InfoBytes Blog

Governor Hochul unveils statewide cybersecurity strategy for New York

On August 9, Governor Hochul announced New York’s first-ever statewide cybersecurity strategy to protect the state’s digital infrastructure from cyber threats. The cybersecurity strategy articulates a set of high-level objectives and agency roles and responsibilities, as well as outlines how existing and planned initiatives will be weaved together in a unified approach. The central principles of the strategy are unification, resilience, and preparedness, with a focus on state agencies working together with local governments to strengthen the entire state’s defenses. Included in the plan was a $600 million commitment to improve cybersecurity, including (i) a $90 million investment for cybersecurity in Fiscal Year 2024; (ii) $500 million to enhance healthcare information technology; and (iii) $7.4 million for law enforcement entities to expand their cybercrime capabilities.

State Issues Privacy, Cyber Risk & Data Security New York Dodd-Frank Federal Reserve Bank Merger Act

Senators call for stronger Fed oversight over bank mergers

On August 9, Senators Sherrod Brown (D-OH), Elizabeth Warren (D-MA), Jack Reed (D-RI), and John Fetterman (D-PA) wrote a letter to the Chair and Vice Chair of Supervision for the Board of Governors of the Federal Reserve System urging the Fed to “review and reconsider” its procedures for approving bank mergers.  The letter cites the Dodd-Frank Act’s amendment to the Bank Merger Act, which mandates that federal banking regulators consider whether a proposed merger “would result in greater or more concentrated risks” to the stability of the banking or financial system.  The senators also voiced concern that the Fed has “not issued any rules or guidance indicating the types of bank mergers that would implicate financial stability concerns” and criticized the process around the Fed’s approval of recent acquisitions. 

Federal Issues Bank Regulatory Senate Banking Committee Bank Supervision Federal Reserve Dodd-Frank Bank Merger Act

CFPB's small biz loan data rule stifled for many banks

On July 31, the U.S. District Court for the Southern District of Texas entered an order granting in part and denying in part a motion for a preliminary injunction against the CFPB. The injunction, filed by a bank and two trade associations (collectively “plaintiffs”), aims to prevent the CFPB from enforcing its new final rule, implementing section 1071 of the CPA, which would require financial institutions to collect and provide to the Bureau data on lending to small businesses (covered by InfoBytes here). A 2022 5th Circuit ruling (covered by an Orrick Special Alert here) in a different suit, however, deemed the CFPB’s funding structure unconstitutional.

Plaintiffs urged the 5th Circuit to enjoin enforcement of the small business lending rule pending Supreme Court resolution of the constitutionality of the CFPB’s funding structure, estimating that the burden of complying with the final rule would be $100,000 per community bank, and “the nonrecoverable costs of complying with an invalid regulation constitute irreparable harm,” among other things. The court held that the plaintiff bank had standing because its injury is imminent and not speculative based on the effective date of the final rule, and the costs of preparation for compliance. The court also held that there is a “substantial likelihood” that the plaintiffs would prevail in asserting the final rule is invalid based on the claim that the Bureau’s funding is unconstitutional. The court agreed with plaintiffs’ claim that the costs of compliance with the final rule are “more than de minimis and thus constitute irreparable harm,” despite the CFPB’s argument that the costs of compliance would not be incurred now. Finally, the court held that the CFPB failed to show any evidence that a stay of the final rule will cause harm. While the court entered an injunction, it limited it to the plaintiffs and their members, declining to enter a nationwide injunction as requested by plaintiffs, because “generic reasons such as ‘nationwide scope’ or ‘need for uniformity’ without more are insufficient.”

The final rule is scheduled to go into effect on August 29. 

Courts Federal Issues CFPB Small Business Lending Section 1071 Dodd-Frank Funding Structure Administrative Procedure Act

CFPB opposes Texas bankers’ request to delay small biz lending rule

The CFPB recently asked a district court in the 5th Circuit to deny a proposed injunction which would delay the implementation of its small-business lending data collection rule, arguing that plaintiffs have failed to establish standing or meet the requirements for preliminary relief. As previously covered by InfoBytes, plaintiffs (including a Texas banking association and a Texas bank) sued the Bureau, challenging the agency’s final rule on the collection of small business lending data. The small business lending rule, which implements Section 1071 of the Dodd-Frank Act, requires financial institutions to collect and provide to the Bureau data on lending to small businesses with gross revenue under $5 million in their previous fiscal year.

