Last Week, This Morning

April 14, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On April 7, the Federal Communications Commission issued an Order announcing that it is delaying by one year the effective date of a new Telephone Consumer Protection Act standard related to revocation of consent. The provision at issue is part of a larger set of TCPA rule changes that took effect on April 11, 2025. Companies engaged in calling and texting subject to the TCPA should pay careful attention to what the FCC's new Order does and does not do. Most of the pending rule changes are unaffected by this Order and still took effect on April 11.

Early in 2024, the FCC finalized several TCPA rule changes related to consent revocation. The TCPA requires consent to use an autodialer or a prerecorded message. The type of consent required depends on the purpose of the call or text message. The TCPA consent requirements are stricter for marketing contacts than for non-marketing contacts. The main purpose of the 2024 rule changes was to add specifics to the TCPA's general right to revoke consent. One change lists seven text message replies that, by definition, constitute valid revocation of TCPA consent. A second change adds further detail to the means by which consumers may revoke their TCPA consent, beyond those seven replies. A third change sets standards for sending one-time text messages confirming a consumer's consent revocation. A fourth change narrows the time period companies have to process TCPA consent revocations and company-specific do-not-call requests. The April 7 FCC Order does not impact any of these TCPA developments, which took effect on April 11, 2025.

The only 2024 TCPA rule change impacted by the April 7 Order relates to the scope of a consumer's consent revocation. The FCC had set up the general rule that a revocation of any TCPA consent applies to all types of telephone calls and text messages from that caller that require TCPA consent. For example, a consent revocation submitted in response to an autodialed text message would also apply to telephone calls made to leave a prerecorded message, unless the subsequent call or text qualified for an exception from the TCPA's consent requirements. A consent revocation submitted in response to an exempted call or text would constitute a consent revocation for all types of calls and text messages requiring consent from that caller. The FCC has delayed the effective date of this TCPA change to April 11, 2026.

Amicus Brief(ly): TCPA consent revocation has been the subject of a lot of consumer litigation over the past decade. This Order offers providers that use automated dialing and announcing devices a one-year reprieve from the impactful rule that will require significant compliance resources to program and implement. Specifically, it will no longer be enough to note and honor revocation of TCPA consent on a single account and/or a single means (call or text). In a year, the rule says callers have to apply that restriction to all calls and texts from that caller. The extra time to program and adjust systems to that change is welcome, but providers should take note of the provisions that were not subject to this Order and went into effect on April 11.

The Consumer Financial Protection Bureau recently released a research report titled "Is Sharing Credit Caring? Piggybacking Accounts and Credit Outcomes." The report examines the practice of "piggybacking," defined as "becoming an authorized user on a credit card for the purpose of establishing credit." The report "provides the first empirical analysis of the prevalence and impact of sharing credit in this manner. [The CFPB] identif[ies] and describe[s] two types of piggybacking: first, the common practice of 'family sharing,' in which parents add their young adult children to their credit cards; and second, a niche market for 'renting' credit card tradelines to strangers. [The CFPB] use[s] both event study and regression discontinuity methods to identify the effect of both types of piggybacking on access to credit, and on outcomes for new credit obtained. [The CFPB] find[s] that piggybacking substantially increases access to credit, and find[s] suggestive evidence that family sharing generally improves the terms of any credit obtained. [The CFPB] find[s] broad evidence that consumers who obtain credit in their own names while piggybacking are more likely to default on the credit in their name, [all other things being equal]. Finally, [the CFPB] discuss[es] the implications of piggybacking for credit inequality in the United States."

Amicus Brief(ly): The report is an interesting read. The authors report that instances of families adding adult children as authorized users on credit cards to help build their credit far outnumber the cases where a person "rents" her or his credit card to a stranger to help the stranger establish a credit record that allows for more expansive access to credit. The authors also make some common-sense observations about how this "piggybacking" concept really only helps adult children of parents who pay their credit card bills on time and how consumer reporting agencies and underwriters have a difficult time dealing with piggybacking because the consumer who had help qualifying for credit may have difficulty repaying the debt she or he incurs. As with most of these studies from the CFPB, there is interesting information in the report but not a lot much there for creditors to take away and implement in a compliance program.

On April 9, the U.S. House of Representatives passed Banking Committee Chairman Tim Scott's (R-SC) Congressional Review Act resolution to repeal the Consumer Financial Protection Bureau's final rule titled "Overdraft Lending: Very Large Financial Institutions." As we reported in a prior issue, the U.S. Senate passed the resolution on March 27. In addition, the U.S. House passed U.S. Congressman Mike Flood's (R-NE) CRA resolution to repeal the CFPB's final rule titled "Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications." The U.S. Senate has already passed the resolution. President Trump is expected to sign both resolutions.

In December 2024, the CFPB adopted the final rule on overdraft fees, which applies to banks and credit unions with more than $10 billion in assets. According to the CFPB's press release about the rule, the rule "close[s] an outdated overdraft loophole that exempted overdraft loans from lending laws" by not treating overdraft fees as finance charges. The rule gives covered banks and credit unions three options to manage overdrafts: they can cap their overdraft fee at $5, they can charge a fee that covers no more than their costs or losses, or they can continue to extend overdraft loans if they comply with standard requirements governing other loans, like credit cards, including giving consumers a choice as to whether to open the line of overdraft credit, providing account-opening disclosures that would allow comparison shopping, sending periodic statements, and giving consumers a choice to pay automatically or manually.

