Last Week, This Morning

October 26, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On October 19, the U.S. Department of Justice announced a settlement with a company that originates, refinances, and services Department of Veterans Affairs-guaranteed home loans, resolving allegations that it violated the Servicemembers Civil Relief Act by failing to reduce the interest rate on servicemembers' mortgage loans to six percent retroactive to the date of the servicemembers' military orders and by failing to reduce the amount of each monthly mortgage payment by the amount of interest forgiven. The DOJ also alleged that the company retaliated against SCRA-protected servicemembers who made requests for interest rate reductions by accelerating the payment of principal on their mortgage loans. In addition, the complaint alleged that the company falsely reported to the VA that servicemembers who had applied for and received interest rate reductions were delinquent on their loan payments. Finally, the DOJ alleged that the company misrepresented the current interest rate of servicemembers' mortgage loans. In certain instances, after receiving a request for an interest rate reduction from a servicemember, the company issued a form letter stating that the servicemember qualified for SCRA benefits but "since your current interest rate is below the 6.00% rate cap provided by the regulation, there will be no change to the interest rate or principal and interest payment for this loan." The company allegedly issued such letters even when the interest rate on the mortgage was above six percent.

Under the settlement, the company will pay at least $425,000 to at least 41 affected servicemembers and pay a $79,380 civil penalty, which is the maximum penalty for a first violation of the SCRA. The settlement also requires the company to revise its policies and procedures to prevent future SCRA violations and provide SCRA training to its employees.

Amicus Brief(ly): Though the dollar amount of the civil penalty in this settlement is not as high as the restitution number, it is significant because it represents the maximum available penalty. We do not get the servicer's side of the story from the DOJ's announcement and settlement agreement, but any SCRA settlement gives compliance professionals a chance to review the allegations and audit their own systems and operating data to ensure that they are complying with the SCRA's important servicemember protections. Those protections - including and especially the interest rate reduction requirement and corresponding requirement to adjust the servicemember's periodic payments to reflect the reduction in the interest rate (and, often, the suppression of servicing fees) - necessitate programming and testing. A clean, exception-free testing and audit report is useful not just to show that the system is working to avoid compliance mistakes but also to demonstrate to regulators and business partners that the servicer is checking to make sure the system is working.

On October 22, President Donald Trump signed an Executive Order titled "Decreasing Housing Costs for the American People."

The EO directs the Federal Housing Finance Agency to consider establishing a pilot program through Fannie Mae and Freddie Mac that uses automated valuation models and other data to periodically assess the current value of homes securing eligible mortgages and identify borrowers who meet requirements for mortgage insurance cancellation. Servicers will be required to notify eligible borrowers promptly when mortgage insurance may be cancelled and reduce or eliminate unnecessary documentation requests, appraisal costs, and other administrative barriers to cancellation.

The EO also establishes a Task Force on Manufactured Housing Innovation, which will submit recommendations to facilitate faster financing approvals, lower construction costs, and greater and more affordable production of manufactured homes eligible for federal housing finance programs.

In addition, the EO directs the FHFA to consider expanding its existing title acceptance pilot into a nationwide, ongoing program available through Fannie Mae and Freddie Mac, under which the government-sponsored enterprises may accept an automated title review or alternative title-risk assessment approved by the FHFA in lieu of a lender's title insurance policy on eligible refinance transactions. The FHFA is instructed to consider:

• expanding eligibility to loans with loan-to-value ratios above 80% when title risk remains low;
• removing geographic restrictions and approving additional title-assessment providers;
• waiving appraisals, income re-verification, and other documentation for qualifying limited cash-out refinances that lower monthly payments; and
• reducing or eliminating certain GSE fees and loan-level price adjustments.

Finally, the EO directs the Secretaries of Agriculture and Veterans Affairs to reduce interest rates on single-family home loans made directly by their respective departments, subject to applicable law and available appropriations.

Amicus Brief(ly): Cynics might point to the timing of this EO and its title and call it an attempt to earn political points before an election, but it does attempt to address real market concerns about access to homeownership and affordability of mortgage loans, especially for first-time homebuyers. We will not know the effectiveness of these directives for months or years, but the possibility of expanding eligibility for federal housing loans has the potential to help many first-time homebuyers qualify for mortgage credit. In addition, the pilot program designed to detect increases in home values and potentially release borrowers from the requirement to pay private mortgage insurance sooner than they otherwise would be released can translate to material savings for borrowers who pay those premiums for years into the life of their mortgage. The EO does not do much beyond sending a message, but if the government reaction to the EO turns into real opportunities and savings for consumers, that will be good for consumers and the market. Time will tell.

On October 21, the New Mexico Department of Justice announced that a state court issued an order requiring Meta Platforms, Inc., formerly known as Facebook, Inc., to pay $25 billion in civil penalties after a jury found nearly 44 million willful violations of the New Mexico Unfair Practices Act. The case arose from Facebook's conduct surrounding the Cambridge Analytica scandal involving allegations that a political consulting firm involved in Donald Trump's 2016 presidential campaign obtained personal data from millions of Facebook users through a third-party app without the users' consent. The jury found that Facebook made misrepresentations to its users concerning control of their personal data, including third-party access to and Facebook's monetization of that data, among other issues related to the platform. The judge noted that state law technically warranted a penalty exceeding $219 billion but reduced the final judgment to $25 billion, which is apparently one of the largest financial penalties against a corporation in U.S. history.

