Last Week, This Morning

April 22, 2024

Happy Earth Day! (It beats Tax Day.) Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an “Amicus Brief(ly)1” comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters – CARLAW®, HouseLaw®, InstallmentLaw™, PrivacyLaw®, and BizFinLaw™ – provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

CFPB Updates Supervision Designation Procedures for Nonbanks Posing Risks

On April 16, the Consumer Financial Protection Bureau issued a rule to update its procedures for designating nonbank covered persons for supervision. Section 1024(a)(1)(C) of the Consumer Financial Protection Act authorizes the CFPB to supervise a nonbank covered person that it “has reasonable cause to determine ... is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” In 2013, the CFPB issued a procedural rule to govern supervisory designation proceedings. After years of largely not using this authority, the CFPB issued an amended procedural rule in 2022 and established a process to publicize the director’s final decisions and orders. In February 2024, the CFPB published its first decision and order where the nonbank subject contested the CFPB’s supervision, and now the CFPB seeks to update its procedures through a new procedural rule.

The new procedural rule clarifies that an agreement consenting to the CFPB’s supervision does not constitute an admission by the respondent and is not subject to the public release process. Orders issued because a respondent failed to file a response or has defaulted in the process are subject to public release, however. If a respondent consented to supervision under the 2022 procedural rule, the term was limited to a two-year period of supervision. Under the new procedural rule, the notice of reasonable cause will continue to include a proposed consent agreement, but instead of a two-year supervision period, the duration of the supervision will be on a case-by-case basis. The CFPB noted that it still expects most of the consent agreements to create a two-year period of supervision.

According to supplementary information to the rule, in February 2024, the CFPB began a transition to a new organizational structure for its supervision and enforcement work. Specifically, the functions of the Associate Director of the Division of Supervision, Enforcement, and Fair Lending (“SEFL”) are being transferred to the Supervision Director as head of a Division of Supervision and the Enforcement Director as head of a Division of Enforcement. Although not yet on the CFPB’s website, it appears that the SEFL Division is being discontinued and that Enforcement and Supervision will now be their own divisions and report directly to the CFPB Director. In light of this restructuring, the procedural rule transfers certain functions to the Supervision Director. The CFPB is hopeful that this new structure will streamline the internal decision-making process.

The procedural rule allows the initiating official to withdraw a notice of reasonable cause and request supplemental briefing. It also imposes word limits for the notice, response, and certain key filings.

The procedural rule is effective upon its Federal Register publication and applies to all proceedings issued on or after that date. It also applies to proceedings that are pending, unless the director determines that it is not just or practicable. Although the procedural rule is exempt from the notice-and-comment requirements, the CFPB is accepting comments on the rule.

Amicus brief(ly): It feels like it is ok to be apprehensive about this development. Having been around the block a few times, we feel pretty certain that the nonbank companies consenting to supervision are not sighing in relief to have a new supervising federal regulator (for two years or otherwise) in the CFPB. But we are where we are – the statutory authority for the CFPB to do this is in place, and the CFPB is acting on it. All the more reason for nonbanks to focus on regulatory compliance and tend to those compliance management systems.
Kansas Will Require Commercial Financing Transaction Disclosures

Kansas Governor Laura Kelly recently signed Senate Bill 345, which establishes commercial financing disclosure requirements. The new law will take effect on July 1, 2024, and will apply to commercial financing transactions of $500,000 or less. The law defines "commercial financing transactions" to include sales-based financing, factoring, and commercial loan transactions.

The new law will require a provider of commercial financing to give the following disclosures with each commercial financing:

  • the total amount of funds provided to the business under the terms of the commercial financing transaction;
  • the total amount of funds disbursed under the terms of the commercial financing transaction if less than the total amount of funds provided;
  • the total amount to be paid to the provider pursuant to the commercial financing transaction agreement;
  • the total dollar cost of the commercial financing transaction, which is determined by subtracting the total amount of funds provided from the total amount to be paid to the provider;
  • the manner, frequency, and amount of each payment; and
  • a statement of whether there are any costs or discounts associated with prepayment of the commercial financing transaction, including a reference to the paragraph in the commercial financing transaction agreement that creates the contractual right to prepayment.

