Alston & Bird Consumer Finance Blog

Bank Regulatory

FSOC Issues Proposed Update to Interpretative Guidance on Nonbank Financial Company Designations

By

A&B Abstract:

On April 21, 2023 the Financial Stability Oversight Council (hereinafter “FSOC” or “Council”) issued for public comment (1) a proposed analytic framework setting forth FSOC’s approach to identifying, evaluating, and addressing potential risks to financial stability (“Proposed Analytic Framework”), and (2) proposed revisions to FSOC’s existing 2019 interpretive guidance that FSOC would use when deciding whether to designate a nonbank financial company for enhanced prudential standards and Federal Reserve supervision (“Proposed Interpretive Guidance”). Comments concerning the new proposed framework are due by June 27, 2023. Given the recent bank failures, it should come as no surprise that federal regulators are focusing on financial risks to U.S. stability across various sectors, including nonbank mortgage lenders and servicers.

Background

Following the 2007-2009 financial crisis, the Dodd-Frank Act created FSOC, an interagency panel of top U.S. financial regulators, to monitor excessive risks to U.S. financial stability and facilitate intergovernmental cooperation to effectively address those risks. The Dodd-Frank Act empowers the Council to designate a nonbank financial company subject to certain prudential standards and supervision by the Federal Reserve’s Board of Governors. The Dodd-Frank Act lists 10 factors that Council must consider before making such designation.  To date, the Council has used this authority sparingly.  According to Treasury Secretary Janet Yellen, the Council’s revisions will make it easier to use its nonbank designation authority, eliminating “inappropriate hurdles as part of the designation process” that exist under the current guidance issued in 2019.

As the country is in the midst of a regional bank crisis, it would not be unreasonable to conclude that the Council may use its authorities less sparingly than in the past. The Council’s annual reports specifically address the potential risks of nonbank companies, supports the updated requirements issued by the Federal Housing Finance Authority, Ginnie Mae and the CSBS Model State Regulatory Prudential Standards for Nonbank Mortgage Servicers, and recommends that relevant federal and state regulators continue to enhance or establish information sharing in responding to distress at a mortgage servicer.  Indeed, in June 2022, FSOC restarted its Nonbank Mortgage Servicing Task Force, an interagency group to facilitate coordination and additional market monitoring of nonbank servicers.

The Proposed Analytic Framework

The Proposed Analytical Framework, which is not a formal rule, broadly describes how FSOC “identifies, evaluates, and responds to potential risks to U.S. financial stability, whether they come from activities, individual firms, or otherwise.”  The Council’s statutory mandate includes the duty to monitor a wide class of assets, such as new or evolving financial products and practices, and nonbank financial companies, such as mortgage originators and servicers, at several key pressure points. A non-exhaustive list of these potential risk factors and the indicators that FSOC intends to monitor includes:

  • Leverage, assessed by levels of debt and other off-balance sheet obligations that may create instability in the face of sudden liquidity restraints.
  • Liquidity Risks & Maturity Mismatches, measured by the ratios of short-term debt to unencumbered liquid assets and the amount of additional funding available to meet unexpected reductions in available short-term funds.
  • Interconnections, measured by the extent of exposure to certain derivatives, potential requirements to post margin or collateral, and overall health of the balance sheet.
  • Operational Risks, measured by the failure to implement proper controls related to financial market infrastructures and the vulnerability of cybersecurity incidents.
  • Complexity & Opacity, such as the extent to which transactions occur outside of regulated sectors, in a grey area of overlapping or indefinite jurisdiction, or are structured in such a way that cannot be readily observed due to complexity or lack of disclosure.
  • Inadequate Risk Management, such as the failure to maintain adequate controls and policies or the absence of existing regulatory oversight.
  • Concentration, measured by the market share for the provision of important services within segments of applicable financial markets and the risk associated with high concentration in a small number of firms.
  • Destabilizing Activities, such as trading practices that substantially increase volatility in a particular market, especially when a moral hazard is present.

Just as FSOC will consider all the factors listed above as sources of potential financial risk contagion, it will also assess the transmission of those risks to broader market sectors and other specific entities based on certain metrics. This non-exhaustive list of transmission risk factors includes:

  • The level of direct and indirect exposure of creditors, investors, counterparties, and others to particular instruments or asset classes.
  • Rapid asset liquidation and the snowball effect of a widespread asset sell off across sectors.
  • The potential consequences of interruption to critical functions or services that are relied upon by market participants for which there is no substitute.
  • The potential for financial contagion arising from public perceptions of vulnerability and loss of confidence in widely held financial instruments.

Once a financial risk has been identified, FSOC may use various tools to mitigate such risk depending on the circumstances.  For instance, FSOC may work with the relevant federal or state regulator to seek to address the risk. Where a regulator can sufficiently address such risk in a timely manner, FSOC will encourage regulators to do so.  Through formal channels, the Council can make a public recommendation to Congress or regulatory agencies to apply new standards or heightened scrutiny to a known risk within their jurisdiction. Where no clear-cut regulatory oversight exists, the Council may make legislative recommendations to Congress to address the risk. These formal recommendations to agencies or Congress, made pursuant to section 120 of the Dodd-Frank Act, are also subject public notice and comment.

