InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
FTC bans operators of auto-warranty scam
On July 6, the FTC announced that it reached an agreement on a stipulated order to resolve a lawsuit against the operators of a telemarketing scam that pitched “extended automobile warranties” to hundreds of thousands of consumers nationwide. The stipulated order, which has been approved by the U.S. District Court for the Southern District of Florida, imposes a lifetime ban against a consulting group and its owner from any outbound telemarketing business and any involvement with extended automobile warranty sales. In February 2022, the FTC sued several companies—including the consulting group and its owner—in connection with their alleged involvement in the telemarketing scam, alleging that they had defrauded consumers out of millions of dollars. The complaint alleged that the companies made numerous unsolicited calls, falsely claiming to be affiliated with vehicle manufacturers and inaccurately promoting their products as offering comprehensive “bumper-to-bumper” protection.
In addition to the lifetime ban, the stipulated order includes a monetary judgment of $6.5 million, which is partially suspended based on the defendants’ alleged inability to pay. The FTC reached a separate settlement with three of the other original defendant companies and their owners in March 2023.
Illinois amends mortgage licensing provisions
On June 30, HB 2325 (the “Act”) was signed by the Illinois governor to amend The Residential Mortgage License Act of 1987. According to the amendments, residential mortgage licensees in Illinois must register every physical office where they conduct business with the Secretary of Financial and Professional Regulation. However, they are allowed to permit mortgage loan originators to work from a remote location if certain conditions are fulfilled. Conditions include but are not limited to: (i) the licensee must have written policies and procedures for supervising remote mortgage loan originators; (ii) access to company platforms and customer information must comply with the licensee's information security plan; (iii) mortgage originators' residences cannot be used for in-person customer interactions unless the residence is a licensed location; (iv) physical records cannot be stored at remote locations; and (v) electronics used at remote locations must be able to securely access the company’s systems. Moreover, "remote location" is not considered a full-service office as defined by the regulations. If the loan originator works remotely, their primary office is the office registered on the Nationwide Multistate Licensing System and Registry record, unless they choose another licensed branch.
The Act is effective January 1, 2024.
Nevada requires licenses for EWA providers
The Nevada governor recently signed SB 290 (the “Act”) outlining several requirements for providers of earned wage access (EWA) products. EWA products allow individuals to access their earned income before receiving their regular paycheck. To operate such services in Nevada, providers must obtain a license from the Nevada Commissioner of Financial Institutions. The licensing requirements apply to both “employer-integrated” services, where the provider receives verified data directly from the employer or the employer’s payroll service to deliver unpaid wages, and “direct-to-consumer” services where the provider delivers unpaid wages after verifying the earned income based on data not obtained from the employer or their payroll service. Notably, the Act specifies that EWA products are not loans or money transmissions under Nevada law and are not subject to existing laws governing these products. The Act outlines application and fee requirements (licenses will be issued via the Nationwide Multistate Licensing System and Registry) and requires licensed EWA providers to submit annual reports to the commissioner by April 15 of each year.
Providers of EWA products are also subject to certain prohibitions, which include: (i) sharing any fees, voluntary tips, gratuities, or other donations with an employer; (ii) the use of credit reports or credit scores to determine eligibility for an EWA service; (iii) the imposition of late fees or penalties for nonpayment by users; (iv) the reporting of a user’s nonpayment to a consumer reporting agency or a debt collector; (v) coercion of users to make payments through civil action; and (vi) restrictions on using a third-party collector or debt buyer to pursue collections from a user.
Additionally, EWA providers must, among other things, (i) implement policies and procedures to respond to questions and complaints raised by users (responses must be provided within 10-business days of receipt); (ii) disclose to the user his or her rights, as well as all related fees, prior to entering an agreement; (iii) allow users to cancel their EWA agreements at any time without being charged a fee; (iv) conspicuously disclose that any tips, gratuities, or donations paid by the user do not directly benefit any specific employee of the EWA provider or any other person (providers must also allow users to select $0 as an amount for such a tip); (v) comply with the EFTA when seeking payment of outstanding proceeds, fees, or other payments from a user’s depository account; and (vi) reimburse users for any overdraft or non-sufficient funds fees incurred as a result of the provider attempting to collect payment on a date earlier than disclosed to the user or in an amount different from what was disclosed.
