procedures, in excess of its statutory authority, and in an unreasonable manner.”

The FTA’s pending lawsuit notwithstanding, BNPL providers may wish to consult with legal counsel regarding compliance with the CFPB’s interpretive rule. Retailers marketing BNPL products should also consider working with legal counsel to implement third-party vendor oversight policies to enhance BNPL-partner compliance with the rule.

CFPB Launches Public Inquiry into Rising Mortgage Closing Costs and ‘Junk Fees’

Go-To Guide:
  • The Consumer Financial Protection Bureau (CFPB) has launched a public inquiry into rising mortgage closing costs, seeking to understand the reasons behind the increase, identify who benefits, and find ways to reduce costs for both borrowers and lenders.
  • This inquiry, part of a broader effort against “junk fees,” aims to gather public input on the impact of these fees on consumers’ financial health and the mortgage lending market, with a focus on third-party costs, fee beneficiaries, and the evolving nature of these expenses.

On May 30, 2024, the CFPB issued a new request for information (RFI) from the public regarding “why closing costs are increasing, who is benefiting, and how costs for borrowers and lenders could be lowered.”

As part of a wider effort targeting what both the CFPB and the Biden administration refer to as “junk fees,” the CFPB is focusing on evaluating how these fees affect consumers’ financial health and the broader impact on mortgage lenders. This follows the CFPB’s continued expression of interest in “junk fees,” on which GT reported in a May 2024 blog post.

“Junk fees and excessive closing costs can drain down payments and push up monthly mortgage costs,” CFPB Director Rohit Chopra said in a separate press release. “The CFPB is looking for ways to reduce anticompetitive fees that harm both homebuyers and lenders.”

The Request for Information

According to a recent CFPB analysis, mortgage closing costs surged by over 36% from 2021 to 2023. The CFPB alleges that these unavoidable fees can strain household budgets and limit the ability to afford a down payment, while also hindering lenders from offering competitive mortgage options due to the higher costs they must absorb or pass on.

The CFPB is seeking public input to address these concerns and make mortgage costs more manageable. Some key areas of interest include:

  • Competitive pressure. The CFPB aims to evaluate the extent to which consumers or lenders currently apply competitive pressure on third-party closing costs, seeking to understand market barriers that limit competition.
  • Fee beneficiaries. The CFPB aims to identify the beneficiaries of required services and determine whether lenders have control or influence over the third-party costs that are transferred to consumers.
  • How fees are evolving and their impact on consumers. The CFPB seeks details on which expenses have surged the most in recent years and the factors driving these increases, such as the higher prices for credit reports and credit scores. Additionally, the CFPB is interested in understanding how closing costs affect housing affordability, access to homeownership, and home equity.

Takeaways

The CFPB oversees numerous laws and regulations concerning mortgage lending and real estate settlement, such as the Truth in Lending Act, the Fair Credit Reporting Act, and the Real Estate Settlement Procedures Act. The insights gained from this inquiry are poised to shape rulemaking, guidance, and various policy initiatives moving forward.

The CFPB invites comments and data from the public and stakeholders within 60 days of the RFI being published in the Federal Register.

We have provided ongoing analysis and commentary on this issue as it has developed. See below more context on legislative and regulatory efforts to curb “junk fees”:

Zeba Pirani contributed to this article

Compliance Update — Insights and Highlights January 2024

On December 7, 2023, the Consumer Financial Protection Bureau (CFPB) ordered Atlantic Union Bank, an approximately $20 billion bank headquartered in Richmond, Virginia, to pay $6.2 million for “illegal overdraft fee harvesting” and “illegally enrolling thousands of customers in checking account overdraft programs.” The bank was ordered to pay $5 million in refunds and $1.2 million to a victims’ relief fund.

Regulation E provides that a bank may not charge a fee for an ATM or one-time debit card transaction unless it completes four steps. First, the bank must provide the customer with a notice describing the bank’s overdraft services in writing. Then, the bank must provide the customer with a “reasonable opportunity” for that customer to “affirmatively consent” to the payment of the ATM or one-time debit card transaction fee. Third, the customer must provide that “affirmative consent” or opt-in to the bank. And finally, the bank must provide the customer with written confirmation of their consent, including a statement of the right to revoke the consent at any time.