In addition to nonbinding recommendations for action to the appropriate financial regulatory authorities, FSOC is empowered to make a “nonbank financial company determination,” by a two-thirds vote, that a specific company shall be supervised by the Federal Reserve Board of Governors and subject to enhanced prudential standards. This designation can be made upon FSOC’s finding that:

  • Material financial distress at the nonbank financial company could pose a threat to the financial stability of the United States; or
  • The nature, scope, size, scale, concentration, interconnectedness, or mix of the activities of the nonbank financial company could pose a threat to financial stability in the United States.

Nonbank Financial Company Designation Interpretative Guidance

The Proposed Interpretive Guidance is procedural in nature relating to nonbank financial company designation.  It would define a two-stage process FSOC will use to make a firm-specific “nonbank financial company determination” discussed in FSOC’s Proposed Analytic Framework. The Council recognized that in the past, it “has used this authority sparingly, but to mitigate the risks of future financial crises, the Council must be able to use each of its statutory authorities as appropriate to address potential threats to U.S. financial stability.”  The Proposed Interpretive Guidance, if adopted, would change the 2019 guidance in the following three ways:

  • First, under the current guidance, FSOC is committed to relying on federal and state regulators to address problematic nonbank financial company activity before considering whether a designation is appropriate. The new guidance removes this prioritization and allows FSOC to consider an entity for a designation proactively, without first relying on regulators to act before FSOC begins deliberating.
  • Second, FSOC has issued the Proposed Analytic Framework discussed above to revise its process for monitoring risks to U.S. financial stability. This comprehensive new framework replaces that found in Section III of the 2019 interpretive guidance.
  • Third, FSOC has reversed course and is eliminating its current practice of conducting a cost-benefit analysis and an assessment of the likelihood of material financial distress prior to making its determination. FSOC has concluded that these processes are not required by Section 113 of the Dodd-Frank Act. FSOC defines “material financial distress” as a nonbank financial company “being in imminent danger of insolvency or defaulting on its financial obligations.” In eliminating the “likelihood” assessment required by the 2019 guidance, the Council would now presuppose a company’s material financial distress and then evaluate what consequences could follow for U.S. financial stability.

With respect to the formal process for nonbank financial company determinations, the Proposed Interpretive Guidance contemplates a two-stage process that FSOC would use once they decide to review a company for a potential designation.

Stage One:  FSOC would conduct preliminary analysis of a company that has been identified for review based on quantitative and qualitative information available publicly and regulatory sources. FSOC would notify the company no later than 60 days before a vote is held to evaluate the company for Stage Two.  A company under review may submit information for FSOC’s review and may request to meet with FSOC staff and members agencies responsible for the analysis.  When evaluating a company in Stage One, the Council’s Nonbank Designations Committee may decide whether to analyze the risk profile of the company as a whole or to consider the risk posed by its subsidiaries as separate entities, depending on which entity the Council believes poses a threat to financial stability. At Stage One, FSOC is statutorily obligated to collect information from any relevant, existing regulators that oversee the company’s activities concerning the specific risks the Council has identified.

Stage Two: Any nonbank financial company selected for additional review would receive notice that the company is being considered for supervision by the Federal Reserve and enhanced prudential standards. The Proposed Interpretive Guidance says that “[t]he review will focus on whether material financial distress at the nonbank financial company, or the nature, scope, size, scale, concentration, interconnectedness, or mix of the activities of the company, could pose a threat to U.S. financial stability.” At this point, if a company is under consideration for a Proposed Determination it would receive a formal Notice of Consideration from the Council.

The Council would begin its Stage Two review by consulting with the U.S. Treasury Department’s Office of Financial Research (OFR) and relevant financial regulators to ascertain the risk profile of the company. This information would remain confidential throughout the process, and, once interagency coordination has produced all available information, the company would be invited to submit any relevant information to the Council. These submissions “may include details regarding the company’s financial activities, legal structure, liabilities, counterparty exposures, resolvability, and existing regulatory oversight. . . . Information relevant to the Council’s analysis may include confidential business information such as detailed information regarding financial assets, terms of funding arrangements, counterparty exposure or position data, strategic plans, and interaffiliate transactions.” Council staff from the FSOC Deputies Committee would be available to meet with representatives of the company and would disclose the specific focus of the Council’s analysis.

Finally, if FSOC preliminarily designates the company for supervision by the Federal Reserve and subjects it to enhanced prudential standards, the company would be able to request a nonpublic hearing after which FSOC may vote to make a final designation. FSOC would conduct an annual review for any company designated by the Council to determine whether continued Federal Reserve supervision and enhanced prudential standards are still appropriate. This annual review period would afford the company the opportunity to meet with Council representatives and present information or make a written submission to the Council about its efforts to mitigate risk. If the Council decides to sustain the designation, it would present the company with a written explanation for its decision.

