InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Fannie Mae to issue RFP for Title Acceptance pilot
On April 12, the FHFA announced plans to test a pilot program that would permit lenders to forego a lender’s title insurance policy or an attorney opinion letter for some refinance loans sold to Fannie Mae, aiming to lower closing costs for borrowers. Since the announcement, Fannie Mae has been working with the FHFA to develop a Title Acceptance pilot framework and has received interest from title, settlement service, and technology providers to join the pilot. In light of this, Fannie Mae declared its intention to release a Request for Proposal (RFP) by the end of the second quarter to identify and assess potential suppliers to participate in the pilot.
CFPB supports Connecticut’s bill to ban medical debt on credit reports
On April 15, the CFPB released a letter written by Brian Shearer, the Assistant Director within the Office of Policy Planning and Strategy, throwing the Bureau’s support behind Connecticut’s new bill to bar medical debt on credit reports. The proposed bill, SB 395, has passed its committee in the first chamber. This legislation would align Connecticut with similar legislation in Colorado and New York, and the CFPB noted that the “preemption of state law is narrow under both the [FDCPA] and the [FCRA], and states may… limit the inclusion of information about a person’s allegedly unpaid medical bills on consumer reports.” The CFPB announced in September 2023 its NPRM to prohibit creditors from using medical bills in underwriting decisions (as covered by InfoBytes here). According to the letter, “[m]edical debt is categorically different from most types of consumer tradelines that typically appear on consumer reports. Consumers frequently incur medical bills in unique circumstances that differ from other forms of credit extension, and CFPB research has found that medical debt is less predictive of future consumer credit performance than other tradelines.”
CFPB’s Frotman speaks on medical debt collections and rental financial products
On April 11, the General Counsel of the CFPB, Seth Frotman, delivered a speech at the National Consumer Law Center/National Association of Consumer Advocates Spring Training, highlighting how the FDCPA and the FCRA cover often-overlooked sectors of consumer finance, including medical collections and landlord-tenant debts. As to medical billing, collections, and credit reporting, Frotman noted that the CFPB has received more than 15,000 complaints in the past two years, as explained previously in the CFPB’s most recent FDCPA annual report (covered by InfoBytes here). These complaints led to the CFPB initiating a rulemaking process to “remove medical bills from credit reports.” Frotman highlighted that many states have taken similar initiatives: Colorado and New York both enacted laws prohibiting the reporting of medical debt, and the CFPB encouraged more states to follow their lead; Connecticut recently introduced legislation banning medical debt in SB 395. Of interest, Frotman noted that when the CFPB contacted debt collectors about suspected bills, they often closed the account – suggesting that these collectors “do not have confidence that this money [was] actually owed,” indicating that collectors could be seeking to collect an invalid medical debt from consumers.
On rental collections and credit reporting, Frotman noted an increase in the “financialization” of the landlord and tenant relationship, such as products to finance security deposits or rent and offering rent-specific credit cards. Frotman also noted that corporate landlords, who have increased their share of the rental housing market, have increased the demand for “tenant screening” products that score prospective tenants. Frotman expressed concern that the algorithms relied on by these tenant screening products have been opaque and even discriminatory. The speech highlighted the CFPB’s focus on tenant screening as part of the Bureau’s increased attention toward debt collection and credit reporting companies generally in the rental industry. For instance, the CFPB noted that law firms that operate as “eviction mills” (i.e., firms that “rubber stamp” eviction actions without performing a meaningful review) could be held liable under the FDCPA.
