Alston & Bird Consumer Finance Blog

Consumer Finance

CFPB Approves Financial Data Exchange to Set Standards for 1033

By

What Happened?

Last week the CFPB issued an Order recognizing the Financial Data Exchange, Inc. (“FDX”) as the first standard setting body (“SSO”) under the CFPB’s Personal Financial Data Rights Rule (the “Rule”).  The Rule requires financial institutions, credit card issuers, and other financial providers (“Subject Entities”) to make available consumers’ financial data and transfer it to third parties, at the consumer’s request, for no charge.   The final version of the Rule was released in October, and it is the subject of a lawsuit filed by the Bank Policy Institute and the Kentucky Bankers Association.

Why does it Matter?

Background:

FDX is a standard-setting organization with more than 200 member organizations in the United States and Canada, including depository and non-depository commercial entities; data providers and data recipients; and others.  FDX’s stated primary purpose is to develop, improve and maintain a common, interoperable standard for secure consumer and business access to financial records.

SSOs:

The Role of SSOs is to issue consensus standards to help entities comply with the Rule, including protocols for secure data sharing.  In June 2024, the CFPB finalized a rule outlining the qualifications to become a recognized industry standard setting body. The CFPB identified five key qualifications that standard setting bodies must demonstrate in order to be recognized by the CFPB, including openness, transparency, balanced decision-making, consensus, and due process and appeals.

The CFPB’s recognition of FDX as an SSO is subject to a number of conditions, including:

  • Ban on “pay-to-play” and other conflicts of interest:  FDX is to develop standards to promote open banking without regard to sponsorships or other financial incentives to give certain market participants an unfair advantage.  FDX must ensure that the organization and its staff do not have any side arrangements that would skew its financial incentives toward particular entities.
  • Mandatory reporting on market adoption:  FDX is required to report to the CFPB on market use of its consensus standards and/or maintain a publicly available resource where companies can disclose their use of standards as well as any certifications of adherence to standards, for the benefit of open banking participants, regulators, and the public.
  • Transparency and availability of standards: FDX must make available to the public any consensus standards that it adopts and maintains, subject to reasonable safeguards, and to ensure that non-members have the same access as members do. FDX must also make publicly available information about its standards development and issuance processes.

What’s Next?

Although FDX was recognized as the first SSO, the CFPB continues to evaluate other applications for SSO recognition.  As these organizations will have significant impact on the way Subject Entities comply with the Rule, those entities should monitor the issuance of consensus standards as they develop.

New York Passes New Removal Procedures for Officers, Directors, Trustees, and Partners of Any Entity Regulated by Department of Financial Services

By

What Happened?

On December 21, 2024, New York Governor Kathy Hochul, signed into law, S7532, which repealed the existing section of the Banking Law addressing the removal of officers, directors, and trustees of banking organizations, bank holding companies and foreign banks (“covered individuals”), and enacted a new section providing a clearer process for removing such individuals and expanding the scope of the removal authority to apply to all entities regulated by the New York Department of Financial Services (“the Department”).

Repealed Section:

The former provisions regarding the removal of covered individuals were limited to banking organizations, bank holding companies, and foreign banks.

The Superintendent of the Department (“the Superintendent”) was authorized to bring an action to the Banking Board (“the Board”) to remove an officer, director, or trustee whenever it found that such individual:

  • violated any law or regulation of the Superintendent of financial services, or
  • “continued unauthorized or unsafe practices . . . after having been ordered or warned to discontinue such practices.”

Note that the Banking Board has not existed since the Department of Financial Services was created in 2011.

The Board would then serve notice of the action to the covered individual to appear before the Board to show why they should not be removed from office. A copy of this notice would be sent to each director or trustee of the banking organization and to each person in charge of and each officer of a branch of a foreign banking corporation.

If after a three-fifths vote by the Board members the Board found that the individual committed such violations, an order would be issued to remove the individual from office.

The removal became effective upon service of the order. The order and findings were not made public, and were only disclosed to the removed individual and the directors or trustees of the banking organization involved. Any such removed individual that participated in the management of such banking organization without permission from the Superintendent would be guilty of a misdemeanor.

Newly Enacted Section:

The new provision expands the removal authority of the Superintendent to apply to all entities regulated by the Department (“covered entities”), including: banks, trust companies, limited purpose trust companies, private banks, savings banks, safe deposit companies, savings and loan associations, credit unions, investment companies, bank holding companies, foreign banking corporations, licensed lenders, licensed cashers of checks, budget planners, mortgage bankers, mortgage loan servicers, mortgage brokers, licensed transmitters of money, and student loan servicers.