On or before September 30, the commissioner is required to prescribe application requirements. EWA providers who were engaged in the offering of EWA services as of January 1, 2023, may continue to provide services until December 31, 2024, if the provider submits an application for licensure by January 1, 2024, and otherwise complies with the Act’s provisions. The Act becomes effective immediately for the purpose of adopting any regulations and performing any preparatory administrative tasks that are necessary to carry out the provisions of the Act and on July 1, 2024, for all other purposes.
Connecticut implements measures for auto-renewals
On June 28, the Connecticut governor signed HB 5314 (the “Act”), enacting measures relating to automatic renewal offers and consumer agreements. The Act, among other things, includes newly defined terms such as “automatic renewal provision.” The Act stipulates that any business that enters into a consumer agreement that contains an automatic renewal or continuous services provision must provide various consumer notices and enable any consumer who enters into such an agreement online to terminate online. Notices include a description of the actions the consumer must take to terminate, and if disclosed electronically, a link or other electronic means. Also, to be disclosed before renewal, in any consumer agreement containing an automatic renewal provision, must be the amount of the recurring charge and the amount of the change if the charges are subject to change (if such change in amount is known by the business). The business must further disclose the length of the term for such an agreement, unless the consumer chooses the length of the term, as well as any minimum purchase obligations and contact information for the business. The business must also establish a means for communication with consumers, such as email, toll-free phone number, or website if the agreement is contracted online. The Act also stipulates the nature of the disclosures for consumers before entering such an agreement, before the business makes a material change to the terms of the agreement, and before a consumer enters an agreement that offers a gift or free trial period. Additionally, the Act provides that no person doing business can impose any charge or fee for providing bills to consumers in paper form.
The Act is effective October 1.
Texas enacts data broker requirements
The Texas governor recently signed SB 2105 (the “Act”) to regulate data brokers operating in the state. The Act defines a “data broker” as “a business entity whose principal source of revenue is derived from the collecting, processing, or transferring of personal data that the entity did not collect directly from the individual linked or linkable to the data.” The Act’s provisions apply to data brokers that derive, in a 12-month period, (i) more than 50 percent of their revenue from processing or transferring personal data, or (ii) revenue from processing or transferring the personal data of more than 50,000 individuals, that was not collected directly from the individuals to whom the data pertains. Among other things, the Act requires covered entities to post conspicuous notices on websites or mobile applications disclosing that they are a data broker. Data brokers must also register annually with the secretary of state and pay required fees. Additionally, data brokers must implement a comprehensive information security program to protect personal data under their control and conduct ongoing employee and contractor education and training. Data brokers are required to take measures to ensure third-party service providers maintain appropriate security measures as well.
The Act does not apply to deidentified data (provided certain conditions are met), employee data, publicly available information, inferences that do not reveal sensitive data that is derived from multiple independent sources of publicly available information, and data subject to the Gramm-Leach-Bliley Act. Additionally, the Act does not apply to service providers that process employee data for a third-party employer, persons or entities that collect personal data from another person or entity to which they are related by common ownership or control where it is assumed a reasonable consumer would expect the data to be shared, governmental entities, nonprofits, consumer reporting agencies, and financial institutions.
The Texas attorney general has authority to bring an action against a data broker that violates the Act and impose a civil penalty in an amount not less than the total of “$100 for each day the entity is in violation,” as well as the amount of unpaid registration fees for each year an entity fails to register. Penalties may not exceed $10,000 in a 12-month period. By December 1, the secretary of state is required to promulgate rules necessary to implement the Act. The Act is effective September 1.
Connecticut establishes rules for virtual currency kiosks
On June 27, the Connecticut governor signed HB 6752 (the “Act”) to establish certain requirements for owners or operators of virtual currency kiosks in the state. Among other things, the commissioner has the authority to establish regulations, forms, and orders that govern the use of digital assets, such as virtual currencies and stablecoins, by regulated entities and individuals. When adopting, amending, or rescinding any such regulation, form, or order, the commissioner may consult with federal financial services regulators, regulators from other states, as well as other stakeholders and industry professionals to promote the consistent treatment and handling of digital assets. Definitions for “virtual currency address,” “virtual currency kiosk,” and “virtual currency wallet” have also been added.
