Last Week, This Morning

March 11, 2024

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an “Amicus Brief(ly)¹” comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters – CARLAW®, HouseLaw®, InstallmentLaw™, PrivacyLaw®, and BizFinLaw™ – provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On March 5, New York State Attorney General Letitia James sued more than 30 companies and individuals for operating an alleged predatory lending scheme by making fraudulent loans to small businesses disguised as merchant cash advances. According to the AG’s press release announcing the suit, the defendants provided merchants with contracts that described each transaction as a purchase of a portion of a merchant’s future revenues, with flexible payment amounts and open-ended terms. In fact, however, the AG alleged that the defendants debited fixed amounts from the merchants’ bank accounts daily over short repayment terms. The AG claimed that the defendants promised to reconcile the daily payments to ensure that they never exceeded a set percentage of the merchants’ receipts, but the defendants used fraudulent measures to ensure that merchants almost never qualified for refunds. According to the AG, instead of being MCAs, the transactions were fraudulent short-term loans with interest rates as high as 820% per year.

In the Verified Petition, which was filed in the Supreme Court of the State of New York, County of New York, and is almost 300 pages long, the AG is seeking at least $1.4 billion in interest and fraudulent fees that were collected from merchants, as well as a court order barring the defendants from continuing their illegal practices and a lifetime ban for Yellowstone’s founder from the MCA industry. The press release noted that, before filing this lawsuit, the AG reached settlements with five individuals involved in this scheme, which included payment of $3.37 million for impacted merchants and a ban from the MCA industry.

Amicus brief(ly): This impactful filing will test the MCA market. The reconciliation provisions in an MCA agreement are critical to distinguishing the product from a “loan,” as are servicing practices that execute those reconciliation provisions as prescribed by the agreement. This may be the biggest recharacterization case since the advent of the MCA industry for small business finance. MCA providers should watch with interest to see how well the AG’s arguments hold up in court and how the court distinguishes MCA agreements from the “loans” the New York AG claims they are.

On March 5, the Consumer Financial Protection Bureau announced that it finalized a rule to limit penalty fees on credit cards issued by so-called "Larger Card Issuers" (issuers that, together with their affiliates, have one million or more open credit card accounts). The new rule modifies Regulation Z and becomes effective 60 days after publication in the Federal Register.

Reg. Z prohibits card issuers from imposing fees for violating the terms or other requirements of a credit card account under an open-end (not home-secured) consumer credit plan, such as a fee for a late payment, unless the fee is proportionate to the card issuer's cost for the violation or complies with safe harbors set forth in Section 52 of Reg. Z. Section 52 currently sets a safe harbor of $30 generally for penalty fees, except that it sets forth a safe harbor of $41 for each subsequent violation of the same type that occurs during the same billing cycle or in one of the next six billing cycles.

The CFPB's final rule repeals the current late fee safe harbor dollar amount for Larger Card Issuers and adopts a late fee safe harbor amount of $8. The final rule also eliminates a Larger Card Issuer's ability to charge a higher late fee safe harbor amount for subsequent violations of the same type that occur during the same billing cycle or in one of the next six billing cycles. In addition, the provision in Reg. Z that provides for annual adjustments to the safe harbor dollar amounts to reflect changes in the Consumer Price Index will not apply to the $8 safe harbor amount for late fees.

The final rule does not affect "Smaller Card Issuers" (issuers that, together with their affiliates, had fewer than one million open credit card accounts for the entire preceding calendar year). For these card issuers, the rule clarifies that the safe harbors continue to apply and that the safe harbor amounts for violations are increased to $32 and to $43 for subsequent violations.

On March 7, the U.S. Chamber of Commerce, three bank trade groups in Texas, the American Bankers Association, and the Consumer Bankers Association sued the CFPB and its director, Rohit Chopra, in the U.S. District Court for the Northern District of Texas challenging the CFPB’s final rule.

Amicus brief(ly): It is rare for one arm of the federal government to sue another, but the response to the CFPB’s credit card late fee rule was swift and sure. The ink was barely dry on the final rule, which had not yet been published in the Federal Register, when the Chamber of Commerce, together with the banking trade groups filed suit only 48 hours later to try and overturn the rule. The 75% reduction in the safe harbor late fee is dramatic, but the $8 safe harbor is the only one we have right now. While watching to see how the Texas lawsuit evolves, banks who are “Larger Card Issuers” (and their servicers) should start to make the appropriate adjustments to the late fees in their servicing systems in advance of the effective date.

The Texas Finance Commission recently amended its rules relating to credit access businesses (“CABs”). Specifically, the new rules amend the requirements for filing a new CAB license application, the Office of Consumer Credit Commissioner’s denial of a CAB license application, the OCCC’s review of the criminal history of a CAB license applicant or licensee, and the model forms for the consumer cost disclosures used by CABs.

The Commission and the OCCC will allow a delayed implementation date of September 1, 2024, for all licensees to provide the amended versions of the cost disclosures. From the rule's effective date of March 7, 2024, through August 31, 2024, licensees may provide consumers with either the previous versions or the amended versions of the disclosures.

