InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Louisiana proposes virtual currency business licensing rules
On June 20, the Louisiana Office of Financial Institutions (OFI) published proposed rules in the Louisiana Register to implement the Louisiana Virtual Currency Business Act (VCBA), which governs the licensing process for businesses or individuals who are currently operating, or intend to soon begin operating, a virtual currency business in the state. As previously covered by InfoBytes, the Act (HB 701), which took effect August 1, 2020, provides for the licensing and regulation of virtual currency businesses in the state. Subject to certain exceptions, the bill establishes licensing and registration requirements, and, among other things, (i) authorizes reciprocity of licensure with other states; (ii) specifies that licensee applications must be submitted through the Nationwide Multi-State Licensing System; (iii) adds provisions related to licensee examinations; (iv) outlines licensee surety bond requirements “based on the nature and extent of risks in the applicant’s virtual currency business model”; (v) provides the state’s office of financial institutions with enforcement authority; and (vi) prohibits licensees from engaging in unfair, deceptive, or fraudulent practices.
The proposed rules are intended to enable OFI to achieve its regulatory goals and supervision and oversight of such persons included within the scope of the VCBA in an efficient, effective manner. OFI also proposes to implement a fee structure to cover regulatory and supervisory costs in order for the agency to effectively ensure compliance with the VCBA, and allow for licensure and registration of covered persons. Among other things, the proposed rules:
- Outline various definitions, including terms related to control, net worth, unfair or deceptive acts or practices, and unfair or unsound acts or practices.
- Describe processes for the approval of a control person or approval of a change in control; licensing renewal or registration notice; determination of net worth; examination and investigation procedures; and requirements for reporting, recordkeeping, and implementation of policies and procedures.
- Stipulate that “failure to provide any disclosure or disclosures required by Subsection 1931(C) of this rule shall be an unfair or deceptive act or practice for purposes of taking enforcement action against a licensee, registrant, or person that is neither a licensee nor registrant but is engaging in virtual currency business activity or activities.” While the proposed rules do not specifically identify the required disclosures, they state that the “commissioner shall also determine, by policy, the time and form required for such disclosures. Disclosures required by this section must be made separately from any other information provided by the licensee to a person and in a clear and conspicuous manner. A licensee may propose, for the commissioner’s approval, alternate disclosures as deemed more appropriate for its virtual currency business activity with, or on behalf of, persons in Louisiana.”
- Clarify that an unsafe or unsound act or practice includes engaging in an activity “which creates the likelihood of material loss, insolvency, dissipation of the licensee’s or registrant’s assets, materially prejudices the interests of its customers, and any other set of facts and circumstances, as determined by the commissioner in his discretion.”
- Allow the commissioner to assess a civil penalty for violations of the VCBA (or any rule promulgated pursuant to the VCBA or an commissioner-issued orders) not to exceed $1,000 for each violation.
The proposed rules provide that “[n]oncompliance with any provisions of the VCBA, including but not limited to any provisions pertaining to ownership, control, security, net worth, registration, or failure to pay any fee may likewise be considered in determining whether to deny issuance or renewal of a license or notice of registration.” Once the rules are implemented, any person already engaged in virtual currency business activity or activities in the state must either apply for a license or file a notice of registration, and submit a completed application within 90 days of the effective date. Persons engaged in virtual currency business activity that fail to submit a completed licensing application or notice of registration within 90 days of the effective date of the rules shall be deemed to be conducting unlicensed or unregistered virtual currency business activity or activities and will be subject to civil and criminal penalties. Starting November 1, 2023, “all applications for renewal for all licenses and notices of registration to engage in virtual currency business activities shall begin submitting an application or notice of registration for renewal on the first day of November of each calendar year.”
Comments on the proposed rules are due July 10.
Halperin discusses invoking UDAAP under CFPA
On June 29, the American University Washington College of Law held a symposium centered in part around the CFPB’s new approach for examining institutions for unfair conduct. During the CFPB’s New Approach to Discrimination: Invoking UDAAP symposium, CFPB Assistant Director for the Office of Enforcement Eric Halperin answered questions related to updates recently made to the Bureau’s Unfair, Deceptive, or Abusive Acts or Practices Examination Manual. These updates detail the agency’s view that its broad authority under UDAAP allows it to address discriminatory conduct in the offering of any financial product or service as an unfair act or practice. (Covered by a Buckley Special Alert here.) The Bureau published a separate blog post by its enforcement and supervision heads explaining that they were “cracking down on discrimination in the financial sector,” and that the new procedures would guide examiners to look “beyond discrimination directly connected to fair lending laws” and “to review any policies or practices that exclude individuals from products and services, or offer products or services with different terms, in an unfairly discriminatory manner.”
