Alert

CFPB Looks to Expand Its Oversight of Nonbanks through Two Controversial New Registries

The Consumer Financial Protection Bureau (“CFPB” or “Bureau”) released two new proposals that aim to expand the Bureau’s authority over nonbank financial institutions:

1. A “repeat offender” registry of consent orders or settlements with an array of state and federal regulators relating to compliance with consumer protection laws (“Repeat Offender Proposal”); and
2. A public registry of the terms and conditions nonbanks use in “form contracts” that consumers typically are not able to negotiate (“Terms and Conditions Proposal”).

Assuming these registries are created as proposed and survive any ensuing legal challenges, complying with the reporting obligations should be relatively easy. The larger challenge will be managing the increased regulatory and litigation risk imposed by the registries.

Repeat Offender Proposal

On December 12, 2022, the CFPB issued a proposal to establish a “repeat offender” registry requiring certain nonbank covered entities to report all final public written orders and judgments (including any settlements, consent decrees, or stipulated orders and judgments) obtained or issued by any federal, state, or local government agency for violation of a number of enumerated consumer protection laws, including those related to unfair, deceptive, or abusive acts or practices (“UDAAPs”).

After receiving these written orders and judgments, the CFPB intends to create a database of enforcement actions that would be available online for use by the public and other regulators. The database will be limited to final settlement or consent orders, so injunctions, preliminary orders, temporary cease-and-desist, and other tentative or temporary orders would not be reportable.

In addition, the proposal would require supervised nonbanks to submit annual written statements regarding compliance with an attestation for each underlying order by an executive with “knowledge of the entity’s relevant systems and procedures for achieving compliance and control over the entity’s compliance efforts.”[1] These entities would also be required to identify a central point of contact related to an entity’s compliance with reportable enforcement actions.

The proposed rule would only apply to certain nonbank covered entities subject to CFPB’s authority. At present, insured depository institutions and credit unions, related persons, states, natural persons, and certain other entities are excluded from registry participation requirements. However, the CFPB stated in the press release for the proposal that it “might later consider collecting or publishing the information described in the proposal from insured banks and credit unions.”[2]

Terms and Conditions Proposal

One month after issuing its repeat offender registry proposal, the CFPB issued a new proposal that would require most CFPB-supervised nonbanks to register certain terms and conditions in their form contracts that the CFPB believes are risky to consumers and/or may violate certain state, federal, or Tribal consumer protection laws.

Specifically, the proposal focuses on terms and conditions that attempt to waive consumers’ legal protections, limit how consumers enforce their rights, or restrict consumers’ ability to file complaints or post reviews.

The proposed rule would apply to nonbank entities subject to CFPB’s supervision authority, including nonbank mortgage originators and servicers, payday lenders, private student lenders, and “larger participants of other consumer financial markets” as defined by Bureau rules. To date, that final category is limited to consumer reporting agencies, consumer debt collectors, student loan servicers, international money transferors, and auto lenders. The proposal provides a limited exemption for certain smaller entities.

For entities subject to the rule, it would create a public registry of terms and conditions used in non-negotiable, “take it or leave it” form contracts that claim to waive or limit consumer rights and protections, and would require supervised nonbank companies to report annually their use of standard-form contract terms that “seek to waive consumer rights or other legal protections or limit the ability of consumers to enforce or exercise their rights.”[3] Specifically, the rule focuses on “covered terms and conditions,” which include the following contractual provisions:

• Mandatory arbitration agreements and class action waivers;
• Limitations on nonbanks’ liability to consumers;
• Restrictions on consumers’ ability to commence legal action by dictating timeframe, forum, or venue requirements;
• Bans or limitations on consumers’ ability to complain or post reviews of nonbanks; and
• Other waivers or limits on consumers’ rights or legal protections.

Statements from Director Chopra indicate that the CFPB intends this registry to help regulators, law enforcement, and private litigants detect potentially unlawful, unfair, or abusive contractual terms that are pushed on consumers without any real ability to negotiate.[4]

Notably, the CFPB’s proposal specifically emphasizes legal theories for how certain contractual provisions may violate a number of state, federal, or Tribal laws, including those enforced by both the Federal Trade Commission (“FTC”) and CFPB, such as the Holder Rule; the 2016 Consumer Review Fairness Act (restricting “gag orders” on bad reviews, assessments, etc.); the FTC Act (including unfair or deceptive acts or practices (“UDAP”) restrictions); the Consumer Financial Protection Act (including UDAAP restrictions); the Credit Repair Organizations Act; and the Servicemembers Civil Relief Act and the Military Lending Act.

What do these proposals mean for nonbanks?

Both proposals rely on the CFPB’s broad authority under Sections 1022(b) and (c) and 1024(c) of the Dodd-Frank Act, which give the CFPB the authority to promulgate rules that “facilitate the Bureau’s market monitoring function and its risk based supervisory process” but were rarely used prior to Director Chopra’s tenure as CFPB director.[5] This is a shift from rules issued via the CFPB’s direct authorities under statutes it administers such as the Truth in Lending Act and the Equal Credit Opportunity Act or its authority to promulgate rules to address unfair, deceptive, or abusive acts or practices.

The CFPB’s use of its market monitoring authority continues a pattern of the Bureau flexing its muscles over nonbank market participants that historically have been better able to fly under the CFPB’s regulatory and enforcement radar than larger institutions that undergo periodic examinations. It also signals a shift in the CFPB’s methods of imposing its will on these types of institutions, moving from direct threat of CFPB enforcement to publicly shaming companies that have been subject to actions by other regulators, or collecting and providing ammunition to other regulators and private litigants who may also enforce consumer protection laws by initiating their own actions. Thus, these proposals show increased interagency coordination to enforce consumer protection laws.

This approach could also be viewed as an attempt by the federal government to encroach on the prudential regulatory authority of state regulators in matters such regulators had sought to keep confidential for reasons of public trust in markets and safety and soundness. The proposal would blindly upend this dynamic for the sake of transparency without regard to broader market and economic implications.

In part, these rulemakings also may relate to past efforts by the CFPB to develop and impose proscriptive discretionary rules on market participants. Chiefly, the CFPB’s Arbitration Rule (which would have prohibited the use of arbitration clauses with class action waivers as a means of avoiding class action liability), which was overturned in 2017 by a Congressional Review Act resolution and the Payday and Small Dollar Lending Rule, which was largely repealed by CFPB leadership during the Trump Administration, with its surviving pieces mired in litigation and still not effective.

With these two new proposals, the CFPB would shift roles into that of an information collector or a data aggregator. This data would be available to parties mining troublesome contractual provisions that could be deemed unfair or abusive and give rise to private actions or enforcement actions by other regulators and state attorneys general.

The Repeat Offender Proposal was published in the Federal Register on January 31, 2023, with a comment period that ends March 31, 2023. The Terms and Conditions Proposal was published February 3, 2023, with a comment period that ends April 3, 2023. Each is likely to draw a substantial number of comments and any final rule promulgated by the CFPB is also likely to face legal challenges.

For additional information, contact R. Andrew Arculin, R. Colgate Selden, Scott E. Wortman, Paula M. Vigo Marques, or Daniel V. Funaro, or another member of Blank Rome’s Financial Institutions Litigation and Regulatory Compliance (“FILARC”) group.