Amicus brief(ly): The biggest takeaway here for licensed credit access businesses in Texas is the update to the cost disclosure forms. The Texas OCCC makes those forms available on its website, and they are also embedded in the regulations on the Texas Secretary of State’s website (at 7 Tex. Admin. Code § 83.6007). With almost six months to adjust to the new forms, providers have time to adopt and test the forms before they become mandatory.

On March 6, New Hampshire Governor Chris Sununu signed Senate Bill 255, which enacts the state’s comprehensive consumer data privacy law. New Hampshire is the latest state to implement a comprehensive consumer data privacy law, following New Jersey, California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Tennessee, Texas, and Oregon. The new law is effective January 1, 2025.

The new law applies to persons that conduct business in New Hampshire or persons that produce products or services that are targeted to residents of New Hampshire that during a one-year period: (1) controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not less than 10,000 consumers and derived more than 25 percent of their gross revenue from the sale of personal data. Certain entities and certain information and data are not subject to the new law, including financial institutions and data subject to the federal Gramm-Leach-Bliley Act.

Under the new law, a consumer has the right to: (1) confirm whether or not a controller is processing the consumer's personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret; (2) correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (3) delete personal data provided by, or obtained about, the consumer; (4) obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret; and (5) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, except as otherwise provided for in the law, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

A New Hampshire consumer may designate an authorized agent to exercise the rights of such consumer to opt out of the processing of the consumer's personal data (and a parent or legal guardian may exercise such consumer rights on a child's behalf).

The new law also delineates the responsibilities of controllers and processors of consumers’ personal data and requires a controller to conduct and document a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer.

The attorney general has exclusive authority to enforce violations of the new law.

Amicus brief(ly): California really started something 6 years ago with its Consumer Privacy Act. New Hampshire adds to the growing list of states that empower consumers with a degree of control over the use of their personal data. The GLBA exemption from the New Hampshire law makes compliance a little simpler for financial institutions subject to the GLBA, but others with a multi-jurisdictional footprint should look to their Virginia privacy policies as a head-start for compliance with this New Hampshire law, because SB 255 borrows fairly heavily from the Virginia statute.

On March 7, the Washington state legislature passed Senate Bill 6025, titled "Predatory Loan Prevention Act." The PLPA amends the Washington Consumer Loan Act by incorporating an anti-evasion provision. The bill provides that "a person may not engage in any device, subterfuge, or pretense to evade the requirements of the [CLA] including, but not limited to:

• making loans disguised as personal property sale and leaseback transactions;
• disguising loan proceeds as a cash rebate for the pretextual installment sale of goods or services; or
• making, offering, assisting, or arranging a debtor to obtain a loan with a greater rate of interest, consideration, or charge than permitted by the [CLA] through any method, including mail, telephone, internet, or any electronic means regardless of whether the person has a physical location in the state."

The PLPA declares that an evasion of the permitted interest rate provisions under the CLA constitutes a violation of the CLA.

The PLPA purports to incorporate the predominant economic interest and the totality of the circumstances standards in determining whether the lender is a "true lender." It provides that "[i]f a loan exceeds the rate permitted under the [CLA,] a person is a lender making a loan subject to the requirements of the [CLA] notwithstanding the fact that the person purports to act as an agent, service provider, or in another capacity for another person that is exempt from the [CLA] if, among other things:

• the person holds, acquires, or maintains, directly or indirectly, the predominant economic interest in the loan; or
• the totality of the circumstances indicates that the person is the lender, and the transaction is structured to evade the requirements of the [CLA]."

The PLPA provides an exemption for non-recourse litigation funding. It states that the CLA does not apply to "[a]ny person that extends money or credit to another person on a nonrecourse basis in exchange for a contingent right to receive an amount of the potential proceeds of any award, judgment, settlement, verdict, or other resolution from a pending legal action." It also states that the exemption does not apply to "any person that requires repayment in the event the person does not prevail in their legal proceeding."

The PLPA also changes the coverage under the CLA to include any loan made to a "person physically located" in Washington, as opposed to any loan made to a "resident" of Washington under current statutory language.

The PLPA further clarifies that a person may not engage in any activity subject to the CLA without first obtaining and maintaining a license. If a person fails to obtain and maintain a license as required under the CLA, loans in which that person is involved after the effective date, if the loans are not residential mortgage loans, are null, void, uncollectable, and unenforceable.

The PLPA will not apply to any loans issued prior to the effective date of the PLPA unless the loan is renegotiated or modified after the effective date. Because it does not provide a specific effective date, the PLPA, once signed into law by the governor, will take effect 90 days after the end of this legislative session.

Amicus brief(ly): This update in Washington tracks with the evolution of state licensed lender laws in other states as they try to more closely regulate all of the non-bank players in fintech and other bank partnership business models. It also follows the trend of states asserting themselves into bank-originated consumer loans by adopting the “predominant economic interest” rule and effectively limiting the ability of non-bank entities to service those bank-originated loans in a manner consistent with the federal preemption (interest rates and otherwise) available to banks. Where Washington really gets our attention is with the draconian remedy for failure to obtain and maintain the Washington license. There are not a lot of states where the remedy for operating without a license is loss of principal, but that’s exactly what Washington does in this new law – an obligation is void and unenforceable if a person involved in a CLA loan should have a license under the expanded definitions but does not. The final kicker is that Washington now regulates litigation funding under the CLA. These are big changes in Washington.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.