Alerts

CFPB Proposes Rule to Establish Public Registry of Nonbanks with Consumer Financial Law Enforcement Orders

December 19, 2022

On Dec. 12, 2022, the Consumer Financial Protection Bureau (“Bureau”) issued a proposed rule (“Proposed Rule”) which would require nonbank covered persons (subject to certain exceptions) that offer consumer financial products or services to report to the Bureau certain final public orders issued by a court or federal, state or local agency.[1] Covered persons would be required to register with the Bureau, and the Bureau would publish the orders on its website. Notably, the registry would include alleged violations of law.[2]

The Proposed Rule would also require larger covered persons subject to the Bureau’s supervision and examination authority who register to identify a senior executive to submit an annual statement and attestation describing how the executive has reviewed and overseen the company’s compliance with the public order. While the annual statement and attestation would remain confidential, the Bureau proposes to publish the name and title of the executive responsible for compliance with the order, and highlights that it will scrutinize these attestations closely in determining its supervision priorities.

The Bureau is pursuing the Proposed Rule as a tool to better identify the companies that pose risks to consumers by violating consumer protection laws. The rule cannot fully go into effect until the Bureau sets up the nonbank registration system (“NBR”), which the Bureau anticipates will be “no earlier than January 2024.”[3] Nonetheless, the Bureau appears to be moving forward quickly, noting that it has already completed its required consultations with state authorities, prudential regulators and tribes.[4]

Public comments are due 60 days after forthcoming publication in the Federal Register. The central features of the Proposed Rule are summarized below.

Who Would Need to Register and Report. The Proposed Rule applies to any entity that provides financial products or services to consumers, meaning for primarily personal, family or household use. The Proposed Rule expressly exempts individuals from the registration requirement. An entity must register if, on or after the effective date of the Proposed Rule, there is a public order of any federal, state or local agency that (1) finds that it violated any provision of federal consumer financial protection law and (2) requires the entity to take some action or refrain from taking some action. The initial registration and any later updates must be made within 90 days of a change in circumstances. When the Proposed Rule first goes into effect, public orders dating back as far as Jan. 1, 2017 may be relevant.[5] By March 31 of each year after first registering and for so long as the public order remains in effect, the larger, supervised entities must submit a statement identifying the senior executive of the entity responsible for the entity’s compliance with the public order and describing the good faith steps the entity has taken to achieve and maintain compliance with the public order.
Which Laws Implicate the Reporting Requirement. The registry would apply to orders related to violations of the enumerated federal consumer financial laws under the Bureau’s jurisdiction, other laws the Bureau may enforce (including, for example the Consumer Financial Protection Act’s prohibition against unfair, deceptive or abusive acts or practices (“UDAAP”)), section 5 of the Federal Trade Commission Act and state laws prohibiting UDAAPs.[6] Notably, the Proposed Rule’s inclusion of federal UDAAP law may pose difficulties for covered entities in determining whether they must register. The Proposed Rule calls for registration if the violations in the public order would also qualify as violations of federal consumer financial protection law.[7] However, given the breadth of federal UDAAP principles and that the Bureau often asserts that violations of other law amount to UDAAPs, covered entities may be left in doubt about whether a public order that otherwise does not implicate registration might be deemed in hindsight to constitute a UDAAP violation.
What the Bureau Will Do With This Information. The Bureau will post the public orders online in a searchable database to help the public and other regulators identify patterns and repeat offenders. While the Bureau does not plan to post the attestations online, it will list the name of the identified senior executives. Further, the Bureau will scrutinize the attestation closely, and if, in the Bureau’s view, the attestation does not demonstrate the entity is taking the necessary steps to comply with the public order, the Bureau will exercise its supervision authority to examine that entity.[8] Additionally, the Bureau expects that the designated senior executive will have reviewed sufficient underlying materials to justify the attestation and requires the entity to maintain those underlying documents for at least five years.[9]
Identifying Risks to Consumers. As is being widely reported, the Bureau intends to spotlight in the proposed national database the “repeat offenders” that have received multiple orders and that have failed to comply with existing orders as particularly risky for consumers.[10] At the same time, the Bureau would view a dearth of orders related to certain consumer financial products as a warning that some areas of consumer financial products lack sufficient oversight.
Public Shame. The Bureau expects publication of the NBR and easy access to the public orders to benefit consumers by providing a national and readily accessible database that “consumer advocacy organizations, researchers, or the media”[11] could use to identify “the most egregious repeat offenders.”[12] Here and elsewhere, the Bureau expects that the Proposed Rule would cause covered entities to improve compliance by pinning their reputation on careful compliance.
Broad Reach. Although part of the focus of the Proposed Rule is to identify “repeat offenders” and egregious noncompliance, any covered provider of consumer financial products and services who is subject to a covered order would be subject to the rule. The broad reach of the proposed rule would implicate entities that may not know if they are covered by the rule. The Bureau recommends, as one option, voluntarily registering with the NBR.[13] The Proposed Rule also includes an option to submit an attestation to the NBR that the entity believes it is not subject to registration.[14] While the Bureau asserts that only a small percentage of nonbanks are subject to public orders, meaning only those few nonbanks will have to register, the Proposed Rule — if finalized as currently drafted — may result in many of the more than 150,000 nonbanks that the Bureau estimates exist to register out of caution.[15]