Takeaway

Given the current 2023 regional banking crisis, it is no surprise that federal regulators are focusing on potential risks to financial stability.  In FSOC’s 2021 and 2022 annual reports, nonbank mortgage companies have been identified as a potential risk.  The Federal Housing Finance Agency and Ginnie Mae have both updated their minimum financial eligibility requirements for seller/servicers and issuers with such requirements taking effect with varying effective dates later in 2023 and 2024.  States also have started to adopt prudential regulatory standards for nonbank mortgage servicers.  The Council appears to be signaling that additional supervision could occur if existing protections do not adequately mitigate risks.

*We would like to thank Summer Associate, Noah LeGrand, for their contribution to this blog post.

CFPB Issues Special Edition of Supervisory Highlights Focusing on Junk Fees

By ,

A&B ABstract:

In the 29nd edition of its Supervisory Highlights, the Consumer Financial Protection Bureau (“CFPB”) focused on the impact of so-called “junk” fees in the mortgage servicing, auto servicing, and student loan servicing industries, among others.

CFPB Issues New Edition of Supervisory Highlights:

On March 8, the CFPB published a special edition of its Supervisory Highlights, addressing supervisory observations with respect to the imposition of junk fees in the mortgage servicing and auto servicing markets – as well as for deposits, payday and small-dollar lending, and student loan servicing.  The observations cover examinations of participants in these industries that the CFPB conducted between July 1, 2022 and February 1, 2023.

Auto Servicing

With respect to auto servicing, the CFPB noted three principal categories of findings the Bureau claims constitute acts or practices prohibited by the Consumer Financial Protection Act (“CFPA”).

First, examiners asserted that auto servicers engaged in unfair acts or practices by assessing late fees: (a) that exceeded the maximum amount stated in consumers’ contracts; or (b) after consumers’ vehicles had been repossessed and the full balances were due.  With respect to the latter, the acceleration of the contract balance upon repossession extinguished not only the customers’ contractual obligation to make further periodic payments, but also the servicers’ contractual right to charge late fees on such periodic payments. The report notes that in response to the findings, the servicers ceased their assessment practices, and provided refunds to affected consumers.

Second, examiners alleged that auto servicers engaged in unfair acts or practices by charging estimated repossession fees that were significantly higher than the average repossession cost.  Although servicers returned excess amounts to consumers after being invoiced for the actual costs, the CFPB found that the assessment of the materially higher estimated fees caused or was likely to cause concrete monetary harm – and, thus, “substantial injury” as identified in unfair, deceptive, and abusive acts and practices (“UDAAP”) supervisory guidance – to consumers.  Further, consumers could have suffered injury in the form of loss of their vehicles to the extent that they did not want – or could not afford – to pay the higher estimated repossession fees if they sought to reinstate or redeem the vehicle.  Examiners found that such injuries: (a) were not reasonably avoidable by consumers, who could not control the servicers’ fee practices; and (b) were not outweighed by a countervailing benefit to consumers or competition.  The report notes that in response to the findings, the servicers ceased the practice of charging estimated repossession fees that were significantly higher than average actual costs, and also provided refunds to consumers affected by the practice.

Third, examiners claimed that auto servicers engaged in unfair and abusive acts or practices by assessing payment processing fees that exceeded the servicers’ actual costs for processing payments.  CFPB examiners noted that servicers offered consumers two free methods of payment: (a) pre-authorized recurring ACH debits; and (b) mailed checks.  Only consumers with bank accounts can utilize those methods; all those without a bank account, or who chose to use a different payment method, incurred a processing fee.  The CFPB reported that as a result of “pay-to-pay” fees, servicers received millions of dollars in incentive payments totaling approximately half of the total amount of payment processing fees collected by the third party payment processors.

Mortgage Servicing

In examining mortgage servicers, CFPB examiners noted five principal categories of findings that related to the assessment of junk fees, which were alleged to constitute UDAAPs and/or violate Regulation Z.

First, CFPB examiners found that servicers assessed borrowers late fees in excess of the amounts permitted by loan agreements, often by neglecting to input the maximum fee permitted by agreement into their operating systems.   The examiners found that by instead charging the maximum late fees permitted under state laws, servicers engaged in unfair acts or practices.  Further, servicers violated Regulation Z by issuing periodic statements that reflected the charging of fees in excess of those permitted by borrowers’ loan agreements. In response to these findings, servicers took corrective action including: (a) waiving or refunding late fees that were in excess of those permitted under borrowers’ loan agreements; and (b) corrected borrower’s periodic statements to reflect correct late fee amounts.

Second, CFPB examiners found that servicers engaged in unfair acts and practices by repeatedly charged consumers for unnecessary property inspections (such as repeat property preservation visits to known bad addresses). In response to the finding, servicers revised their policies to preclude multiple charges to a known bad address, and waived or refunded the fees that had been assessed to borrowers.