Assistant Director Halperin’s remarks were followed by a discussion of the Bureau’s revisions to its Examination Manual by a panel that consisted of David Silberman of the Center for Responsible Lending, Kitty Ryan of the American Bankers Association, and John Coleman of Buckley LLP, which was moderated by Jerry Buckley. Topics covered included a June 28 letter that trade associations sent to the CFPB urging recission of revisions to the Examination Manual.
In his interview with American University Law School Professor V. Gerard Comizio, Halperin stated that the CFPB’s Examination Manual updates provide guidance on how examiners will implement the Bureau’s statutory authority to examine whether an act or practice is unfair because it may cause or is likely to cause substantial injury to consumers that is not reasonably avoidable and not outweighed by countervailing benefits to consumers or competition. He stressed that the update does not create a new legal standard under the three prongs of the unfairness standard. Halperin also discussed how the Bureau’s UDAAP authority interacts with laws enacted specifically to prevent discriminatory conduct such as ECOA and the Fair Housing Act, and touched on steps institutions should consider taking to ensure compliance. Notably, when asked whether the Bureau intends to pursue disparate impact claims under the CFPA, Halperin stated that disparate impact, along with disparate treatment, are wholly distinct concepts from Dodd-Frank’s prohibition on unfair acts and practices. He added that in assessing an unfair act and practice, the key is to examine the substantial injury prong and then assess the reasonable avoidability and the countervailing benefits prongs. He further explained that the unfairness test does not contain an intentional standard and noted that there have been cases brought by both the FTC and the Bureau where there was injurious conduct that was not intentional or specifically known to the party engaging in this practice. According to Halperin, substantial injury alone is not sufficient to prove unfairness and using disparate impact as the mechanism of proof is not what the Bureau uses to prove an unfairness claim.
Halperin reiterated that the CFPB Examination Manual is designed to provide transparency to financial institutions about the types of issues that examiners will be inquiring about in furtherance of determining whether there has been an unfair act or practice under the current framework, and does not extend or create new law. In terms of practical compliance implications, Halperin said most financial institutions should already have robust UDAAP compliance systems in place and should already be looking for potential unfair acts or practices and examining patterns and group characteristics to identify the root cause of any issues, and to avoid substantial injury to consumers. With respect to a white paper recently sent to CFPB Director Rohit Chopra from several industry groups and the U.S Chamber of Commerce urging the Bureau to rescind the UDAAP exam manual (covered by InfoBytes here), Halperin commented that he has not had time to fully digest the white paper in detail but hoped that some of what was discussed during the symposium, particularly on the legal principles that will be used both in the exam manual and in any supervision and enforcement actions, clarifies that the Bureau is looking for conduct that violates the unfairness test.
CFPB warns debt collectors on “pay-to-pay” fees
On June 29, the CFPB issued an advisory opinion to state its interpretation that Section 808 of the FDCPA and Regulation F generally prohibit debt collectors from charging consumers “pay-to-pay” fees for making payments online or by phone. “These types of fees are often illegal,” the Bureau said, explaining that its “advisory opinion and accompanying analysis seek to stop these violations of law and assist consumers who are seeking to hold debt collectors accountable for illegal practices.”
These fees, commonly known as convenience fees, are prohibited in many circumstances under the FDCPA, the Bureau said. It pointed out that allowable fees are those authorized in the original underlying agreements that consumers have with their creditors, such as with credit card companies, or those that are affirmatively permitted by law. Moreover, the Bureau stressed that the fact that a law does not expressly prohibit the assessment of a fee does not mean a debt collector is authorized to charge a fee. Specifically, the advisory opinion interprets FDCPA Section 808(1) to permit collection of fee only if: (i) “the agreement creating the debt expressly permits the charge and some law does not prohibit it”; or (ii) “some law expressly permits the charge, even if the agreement creating the debt is silent.” Additionally, the Bureau’s “interpretation of the phrase ‘permitted by law’ applies to any ‘amount’ covered under section 808(1), including pay-to-pay fees.” The Bureau further added that while some courts have adopted a “separate agreement” interpretation of the law to allow collectors to assess certain pay-to-pay fees, the agency “declines to do so.”
