Last Week, This Morning

December 15, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

The Consumer Financial Protection Bureau and the Federal Reserve Board are increasing the dollar thresholds in Regulation Z (Truth in Lending) and Regulation M (Consumer Leasing) for exempt consumer credit and lease transactions. The Dodd-Frank Act provides that the dollar amount thresholds for TILA and the CLA must be adjusted annually by any annual percentage increase in the Consumer Price Index. Based on the annual percentage increase in the CPI as of June 1, 2025, the protections of TILA and the CLA generally will apply to consumer credit transactions and consumer leases of $73,400 or less in 2026. However, private education loans and loans secured by real property (such as mortgages) are subject to TILA regardless of the loan amount.

Amicus Brief(ly): It's that time of year again. The holidays are upon us, and the CFPB and the FRB have adjusted Reg. M for leases and the Reg. Z thresholds for credit, other than mortgage loans and private education loans, to keep up with the CPI. Many creditors simply comply with Reg. M and Reg. Z as a matter of course for all consumer credit transactions - it allows for less documentation, formatting, system complexity, monitoring, testing, training, etc., when there is a single contract with a single, uniform set of disclosures to worry about. But for those whose consumer programs differ based on the transaction thresholds, it is time to adjust the scope threshold up by $1,500 to include more consumer transactions. Don't forget the states, like Iowa, Maine, and others, that have adopted the TILA thresholds as their Uniform Consumer Credit Code coverage thresholds; we have adjustments to make there, too.

On December 11, President Trump issued an Executive Order to establish a policy to "sustain and enhance the United States' global AI dominance through a minimally burdensome national policy framework for AI" and prohibit state AI laws that conflict with this policy. The EO explains that the policy is necessary to avoid "excessive" state regulation of AI that "creates a patchwork of 50 different regulatory regimes that makes compliance more challenging," as well as to avoid state AI laws that require entities to "embed ideological bias within models" by, for example, banning "algorithmic discrimination."

The EO tasks the U.S. Attorney General with creating an AI Litigation Task Force that will challenge state AI laws inconsistent with the new federal policy. In addition, the EO tasks the Secretary of Commerce, among other federal appointees, with identifying existing state AI laws that conflict with the policy set forth in the EO, as well as laws that should be referred to the AI Litigation Task Force. According to the EO, this "evaluation of State AI laws shall, at a minimum, identify laws that require AI models to alter their truthful outputs, or that may compel AI developers or deployers to disclose or report information in a manner that would violate the First Amendment or any other provision of the Constitution."

The EO directs federal regulators to withhold certain state funds if states enact state AI laws, or enforce state AI laws already in place, that conflict with the federal AI policy.

The EO also mandates the Chairman of the Federal Trade Commission to issue a policy statement on the application of the FTC Act's prohibition on unfair and deceptive acts or practices to AI models. The policy statement must "explain the circumstances under which State laws that require alterations to the truthful outputs of AI models are preempted by the [FTC Act's] prohibition on engaging in deceptive acts or practices affecting commerce."

Amicus Brief(ly): Interesting. The "patchwork of state laws" argument did not work at the U.S. Supreme Court in the Cantero case last year when the Court looked at the National Bank Act's preemption standard. So, in some circumstances, national banks are still subject to that "patchwork of state laws," and the National Bank Act actually articulates a preemption standard. There is no single federal law specifically regulating the creation and use of AI in any context, so there is no federal standard to apply. While the "patchwork of state laws" argument may or may not be effective if the administration has to defend this EO, a sensible federal AI law would go a long way for users of this increasingly useful technology that are trying to figure out how to use it while complying with applicable laws. It may be a while until we get a federal AI law though, so for now there is this EO.

The Federal Trade Commission recently announced that it will hold a free public workshop on January 28, 2026, to discuss issues related to age verification and estimation technologies. The workshop will be held online and in person in Washington, D.C., and registration is not required to attend.

The workshop will bring together researchers, academics, industry representatives, consumer advocates, government regulators, and others to discuss topics including:

• why age verification matters;
• age verification and estimation tools;
• navigating the regulatory contours of age verification;
• how to deploy age verification more widely; and
• the interplay between age verification technologies and the Children's Online Privacy Protection Act Rule.

Amicus Brief(ly): The FTC's workshop sounds promising as a forum for updating industry participants about measures designed to protect children from potentially deceptive and harmful online content. It is an important step, especially following the FTC's rejection in 2024 of a proposed age estimation service designed to comply with COPPA, noting concerns about privacy, accuracy, and deepfakes. The workshop should provide industry participants with timely information about age verification and age estimation technology and perhaps may provide a preview of what the FTC will expect of those technologies in the near term. States have been openly interested in protecting children's privacy over the past couple of years, too, so this workshop is timely and focused on important privacy issues.

New York Governor Kathy Hochul recently signed Senate Bill 8408, which provides that persons engaged in activity for which a license, registration, or other authorization from the Superintendent of Financial Services is required under New York's Banking Law or Financial Services Law will be subject to a civil penalty for violations of those laws, regardless of whether such person is licensed or otherwise authorized to do such activity. The new law aims to close a loophole where unlicensed entities were previously not subject to civil penalties for acts that would constitute violations subject to civil penalties if the entity were licensed.