Third, CFPB examiners noted two sets of findings related to private mortgage insurance (“PMI”).  When a loan is originated with lender-paid PMI, PMI premiums should not be billed directly to consumers.  In certain cases, the CFPB found that servicers engaged in deceptive acts or practices by mispresenting to consumers – including on periodic statements and escrow disclosures – that they owed PMI premiums, when in fact the borrowers’ loans had lender-paid PMI.  These misrepresentations led to borrowers’ overpayments reflecting the PMI premiums; in response to the findings, servicers refunded any such overpayments. Similarly, CFPB examiners found that servicers violated the Homeowners Protection Act by failing to terminate PMI on the date that the principal balance of a current loan was scheduled to read a 78 percent LTV ratio, and continuing to accept borrowers’ payments for PMI after that date.  In response to these findings, servicers both issued refunds of excess PMI payments and implemented compliance controls to enhance their PMI handling.

Fourth, CFPB examiners found that servicers engaged in unfair acts or practices by failing to waive charges (including late fees and penalties) accrued outside of forbearance periods for federally backed mortgages subject to the protections of the CARES Act.  The CARES Act generally prohibits the accrual of fees, penalties, or additional interest beyond scheduled monthly payment amounts during a forbearance period; however, the law does not address fees and charges accrued during periods when loans are not in forbearance.  Under certain circumstances, HUD required servicers of FHA-insured mortgages to waive fees and penalties accrued outside of forbearance periods for borrowers exiting forbearances and  entering permanent loss mitigation options.  CFPB examiners found that servicers sometimes failed to complete the required fee waivers, constituting an unfair act or practice under the CFA.

Finally, CFPB examiners found that servicers engaged in deceptive acts and practices by sending consumers in their last month of forbearance periodic statements that incorrectly listed a $0 late fee for the next month’s payment, when a full late fee would be charged if such payment were late.  In response to the finding, servicers updated their periodic statements and either waived or refunded late fees incurred in the referenced payments.

Deposits

The CFPB determined that two overdraft-related practices constitute unfair acts or practices: (i) authorizing transactions when a deposit’s balance was positive but settled negative (APSN fees); and (ii) assessing multiple non-sufficient funds (NSF) fees when merchants present a payment against a customer’s account multiple times despite the lack of sufficient funds in the account.  The CFPB has criticized both fees before in Consumer Financial Protection Circular 2022-06, Unanticipated Overdraft Fee Assessment Practices.

According to the report, tens of millions of dollars in related customer injury are attributable to APSN fee practices, and redress is already underway to more than 170,000 customers.  Many financial institutions have abandoned the practice, but the CFPB noted that even some such institutions had not ceased the practice and were accordingly issued matters requiring attention to correct the problems.  As for NSF fees, the CFPB found millions of dollars of consumer harm to tens of thousands of customers.  It also determined that “virtually all” institutions interacting with the CFPB on the issue have abandoned the practice.

Student Loan Servicing

Turning to student loan servicing, the CFPB found that servicers engaged in unfair acts or practices prohibited by the CFPA where: (a) customer service representative errors delayed consumers from making valid payments on their accounts, and (b) those delays led to consumers owing additional late fees and interest associated with the delinquency.  Contrary to servicers’ state policies against the acceptance of credit cards, customer service representatives accepted and processed credit card payments from consumers over the phone.  The servicers initially processed the credit card payments, but then reversed those payments when the error in payment method was identified.

Payday and Small Dollar Lending

The CFPB determined that lenders, in connection with payday, installment, title, and line-of-credit loans, engaged in a number of unfair acts or practices.  The first conclusion they made was that lenders simultaneously or near-simultaneously re-presented split payments from customers’ accounts without obtaining proper authorization, resulting in multiple overdraft fees, indirect follow-on fees, unauthorized loss of funds, and inability to prioritize payment decisions. The second such conclusion concerned charges to borrowers to retrieve personal property from repossessed vehicles, servicer charges, and withholding subject personal property and vehicles until fees were paid.  The third such determination related to stopping vehicle repossessions before title loan payments were due as previously agreed, and then withholding the vehicles until consumers paid repossession-related fees and refinanced their debts.

Takeaways

The CFPB’s focus on “junk” fees is not new – it follows on an announcement last January that the agency would be focused on the fairness of fees that various industries impose on consumers.  (We have previously discussed how the CFPB’s actions could impact mortgage servicing fee structures.)  Similarly, the Federal Trade Commission has previously considered the issue of “junk fees” in connection with auto finance transactions.

By focusing specifically on the issue in a special edition of the Supervisory Highlights, the CFPB is drawing special attention to the issue of these fees in the servicing context.  Mortgage, auto, and student loan servicers might use this as an opportunity to review their current practices and see how they stack up against the CFPB’s findings.

CFPB Issues Proposed Rule to Establish Public Registry of Supervised Nonbank Form Contract Provisions that Waive or Limit Consumers’ Legal Protections

By , ,

A&B ABstract:

On January 11, 2023, the Consumer Financial Protection Bureau (the “CFPB” or “Bureau”) announced a proposed rule to establish a public registry and require  nonbanks supervised by the agency to register their use of certain terms and conditions contained in “take it or leave it” form contracts for consumer financial products or services that “attempt to waive consumers’ legal protections,” “limit how consumers enforce their rights,” or “restrict consumers’ ability to file complaints or post reviews” (the “Proposed Rule”).  The purpose of Proposed Rule’s registration system is to allow the CFPB to prioritize oversight of nonbanks that use the covered terms and conditions based on the agency’s perception these provisions pose risks for consumers.