FTC orders mental health service company to pay for privacy and data violations
On April 15, the FTC released its administrative complaint and joint stipulated order against a mental health service provider, requiring the provider to pay a total of more than $7 million, including $5.1 million for consumer refunds and $2 million in civil penalties. According to the complaint, the defendant collected sensitive personal health information and sold online mental healthcare treatments (i.e., telehealth) through its website to “hundreds of thousands” of patients between 2021 to 2022. The FTC alleged the mental health service provider had engaged in deceptive and unfair practices relating to the marketing of its data security practices, like failing to disclose material items, failing to obtain consumers’ express informed consent, and failing to implement adequate data security measures. In addition, the FTC alleged that the provider misled consumers about its cancellation of services, including failure to provide a mechanism to stop recurring charges. The FTC’s complaint specifically found that the company misrepresented how it would use and disclose patients’ personal information, mishandled and exposed “hundreds of thousands” of personal information, and failed to provide a means to cancel subscriptions. The FTC charged the defendant with violating Section 5 of the FTC Act covering deceptive privacy practices, deceptive data security practices, unfair privacy and data security practices, and deceptive cancellation practices – allegedly violating the Opioid Act, and violating the Restore Online Shoppers’ Confidence Act (ROSCA).
In the joint stipulated order, although the defendant neither admitted nor denied these allegations, the judgment prohibited the defendant from disclosing any covered information to any third party for advertising purposes, disclosing any covered information to an outside party without obtaining a consumer’s affirmative express consent, and misrepresenting its cancellation policies. The order also required the defendant to implement stronger protections of the private information of individuals and initiate regular assessments of its data security practices. The court ordered the defendant to pay $5,087,252 as monetary relief to consumers and a civil money penalty of $10 million, which the FTC agreed to suspend in exchange for a payment of $2 million, based on the defendant’s inability to pay the full civil money penalty.
Democratic senators pen letter to trade org. that brought suit against CFPB’s credit card late fee rule
On April 14, two Democratic senators, Sen. Elizabeth Warren (D-MA) and Sen. Sheldon Whitehouse (D-RI), wrote a letter to the head of a commercial trade organization that brought a lawsuit against the CFPB, challenging the CFPB’s rule capping credit card late fees. As previously covered by InfoBytes, the trade organization and other business groups sued the CFPB, challenging its recent final rule limiting most credit card late fees to $8. The senators wrote that the trade organization’s decision to sue was “outrageous and unwarranted” as the senators sought an explanation for the opposition.
The senators stated that the lawsuit was “frivolous,” and argued that the trade organization neglected “Main Street businesses” and instead was “doing the dirty work of its big bank members” who charged these high fees. Bolstering their position that the rule would cover large credit card issuers only, the senators noted that the rule would be expected to apply to less than one percent of the 4,000 financial institutions offering credit cards. Further, the senators argued that this lawsuit was a pattern of the trade organization representing the interests of large corporations, citing a report that found that only 23 of the 28 million small businesses in the U.S. benefited from the trade organization’s litigation. In seeking an explanation, the senators requested answers to a series of questions, including “How did [the trade organization] reach the decision to sue the CFPB to stop the agency from putting this rule in place?” and “Has the [trade organization] conducted an economic analysis of how the CFPB proposal would impact its members?”
CFPB finalizes rule to change its supervision designation procedures for nonbanks
On April 16, the CFPB issued a procedural rule to change how the Bureau will designate nonbanks for supervision. Under the CFPA, the CFPB was authorized to supervise a nonbank covered person if the Bureau had reasonable cause to determine if the nonbank covered person was engaged in financial services-related conduct that posed a risk to consumers. In 2013, the CFPB issued a rule providing procedures to govern supervisory designation proceedings under this authority; in 2022, the CFPB published a final rule amending the procedural rule to allow it to publicize its resolution of any contested designation proceeding (covered by InfoBytes here). In late February 2024, the CFPB transitioned to a new organizational structure for its supervision and enforcement work, and this rule will reflect the technical changes of the new structure in the context of supervisory designation proceedings.
According to the Bureau, there were small differences between two separate provisions under the 2013 rule that allowed nonbanks to consent to the CFPB’s exercise of supervisory authority. The new procedural rule will combine these provisions and clarify a few points of distinction from the two original provisions, including (i) a consent agreement does not constitute an admission; and (ii) supervision durations following consent agreements can be negotiated on a case-by-case basis, instead of applying a default duration of two years.