The CFPB alleged that Atlantic Union Bank failed to obtain proper consent when an account was opened in person at a branch. Bank employees orally provided customers with options for opting in to the payment of one-time debit card and ATM transaction fees pursuant to Regulation E. Bank employees asked customers to opt in orallyand then input the option into the bank’s account-opening computer system before printing the written consent form. The consent form was printed at the end of the account-opening process and was pre-populated with the customer’s oral opt-in choice.

In instances in which a customer was given options for opting in to the payment of one-time debit card and ATM transaction fees over the phone, bank employees did not have a script and allegedly provided misinformation and misleading statements about the benefits, costs, and other aspects of opting in to the payment of one-time debit card and ATM transaction fees pursuant to Regulation E.

The CFPB has taken the logical approach that a bank must provide the customer with a written disclosure of its overdraft practices prior to having them opt in. Additionally, without providing the customer with a prior written disclosure, a bank should not pre-populate its Regulation E opt-in form. Now is the time to review the consent order and your bank’s Regulation E opt-in processes and procedures.

For more news on CFPB Compliance, visit the NLR Financial Institutions & Banking section.

CFPB Investigates Crypto Lender

On December 1, 2022, the Consumer Financial Protection Bureau (Bureau) made public an administrative order denying Nexo Financial LLC’s (Nexo) petition to modify the Bureau’s civil investigative demand.  The order represents the first publicly known Bureau investigation of a digital asset company, in this case, over Nexo’s “Earn Interest” crypto lending product.

The Bureau served Nexo with a civil investigative demand in late 2021 seeking further information about whether Nexo products were subject to federal consumer financial law, and in particular Nexo’s compliance with the Consumer Financial Protection Act and regulations under the Electronic Funds Transfer Act.  Nexo sought to set aside the civil investigative demand and argued that, because the SEC had taken the position that other crypto lending products were securities, the Bureau was estopped from investigating it under provisions of federal law that preempt the Bureau from regulating securities products.

The Bureau rejected Nexo’s line of reasoning.  According to the Bureau order, “Nexo Financial is trying to avoid answering any of the Bureau’s questions about the Earn Interest Product (on the theory that the product is a security subject to SEC oversight) while at the same time preserving the argument that the product is not a security subject to SEC oversight.”  The order continues, “This attempt to have it both ways dooms Nexo Financial’s petition from the start.”  The Bureau also found that Nexo’s petition was not timely filed.

As we recently noted, the Bureau has been increasing its attention to the digital asset sector.  The Nexo order includes a lengthy discussion about the breadth of its jurisdiction and ability to investigate potential violations of law.  As the crypto winter persists, we expect to see the Bureau continue to explore ways to assert its authority to regulate elements of the digital asset sector.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

Chamber of Commerce Challenges CFPB Anti-Bias Focus Concerning AI

The end of last month the U.S. Chamber of Commerce, the American Bankers Association and other industry groups (collectively, “Plaintiffs”) filed suit in Texas federal court challenging the Consumer Financial Protection Bureau’s (“CFPB”) update this year to the Unfair, Deceptive, or Abusive Acts or Practices section of its examination manual to include discrimination.  Chamber of Commerce of the United States of America, et al v. Consumer Financial Protection Bureau, et al., Case No. 6:22-cv-00381 (E.D. Tex.)

By way of background, the Consumer Financial Protection Act, which is Title X of the 2010 Dodd-Frank Act (the “Act”), prohibits providers of consumer financial products or services or a service provider from engaging in any unfair, deceptive or abusive act or practice (“UDAAP”).  The Act also provides the CFPB with rulemaking and enforcement authority to “prevent unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service.”  See, e.g.https://files.consumerfinance.gov/f/documents/cfpb_unfair-deceptive-abusive-acts-practices-udaaps_procedures.pdf.  In general, the Act provides that an act or practice is unfair when it causes or is likely to cause substantial injury to consumers, which is not reasonably avoidable by consumers, and the injury is not outweighed by countervailing benefits to consumers or to competition.