The CFPB seeks public comment on the practical utility of collecting and publishing this information as well as ways to minimize the burden of the information collection on respondents. The comment period closes on April 3, 2023.

The Proposed Rule

The Proposed Rule would require annual registration by most nonbanks subject to the CFPB’s jurisdiction, with limited exceptions. “Specifically, a “supervised nonbank” would be defined to mean a nonbank covered person that is subject to supervision and examination by the Bureau, except to the extent that such person engages in conduct or functions that are excluded from the Bureau’s supervisory authority pursuant to 12 U.S.C. 5517 or 5519.  A “supervised nonbank” would include any nonbank covered person that (1) offers or provides a residential mortgage-related product or service, any private educational consumer loan, or any consumer payday loan, (2) is a larger participant engaged in consumer reporting, consumer debt collection, student loan servicing, international money transfers, and auto financing, or (3) is subject to a CFPB order issued pursuant to 12 U.S.C. 5514(a)(1)(C).

Those excluded from the scope of the Proposed Rule would include, among others, persons subject to CFPB supervision and examination solely in the capacity of a service provider; natural persons; persons with less than $1 million in annual receipts resulting from offering or providing all consumer financial products and services as relevant to the activities noted in (1) through (3) above.  Also exempt from the rule would be a person that has not, together with its affiliates, engaged in more than de minimis use of covered terms and conditions (i.e., fewer than 1,000 times in the previous calendar year) and a person that used covered terms or conditions in covered form contracts in the previous calendar year solely by entering into contracts for residential mortgages on a form made publicly available on the Internet required for insurance or guarantee by a Federal agency or purchase by Fannie Mae, Freddie Mac, or Ginnie Mae.

Under the Proposed Rule, a “covered term or condition” would be subject to the rule’s reporting requirements. A “covered term or condition” would be defined as “any clause, term, or condition that expressly purports to establish a covered limitation on consumer legal protections applicable to the offering or provision of any consumer financial product or service.” In turn, “covered limitation on consumer legal protections” would be defined to mean any covered term or condition in a covered form contract:

  • Precluding the consumer from bringing a legal action after a certain period of time;
  • Specifying a forum or venue where a consumer must bring a legal action in court;
  • Limiting the ability of the consumer to file a legal action seeking relief for other consumers or to seek to participate in a legal action filed by others;
  • Limiting liability to the consumer in a legal action including by capping the amount of recovery or type of remedy;
  • Waiving a cause of legal action by the consumer, including by stating a person is not responsible to the consumer for a harm or violation of law;
  • Limiting the ability of the consumer to make any written, oral, or pictorial review, assessment, complaint, or other similar analysis or statement concerning the offering or provision of consumer financial products or services by the supervised registrant;
  • Waiving, whether by extinguishing or causing the consumer to relinquish or agree not to assert, any other identified consumer legal protection, including any specified right, defense, or protection afforded to the consumer under Constitutional law, a statute or regulation, or common law; or
  • Requiring that a consumer bring any type of legal action in arbitration.

In the Proposed Rule, the CFPB acknowledges that there may be overlap in the types of covered terms and conditions, so some contract provisions may fall into more than one category.  The Proposed Rule currently proposes to limit the collection of terms and conditions that expressly attempt to establish the covered limitation.  Any contract containing a covered term would be considered a “form contract” provided it was (1) included in the original contract draft presented to the consumer, (2) was not negotiated between the parties, (3) is intended for repeated use in transactions between the company and consumers and contains a covered term or condition.

Supervised nonbanks covered by the Proposed Rule would be required to collect and submit this information through the CFPB’s registration system.  Under the Proposed Rule, the registry of terms and conditions would be publicly available, rather than limited to government regulators or CFPB staff.  The CFPB supports the public availably of this data on the grounds that it will lead to more informed consumers and provide other regulators the opportunity to identify covered terms and conditions that are explicitly prohibited by the laws they enforce or supervise.  The proposed format for the registry is similar to another recent CFPB proposed rule which proposes to establish a public registry of regulatory actions involving certain nonbanks subject to CFPB supervision. We previously discussed this proposed rule in another blog post.

CFPB’s Request for Comment on the Proposed Rule

The CFPB is seeking comment on a range of issues related to the Proposed Rule, including:

  • The prevalence of the covered terms and conditions;
  • Potential impacts of collecting and publishing this information;
  • Reasons why the information should not be publicly disclosed;
  • The burden of collecting and filing these provisions;
  • The use of form contracts purchased from third parties; and
  • Other entities that may be affected by the proposed rule.

The period for public comment ends on April 3, 2023.

Is the establishment of a Public Registry likely?

