Last Week, This Morning

July 21, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On July 13, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the National Credit Union Administration issued joint guidance "to remind supervised financial institutions of their existing obligations with respect to credit risk management, particularly as it relates to borrowers who are not legally authorized to work in the United States (non-work authorized borrowers)." The guidance was issued in accordance with President Trump's May 19 executive order titled "Restoring Integrity to America's Financial System," which directs federal financial regulators to review and strengthen anti-money laundering and customer due diligence/identification requirements with a focus on risks to the country's financial system posed by the extension of consumer credit to undocumented immigrants and by employers of undocumented immigrants that may be violating immigration law.

The agencies' guidance notes that lending to non-work authorized borrowers may present elevated credit risk because the borrowers' ability to generate income, maintain employment, and remain financially stable may be subject to greater uncertainty. When lending to non-work authorized borrowers, the guidance states that financial institutions should consider certain underwriting issues, including:

• stability and reliability of the borrowers' sources of income;
• ability to enforce security interests in collateralized loans, as it may be more difficult to contact non-work authorized borrowers or locate or repossess their collateral;
• documentation and verification of employment income; and
• risks to a financial institution's lending portfolio where lending is concentrated on borrowers in specific geographic areas or with similar employers in similar industries, such that the portfolio may be disproportionately affected by changes involving non-work authorized borrowers (such as immigration enforcement or workforce disruptions) that may affect the repayment capacity of multiple borrowers simultaneously.

The guidance also advises financial institutions to carefully consider the Consumer Financial Protection Bureau's June 8 "Statement on Ability to Repay and Immigration Status" concerning creditors' obligations under the Truth in Lending Act, as implemented by Regulation Z, and the Equal Credit Opportunity Act, as implemented by Regulation B, as they relate to non-work authorized borrowers.

Amicus Brief(ly): As was the case with the CFPB's June statement on the same subject, we do not anticipate that this guidance from the banking agencies is going to result in any dramatic changes to underwriting and credit policies at banks or credit unions. The risks and issues identified are baked into those policies already because banks and credit unions are looking to extend credit to consumers who they reasonably expect to repay it. The messaging follows through on the administration's executive order, as it should - but, again, we do not expect this guidance to be terribly impactful for financial institutions.

On July 16, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the Federal Reserve Board issued a joint statement describing enhanced procedures for the handling of highly sensitive information during examinations of supervised banks. The agencies will rely on bank management to identify data and documents requested for an examination that should be considered highly sensitive information. For highly sensitive information, the agencies will consider a range of potential options to minimize collection and storage by the agencies, including on-site review, direct digital review from the systems of the supervised banks, redacted or summarized versions of documents, and additional measures related to transmission of, and access to, sensitive information.

The agencies will notify banks of any potential or confirmed material data breach involving confidential supervisory information as soon as practicable but no later than 72 hours after discovery, unless legal restrictions apply.

Amicus Brief(ly): The federal banking regulators are effectively making clear that their regulated banks are responsible to identify "highly sensitive" examination information worthy of heightened protections. Banks have a good sense of how to do that already with respect to non-public personal information about customers, given the information privacy and data security requirements that apply to them under federal and state law. But the information referenced in the statement pertains to proprietary information about the banks' overall condition that they will naturally want to protect and keep confidential - things like penetration test results, system vulnerabilities, and succession planning. The statement includes an important caveat at the end: "This memorandum is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the [agencies] or their officers, employees, or agents." The overall takeaway from the statement seems to be that banks have an important, independent role to play in the protection of their examination and supervisory information and that they should act accordingly.

The attorney general of the District of Columbia recently reached a settlement with a rent-to-own company, resolving allegations that it engaged in misleading advertising, charged hidden markups, obscured terms in its rental purchase agreements, and made deceptive promises about its return process. Specifically, the AG alleged that the company:

• falsely advertised "90 day same as cash" or "90 day cash option" to finance purchases of household goods, leading customers to believe they could pay for their purchase over three months without interest or fees. Instead, according to the AG, the company automatically placed consumers into 12-month payment plans with high additional charges, often without consumers' knowledge or full understanding;
• charged some consumers a markup of up to $100 dollars over the retail prices of their purchases, despite ads claiming to be "same as cash." The company allegedly failed to disclose this markup to the base prices of items or concealed the markup in the rental purchase agreements' fine print;
• hid key terms of its rental purchase agreements during the sign-up process. The company allegedly made it difficult for consumers to review the terms of their rental purchase agreements by using pop-up windows that blocked text, displaying terms in small font, and prompting people to electronically sign documents without viewing them; and
• deceptively promised "hassle-free returns," but its return process was difficult and confusing. The company allegedly refused numerous return requests. When returns were approved, the company was often slow to process them or pick them up and required consumers to continue making lease payments while they waited, even for items that were broken or defective.