Regarding the Supervision Director’s notice of reasonable cause, the rule will expand the possible methods of delivery to include other methods that are “reasonably calculated to give notice.” Additionally, the rule states that the initiating official may withdraw a notice, and that they may file a written reply to the notice recipient’s response, neither of which was not contemplated under the previous rule. The Bureau said these changes could allow for more transparency in the decision-making process.
Concerning a supplemental oral response, the Bureau noted under the previous rule, a respondent nonbank entity presented supplemental oral responses to the Associate Director for Supervision, Enforcement, and Lending. In light of the elimination of the Associate Director position pursuant to a recent reorganization that split the Division of Supervision, Enforcement, and Fair Lending into a Division of Enforcement and a Division of Supervision, the rule provided that the Director of the Bureau will assume the Associate Director’s adjudicative roles and supervision-related functions. Therefore, the Director will be responsible for issuing a decision and order subjecting an entity to the Bureau’s supervision or terminating a proceeding.
The rule further stipulated that (i) an additional time limit for mail and delivery services are no longer warranted, since email would be “generally instantaneous”; (ii) there will be a 13,000-word limit for the proceeding filings; (iii) any changes to time or word limits can be decided between the initiating official and the respondent with a notice to the Director and will be subject to change by the Director.
Regarding the confidentiality of proceedings, the rule maintained a process for the CFPB to decide whether to publicly release final decisions and orders, including orders entered as a result of respondent failing to file a response and therefore defaulting. The Bureau did note, however, consent agreements entered into between the initiating official and the respondent will not be subject to public release under the rule.
The rule also established an issue exhaustion requirement, requiring respondents to raise arguments they have in their written response to the Bureau to avoid waiving the argument in future proceedings. The Bureau will invite public comments which must be submitted 30 days after publication in the Federal Register, although the rule will be exempt from the notice-and-comment rulemaking requirements under the APA as a rule of agency organization, procedure, or practice. The rule will be effective upon publication to the Federal Register, and it will apply to proceedings pending on the effective date, unless the Director determined that it will be “not practicable.”
CFPB and European Commission convene for future oversight of consumer finance products
On April 11, the CFPB Director, Rohit Chopra, and the Commissioner for Justice and Consumer Protection of the European Commission, Didier Reynders, issued a joint statement announcing their intent to begin an informal dialogue between the CFPB and the European Commission on consumer financial protection issues. The agencies have already convened three staff-level meetings on the following topics: (1) BNPL and over-indebtedness, where the U.S. shared the FCRA framework and the European Commission discussed the differences in the BNPL industry’s evolution in their respective jurisdictions; (2) digital payment access and fraud, where they discussed fraud, the issue of nonbanks in payments, Big Tech’s involvement in consumer finance, and digital access for the unbanked; and (3) artificial intelligence, where the European Commission shared four pieces of legislation or regulations and two recent court judgments. The joint statement iterated their inputs: “Our staff have shared expertise, best practices, and lessons learned on an important set of issues. Jointly analyzing the expansion of Big Tech’s financial services offerings, and the attendant risks to consumer privacy and competition, has been highly productive.”
FDIC releases comprehensive report on international, systemically important banks
On April 10, the FDIC released a report on the FDIC’s plans and readiness to step in as a receiver for a financial company under Title II of the Dodd-Frank Act. The FDIC Chairman said this report was the “most detailed description to date of the FDIC’s preparedness to use its Title II resolution authority.”
The report provided background on resolution-related authorities under Dodd-Frank, highlighted key measures that provided readiness of resolution under Title II authority, reviewed strategic decision-making for the use of such authority, and explained how the Commission expects to undertake a Title II resolution of a Global Systematically Important U.S. Bank (GSIB) using a Single Point of Entry (SPOE) resolution strategy. FDIC Chairman Martin Gruenberg said that such a resolution “will be a challenging process under any circumstance, with a number of steps that need to be taken quickly and in close coordination with a range of stakeholders.”