The Bureau also opined that a debt collector is in violation of the FDCPA if it uses a third-party payment processor for which any of that fee is remitted back to the collector in the form of a kickback or commission. “Federal law generally forbids debt collectors from imposing extra fees not authorized by the original loan,” CFPB Director Rohit Chopra said. “Today’s advisory opinion shows that these fees are often illegal, and provides a roadmap on the fees that a debt collector can lawfully collect.”
As previously covered by InfoBytes, the Bureau finalized its Advisory Opinions Policy in 2020. Under the policy, entities seeking to comply with existing regulatory requirements are permitted to request an advisory opinion in the form of an interpretive rule from the Bureau (published in the Federal Register for increased transparency) to address areas of uncertainty.
CFPB says states may regulate credit reporting markets
On June 28, the CFPB issued an interpretive rule addressing states’ authority to pass consumer-reporting laws. Specifically, the Bureau clarified that states “retain broad authority to protect people from harm due to credit reporting issues,” and explained that state laws are generally not preempted unless they conflict with the FCRA or “fall within narrow preemption categories enumerated within the statute.” Under the FCRA, states have flexibility to enact laws involving consumer reporting that reflect challenges and risks affecting their local economies and residents and are able to enact protections against the abuse and misuse of data to mitigate these consequences.
Stating that the FCRA’s express preemption provisions have a narrow and targeted scope, the Bureau’s interpretive rule provided several examples such as (i) if a state law “were to forbid consumer reporting agencies [(CRA)] from including information about medical debt, evictions, arrest records, or rental arrears in a consumer report (or from including such information for a certain period of time), such a law would generally not be preempted; (ii) a state law that prohibits furnishers from furnishing such information to a CRA would generally not be prohibited; and (iii) if a state law requires a CRA to provide information required by the FCRA at the consumer’s requests in a language other than English, such a law would generally not be preempted. The interpretive rule is effective upon publication in the Federal Register.
The issuance of the interpretive rule arises from a notice received by the Bureau from the New Jersey attorney general concerning pending litigation that involves an argument that the FCRA preempted a state consumer protection statute. The Bureau stated that it “will continue to consider other steps to promote state enforcement of fair credit reporting along with other parts of federal consumer financial protection law,” including “consulting with states whenever interpretation of federal consumer financial protection law is relevant to a state regulatory or law enforcement matter, consistent with the State Official Notification Rule." As previously covered by InfoBytes, the Bureau issued an interpretive rule last month, clarifying states’ authority to bring enforcement actions for violations of federal consumer financial protection laws, including the CFPA.
Fed to implement new Fedwire message format in March 2025
On June 27, the Federal Reserve Board announced the final timeline and implementation details for the adoption of the International Organization for Standardization’s (ISO) 20022 message format for its Fedwire Funds Service—a real-time gross settlement system owned and operated by the Federal Reserve Banks that enables businesses and financial institutions to quickly and securely transfer funds. (See notice here.) The final details are “broadly similar” to the Fed’s proposal issued last October (covered by InfoBytes here). The Fed confirmed that ISO 20022 will be adopted on a single day as previously proposed instead of in three separate phases. Additionally, the Fed extended the implementation timeframe from a target date of November 2023 to March 10, 2025, based on comments received in response to the initial proposal. The Fed also provided information concerning its revised testing strategy and backout strategy, as well as other details concerning the implementation of the new message format.
DFPI seeks to regulate commercial financial products and services under the CCFPL
Recently, the California Department of Financial Protection and Innovation (DFPI) issued a notice of proposed rulemaking (NPRM) to adopt regulations to implement certain sections of the California Consumer Financial Protection Law (CCFPL) related to commercial financial products and services. (See also text of the proposed regulations here.) As previously covered by a Buckley Special Alert, the CCFPL became law in 2020 and, among other things, (i) establishes UDAAP authority for the DFPI; (ii) authorizes the DFPI to impose penalties of $2,500 for “each act or omission” in violation of the law without a showing that the violation was willful (thus going beyond both Dodd-Frank and existing California law); (iii) provides the DFPI with broad discretion to determine what constitutes a “financial product or service” within the law’s coverage; and (iv) provides that enforcement of the CCFPL will be funded through the fees generated by the new registration process as well as fines, penalties, settlements, or judgments. While the CCFPL exempts certain entities (e.g., banks, credit unions, certain licensees), the law expands the DFPI’s oversight authority to include debt collection, debt settlement, credit repair, check cashing, rent-to-own contracts, retail sales financing, consumer credit reporting, and lead generation.