Plaintiffs explained in their complaint that the goal of invalidating the final rule is premised on the argument that it will drive from the market smaller lenders who are not able to effectively comply with the final rule’s “burdensome and overreaching reporting requirements” and decrease the availability of products to customers, including minority and women-owned small businesses. Plaintiffs also argued that the final rule is invalid because the Bureau’s funding structure is unconstitutional and that certain aspects of the final rule allegedly violate various requirements of the Administrative Procedure Act. Last month, plaintiffs filed a preliminary injunction motion asking the court to enjoin the final rule and stay the compliance deadlines.

Claiming plaintiffs failed to establish standing for preliminary relief, the Bureau argued that the Texas bank has not demonstrated that it would even have to comply with the final rule. The Bureau further maintained plaintiffs have also not satisfied all four factors required for preliminary relief, including that plaintiffs “have not shown that irreparable harm is imminent or that the balance of equities favors the requested relief,” which would lead to the postponement of reporting requirements mandated by Congress more than ten years ago. With respect to the funding structure constitutionality concerns raised by plaintiffs, the Bureau argued that “even assuming that [p]laintiffs have shown a likelihood of ultimately succeeding on the merits … that factor standing alone would not be enough to warrant preliminary relief.” The Bureau asked the court to, at a minimum, tailor any relief to apply only to plaintiffs and members who would face imminent harm absent such relief.

Courts CFPB Small Dollar Lending Section 1071 Dodd-Frank Funding Structure Administrative Procedure Act

CFPB releases regulatory agenda

The Office of Information and Regulatory Affairs recently released the CFPB’s spring 2023 regulatory agenda. Key rulemaking initiatives that the agency expects to initiate or continue include:

• Overdraft fees. The Bureau is considering whether to engage in pre-rulemaking activity in November to amend Regulation Z with respect to special rules for determining whether overdraft fees are considered finance charges.
• FCRA rulemaking. The Bureau is considering whether to engage in pre-rulemaking activity in November to amend Regulation V, which implements the FCRA. In January, the Bureau issued its annual report covering information gathered by the Bureau regarding certain consumer complaints on the three largest nationwide consumer reporting agencies (CRAs). CFPB Director Rohit Chopra noted that the Bureau “will be exploring new rules to ensure that [the CRAs] are following the law, rather than cutting corners to fuel their profit model.” (Covered by InfoBytes here.)
• Insufficient funds fees. The Bureau is considering whether to engage in pre-rulemaking activity in November regarding non-sufficient fund (NSF) fees. The Bureau commented that while NSF fees have been a significant source of fee revenue for depository institutions, recently some institutions have voluntarily stopped charging such fees.
• Amendments to FIRREA concerning automated valuation models. On June 1, the Bureau issued a joint notice of proposed rulemaking (NPRM) with the Federal Reserve Board, OCC, FDIC, NCUA, and FHFA to develop regulations to implement quality control standards mandated by the Dodd-Frank Act concerning automated valuation models used by mortgage originators and secondary market issuers. (Covered by InfoBytes here.) Previously, the Bureau released a Small Business Regulatory Enforcement Fairness Act (SBREFA) outline and report in February and May 2022 respectively. (Covered by InfoBytes here.)
• Section 1033 rulemaking. Section 1033 of Dodd-Frank provides that covered entities, such as banks, must make available to consumers, upon request, transaction data and other information concerning consumer financial products or services that the consumer obtains from the covered entity. Over the past several years, the Bureau has engaged in a series of rulemaking steps to prescribe standards for this requirement, including the release of a 71-page outline of proposals and alternatives in advance of convening a panel under the SBREFA and the issuance of a final report examining the impact of the Bureau’s proposals to address consumers’ personal financial data rights. (Covered by InfoBytes here.) Proposed rulemaking may be issued in October.
• Property Assessed Clean Energy (PACE) financing. The Bureau issued an NPRM last month to extend TILA’s ability-to-repay requirements to PACE transactions. (Covered by InfoBytes here.) The proposed effective date is at least one year after the final rule is published in the Federal Register (“but no earlier than the October 1 which follows by at least six months Federal Register publication”), with the possibility of a further extension to ensure compliance with a TILA timing requirement.
• Supervision of Larger Participants in Consumer Payment Markets. The Bureau is considering whether to engage in pre-rulemaking activity next month to define larger participants in consumer payment markets and further the scope of the agency’s nonbank supervision program.
• Nonbank registration. The Bureau announced its intention to identify repeat financial law offenders by establishing a database of enforcement actions taken against certain nonbank covered entities. (Covered by InfoBytes here.) The Bureau anticipates issuing a final rule later this year.
• Terms and conditions registry for supervised nonbanks. At the beginning of the year, the Bureau issued an NPRM that would create a public registry of terms and conditions used in non-negotiable, “take it or leave it” nonbank form contracts that “claim to waive or limit consumer rights and protections.” Under the proposal, supervised nonbank companies would be required to report annually to the Bureau on their use of standard-form contract terms that “seek to waive consumer rights or other legal protections or limit the ability of consumers to enforce or exercise their rights” and would appear in a publicly accessible registry. (Covered by InfoBytes here.) The Bureau anticipates issuing a final rule later this year.
• Credit card penalty fees. The Bureau issued an NPRM in February to solicit public feedback on proposed changes to credit card late fees and late payments and card issuers’ revenue and expenses. (Covered by InfoBytes here.) Under the CARD Act rules inherited by the Bureau from the Fed, credit card late fees must be “reasonable and proportional” to the costs incurred by the issuer as a result of a late payment. A final rule may be issued later this year.
• LIBOR transition. In April, the Bureau issued an interim final rule, amending Regulation Z, which implements TILA, to update various provisions related to the LIBOR transition. Effective May 15, the interim final rule further addresses LIBOR’s sunset on June 30, by incorporating references to the SOFR-based replacement—the Fed-selected benchmark replacement for the 12-month LIBOR index—into Regulation Z. (Covered by InfoBytes here.)