Notably, the required disclosures do not include an annual percentage rate.

The new law will also prohibit a broker from charging an advance fee or making any false or misleading statements in its brokering activities.

The new law does not apply to banks, credit unions, real property-secured or purchase-money (any collateral) transactions, or leases. The law also does not apply to a company that makes five or fewer commercial financing transactions in Kansas during a 12-month period.

A company that violates the new law is subject to a civil penalty of up to $500 per violation and $20,000 for all aggregated violations. The maximum penalties increase to $1,000 per violation and $50,000 for all aggregated violations if the violations occur after the Kansas attorney general has notified the company of a previous violation. The AG has exclusive authority to enforce the law. The new law creates no private right of action against any person for failure to comply.

Amicus brief(ly): This bill is just another in a growing line of states more actively regulating commercial financing transactions. Fortunately, Kansas omits the APR disclosure that is so complicated (and misplaced?) in California. And it omits the private right of action in favor of AG enforcement, hopefully avoiding the kinds of technical claims plaintiffs’ lawyers look to bring even in the absence of harm. The de minimis number of transactions exemption, the $500,000 transaction limit (beyond which the new law does not apply), and the other exclusions from scope make this Kansas law appear pretty rational. Providers in this space should note the compliance requirements in advance of the July 1 effective date, which should not be a big lift for providers already doing business in California, New York, and other states with similar laws.
Massachusetts AG Issues Advisory on Applicability of State’s Consumer Protection, Anti-Discrimination, and Data Security Laws to Artificial Intelligence

On April 16, the Massachusetts Office of the Attorney General issued an advisory to provide guidance to developers, suppliers, and users of artificial intelligence and algorithmic decision-making systems (collectively, “AI”) about their respective obligations under the Massachusetts Consumer Protection Act, G.L. c. 93A, § 2, and the regulations promulgated in 940 Code Mass. Regs. 3.00 et seq. and 940 Code Mass. Regs. 5.00 et seq, the Massachusetts Anti-Discrimination Law, G.L. c. 151B, § 4, and the Data Security Law, G.L. c. 93H, and implementing regulations, 201 Code Mass. Regs. 17.00 et seq.

The advisory states that the following acts or practices, among others, are unfair or deceptive under the MCPA:

  • falsely advertising the quality, value, or usability of AI systems;
  • supplying an AI system that is defective, unusable, or impractical for the purpose advertised;
  • misrepresenting the reliability, manner of performance, safety, or condition of an AI system;
  • offering for sale or use an AI system in breach of warranty, in that the system is not fit for the ordinary purposes for which such systems are used or that the system is not fit for the specific purpose for which it is sold where the supplier knows of such purpose;
  • misrepresenting audio or video content of a person for the purpose of deceiving another to engage in a business transaction or supply personal information as in the case of deepfakes, voice cloning, or chatbots used to engage in fraud; and
  • failing to comply with Massachusetts statutes, rules, regulations, or laws meant for the protection of the public’s health, safety, or welfare.

The advisory also notes that the state’s anti-discrimination laws prohibit AI developers, suppliers, and users from using technology that discriminates against individuals based on a legally protected characteristic, such as technology that relies on discriminatory inputs and/or produces discriminatory results that would violate the state’s civil rights laws. The advisory also clarifies that AI developers, suppliers, and users must take appropriate steps to safeguard personal data and comply with the state’s data breach notification requirements.