The NPRM proposes new rules to implement sections 22159, 22800, 22804, 90005, 90009, 90012, and 90015 of the CCFPL related to the offering and provision of commercial financing and other financial products and services to small businesses, nonprofits, and family farms. According to DFPI’s notice, section 22800 subdivision (d) authorizes the Department to define unfair, deceptive, and abusive acts and practices in connection with the offering or provision of commercial financing. Section 90009, subdivision (e), among other things, authorizes the Department’s rulemaking to include data collection and reporting on the provision of commercial financing or other financial products and services.
Among other things, the NPRM:
- Clarifies that the CCFPL makes it unlawful for covered providers, as defined, to engage in unfair, deceptive, or abusive acts or practices;
- Provides standards for determining whether an act or practice is unfair, deceptive, or abusive;
- Defines small business, nonprofit, and family farm, among other terms;
- Clarifies DFPI's ability to enforce the regulation’s provisions;
- Requires covered providers to submit annual reports containing information about their provision of commercial financing or other financial products and services to small businesses, nonprofits, and family farms;
- Identifies persons excluded from the reporting requirement;
- Specifies the information required in the reports, as well as provide guidance on calculating or determining certain information;
- Clarifies the obligations of those also submitting annual reports to DFPI as licensees under the California Financing Law.
Written comments on the NPRM are due by August 8.
FTC seeks to ban auto lending “junk fees” and “bait-and-switch tactics”
On June 23, the FTC issued a notice of proposed rulemaking (NPRM) to ban “junk fees” and “bait-and-switch” advertising tactics related to the sale, financing, and leasing of motor vehicles by dealers. Specifically, the NPRM would prohibit dealers from making deceptive advertising claims to entice prospective car buyers. According to the FTC’s announcement, deceptive claims could “include the cost of a vehicle or the terms of financing, the cost of any add-on products or services, whether financing terms are for a lease, the availability of any discounts or rebates, the actual availability of the vehicles being advertised, and whether a financing deal has been finalized, among other areas.” The NPRM would also (i) prohibit dealers from charging junk fees for “fraudulent add-on products” and services that—according to the FTC—do not benefit the consumer; (ii) require clear, written, and informed consent (including the price of the car without any optional add-ons); and (iii) require dealers to provide full, upfront disclosure of costs and conditions, including the true “offering price” (the full price for a vehicle minus only taxes and government fees), as well as any optional add-on fees and key financing terms. Dealers would also be required to maintain records of advertisements and customer transactions. Comments on the NPRM are due 60 days after publication in the Federal Register.
The FTC noted that in the past 10 years, the Commission has brought more than 50 auto-related enforcement actions and helped lead two nationwide law enforcement sweeps including 181 state-level enforcement actions in this space. Despite these efforts, the FTC reported that automobile-related consumer complaints are among the top ten complaint types submitted to the Commission.
CFPB to look at late fees on cards
On June 22, the CFPB issued an Advance Notice of Proposed Rulemaking (ANPRM) soliciting information from credit card issuers, consumer groups, and the public regarding credit card late fees and late payments, and card issuers’ revenue and expenses. Under the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act) rules inherited by the CFPB from the Federal Reserve, credit card late fees must be “reasonable and proportional” to the costs incurred by the issuer as a result of a late payment. However, the rules provide for a safe harbor limit that allows banks to charge certain fees, adjusted for inflation, regardless of the costs incurred. Calling the current credit card late fees “excessive,” the Bureau stated it intends to review the “immunity provision” to understand how banks that rely on this safe harbor set their fees and to examine whether banks are escaping enforcement scrutiny “if they set fees at a particular level, even if the fees were not necessary to deter a late payment and generated excess profits.”