According to the New Mexico DOJ's press release, "[t]he magnitude of the verdict underscores the importance of state consumer protection statutes as a tool for holding technology companies accountable. New Mexico pursued its case independently, rather than joining a multistate settlement to resolve its claims, ensuring that the State's allegations were tested in court and that Facebook was held accountable under New Mexico law." The DOJ added that "[t]he case demonstrates the State's willingness to use its independent enforcement authority to challenge corporate conduct that harms consumers and undermines public trust. The penalty order ... reinforces the role of state attorneys general in enforcing consumer protection laws."

Amicus Brief(ly): Meta has said out loud that it will appeal this astronomical judgment, which is to be expected (notwithstanding the judge's note that the facts warranted a penalty almost 10 times as large). At its core, this case is about data use and user consent - an information privacy issue that has been an increasing priority for state and federal enforcement agencies and prudential regulators alike over the past several years. This case was over five years in the making, running concurrently with other jury trials New Mexico brought against Meta over its alleged misleading practices with respect to young users' safety, and follows a $5 billion settlement with the Federal Trade Commission over the same alleged improper privacy practices. While New Mexico is not the first state we think of when it comes to consumer data privacy protections, it is clear that its DOJ is prepared to use its unfair or deceptive acts or practices enforcement authority to challenge companies over data use.

On October 21, the attorneys general of 17 states announced a settlement with a company that offers rental-purchase agreements to consumers through merchant partners, resolving allegations that the company violated the states' consumer protection laws. The company purchases the merchandise from the merchant, takes title to or ownership of the merchandise, and then leases it to the consumer. The consumer has the option to either make each payment contemplated or return the item at any time under the RPA. The settlement requires the company to cancel approximately $662 million in rental payments and to pay $2.75 million to the states. Under the terms of the settlement, the company:

• is prohibited from representing in advertising to consumers that they will only pay the cash price under the RPA. Accordingly, the company is prohibited from using "cash option," "cash payoff," "same as cash," or "no additional fees required" in connection with advertising its RPAs, provided, however, that subject to certain terms and conditions, the company is permitted to use these slogans, phrases, or similar terms when advertising an early purchase option if the early purchase option price does not exceed the cash price;
• must clearly and conspicuously disclose in its advertising the time to acquire ownership of merchandise under an RPA and the terms and conditions of early purchase options;
• is prohibited from representing in advertising that its rent-to-own financing is a "loan" or a "credit transaction";
• is prohibited from representing in advertising that applying for or using an RPA will help consumers increase their credit ratings;
• must disclose the full terms and cost of a lease in accordance with state law before the lease can be signed;
• must make changes to certain servicing practices related to late deliveries of merchandise, merchandise damaged at delivery, responsibility for repairing or replacing merchandise during the term of an RPA, and changing a payment method by the consumer;
• is prohibited from threatening seizure of a product for non-payment of a lease when the company has no intent to do so;
• must provide clear disclosure of the right to terminate a lease and provide practical ways for a consumer to return property when terminating a lease while pausing payment accrual when termination requests are processed; and
• must meet certain initial and ongoing merchant training requirements and provide annual compliance reports for three years.

Amicus Brief(ly): The states' claims in the investigation that led to this multistate settlement focus on familiar issues: disclosure (especially with respect to costs), servicing practices, representations about both the product and the impact of making (or missing) payments on consumer reports, and product disclosures. It is noteworthy that some of the most active states in enforcement of consumer protection laws (e.g., California, New York, Connecticut) are not among the states involved in the investigation. We commend compliance professionals in the rent-to-own space to the settlement's compliance program requirements as a reference point for their own policies, procedures, and training materials. This kind of multistate settlement provides an opportunity to fine-tune those materials.

On October 22, the New York City Department of Consumer and Worker Protection revised its Frequently Asked Questions document that provides guidance to regulated entities on its debt collection rule (the "SHIELD Rule"). Though not redlined, the revisions add two new questions. The first is a new question (Question #3) in Section III (regarding electronic communications) that addresses whether a debt collector may obtain "consent in writing" by using an email with a confirmation link. The second is a new question (Question #9) in Section VII (regarding debt validation notices and itemization of the debt) that addresses whether a debt collector may configure its phone systems to comply with the SHIELD Rule's mandate regarding the assigned call-back person listed in the validation notice.

Amicus Brief(ly): The two new FAQs issued by the DCWP provide useful clarifications. The first explains that a "debt collector" engaged in debt collection procedures can obtain the consumer's revocable written consent to receive electronic communications by using an electronic confirmation link under certain conditions. Specifically, the communication has to comply with New York's electronic signatures law and federal law, and it cannot ask for payment. When a debt collector does so, that single communication does not count toward the 3-in-7 contact frequency limitation - but future attempts, if the first attempt is unsuccessful, does count against the limitation. The second new FAQ simply confirms that "debt collectors" can use IVR menus to route calls to designated callback persons, which for NYC licensees has to connect the caller with a natural person in less than two minutes (for non-licensees, the DCWP makes clear that compliance with the rules for licensees is a best practice). The FAQ reminds "debt collectors" that if the callback person listed on the debt collector's debt validation notice is not available, the system can route that call to a designated person who can answer the caller's questions. This FAQ does not remind debt collectors that they have to record among their notes the reason(s) why the designated callback person did not take the call, but the response to Question 6 in Section VII does. While the FAQs on the whole did not provide much new, practical information about the DCWP's interpretations of its rule, these new ones did.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.