Agency Rule-Making & Guidance Federal Issues CFPB Fintech Payments Dodd-Frank Overdraft FCRA Consumer Reporting Agency NSF Fees FIRREA AVMs Section 1033 PACE Nonbank Supervision Credit Cards LIBOR Consumer Finance

CFPB issues guide on collecting small-biz data

The CFPB recently issued a compliance guide for its final rule implementing Section 1071 of the Dodd-Frank Act. Consistent with Section 1071, the final rule (issued at the end of March) will require financial institutions to collect and provide to the Bureau data on lending to small businesses, defined as an entity with gross revenue under $5 million in its last fiscal year (covered by InfoBytes here). The guide: (i) includes a detailed summary of the final rule’s requirements, including data reporting deadlines; (ii) provides comprehensive information on the types of data financial institutions need to collect and report on small business lending applications and decisions; and (iii) includes parameters for covered institutions and covered originations. The guide further breaks down reportable data points and explains the final rule’s “firewall” provision, which states that employees and officers of a financial institution or its affiliates “involved in making any determination” on a reportable application are generally prohibited from accessing applicant demographic information relating to ethnicity, race, sex, and status as a minority-owned, women-owned, or LGBTQI+-owned business. The guide specifies that certain exceptions may apply to situations where an employee involved in decision-making must have access to the data to fulfill their assigned job duties (e.g. a loan officer or loan processor). In these situations, financial institutions are required to provide notice to applicants that employees and officers involved in decision-making may have access to their demographic data.

Agency Rule-Making & Guidance Federal Issues CFPB Small Business Small Business Lending Section 1071 Dodd-Frank Compliance

OCC, FDIC say some overdraft fees may be unfair or deceptive

On April 26, the OCC and FDIC issued supervisory guidance addressing consumer compliance risks associated with bank overdraft practices. (See OCC Bulletin 2023-12 and FDIC FIL-19-2023.) The guidance highlighted certain practices that may result in increased risk exposure, including assessing overdraft fees on “authorize positive, settle negative” (APSN) transactions and assessing representment fees each time a third party resubmits the same item for payment after being returned by a bank for non-sufficient funds. The agencies provided guidance for banks that may help control risks associated with overdraft protection programs and achieve compliance with Dodd-Frank’s UDAAP prohibitions and section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices.

The FDIC’s supervisory guidance expanded on the 2019 Consumer Compliance Supervisory Highlights (covered by InfoBytes here), and warned that APSN overdraft fees present risks of unfairness under both statutes as consumers “cannot reasonably avoid” receiving these fees because they lack “the ability to effectively control payment systems and overdraft processing systems practices.” The FDIC cited the “complicated nature of overdraft processing systems” as another impediment to a consumer’s ability to avoid injury. The FDIC also emphasized that risks of unfairness exist both in “available balance” or “ledger balance” methods of assessing overdraft fees, but cautioned that risks may be “more pronounced” when a bank uses an available balance method. Furthermore, the FDIC warned that disclosures describing how transactions are processed may not mitigate UDAAP and UDAP risk. Banks are encouraged to “ensure customers are not charged overdraft fees for transactions consumers may not anticipate or avoid,” and should take measures to ensure overdraft programs provided by third parties comply with all applicable laws and regulations, as such arrangements may present additional risks if not properly managed, the FDIC explained.

