The Consumer Finance Protection Bureau ("CFPB") announced that it will examine nonbank financial companies that pose risks to consumers, using statutory authority that until now had gone unused. Additional examinations would fill a gap in the number and type of entities it currently subjects to periodic structured scrutiny, as many nonbank financial services providers are only scrutinized for compliance with federal financial law in the event of an investigation or as recipient of a market information inquiry. The Bureau also is adding a mechanism to its rules to make final decisions and orders in its nonbank risk-determination proceedings public.
Expansion of Nonbank Supervision and Examination Based on Risk
The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 ("Dodd-Frank Act") provides the CFPB with broad authority to regulate consumer financial practices, but the Bureau had previously supervised and examined only a limited number of nonbanks based on market categories and their status as larger participants, and had not utilized its authority to examine nonbanks that pose a risk. According to CFPB Director Rohit Chopra, "This authority gives us critical agility to move as quickly as the market, allowing us to conduct examinations of financial companies posing risks to consumers and stop harm before it spreads."
FinTechs, or nonbank financial companies operating in consumer financial markets without a bank, thrift, or credit union charter, were specifically called out as the types of companies the CFPB is seeking to exercise supervisory authority over. Other categories of companies that could be impacted include payment systems providers, buy now, pay later providers, medical debt collectors, debt relief services providers, lead generators, and others, which have previously not fallen under the scope of the Bureau's supervision and examination program.
The Bureau intends to base its reasonable consumer risk-determinations on information gathered from a variety of sources, including complaints collected by the Bureau, judicial and administrative decisions, whistleblowers, state and federal partners, and news reports, among other potential sources.
The Dodd-Frank Act authorizes the Bureau to examine nonbanks in the mortgage, private student loan, and payday loan industries. Second, the Bureau examines "larger participants" in the markets of consumer reporting, debt collection, student loan servicing, international remittances, and auto loan servicing. Although the authorization has not been exercised, the Bureau also may examine a nonbank that "the Bureau has reasonable cause to determine, by order," after a notice and comment period, "is engaging, or has engaged, in conduct that poses risk to consumers with regard to the offering or provision of consumer financial products or services." See 12 U.S.C. 5514(a)(1)(C).
New Confidentiality Rules for Risk-Determination Procedures Open for Comment
The CFPB also announced it is updating its nonbank risk-determination. Specifically, the Bureau is adding a mechanism allowing it to make final decisions and orders in these proceedings public. Of note:
- The Bureau issued a procedural rule in 2013 to govern risk-determination of nonbank proceedings.
- Section 1091.115(c) of the existing rule provides, in summary, that documents, records, or other items in connection with a proceeding under part 1091 shall be deemed confidential supervisory information.
- The CFPB would now add a new § 1091.115(c)(2), which provides an exception regarding final decisions and orders by the Director.
- The process established in § 1091.115(c)(2) is as follows: Within seven days of service of the decision or order, the respondent has the option of filing a submission on this issue, and the Director will then determine whether the decision or order will be released on the Bureau's website, in whole or in part.
An important takeaway from the proposed rulemaking is that the CFPB's risk-determination orders may be posted to the CFPB's website for the public to see, which could result in negative publicity for the company subject to that order. This procedural rule became effective on April 29, 2022, when it was published in the Federal Register. The CFPB will accept comments on or before May 31, 2022.
Next Steps for Impacted Nonbanks
In anticipation of the CFPB's issuing such orders, FinTechs and other nonbank financial services providers should take steps to validate their compliance management systems and compliance with federal consumer financial law. As we discussed in our article on CFPB examinations, companies should prepare for an examination by "investing time and resources in a robust compliance management system that is tailored to the company's business activities, size, and regulatory requirements." The system should — most importantly — account for consumer protection issues. Once in place, companies should consider conducting a "mock exam" that performs a detailed internal review of internal compliance operations to identify areas of potential weakness before the CFPB conducts a formal exam.
* * * * *
Related Articles
What to Know about CFPB Supervision and Examination
Navigating CFPB Examinations: Best Practices for Success
How to Prepare for and Survive a CFPB Examination
The CFPB's Examination Playbook Revealed
What to Know about CFPB Supervision and Examination
What to Expect When You're Under a CFPB Investigation – Negotiating the Scope of the CID
CFPB Enforcement Settlement Principles Revealed
CFPB Supervision and Enforcement: Thinking About Overlap
CFPB Warns of Service Provider Scrutiny