The Superintendent is authorized to bring an action to remove such individuals whenever it finds reason to believe that they:

  • caused, facilitated, permitted, or participated in any violation by a covered entity of a law or regulation, order issued by the Superintendent or any written agreement between such covered entity or covered individual and the Superintendent;
  • engaged or participated in any unsafe or unsound practice in connection with any covered entity; or
  • engaged or participated in any willful material act or omitted to take any material act that directly contributed to the failure of a covered entity.

The notice and hearing provisions were changed to allow the Superintendent to serve a statement of charges against the covered individual and a notice of an opportunity to appear before the Superintendent to show cause why they should not be removed from office. A copy of such notice must now be sent to the affected covered entity, instead of the directors or trustees of the covered entity and persons in charge of foreign bank branches.

Additionally, the threshold for removal was changed. Instead of being removed by a three-fifths vote of a board that no longer exists, the covered individual may be removed if, after notice and hearing: (1) the Superintendent finds that the covered individual has engaged in the unlawful conduct, or (2) if the individual waives a hearing or fails to appear in person or by authorized representative.

The order of removal is effective upon service to the individual. The order must also be served to any affected covered entity along with the statement of charges. The order remains in effect until amended, replaced, or rescinded by the Superintendent or a court of competent jurisdiction. Such removed individual is prohibited from participating in the “conduct of the affairs” of any covered entity unless they receive written permission from the Superintendent. If the individual violates such prohibition, they are guilty of a misdemeanor.

Furthermore, the Superintendent is now authorized to suspend the covered individual from office for a period of 180 days pending the determination of the charges if the Superintendent has reason to believe that:

  • a covered entity has suffered or will probably suffer financial loss that impacts its ability to operate in a safe and sound manner;
  • the interests of the depositors at a covered entity have been or could be prejudiced; or
  • the covered individual demonstrates willful disregard for the safety and soundness of a covered entity.

The suspension may be extended for additional periods of 180 days if the hearing is not completed within the previous period due to the request of the covered individual.

Why Does it Matter?

Prior to the update, the Superintendent only had the power to remove individual officers, directors, or trustees from office in various bank organizations. The new law expands this removal power to all entities regulated by the Department.

The amended statute creates an additional penalty for individuals who caused, facilitated, permitted, or participated in the violation of the Banking Law in their positions of power of a regulated entity. Such individuals may be removed from their positions and prohibited from participating in the management of any regulated entity, until they receive written permission from the Superintendent. If they violate the prohibition, they are guilty of a misdemeanor, which can be punished by imprisonment for up to 364 days or by a fine set by the Superintendent.

What Do I Need To Do?

Entities regulated by the Department that are now covered under this section should be aware that violations of law by a licensee may also lead to the removal of certain high-level individuals within the organization. If removed, such individuals would also be prohibited from managing any regulated entity until the Superintendent provides written permission to do so. Affected entities and individuals should take care to ensure compliance with the law to avoid these new penalties.

FHFA Announces UDAP Compliance Expectations

By ,

What Happened?

On November 29, 2024, the Federal Housing Finance Agency (“FHFA”) released Advisory Bulletin AB 2024-06 (the “Advisory Bulletin”), which sets forth FHFA’s expectations and guidance for Fannie Mae and Freddie Mac (the “GSEs”) and the Federal Home Loan Banks (collectively, the “Regulated Entities”) regarding compliance with the prohibition against unfair and deceptive acts or practices under Section 5 of the Federal Trade Commission Act (“FTC Act”). The Advisory Bulletin follows the FHFA Final Rule on Fair Lending, Fair Housing, and Equitable Housing Finance Plans published in the Federal Register in May 2024 (“Final Rule”).

Why It Is important?

While the Advisory Bulletin applies directly to the Regulatory Entities, any company that does business with the GSEs or the Federal Home Loan Banks should take note, as there likely will be downstream implications. The Regulated Entities are required to certify compliance with Section 5 of the FTC Act.  The Advisory Bulletin, however, raises several concerns.