 The CFPB currently has thirty-seven (37) rules that have been proposed but not implemented, of which only five of were proposed since the start of the Biden Administration.  Most notably, neither the CFPB’s proposed rule for small business lending data collection from September 1, 2021 or its proposed rule for credit card late fees and late payments from June 22, 2022 have been finalized.  Since the substance of this rule is limited to the collection and publication of contract terms, rather than the prohibition of any behavior, enactment might be more likely.  The recent Fifth Circuit decision in Community Financial Services found the CFPB’s funding structure unconstitutional and vacated the agency’s Payday Lending Rule on those grounds.  Accordingly, any rule promulgated by the CFPB would likely be susceptible to legal challenges.

Takeaway

The Bureau’s focus on seeking public disclosure of covered terms and conditions reflects a continued focus on the content of form contracts used in connection with consumer finance products and services of nonbanks.  The public nature of the registry could lead to increased scrutiny of contract provisions from the Bureau, other regulators, and the public, increasing reputational risk to covered entities as well as the likelihood of heightened enforcement activity by Federal and State regulators. Accordingly, entities that would be subject to the Proposed Rule’s requirements should carefully review the Proposed Rule and consider commenting thereon.

Trends in Enforcement and Recommendations on Protecting Financial Institutions

By , ,

In his 2022 speech “Reining in Repeat Offenders” at the Distinguished Lecture on Regulation at the University of Pennsylvania Law School, the director of the Consumer Financial Protection Bureau (CFPB) stated that “[a]chieving general deterrence is an important goal for the CFPB” and “the role of individual liability cannot be discounted.” To that end, the CFPB recently proposed an enforcement order registry that would, among other things, require certain larger participant nonbanks subject to the CFPB’s supervisory authority to designate a senior executive who is responsible for and knowledgeable of the nonbank’s efforts to comply with the orders identified in the registry to attest regarding compliance with covered orders and submit an annual written statement attesting to the steps taken to oversee the activities subject to the applicable order for the preceding calendar year and whether the executive knows of any violations of, or other instances of noncompliance with, the covered order.

It is not surprising that one of the major questions that has arisen about financial institution (FI) insurance coverage is the extent of coverage for regulatory enforcement actions. Other questions arise in interpreting the scope of FI insurance coverage for terms such as a pending and prior claim, the performance of professional services, invasion of privacy (and whether data breaches are covered), and fraud. These terms can be particularly important in the heavily regulated financial services industry. Accordingly, financial institutions need to understand FI coverage options and the negotiable terms.

Are regulatory enforcement actions included in coverage terms?

Responding to inquiries from agencies such as the CFPB, Securities Exchange Commission (SEC), Department of Justice, attorneys general, and federal and state banking agencies can be disruptive and expensive. As a threshold matter it is important to understand the extent of insurance coverage, including the kind of inquiry that is covered. The first step is to make sure you understand which regulators are covered when there is an inquiry or enforcement action. Ideally, financial institutions would have coverage for claims from any federal or state agency.

Is there coverage for costs incurred in responding to informal inquiries?

For example, there may be coverage for an informal document request and employee interview by a government agency. Many policies now offer some coverage of a formal government agency civil investigative demand (CID) or subpoena to a financial institution, and it is important to understand the specific scenarios in which such a CID or subpoena is covered.

When facing an ongoing government investigation, is it subject to the excess policy’s “pending and prior claim” exclusion? 

In a recent case, the policy language provided that the excess policy did not apply to “any amounts incurred by the Insureds on account of any claim or other matter based upon, arising out of or attributable to any demand, suit or other proceeding pending or order, decree, judgment or adjudication entered against any Insured on or prior to July 31, 2011.” The court ruled that the parties had agreed to exclude from the excess policy coverage any claim as defined in the language of the primary policy.

The court also ruled that an ongoing SEC investigation, even though it was not being covered by any insurance policy, was a claim as defined under the primary policy and thus was subject to the pending and prior claim exclusion of the excess policy. This case emphasizes the importance of understanding the definitions of a claim within the relevant policies.

What are some considerations for losses arising out of the performance of professional services? 

Many FI policies have exclusions for loss arising out of the performance of professional services, which distinguish claims covered by a company’s errors and omissions (E&O) insurance. It is important to understand the effect of these exclusions, which are illustrated in recent court decisions.

In one recent case, a court held that a bank’s policy’s professional services exclusion precluded coverage for all insureds, not just those delivering the services. The exclusion in the case provided that there was no liability for claims “made against any Insured alleging, arising out of, based upon, or attributable to the Organization’s or any Insured’s performance of or failure to perform professional services for others….” The court held that the phrase “any Insured” made the insurer’s obligations jointly held, which prohibited recovery from any insured.

However, the policy at issue in this case did not have a severability provision. The court’s opinion suggests that a professional services exclusion in a policy with a severability provision would preclude coverage only for those who actually performed the professional services.

Another consideration is the broad language that was used in the clause in this case—it uses words like “arising out of,” “based upon,” or “attributable to” the professional services provided. Companies should ensure that the clause serves its purpose and does not preclude too much coverage.

Another issue involving professional services exclusions, particularly for banks, are fee cases. Overdraft fees, as well as a lot of other fees, including junk fees, have been a focus of regulators. One court has considered the question of insurance coverage for a bank’s obligation to repay overdraft fees. In this case, a bank customer filed suit against the bank, seeking relief from “unfair and unconscionable assessment and collection of excessive overdraft fees.” The bank filed suit against its insurer for refusing to pay defense costs in the lawsuit.