The CFPB earlier this spring published revised examination guidelines on unfair, deceptive, or abusive acts and practices, or UDAAPs.  Importantly, this set forth a new position from the CFPB, that discrimination in the provision of consumer financial products and services can itself be a UDAAP.  This was a development that was surprising to many providers of financial products and services.  The CFPB also released an updated exam manual that outlined its position regarding how discriminatory conduct may qualify as a UDAAP in consumer finance.  Additionally, the CFPB in May 2022 additionally published a Consumer Financial Protection Circular to remind the public of creditors’ adverse action notice requirements under the Equal Credit Opportunity Act (“ECOA”).  In the view of the CFPB, creditors cannot use technologies (include algorithmic decision making) if it means they are unable to provide required explanations under the ECOA.

In July 2022, the Chamber and others called on the CFPB to rescind the update to the manual.  This included, among other arguments raised in a white paper supporting their position, that in conflating the concepts of “unfairness” and “discrimination,” the CFPB ignores the Act’s text, structure, and legislative history which discusses “unfairness” and “discrimination” as two separate concepts and defines “unfairness” without mentioning discrimination

The Complaint filed this fall raises three claims under the Administrative Procedure Act (“APA”) in relation to the updated manual as well as others.  The Complaint contends that ultimately it is consumers that will suffer as a result of the CFPB’s new position, as “[t]hese amendments to the manual harm Plaintiffs’ members by imposing heavy compliance costs that are ultimately passed down to consumers in the form of higher prices and reduced access to products.”

The litigation process started by Plaintiffs in this case will be time consuming (a response to the Complaint is not expected from Defendants until December).  In the meantime, entities in the financial sector should be cognizant of the CFPB’s new approach and ensure that their compliance practices appropriately mitigate risk, including in relation to algorithmic decision making and AI.  As always, we will keep you up to date with the latest news on this litigation.

For more Consumer Finance Legal News, click here to visit the National Law Review

© Copyright 2022 Squire Patton Boggs (US) LLP

CFPB Plans to Increase Regulation over “Buy Now, Pay Later” Lenders

The Consumer Financial Protect Bureau (CFPB) issued a release on September 15, 2022, announcing its intent to issue additional interpretive guidance or rules to ensure “Buy Now, Pay Later” (BNPL) lenders comply with the same or similar regulations already established for credit cards following a study on the industry.

In its press release, the CFPB Director Rohit Chopra noted the rapidly growing use of “Buy Now, Pay Later is a rapidly growing type of loan that serves as a close substitute for credit cards.” While credit cards include interest charges, BNPL loans do not, making them more attractive to consumers. Instead, these loans allow consumers to purchase a product and repay the purchase price through several installment payments. As a result, BNPL loans have become prominent over the past several years, particularly during the COVID-19 pandemic. These previously niche loans, typically used for apparel and beauty purchases, are now used in almost all consumer-facing industries.

The CFPB noted several highlights of BNPL loans found through the study, which include:

  • Increased loan approval rates year over year;
  • Increased occurrences of late fee charges;
  • Increased product returns by consumers; and
  • Shrinking profit margins by BNPL lenders.

As a result of the study, the CFPB outlined the following concerns with the BNPL industry, mainly because the marketing of these loans leads consumers to believe the loans are a “zero-risk credit option.”

  • Limited Consumer Protections: While BNPL loans are used as an alternative to credit cards, they lack the standard credit disclosures, dispute resolution rights, etc., that similar consumer credit transactions often require.
  • Data Harvesting: Lower profit margins associated with BNPL loans have pushed the industry to monetize consumer data, potentially impacting consumer privacy.
  • Debt Accumulation: According to the CFPB, BNPL loans encourage consumers to purchase more products and borrow more, resulting in consumers becoming overleveraged. While the CFPB notes that the lenders in this space do not furnish credit data to credit reporting companies, the CFPB is concerned about this industry extending credit to consumers who may not be able to repay the debt.