First, the Advisory Bulletin conflates Section 5 UDAP compliance and fair lending principles. The Bulletin cautions that Regulated Entities are not only subject to the prohibition in Section 5 of the FTC Act against “unfair or deceptive acts or practices in or affecting commerce” but also the Fair Housing Act, the Equal Credit Opportunity Act (“ECOA”) and implementing regulations. To that end, the Final Rule requires the Board of Directors of Regulated Entities to bring their operations into compliance with these obligations in their “oversight of the [R]egulated [E]ntity and its business activities.” However, while the stated intent of the Advisory Bulletin is to provide guidance to the Regulated Entities consistent with the FTC Act, the Advisory Bulletin lumps together UDAP and discrimination, reminiscent of the CFPB’s similar attempt in 2022. In carefully worded language, FHFA states that its UDAP expectations “complement FHFA’s expectations regarding compliance with applicable fair lending laws.” And, specifically with respect to “unfairness,” FHFA states that its “duty to affirmatively further fair housing” may be considered when determining whether an act or practice is unfair. Yet any rule or bulletin by the FHFA providing that a violation of Section 5 of the FTC Act may be a violation of other federal and state laws (including fair housing, fair lending, and other consumer protection laws) undoubtedly extends fair lending laws beyond the bounds carefully set by Congress. See American Bankers Association, Unfairness and Discrimination: Examining the CFPB’s Conflation of Distinct Statutory Concepts (June 2022).

Second, the Advisory Bulletin suggests various theories of liability for violations of Section 5 of the FTC Act. In particular, the Advisory Bulletin points out that, in addition to direct liability for UDAP violations, the Regulated Entities may be held vicariously liable for UDAPs resulting from the conduct of their employees, agents, or third parties (depending on the Entity’s control or other legal responsibility over the third party’s conduct) regardless of whether such Entity knew or should have known of that conduct consistent with agency law. Moreover, the Regulated Entity may be liable for failing to take prompt action to correct UDAP violations in certain circumstances. Here again, the Advisory Bulletin conflates UDAP with fair lending, as the Bulletin delves into liability principles typically applicable to the Fair Housing Act and ECOA.

Finally, given the potential liability to the Regulated Entities for the conduct of its agents or other third parties, the Advisory Bulletin may serve to further incentivize the Agencies to act as de facto regulators in their oversight of single-family and multi-family seller servicer relationships. Not surprisingly, the Advisory Bulletin reminds the Regulated Entities of the importance of “assessing, monitoring, and taking corrective action related to legal, compliance, and reputation risks associated with potential sellers and servicers, including risks associated with compliance programs, records of compliance, and other relevant information related to compliance with all applicable laws.” Yet, if the GSEs were to exit conservatorship, it remains uncertain what kind of authority they would have to enforce and remediate compliance deficiencies.

What Do I Need To Do?

The Regulated Entities are directed to identify, assess, monitor, and mitigate risks associated with UDAP, including legal, compliance, operational, strategic and reputational risks. Given that the Regulated Entities are required to certify compliance with Section 5 of the FTC Act, companies should expect downstream implications and should work to ensure it has sufficient controls in place to mitigate UDAP risks and avoid unwelcome repurchase demands or rep and warrant breaches.

CFPB’s “Overdraft Lending” Rule Faces Immediate Legal Challenge

By ,

What Happened?

On December 12, 2024, the Consumer Financial Protection Bureau (CFPB) issued its final “overdraft lending” rule aimed at curbing overdraft fees charged by banks and credit unions with more than $10 billion in assets, also known as very large financial institutions (VLFIs). The CFPB characterized the rule as closing “an outdated overdraft loophole that exempted overdraft loans from lending laws.” This is the most recent development in the CFPB’s effort to address so-called junk fees.

That same day, a group of banks and financial trade associations—including the Mississippi Bankers Association, the Consumer Bankers Association, the American Bankers Association, and America’s Credit Unions—filed a lawsuit against the CFPB challenging the rule and seeking an injunction.

Why Does it Matter?

Key Provisions

Under the final rule, Regulation Z will apply to overdraft credit provided by VLFIs unless the VLFI provides such overdraft credit at or below costs and losses. As a result, VLFIs will have to choose one of the following options in connection with fees for overdraft credit: (1) capping fees for overdraft credit at the greater of $5 or at an amount that covers their costs and losses; or (2) disclosing the terms of overdraft credit in accordance with the Truth in Lending Act (TILA) and its implementing regulation, Regulation Z.

The CFPB’s final rule amends the definition and exemptions related to “Finance Charges” under Regulation Z and establishes new definitions related to “Overdraft Credit.” Currently, most overdraft fees are generally excluded from the definition of “Finance Charge”, and, therefore, overdraft services are not covered by TILA and Regulation Z The final rule amends this exclusion by creating a new defined term, “Above Breakeven Overdraft Credit,” and excludes such overdraft credit from the exemption for “charges imposed by a financial institution for paying items that overdraw an account.”

“Above Breakeven Overdraft Credit” is defined as “overdraft credit extended by a very large financial institution to pay a transaction on which, as an incident to or a condition of the overdraft credit, the very large financial institution imposes a charge or combination of charges exceeding the average of its costs and charge-off losses for providing non-covered overdraft credit.” The charges will be deemed to exceed the average costs and charge-off loses if they exceed the greater of: (1) the pro rata share of the very large financial institution’s total direct costs and charge-off losses for providing non-covered overdraft credit in the previous year; or (2) $5. A charge that exceeds this amount will be considered a finance charge and, therefore, imposing such charge on overdraft credit will result in the overdraft credit being considered “Covered Overdraft Credit.”