The policy at issue had a duty-to-defend clause covering claims “for a Wrongful Act committed by an Insured or any person for whose acts the Insured is legally liable while performing Professional Services, including failure to perform Professional Services.” However, the policy also had an exclusion “for Loss on account of any Claim … arising from … any fees or charges.” The court affirmed the denial of the companies’ entitlement to payment for defense costs, ruling that the fees exclusion absolved the carrier of an obligation to pay such costs. Cases like these reinforce the importance of understanding defense costs coverage for these kinds of overdraft fee cases.

How does an exclusion for invasion of privacy impact cyber breaches?

It is not uncommon for policies to have clauses that exclude claims based on invasion of privacy. Recent cases underscore the importance of understanding whether such clauses exclude coverage for claims in cyber breaches.

A court recently held that the Los Angeles Lakers were not entitled to insurance coverage for allegations that the team violated the Telephone Consumer Protection Act (TCPA). The court ruled that “because a [TCPA] claim is inherently an invasion of privacy claim, [the insurer] correctly concluded that the underlying [TCPA] claims fell under the Policy’s broad exclusionary clause.”

This decision could affect coverage of cyber-liability claims involving cybersecurity and data privacy, which are becoming increasingly common and which often touch on invasion of privacy issues. Companies should understand their exclusionary clauses on this score.

What is “final” for purposes of an insurance policy’s fraud exclusion?

Many FI insurance policies exclude coverage if the insured is found to have engaged in fraud. Often, the exclusion is only triggered after a “final” judicial determination that the excluded conduct has occurred. The issue of what a “final” determination is can affect the coverage for a claim.

Financial institutions should look for fraud exclusions in their FI policies to determine whether such exclusions refer to a “final, non-appealable adjudication” or a “final judgment.” In a New York state case, after a former CEO was sentenced for the commission of various fraud crimes, he filed an appeal of his convictions. While the appeal was still pending, however, his insurer asked to be relieved of its obligation to defend the plaintiff because the fraud exclusion in its policy was triggered upon a final judgment against its insured.

The former CEO filed suit against his insurer, but the appellate court affirmed the trial court’s ruling that the insurer was no longer obligated to pay his defense. The court held that the imposition of the criminal sentence was a “final judgment,” which appropriately triggered the fraud exclusion in the policy. The court explained that even if an appeal is successful, the finality of the sentence is not changed.

This case shows how important it is to understand the contours of a policy’s fraud exclusion.

Defense Costs: Duty to Defend v. Duty to Indemnify

Finally, a company needs to consider whether it wants to have primary control over the defense of a covered claim or wants the insurer to have primary control. An advantage of having the insurer control the defense—a “duty to defend” policy—is that the coverage requirements can be a bit more broad in many states. The main advantage of the company having primary control of the defense in a so-called “duty to indemnify” policy is that the company gets wider latitude in choosing lawyers that they trust and know to have the appropriate experience to handle the matter. Under either of these arrangements, the carrier would pay covered defense costs.

Conclusion

As trends in enforcement shift, it is increasingly important to understand liability coverage. Financial institutions should consider reaching out to experienced insurance brokers and attorneys to assist them in reviewing and analyzing the terms and features of their policies in the evolving enforcement climate.

CFPB Proposes Nonbank Registry to Focus on Compliance “Recidivism”

By , ,

A&B ABstract:

On December 12, 2022, the Consumer Financial Protection Bureau (CFPB) announced a proposed rule to require certain non-banks to register with the agency when they become subject to a public written order or judgment imposing obligations based on violations of certain consumer protection laws. The CFPB also proposes to maintain a public online registry of those nonbanks subject to agency or court orders, to “limit the harms from repeat offenders.” We provide below a description of the CFPB’s proposed rule, along with the potential implications for the financial services industry.

Background on Proposed Rule

Earlier this year, CFPB Director Rohit Chopra presented remarks at the University of Pennsylvania, where he asserted that “[c]orporate recidivism has become normalized and calculated as the cost of doing business; the result is a rinse-repeat cycle that dilutes legal standards and undermines the promise of the financial sector and the entire market system.” To address this problem, Director Chopra suggested establishing “dedicated units in our supervision and enforcement divisions to enhance the detection of repeat offenses and corporate recidivists and to better hold them accountable.” With respect to accountability for “serial offenders of federal law,” Director Chopra warned that the CFPB would be focusing on “remedies that are more structural in nature,” including “limits on the activities or functions” of the entity.

Subsequently, in November 2022, and leading up to the proposed rule, the CFPB announced, as part of its Supervisory Highlights, that it would be establishing a Repeat Offender Unit as part of its supervision program. The Repeat Offender Unit would be focused on: reviewing and monitoring the activities of “repeat offenders;” identifying the root cause of recurring violations; pursuing and recommending solutions and remedies that hold entities accountable for failing to consistently comply with Federal consumer financial law; and designing a model for order review and monitoring that reduces the occurrences of repeat offenders. The Bureau asserts that its authority for these efforts, along with any proposed rulemaking, is derived from the Consumer Financial Protection Act’s mandate that the Bureau “monitor for risks to consumers in the offering or provision of consumer financial products or services” and “gather information from time to time regarding the organization, business conduct, markets, and activities of covered persons and service providers.” See 12 U.S.C. § 5512(c)(1), (4).