In November 2024, the CFPB adopted the final rule on digital payments, which confirmed the agency's supervisory authority, under the Consumer Financial Protection Act, over nonbank companies offering digital funds transfer and payment wallet applications by defining "larger participants" in the market to include such companies that handle more than 50 million covered consumer payment transactions per year. Under the CFPA, the CFPB has supervisory authority over "larger participants" of markets for consumer financial products and services, as defined by CFPB rules. The final rule established increased oversight over larger, nonbank market participants in the payments ecosystem, specifically those in the "general-use digital consumer payment applications" market. This market includes providers of funds transfer and payment wallet functionalities through digital applications for consumers' general use in making payments to other persons for personal, family, or household purposes. Examples include consumer financial products and services that are commonly described as "digital wallets," "payment apps," "funds transfer apps," "peer-to-peer payment apps," "person-to-person payment apps," and "P2P apps."

Amicus Brief(ly): It is rare for Congress to bring and succeed with a CRA resolution like this, let alone two. But concerns about the Rohit Chopra-led CFPB's quick-paced rulemakings and enforcement action settlements in the months leading up to and following the election in November led to lawsuits challenging several CFPB actions, and there was near-universal support for these CRA actions among Republicans in Congress, with encouragement from industry trade groups. That support was enough to reverse the controversial overdraft fee rule and the rule defining "larger participants" in the digital payments space.

The Illinois Department of Financial and Professional Regulation recently amended the Consumer Installment Loan Act and the Sales Finance Agency Act regulations. The amendments require licensees under both Acts to submit a year-end balance sheet prepared according to generally accepted accounting principles ("GAAP") during the annual renewal process in order to demonstrate that the licensee has maintained a positive net worth of $30,000. The amendments also require licensees to provide balance sheets prepared according to GAAP when the IDFPR secretary has good cause to believe that the licensee may not have maintained the required positive net worth.

The amendments to both Acts also address the requirements to refund unearned charges for insurance, debt cancellation products, and other credit-related ancillary products. When a loan or account is prepaid in full, cancelled, renewed, refinanced, or reduced to judgment prior to maturity, the licensee must, not later than the 60th day after a loan or account is prepaid in full, cancelled, renewed, refinanced, or reduced to judgment prior to maturity, refund or credit the unearned charges for the insurance and/or products or provide written instruction to the person able to refund or credit the unearned charges. The licensee must make all reasonable efforts to ensure that the person able to refund or credit the unearned charges completes the refund or credit within 60 days of sending the written instruction. The required refund or credit must be computed according to a method at least as favorable to the obligor as the actuarial method. The licensee must maintain records to demonstrate compliance with the refund or credit requirements for at least two years from the date of refund, credit, or written instruction. Note, however, that vehicle service contracts and vehicle protection products or warranties are not subject to the refund or credit of unearned charges provisions.

The amendments to the CILA include clarification that a licensee may not require a borrower to purchase more than one type of property damage insurance against loss or damage to real or personal property. The amendments provide that the purchase of such insurance through the licensee or from an agent, broker, or insurer specified by the licensee may not be a condition precedent to the granting of the loan, and no licensee may require a borrower to purchase insurance that the borrower cannot reasonably purchase from an agent, broker, or insurer unrelated to and not specified by the licensee.

Amicus Brief(ly): Kudos to the IDFPR for enacting common-sense refund rules for ancillary products that make clear that creditors should ensure that the person in the position to make the refund (i.e., the person holding the premium, which is rarely the creditor) makes it, but do not require the creditor to front the refund. Several states require creditors to ensure that consumers receive refunds upon prepayment for ancillary products, and some states require creditors to make the refunds themselves, even if another party is holding the unearned premium. But notwithstanding state laws governing refunds, some creditors have taken the approach that they will make refunds in all cases to avoid dustups with state and federal regulators (especially the now-quiet CFPB) that want to see consumers receive refunds promptly after prepayment. Absent that pressure, creditors in Illinois should ensure that they have policies and procedures that reflect an effort to notify and follow up with the holders of unearned ancillary product premiums to make refunds when consumers prepay their retail installment sale contracts or CILA loans.

On April 10, Kansas enacted House Bill 2291, which establishes within the Kansas Office of the Attorney General a regulatory relief division to administer a general regulatory sandbox program. Kansas Governor Laura Kelly had vetoed the bill on April 3, but the Kansas legislature overrode the veto.

The new law tasks the regulatory relief division with establishing a regulatory sandbox program to enable a person to obtain legal protections and limited access to the market in the state to demonstrate an innovative offering without obtaining a certification or registration that might otherwise be required by state law. Nothing in the law may be construed to permit any waiver or suspension of any licensing requirement or regulation regarding licensing or to permit a license to be deemed for purposes of federal or state law. The regulatory relief division may enter into agreements with or adopt the best practices of corresponding federal regulatory agencies or other states that are administering similar programs and may consult with businesses in the state about existing or potential proposals for the sandbox program.

If the regulatory relief division approves an application for the sandbox program, the sandbox participant will have 24 months after approval to demonstrate the offering described in the application.

Amicus Brief(ly): A regulatory sandbox is a good idea, as evidenced by the bipartisan support for the concept among state regulators that was broad enough to override the governor's veto. Governor Kelly's concern with the bill focused on the apparent lawmaking authority the bill granted to an advisory committee in the AG's office "without proper oversight." Kansas joins a small handful of other states with a broad regulatory sandbox covering all industries. With the sunset of Nevada's fintech sandbox in 2022, there are no states currently running a regulatory sandbox focused on financial services. But state legislators in Kansas are hoping that Kansas entrepreneurs will be able to work with regulators in the state to develop products collaboratively and allow some time for observations about how novel products work and how best to regulate them (if at all).

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.