VLFIs should prepare to comply with this new rule by its effective date of October 1, 2025.

The Challenge to the Rule

A group of financial trade associations and banks filed suit in the Southern District of Mississippi challenging the final rule as improperly imposing an expansive and complex new regulatory regime on overdraft services offered by VLFIs, replete with de facto price caps and significant restrictions on the terms under which overdraft services can be offered.

The plaintiffs bring four challenges to the rule under the Administrative Procedure Act (APA), TILA, and the Consumer Financial Protection Act (CFPA).

First, they allege that the CFPB exceeded its statutory authority under TILA by interpreting “Credit” as encompassing overdraft services, and amending “Finance Charge” to include “Above Breakeven Overdraft Credit.” This, they argue, implicates the major questions doctrine—which bars agencies from making major policy decisions without clear congressional authorization—because the final rule will likely impact millions of Americans and billions of dollars of transactions.

Second, the plaintiffs allege the CFPB exceeded its statutory under TILA by imposing substantive credit restrictions when TILA is merely a disclosure statute. They argue this, too, implicates the major questions doctrine.

Third, the plaintiffs allege that the CFPB exceeded its statutory authority under the CFPA by imposing an unlawful fee cap on discretionary overdraft services because the CFPA itself expressly prohibits this kind of fee cap: the CFPB is prohibited from “establish[ing] a usury limit applicable to an extension of credit offered or made by a covered person to a consumer.”

Finally, the plaintiffs allege that the rule is arbitrary and capricious in violation of the APA because, among other things, it: (1) contains an inadequate cost-benefit analysis; (2) does not explain the change in the CFPB’s interpretation of TILA—namely, the CFPB’s reinterpretation of the definition of “Credit” as encompassing overdraft services; and (3) targets large institutions by imposing a $10 billion asset threshold, but ignores smaller financial institutions that similarly charge overdraft fees.

What Do I Need To Do?

VLFIs should consider what changes they need to make to their overdraft services to comply with the new rule by October 1, 2025, assuming that the new rule survives legal challenge.

That said, the legal challenge here has a meaningful chance of success. Recently, courts have been more willing to strike down rules under the major questions doctrine. It is also unclear how much genuine resistance the CFPB will put up in response to this challenge given the forthcoming change in administration. Assuming the new administration does not support this rule, it would likely be more efficient for the CFPB to allow the rule to be challenged and struck down than for it to attempt to repeal the rule, which will require a formal notice-and-comment rulemaking.

Carter State Funeral is not a “Legal Public Holiday” for Purposes of Certain Regulation Z Disclosure Requirements

By

What Happened?

President Biden has proclaimed January 9, 2025, a federal holiday for the state funeral of former President Jimmy Carter; as a result, Federal government agencies and departments will be closed that day.  Is this federal holiday proclaimed by executive order a “legal public holiday” for purposes of certain disclosure timing requirements of Regulation Z?

Why is it Important?

Under the Truth in Lending Act (TILA) Real Estate Settlement Procedures Act (RESPA) Integrated Disclosure Rule (TRID), generally, the creditor is responsible for ensuring that it delivers or places in the mail the loan estimate (LE) no later than the third business day after receiving the consumer’s application. Further, a creditor must ensure that the consumer receives the closing disclosure (CD) at least three business days before consummation of the transaction. In addition, for certain refinancings, Regulation Z permits the consumer to rescind (cancel) the transaction within three business days after consummation.

For purposes of providing the LE, a business day is a day on which the creditor’s offices are open to the public for carrying out substantially all of its business functions. However, the term “business day” is defined differently for other purposes, such as counting days to ensure the consumer receives the CD on time and the consumer’s exercise of the right to rescind the transaction. For these purposes, “business day” means all calendar days except Sundays and the legal public holidays specified in 5 U.S.C. § 6103(a): New Year’s Day, the Birthday of Martin Luther King, Jr., Washington’s Birthday, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day.

What to do Now?

Because the Carter state funeral on January 9, 2025, is not a “legal public holiday” within the meaning of 5 U.S.C. § 6103(a), it is a business day for counting days to ensure the consumer receives the CD on time and for the consumer’s exercise of the right to rescind the transaction.  Further, January 9, 2025, is also a business day for purposes of providing the LE as long as the creditor’s offices are open to the public for carrying out substantially all of its business functions.