In addition to implementing certain changes to its business practices, the settlement requires the company to provide $900,000 in refunds to consumers who fully paid their rental purchase agreements, $2.7 million in debt forgiveness to consumers with outstanding balances, and $100,000 in account vouchers that consumers can apply to their lease payments. The company will also pay $300,000 in penalties to the District of Columbia.

Amicus Brief(ly): Another deceptive advertising settlement graces these pages, this time from the relatively quiet District of Columbia AG. The themes are consistent with others - alleged advertisements of terms that the company did not honor, misleading price advertisements, unclear disclosures, and difficult return or cancellation policies. For such a quiet AG's office, this was an expensive settlement at a total of $4 million. The lesson is there for retailers willing to learn it: check advertisements against policies and procedures to ensure they are aligned, make clear, truthful, and complete disclosures, and get informed consumer consent when required (or even desirable). Those measures can help avoid protracted investigations and expensive settlements.

The Indiana Department of Financial Institutions, Consumer Credit Division, recently issued an advisory regarding the obligations of purchasers or assignees of consumer credit sales that include credit insurance and/or guaranteed asset protection sold by the originating auto dealers. The advisory states that "Purchasers or assignees of consumer credit sales are advised that upon prepayment in full of the consumer credit sale, Ind. Code § 24-4.5-2-202(4)(g) and Ind. Code § 24-4.5-4-108(3) require the seller/creditor or creditor's assignee to promptly make an appropriate refund to the debtor for any separate charge made for credit insurance or GAP. Because there is a statutory obligation placed equally on the seller/creditor and the creditor's assignee, Purchasers should review their internal policies and procedures to ensure dealer agreements clearly identify the party contractually obligated to make refunds."

"If the dealer agreement requires the assignee to make refunds, the Purchaser should provide the seller/creditor with periodic reports outlining all refunds made to include the name of [the] consumer, the date of refund, type of refund (credit insurance or GAP), and the amount of the refund. If the [dealer] agreement requires the seller/creditor to make refunds, the Purchaser should have procedures to promptly notify the seller/creditor upon prepayment in full of the consumer credit sale. Purchasers should also conduct due diligence periodically to ensure each dealer is making refunds as agreed. Additionally, Purchasers should have a procedure in place to ensure consumers are provided refunds should the seller/creditor cease operations. Concerning sellers/creditors that have sold their assets and ceased operations, Purchasers must: [c]onfirm dealers that ceased operations will continue to issue credit insurance and/or GAP refunds to consumers upon prepayment in full as set forth in dealer agreements and confirm the method for delivery (to include updated address if applicable) of all future prepayment notifications; or [i]f the Purchaser cannot confirm a dealer that ceased operations will continue to issue refunds, the Purchaser must issue credit insurance and/or GAP refunds to consumers that prepaid their agreement in full early, to satisfy its statutory obligations."

Amicus Brief(ly): Well, the Indiana DFI could not have made a clearer statement about whether finance companies bear the burden in Indiana of making sure consumers get their GAP refunds upon prepayment or cancellation: they do. Whether the actual refund obligation belongs to the dealer or the holder of the contract, Indiana's Uniform Consumer Credit Code requires the assignee to make sure the refund happens. As a practical matter, that has been a regulatory expectation for some time. The Consumer Financial Protection Bureau set that expectation years ago through examinations and published guidance, to the point that financial institutions in some cases would make all refunds - even when they did not receive any part of the GAP premium - and then chase the refund from the dealer or GAP administrator who had the contractual obligation to make it. Indiana has made its position clear, so finance companies and other holders should "review their internal policies and procedures" as admonished to ensure that their refund obligations and procedures are clear.

The New York City Department of Consumer and Worker Protection moved the effective date of its amended debt collection regulation (commonly referred to as the "SHIELD Rule") from September 1, 2026, to January 1, 2027. The reason for the delay is twofold: (1) to provide the industry with additional time to operationalize the rule's new requirements; and (2) to provide the DCWP with additional time to respond to questions raised by the regulated community.

The DCWP will publish proposed amendments to the rule to align with the new effective date.

Amicus Brief(ly): Everyone will appreciate the deferred effective date of this complex, impactful rule that imposes substantive requirements on creditors, servicers, debt collectors, and debt buyers alike. There is a lot to unpack in the rule, and we are looking forward to the published Frequently Asked Questions the DCWP has promised to see how the department reacts to important comments and questions about how to comply with the rule. If readers have not yet reviewed the final rule or at least summaries of its requirements, there is still time, and we commend you to it.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.