In 2010, the Federal Reserve Board approved implementing regulations for the CARD Act that allowed credit card issuers to charge a maximum late fee, plus an additional fee for each late payment within the next six billing cycles (subject to an annual inflation adjustment). As the CFPB reported, the safe harbor limits are currently set at $30 and $41 respectively. The CFPB pointed out that in 2020, credit card companies charged $12 billion in late fee penalties. “Credit card late fees are big revenue generators for card issuers. We want to know how the card issuers determine these fees and whether existing rules are undermining the reforms enacted by Congress over a decade ago,” CFPB Director Rohit Chopra said. Chopra issued a separate statement on the same day discussing the current credit card market, questioning whether it is appropriate for card issuers to receive enforcement immunity if they hike the cost of credit card late fees each year by the rate of inflation. “Do the costs to process late payments really increase with inflation? Or is it more reasonable to expect that costs are going down with further advancements in technology every year?” he asked.
Among other things, the ANPRM requests information relevant to certain CARD Act and Regulation Z provisions related to credit card late fees to “determine whether adjustments are needed.” The CFPB’s areas of inquiry include: (i) factors used by card issuers to determine late fee amounts and how the fee relates to the statement balance; (ii) whether revenue goals play a role in card issuers’ determination of late fees; (iii) what the costs and losses associated with late payments are for card issuers; (iv) the deterrent effects of late fees and whether other consequences are imposed when payments are late; (v) methods used by card issuers to facilitate or encourage timely payments such as autopay and notifications; (vi) how late are most cardholders’ late payments; and (vii) card issuers’ annual revenue and expenses related to their domestic consumer credit card operations. The Bureau stated that public input will inform revisions to Regulation Z, which implements the CARD Act and TILA. Comments on the ANPRM are due July 22.
The ANPRM follows a June 17 Bureau blog post announcing the agency’s intention to review a “host of rules” inherited from other agencies such as the FTC and the Federal Reserve, including the CARD Act. (Covered by InfoBytes here.)
CFPB issues final rule re: credit reporting on human trafficking victims
On June 23, the CFPB issued a final rule implementing amendments to the FCRA intended to assist victims of human trafficking. According to the Bureau’s announcement, the final rule prohibits credit reporting agencies (CRAs) from providing reports containing any adverse items of information resulting from human trafficking. The final rule amends Regulation V to implement changes to the FCRA enacted in December 2021 in the “Debt Bondage Repair Act,” which was included within the National Defense Authorization Act for Fiscal Year 2022. (Covered by InfoBytes here.)
Among other things, the final rule establishes methods available for trafficking victims to submit documentation to CRAs establishing that they are a survivor of trafficking (including “determinations made by a wide range of entities, self-attestations signed or certified by certain government entities or their delegates, and documents filed in a court where a central issue is whether the person is a victim of trafficking”). The final rule also requires CRAs to block adverse information in consumer reports after receiving such documentation and ensure survivors’ credit information is reported fairly. CRAs will have four business days to block adverse information once it is reported and 25 business days to make a final determination as to the completeness of the documentation. All CRAs, regardless of reach or scope, must comply with the final rule, including both nationwide credit reporting companies and specialty credit reporting companies.
The final rule takes July 25.
FinCEN issues statement on independent ATM customer due diligence
On June 22, FinCEN issued a statement providing clarity to banks on the application of a risk-based approach to conducting customer due diligence (CDD) on independent Automated Teller Machine (ATM) owners or operators, consistent with FinCEN’s 2016 CDD Rule. As previously covered by InfoBytes, FinCEN issued a final rule imposing standardized CDD requirements for banks, broker-dealers, mutual funds, futures commission’s merchants, and brokers in commodities in May 2016. The rule established that covered institutions must identify any natural person that owns, directly or indirectly, 25 percent or more of a legal entity customer or that exercises control over the entity. The rule also established ongoing monitoring for reporting suspicious transactions and, on a risk basis, updating customer information. The recently released statement explained that the level of money laundering and terrorism financing risk varies with these customers, and that they do not automatically present a higher level of risk. FinCEN pointed to certain customer information that may be useful for banks in making determinations on the risk profile of independent ATM owner or operator customers, including, among other things: (i) organizational structure and management; (ii) operating policies, procedures, and internal controls; (iii) currency servicing arrangements; (iv) source of funds if a bank account is not used to replenish the ATM; and (v) description of expected and actual ATM activity levels.