Under the SPOE resolution strategy, the FDIC would place only the holding company of the GSIB into receivership. The FDIC then would establish a bridge financial company under its control and would transfer the operating subsidiaries to the bridge institution. The bridge institution and its subsidiaries would remain operating while the FDIC performed its receivership duties, including the claims process. The final stage of GSIB receivership would be the implementation of a restructuring and wind-down plan that would aim to maintain value, address the causes of the failure, and transition operations. Chairman Gruenberg also noted that orderly resolution of a GSIB has not been executed before, “so there will be questions on whether it can be done.”
CFPB reports on consumer reporting companies' compliance violations
On April 8, the CFPB released its Supervisory Highlights on consumer reporting companies (CRC) and furnishers from April to December 2023. With respect to CRCs, the CFPB found deficiencies related to (i) placing identity theft blocks on consumer reports, (ii) blocking adverse items identified by a consumer as the result of human trafficking, and (iii) the accuracy of information in consumer reports.
For identity theft, the CFPB noted that some CRCs automatically declined to implement identity theft blocks based on overly broad, disqualifying criteria that did not support a reasonable determination, in violation of the FCRA. CRCs also failed to properly notify these customers that they declined these identity blocks.
Regulation V required CRCs to block adverse items of information identified by a consumer from human trafficking. While CRCs must block these items within four business days of such request, the CFPB found CRCs either failed to timely block these items or that CRCs blocked some, but not all such items.
In failing to ensure the maximum possible accuracy of consumer reports, the CFPB found that CRCs (i) inadequately monitored dispute metrics that may suggest a furnisher would not a reliable source of information about consumers, and (ii) failed to implement procedures to ensure the accuracy of information provided by unreliable furnishers and continued to include such information in reports.
With respect to furnishers, the CFPB similarly found deficiencies in accuracy, dispute investigation, and identity theft requirements. Specifically, CFPB examiners found that furnishers reported incomplete or inaccurate information for several months or even years after determining the information was incomplete or inaccurate. Additionally, furnishers that received direct disputes both continued to report such information and failed to notify CRCs of the disputed information. The report also noted that furnishers who received proper identity theft reports continued to furnish information regarding the consumer before confirming the accuracy of the information with the consumer.
CFPB focuses on in-game video game market and its consumer protection issues
On April 4, the CFPB released a report titled “Banking in video games and virtual worlds” that examined the gaming industry and the consumer financial systems that affect it. The Bureau’s report identified three key findings: (i) a network of financial products and services has entered the gaming industry to leverage and support the transfer of gaming assets and currency; (ii) the increased value of these assets has led to an increase of hacking attempts, account theft, scams, and unauthorized transactions; and (iii) the consumer data collected by gaming companies was bought, sold, and traded between companies, which can pose a risk to gaming customers. As a result, the CFPB will intend to monitor these issues in gaming and other such non-traditional markets to ensure companies comply with federal consumer financial protection laws.
The report noted that the proliferation of gaming and the evolution of the industry to offering in-game purchases and gaming assets has created the need for an infrastructure to enable fiat currency to flow into and out of games and virtual worlds. This can include transactions within the game, trading virtual items with other players, buying products on secondary markets, converting gaming assets to traditional currency, withdrawals of that currency, and/or using third parties to convert and withdraw the currency. As a result, companies have established financial products and services that increasingly resemble traditional financial products, like loans, payment processing, and money transmission.
In addition to the gaming economy creating a relatively new and unregulated financial marketplace, the Bureau identified additional risks similar to those found in the traditional market surrounding fraud, identity theft, money laundering, and privacy. For example, the report noted that these highly valuable gaming assets have made player accounts vulnerable to phishing and hacking attempts as well as unauthorized transactions. However, efforts by the FTC or CFPB to address complaints related to this activity have been met with a “buyer beware” approach by gaming companies.
Further, gaming companies collect a significant amount of data on players as a way to personalize the experience. However, the companies use this data to monetize gameplay to entice more spending as well as buy, sell and trade this data. The report noted that (i) the use of personal data can result in highly individualized pricing and (ii) the storage and transfer of consumer data poses privacy risks for gamers. In light of these various issues, the CFPB plans to work with other agencies to monitor both these non-traditional financial products and services as well as the companies that collect and sell sensitive consumer data.