The OCC’s guidance also warned that disclosures may be deceptive under section 5 if they fail to clearly explain that multiple or additional fees may result from multiple presentments of the same transaction. Recognizing that some banks have already implemented changes to their overdraft protection programs, the OCC also acknowledged that “[w]hen supported by appropriate risk management practices, overdraft protection programs may assist some consumers in meeting short-term liquidity and cash-flow needs.” The OCC encouraged banks to explore other options, such as offering low-cost accounts and low-cost alternatives for covering overdrafts, such as overdraft lines of credit and linked accounts. 

Bank Regulatory Federal Issues OCC FDIC Consumer Finance Overdraft FTC Act UDAP UDAAP Deceptive Unfair Dodd-Frank Fees Agency Rule-Making & Guidance

Texas bankers seek to invalidate CFPB’s small business lending rule

On April 26, plaintiffs, including a Texas banking association, sued the CFPB, challenging the agency’s final rule on the collection of small business lending data. As previously covered by InfoBytes, last month, the Bureau released its final rule implementing Section 1071 of the Dodd-Frank Act, which requires financial institutions to collect and provide to the Bureau data on lending to small businesses with gross revenue under $5 million in their last fiscal year. According to the Bureau, the final rule is intended to foster transparency and accountability by requiring financial institutions—both traditional banks and credit unions, as well as non-banks—to collect and disclose data about small business loan recipients’ race, ethnicity, and gender, as well as geographic information, lending decisions, and credit pricing. 

The plaintiffs’ goal of invalidating the final rule is premised on the argument that it will drive from the market smaller lenders who are not able to effectively comply with the final rule’s “burdensome and overreaching reporting requirements” and decrease the availability of products to customers, including minority and women-owned small businesses. Plaintiffs argued that the Bureau “took the original three pages of legislation and the 13 reporting data points required by [Dodd-Frank] and turned them into almost 900 pages of rulemaking—a new [f]inal [r]ule that requires banks to develop and implement new software and compliance mechanisms to comply with over 80 reporting requirements that have been exponentially grown by the CFPB since the Act requiring this [r]ule was passed.”

The plaintiffs further pointed to a decision issued by the U.S. Court of Appeals for the Fifth Circuit in Community Financial Services Association of America v. Consumer Financial Protection Bureau, where the court found that the CFPB’s “perpetual self-directed, double-insulated funding structure” violated the Constitution’s Appropriations Clause (covered by InfoBytes here and a firm article here), as justification for why the final rule should be set aside. The plaintiffs also pointed out certain aspects of the final rule that allegedly violate various requirements of the Administrative Procedure Act, and claimed that a recent data breach involving sensitive information on numerous financial institutions and consumers indicates that the agency is unprepared “to adequately assess the security and privacy impacts of its massive § 1071 data collection on small businesses.” The complaint seeks a court order finding the final rule to have been premised on the same unconstitutional grounds as found in CFSA, preliminary and permanent injunctions to set aside the final rule, and attorney fees and costs.

Courts CFPB Small Business Lending Section 1071 Dodd-Frank Funding Structure Administrative Procedure Act

CFPB reports on Section 1033 rulemaking

The CFPB recently released a final report issued by the Small Business Review Panel (Panel), which examines the impact of the Bureau’s proposals to address consumers’ personal financial data rights. Section 1033 of Dodd-Frank generally provides that covered entities, such as banks, must make available to consumers, upon request, transaction data and other information concerning consumer financial products or services that the consumer obtains from the covered entity. Over the past several years, the Bureau has engaged in a series of rulemaking steps to prescribe standards for this requirement, including the release of a 71-page outline of proposals and alternatives in advance of convening a panel under the Small Business Regulatory Enforcement Fairness Act. The outline presents items under consideration that “would specify rules requiring certain covered persons that are data providers to make consumer financial information available to a consumer directly and to those third parties the consumer authorizes to access such information on the consumer’s behalf, such as a data aggregator or data recipient (authorized third parties).” (Covered by InfoBytes here.)

While the Panel’s final report reflects its review of the Bureau’s proposals and the feedback received from small entity representatives that likely would be subject to the rule, it may not reflect updated findings uncovered during the process of producing a notice of proposed rulemaking because the report is drafted at the preliminary stage of the Bureau’s required rulemaking process.