The Bureau’s proposal to establish a registry of violators is appropriately gathering the attention of many nonbanks who will be required to navigate its provisions once the NBR is launched. It appears that part of the motivation for the NBR is that the Bureau is not finding the extent of cooperation it has with other authorities or its existing supervision efforts sufficient to provide the visibility it wants into covered entities’ performance.[16] It is noteworthy that the Bureau is not proposing an overall registry for all nonbanks to provide a census of the entities that may be subject to the Bureau’s oversight but instead is focused on magnifying the prior shortcomings of entities already subject to public orders.

Persons interested in submitting a comment to address the Proposed Rule have about two months to do so, but “early submission” is always encouraged.[17]

Schulte Roth & Zabel’s lawyers are available to assist you in preparing a public comment or addressing any questions you may have regarding these developments. Please contact the Schulte Roth & Zabel lawyer with whom you usually work, or any of the following attorneys:

Donald J. Mosher – New York (+1 212.756.2187, donald.mosher@srz.com)

Melissa G.R. Goldstein – Washington, DC (+1 202.729.7471, melissa.goldstein@srz.com)

Kara A. Kuchar – New York (+1 212.756.2734, kara.kuchar@srz.com)

Adam J. Barazani – New York (+1 212.756.2519, adam.barazani@srz.com)

Jessica Romano – New York (+1 212.756.2205, jessica.romano@srz.com)

Jessica Sklute – New York (+1 212.756.2180, jessica.sklute@srz.com)

Noah N. Gillespie – Washington, DC (+1 202.729.7483, noah.gillespie@srz.com)

Hadas A. Jacobi – New York (+1 212.756.2055, hadas.jacobi@srz.com)

Rebecca A. Raskind – New York (+1 212.756.2396, rebecca.raskind@srz.com)

Jesse Weissman – New York (+1 212.756.2460, jesse.weissman@srz.com)

[1] Available at https://www.consumerfinance.gov/rules-policy/rules-under-development/registry-of-nonbank-covered-persons-subject-to-agency-court-orders/. The Bureau issued the Proposed Rule on its website, but it is not yet published in the Federal Register.

[2] See, e.g., Proposed Rule at 188 (Section (201(c)), at 189 (Section 201(e)(4)), and at 191 (Section 201(m)).

[3] Proposed Rule at 155.

[4] Id. at 14.

[5] Id. at 190.

[6] The state laws are enumerated in an appendix.

[7] See, e.g., Proposed Rule at 36-39.

[8] See Proposed Rule at 44.

[9] Proposed Rule at 196.

[10] Id. at 12; see also SRZ Alert, CFPB Invokes “Dormant” Authority to Conduct Exams of Fintech Companies (Apr. 27, 2022), available here.

[11] See at or around footnote 113 and surrounding text.

[12] Ibid.

[13] See Proposed Rule at 161.

[14] Proposed Rule at 194 (Section 202(g)).

[15] Proposed Rule at 160.

[16] See id. at 28.

[17] Proposed Rule at 2.

This communication is issued by Schulte Roth & Zabel LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2022 Schulte Roth & Zabel LLP.