Takeaways

The CFPB has yet again reinforced its commitment to regulate lenders that extend consumer credit. The CFPB’s decision to either enforce existing consumer laws (i.e., the Truth in Lending Act disclosures already required for credit cards and other consumer loans) or create new rules on the growing BNPL industry is not unexpected. However, the CFPB’s release shows a renewed focus on protecting consumers’ privacy rights and ensuring that consumers can afford to repay their credit lines before offers of credit are extended, and demonstrates once more that the Bureau will seek to regulate emerging forms of consumer credit.

© 2022 Bradley Arant Boult Cummings LLP

Regulation by Definition: CFPB Broadens Definition of “Unfairness” to Rein in Discrimination

In a significant move, the CFPB announced on March 16revision to its supervisory operations to address discrimination outside of the traditional fair lending context, with future plans to scrutinize discriminatory conduct that violates the federal prohibition against “unfair” practices in such areas as advertising, pricing, and other areas to ensure that companies are appropriately testing for and eliminating illegal discrimination.  Specifically, the CFPB updated its Exam Manual for Unfair, Deceptive, or Abusive Acts or Practices (UDAAPs) noting that discrimination may meet the criteria for “unfairness” by causing substantial harm to consumers that they cannot reasonably avoid.

With this update, the CFPB intends to target discriminatory practices beyond its use of the Equal Credit Opportunity Act (ECOA) – a fair lending law which covers extensions of credit – and plans to also enforce the Consumer Financial Protection Act (CFPA), which prohibits UDAAPs in connection with any transaction for, or offer of, a consumer financial product or service.  To that end, future examinations will focus on policies or practices that, for example, exclude individuals from products and services, such as “not allowing African-American consumers to open deposit accounts, or subjecting African-American consumers to different requirements to open deposit accounts” that may be an unfair practice where the ECOA may not apply to this particular situation.

The CFPB notes that, among other things, examinations will (i) focus on discrimination in all consumer finance markets; (ii) require supervised companies to include documentation of customer demographics and the impact of products and fees on different demographic groups; and (iii) look at how companies test and monitor their decision-making processes for unfair discrimination, as well as discrimination under ECOA.

In a statement accompanying this announcement, CFPB Director Chopra stated that “[w]hen a person is denied access to a bank account because of their religion or race, this is unambiguously unfair . . . [w]e will be expanding our anti-discrimination efforts to combat discriminatory practices across the board in consumer finance.”

Putting it Into Practice:  This announcement expands the CFPB’s examination footprint beyond discrimination in the fair lending context and makes it likely that examiners will assess a company’s anti-discrimination programs as applied to all aspects of all consumer financial products or services, regardless of whether that company extends any credit.  By framing discrimination also as an UDAAP issue, the CFPB appears ready to address bias in connection with other kinds of financial products and services.  In particular, the CFPB intends to closely examine advertising and marketing activities targeted to consumers based on machine learning models and any potential discriminatory outcomes.

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.

CFPB to Examine College Lending Practices

On January 20, the CFPB announced that it would begin examining the operations of post-secondary schools that offer private loans directly to students and update its exam procedures to include a new section on institutional student loans.  The CFPB highlights its concern about the student borrower experience in light of alleged past abuses at schools that were previously sued by the CFPB for unfair and abusive practices in connection with their in-house private loan programs.

When examining institutions offering private education loans, in addition to looking at general lending issues, CFPB examiners will be looking at the following areas:

  • Placing enrollment or attendance restrictions on students with loan delinquencies;
  • Withholding transcripts;
  • Accelerating payments;
  • Failing to issue refunds; and
  • Maintaining improper lending relationships

This announcement was accompanied by a brief remark from CFPB Director Chopra:  “Schools that offer students loans to attend their classes have a lot of power over their students’ education and financial future.  It’s time to open up the books on institutional student lending to ensure all students with private student loans are not harmed by illegal practices.”

Putting it Into Practice:  The CFPB’s concern with the experience of student borrowers is in line with a number of enforcement actions pursued by the Bureau against post-secondary schools.  The education loan exam procedures manual is intended for use by Bureau examiners, and is available as a resource to those subject to its exams. These procedures will be incorporated into the Bureau’s general supervision and examination manual.

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.