The report includes an overview of proposals and alternatives under consideration for the use of two existing definitions to establish data provider coverage: “financial institution” as defined by Regulation E (i.e. “depository and nondepository financial institutions that provide consumer funds-holding accounts or that otherwise meet the Regulation E definition of financial institution”), and “card issuer” as defined by Regulation Z (i.e. “depository and nondepository institutions that provide credit cards or otherwise meet the Regulation Z definition of card issuer”). Entities that meet the definition of a “card issuer” would include both the person that issues a credit card and the person’s agents with respect to the card.

The report analyzes numerous topics, including proposals covering asset accounts and credit card accounts, potential exemptions for certain covered data providers, the process for making information available to consumers and to third parties (including third-party commitments to data security, data accuracy and limitations, and disclosure compliance), record retention obligations, and the potential impact on small entities. The report includes a thorough breakdown of panel findings and recommendations.

Federal Issues CFPB Consumer Finance Section 1033 Dodd-Frank SBREFA Agency Rule-Making & Guidance

CFPB finalizes Section 1071 rule on small business lending data

On March 30, the CFPB released its final rule implementing Section 1071 of the Dodd-Frank Act. Consistent with Section 1071, the final rule will require financial institutions to collect and provide to the Bureau data on lending to small businesses, defined as an entity with gross revenue under $5 million in its last fiscal year, which the Bureau will ultimately publish. (See also an executive summary here.) 

As explained in a corresponding fact sheet, the final rule is intended to foster transparency and accountability by requiring financial institutions—both traditional banks and credit unions, as well as non-banks—to collect and disclose data about small business loan recipients’ race, ethnicity, and gender, as well as geographic information, lending decisions, and credit pricing. The credit application information will be compiled in a comprehensive, publicly available database to help policymakers, borrowers, and lenders better address economic development needs and adapt to future challenges. The final rule also contains a sample data collection form that lenders can, but are not required to, use to collect applicants’ demographic data, and while small businesses are given the option not to provide this information, lenders must not discourage applicants from supplying this data (as explained in more detail in an accompanying policy statement). The Bureau also released a report detailing user testing research used to learn about lenders’ likely experience in filling out the sample data collection form, as well as a report describing the agency’s methodology for estimating how many lenders will be required to report under the final rule and for producing cost estimates associated with implementing the final rule.

The final rule contains important changes from the proposed rule issued in September 2021 (covered by a Special Alert here). Explaining that these changes are designed to make the final rule more effective and easier to follow, the Bureau stated that larger lenders will be required to collect and report data earlier than small lenders. The reporting requirements begin once a lender originates at least 100 covered small business loans in each of the two prior calendar years—a threshold that “accounts for more than 95 percent of small-business loans by banks and credit unions,” the Bureau said in its press release, noting that it was raised from the originally proposed 25-loans-per-year threshold.

While the final rule is effective 90 days after publication in the Federal Register, lenders will follow a tiered compliance date structure:

• Lenders that originate at least 2,500 covered small business loans in both 2022 and 2023, must begin collecting data on October 1, 2024.
• Lenders that originate at least 500 covered small business loans in both 2022 and 2023, must begin collecting data on April 1, 2025.
• Lenders that originate at least 100 covered small business loans in both 2022 and 2023 must begin collecting data on January 1, 2026.
• Lenders that did not originate at least 100 covered small business loans in both 2022 and 2023, but subsequently originated at least 100 transactions in two consecutive calendar years may begin collecting data no earlier than January 1, 2026.
• Lenders that originate between 100 and 500 small business loans in both 2024 and 2025, must begin collecting data on January 1, 2026.

Other changes from the proposal include allowing applicants to self-identify demographic information, including race and ethnicity, rather than requiring loan officers to make the determination. The final rule also now includes an exclusion for mortgage loans that must be reported under HMDA, and suggests that under the federal regulators’ forthcoming Community Reinvestment Act (CRA) reporting requirements, data submitted under the Bureau’s final rule will satisfy relevant CRA requirements. Additionally, financial institutions and other third parties will be allowed to develop services and technologies to assist lenders with collecting and reporting data. The Bureau noted that it is working on a supplementary proposal that would, if finalized, give more compliance time for small lenders that are already successful in meeting the needs of the local communities they serve.

CFPB Director Rohit Chopra commented that the final rule’s impact “will be in the comprehensive data that it produces, which can be used by lenders, borrowers, and the broader public to achieve better credit outcomes for small businesses and communities across the country.”

Agency Rule-Making & Guidance Federal Issues CFPB Small Business Lending Section 1071 Dodd-Frank