Proposed Requirements

The CFPB’s proposed rule would require certain nonbanks covered person entities (with exclusions for insured depository institutions, insured credit unions, related persons, States, certain other entities, and natural persons) to register with the Bureau upon becoming subject to a public written order or judgment imposing obligations based on violations of certain consumer protections laws. Such entities would be required to register in a system established by the Bureau, provide basic identifying information about the company and the order (including a copy of the order), and periodically update the registry for accuracy and completeness. For purposes of the proposed rule, “covered person” would have the same meaning as in 12 U.S.C. § 5481(6). Further, “service providers” would be deemed covered persons to the extent that they engage in the offering or provision of their own consumer financial product or services or where they act as service providers to covered person affiliates.

In addition, certain larger participant nonbanks subject to the Bureau’s supervisory authority would be required to designate a senior executive, who is responsible for and knowledgeable of the nonbank’s efforts to comply with the orders identified in the registry, to attest regarding compliance with covered orders and submit an annual written statement attesting to the steps taken to oversee the activities subject to the applicable order for the preceding calendar year, and whether the executive knows of any violations of, or other instances of noncompliance with, the covered order.

Further, the CFPB is considering whether to release, via its publicly available website, the above registry information for non-banks.

Implications for Non-Banks

While the CFPB’s proposed enforcement order registry would provide greater transparency about a lender’s regulatory track record to the various federal and state regulators and the general public, it remains to be seen how the information maintained in this registry might be used against lenders. At a minimum, however, the proposed rule raises the following significant implications for non-banks:

  • Supervision and examination considerations. The CFPB intends to use the information in the registry to coordinate its “risk-based supervisory prioritization,” for those non-bank markets covered by the Bureau’s supervision and examination authority under CFPA section 1024(a). Thus, entities with a local, state, or federal prior enforcement order may be subject to more targeted supervision.
  • Investigation and enforcement presumptions. The CFPB intends to use the information in the registry in connection with its investigation and potential enforcement activities, which presents various risks, including:
    • Increased civil money penalties. Specifically, the CFPB believes that the information contained in the proposed registry can assist the agency in determining the civil penalties that may be assessed for a future violation of federal consumer financial law, given that federal law permits the CFPB to consider the entity’s “history of previous violations.” Indeed, it is possible that the CFPB may use evidence of prior enforcement against an entity, brought by itself or another agency, to establish that the entity acted knowingly or recklessly in violating federal consumer financial law, perhaps even where the prior enforcement order involved a different consumer-related issue.
    • Presumption of consumer harm. Further, the CFPB believes there is a “heightened likelihood” that entities that are subject to public orders relating to consumer financial products and services may pose risks to consumers in the markets for those products and services, since entities that have previously been subject to enforcement actions “present an increased risk of committing violations of laws.” Thus, there may be a presumption of consumer harm against an entity where a prior enforcement order exists. Yet this approach by the CFPB likely will overstate the actual harm to consumers, as most consent orders do not contain an admission by the entity of any liability or wrongdoing.
  • Increased reputational risk. Given that the CFPB maintains Memoranda of Understanding with federal parties (such as the Federal Trade Commission and the U.S. Department of Justice), as well as with at least 20 state attorneys general offices, it appears that the information reported to the registry already would be available to such agencies. However, the registry will permit all agencies, as well as the general public, a readily accessible, one-stop shop to an entity’s entire enforcement track record, which may present significant reputational risk to that entity, as well as a potentially increased risk of class action lawsuits and other consumer claims.
  • Facilitating of private enforcement. The CFPB believes that the proposed registry may “facilitate private enforcement of the Federal consumer financial laws by consumers, to the extent those laws provide private rights of action, where consumers have been harmed by a registered nonbank.” In other words, the “information that would be published under the proposal might be useful in helping consumers understand the identity of a company that has offered or provided a particular consumer financial product or service, and in determining whether to file suit or otherwise make choices regarding how to assert their legal rights.”

Takeaway:

Given the significant implications raised by the CFPB’s proposed rule, non-bank financial institutions should consider submitting comments, which are due 60 days after publication in the Federal Register. In particular, the CFPB seeks comment on “its preliminary conclusion that collecting and registering public agency and court orders imposing obligations based upon violations of consumer law would assist with monitoring for risks to consumers in the offering or provision of consumer financial products and services.” The CFPB also seeks comment on “whether the types of orders described in the proposal, and the types of information that would be collected about those orders and covered nonbanks under the proposal, would provide useful information to the Bureau,” as well as “any other risks that might be identified through collecting the information described in the proposal.” Finally, the Bureau seeks comment on whether it should consider collecting any other information in order to identify risks to consumers associated with orders.