Amicus brief(ly): Massachusetts is very protective of its consumers. (Is that an understatement?) This advisory is almost a CFPB-esque preview of where the Massachusetts AG’s office sees a likelihood of UDAP claims based on the use of AI. It is helpful, and not surprising if the idea is to adhere to the CFPB’s guidance (warning?) documents, to see the AG note the UDAP examples and the data security concerns. Providers using AI in Massachusetts and elsewhere would do well to spend 10 minutes on this 4-page document just to make sure there are no potential UDAP claims in their offerings. The Massachusetts AG made it pretty easy to do that.
AFSA Releases First Consumer Credit Conditions Index

On April 18, the American Financial Services Association released its first Consumer Credit Conditions (C3) Index, a quarterly survey of senior executives of AFSA finance company members, including providers of mortgages, vehicle financing, personal installment loans, credit cards, and other products. Participants in the survey provide their views on several key business indicators, including how they see consumer lending evolving in the coming months. This first C3 Index survey was conducted between March 27 and April 8, 2024. The survey’s results show conditions facing consumer lenders deteriorated on balance in the first quarter of 2024 compared to the fourth quarter of 2023. However, nearly 34% of lenders expect improved consumer credit conditions in the next six months.

Amicus brief(ly): We are grateful to AFSA for compiling this survey with valuable insight into the broader market conditions over the first quarter of this year. It is telling that only about a third of the lenders participating in the survey have optimism about improvements over the next six months (and 25% of those surveyed expect conditions to worsen over that period). But with interest rates still pretty high, inflation staying relatively steady notwithstanding those high rates, and reports about high levels of existing consumer debts, the lack of broader optimism is understandable. It stands to reason that some of those market pressures will have to ease before lenders see an improvement in loan demand, but we look forward to future C3 Index surveys to see if the forecast from those most directly involved in the lending market and impacted by these market conditions improves.
CFPB Imposes Ban from Consumer Lending Activities and $164,000 Penalty on For-Profit Vocational School and Its Founder for Hiding Loan Costs from Students

On April 17, the Consumer Financial Protection Bureau entered into a consent order with a for-profit vocational school that offered coding programs using income-share agreements as tuition financing options. Unlike conventional student loans, ISAs are products under which students defer their tuition payments by agreeing to pay the provider a predetermined share of their future income. Under most of the ISAs, students who earn more than $50,000 post-graduation must pay the school 17 percent of their pre-tax income each month until they make 24 payments or hit a cap of $30,000 in total payments, which was often $10,000 more than the sticker price of tuition.

The CFPB found that the school and its founder engaged in deceptive practices, in violation of the Consumer Financial Protection Act, by misleading students into believing the ISAs were not loans, did not create debt, had no finance charge, and were risk-free. The school advertised on its website “No loans, no debt” and claimed students could “skip student debt” and “Graduate Risk-Free.” In fact, the CFPB found that the ISAs had an average finance charge of $4,000 and carried substantial risk in that a single missed payment triggered a default and the remainder of the $30,000 cap coming due immediately.

The CFPB also found that the school and its founder engaged in abusive practices, in violation of the CFPA, by representing to students that their interests were aligned in that respondents would only make money if students did. The CFPB claimed that the respondents knew that students were rarely placed into high-paying jobs, and the respondents pursued a business strategy of enrolling more students each month and placing less than half of them into qualifying jobs.

Finally, the CFPB found that the school and its founder violated the Truth in Lending Act and Regulation Z by failing to disclose the amount financed, finance charge, and annual percentage rate of the ISAs and violated the Holder Rule by failing to include a provision in its ISAs making any holder of the agreement subject to the legal claims that students could assert.

The school and its founder neither admitted nor denied the allegations. To resolve the matter, they agreed to rescind the ISAs of certain affected consumers, instruct their servicers to cap repayments at the upfront cost of tuition, and return finance charges made by those consumers after the order’s effective date. The respondents also agreed to offer currently enrolled students the option to withdraw from the program and rescind their ISAs. Further, the school will pay a civil penalty of $100,000 and the founder a civil penalty of $64,235. The order permanently bans the school from all consumer lending activities and bans the founder from such activities for 10 years.

Amicus brief(ly): The CFPB telegraphed its distaste for ISA products (and, notably, referred to them as something other than loans) several years ago, so this consent order is consistent with the Bureau’s prior statements on those products. Even if this was the first CFPB action on ISAs, its position that they are disguised loans is entirely predictable. The Truth in Lending Act and other claims become pretty clear once the CFPB takes the position that ISAs are loans, and the draconian penalties in this action just underscore how negatively the CFPB views this product when providers distinguish it from a loan.

1 For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.