Under S.B. 8408, the superintendent may, after notice and a hearing, levy a civil penalty for any prohibited unlicensed act as follows:

1. The penalty for a prohibited unlicensed act that relates to the requirements of the Banking Law will be the same as the penalty provided in Section 44 of the Banking Law for any violation of the Banking Law.
2. The penalty for a prohibited unlicensed act that relates to the requirements of the Financial Services Law will be the same as the penalty provided for in Section 408 for any violation of the Financial Services Law. However, the superintendent may not impose any penalty for a prohibited unlicensed act if the superintendent imposes any penalty pursuant to paragraph (1) above or paragraphs (a)(2) or (a)(3) of Section 408 for the same act or omission.
3. If a prohibited unlicensed act results in consumer harm, the penalty may not be more than double the penalty amount applicable to such violation set forth in paragraphs (1) and (2) above.

In addition to any civil penalty imposed upon a person for a prohibited unlicensed act, the superintendent may order that person to pay restitution.

S.B. 4808 defines "prohibited unlicensed act" to mean:

1. engaging in an activity in this state for which a license, certification, registration, authorization, charter, accreditation or incorporation is required by [the Financial Services Law] or the [B]anking [L]aw, or the regulations promulgated thereunder, without such license, certification, registration, authorization, charter, accreditation or incorporation or an exemption from such requirement; or
2. any act or omission by a person who is required by [the Financial Services Law] or the [B]anking [L]aw, or the regulations promulgated thereunder, to be licensed, certified, registered, authorized, chartered, accredited or incorporated and is not so licensed, certified, registered, authorized, chartered, accredited or incorporated, or exempted from such requirement, if such act or omission would constitute a violation of [the Financial Services Law] or the [B]anking [L]aw, or the regulations promulgated thereunder, subject to monetary penalty if such person were so licensed, certified, registered, authorized, chartered, accredited or incorporated.

Amicus Brief(ly): Most states have clear civil penalties in place for companies engaged in licensable activity without the required license, ranging from fines and the potential for denial of a license application to criminal penalties for willful violations. In some states, extending credit without a required license can result in that credit being void, costing the unlicensed creditor its principal investment and any finance charges or interest that accrued on it. New York's update will impose penalties on unlicensed providers not just for not having a license but for violations of the laws that would have applied if the providers had been licensed. This is a good time to look into your licensing status in New York. The specific "consumer harm" kicker is novel as a remedy for unlicensed activity, underscoring the state's current focus on policing financial services activity.

The Supreme Court of Maryland recently held in that an assignee of a retail installment sale contract could not compel arbitration of a car buyer's claims pursuant to an arbitration provision in a purchase order, where language in the RISC limited the agreement between the buyer and the assignee to only the RISC and not other documents executed in connection with the car purchase.

A car buyer filed a class action complaint against the assignee of a RISC that he entered into with a dealership, alleging that the assignee breached the RISC and violated Maryland law in connection with its collection of convenience fees from customers. The assignee moved to compel arbitration of the buyer's claims pursuant to an arbitration provision in the purchase order that he signed in connection with his purchase. The trial court granted the motion to compel, and the Appellate Court of Maryland affirmed.

The Supreme Court of Maryland, however, reversed. The purchase order contained a notice in bold and all capital letters on the front side of the 1-page document directing the buyer to see the reverse side and separate arbitration agreement. The reverse side contained an arbitration provision and referenced the separate arbitration agreement attached thereto and incorporated by reference therein. However, there was no record of a separate signed arbitration agreement between the buyer and the dealership. The RISC, which did not contain an arbitration provision, contained an integration clause stating: "'This contract, along with all other documents signed by you in connection with the purchase of this vehicle, comprise the entire agreement between you and us affecting this purchase. ... Upon assignment of this contract: (i) only this contract and the addenda to this contract comprise the entire agreement between you and the assignee relating to this contract.'" The buyer argued that he did not enter into a separate signed arbitration agreement with the dealership and that any arbitration agreement he entered into was too indefinite to enforce. The buyer also argued that the assignee of the RISC lacked standing to enforce the arbitration provision in the purchase order because the integration clause in the RISC did not incorporate the purchase order.

The Supreme Court of Maryland did not address the buyer's first argument because it found that its resolution of his second argument rendered consideration of his first argument unnecessary. The court recognized that the purchase order and the RISC were part of a single transaction and should be read together. However, the court determined that the scope of the assignment was limited to "'only this contract,'" meaning the RISC, and not "'all other documents signed by you,'" meaning the purchase order and any other documents that the buyer signed in connection with the purchase. The court found that the wording of the RISC compelled the conclusion that neither the purchase order nor the arbitration provision within it were assigned to the assignee of the RISC, and, therefore, the assignee lacked standing to enforce the arbitration provision.

Amicus Brief(ly): It is always the case that words matter, but the words of the assignment in this case mattered a lot. Leaving aside consumer-filed mass arbitrations, arbitration agreements are most often good for creditors. But in the context of indirect financing where the arbitration agreement is separate from the RISC, it will only work for the finance company as assignee if the deal documents make clear that the assignment includes assignment of the separate arbitration agreement. That was the issue in this case and the reason why the Maryland Supreme Court reversed the two lower courts and said the finance company could not enforce the separate arbitration agreement. The issue here is effectively the same as the issue in another Maryland case (in federal court) involving a fintech company on which we reported back in June. Consumers are pushing back on arbitration, so providers in a business that relies on the assignment of agreements (e.g., indirect motor vehicle finance and fintech arrangements) that want to be able to compel arbitration should ensure that their transaction document templates include a clear assignment of the arbitration agreement.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.