The Act further provides that prior to engaging in an initial virtual currency transaction with a customer, the owner or operator of a virtual currency kiosk is required to provide clear and conspicuous written disclosures in English regarding the material risks associated with virtual currency. These disclosures should cover several key points, including a prominent and bold warning acknowledging that losses resulting from fraudulent or accidental transactions may not be recoverable, transactions in virtual currency are irreversible, and that the nature of virtual currency may lead to an increased risk of fraud or cyber-attack. Disclosures must also address a customer’s liability for unauthorized virtual currency transactions, a customer’s right to stop payment for a preauthorized virtual currency transfer (along with the process to initiate a stop-payment order), and circumstances in which the owner or operator will disclose information regarding the customer’s account to third parties, unless required by a court or government order. Additionally, customers must be provided upfront information relating to the amount of the transaction, any fees, expenses, and charges, and any applicable warnings. It is the responsibility of the owner or operator of a virtual currency kiosk to ensure that every customer acknowledges the receipt of all disclosures mandated by the Act, and to provide receipts upon completion of any virtual currency transaction. The Act is effective October 1.
CFSA says CFPB funding violates Constitution
On July 3, the Community Financial Services Association of America (CFSA) and the Consumer Service Alliance of Texas filed their brief with the U.S. Supreme Court, urging the high court that the CFPB’s independent funding structure is “unprecedented and must be stopped before it spreads without limit.” Respondents asked the Court to affirm the U.S. Court of Appeals for the Fifth Circuit’s decision in Community Financial Services Association of America v. Consumer Financial Protection Bureau, where the appellate court found that the Bureau’s “perpetual self-directed, double-insulated funding structure” violated the Constitution’s Appropriations Clause (covered by InfoBytes here and a firm article here). The 5th Circuit’s decision also vacated the agency’s Payday Lending Rule on the premise that it was promulgated at a time when the Bureau was receiving unconstitutional funding.
The Bureau expanded on why it believes the 5th Circuit erred in its holding in its opening brief filed with the Court in May (covered by InfoBytes here), and explained that even if there were some constitutional flaw in the statute creating the agency’s funding mechanism, the 5th Circuit should have looked for some cure to allow the remainder of the funding mechanism to stand independently instead of presuming the funding mechanism created under Section 5497(a)-(c) was entirely invalid. Vacatur of the agency’s past actions was not an appropriate remedy and is inconsistent with historical practice, the Bureau stressed.
In their brief, the respondents challenged the Bureau’s arguments, writing that the “unconstitutionality of the CFPB’s funding scheme is confirmed by both its unprecedented nature and lack of any limiting principle. Whether viewed with an eye toward the past or the future, the threat to separated powers and individual liberty is easy to see.” Disagreeing with the Bureau’s position that the Constitution gives Congress wide discretion to exempt agencies from annual appropriations and that independent funding is not uncommon for a financial regulator, the respondents stated that Congress gave up its appropriations power to the Bureau “without any temporal limit.” The respondents further took the position that the Bureau “can continue to set its own funding ‘forever’” unless both chambers agree and can persuade or override the president. Moreover, because the Federal Reserve Board is required to transfer “the amount determined by the Director to be reasonably necessary to carry out the [CFPB’s] authorities, . . . it ‘foreclose[s] the application of any meaningful judicial standard of review.’”
The respondents also argued that the Bureau’s funding structure is clearly distinguishable from other assessment-funded agencies in that these financial regulators are held to “some level of political accountability” since “they must consider the risk of losing funding if entities exit their regulatory sphere due to imprudent regulation.” Additionally, the respondents claimed that the fundamental flaws in the funding statute cannot be severed, reasoning, among other things, that courts “cannot ‘re-write Congress’s work’” and are not able to replace the Bureau’s self-funding discretion with either a specific sum or assessments from regulated parties.
With respect to the vacatur of the Payday Lending Rule and the potential for unintended consequences, the respondents urged the Court to affirm the 5th Circuit’s rejection of the rule, claiming it was unlawfully promulgated since a valid appropriation was a necessary condition to its rulemaking. “Lacking any viable legal argument, the Bureau resorts to fear-mongering about ‘significant disruption’ if all ‘the CFPB’s past actions’ are vacated,” the respondents wrote, claiming the Bureau “grossly exaggerates the effects and implications of setting aside this Rule.” According to the respondents, the Bureau does not claim that any harm would result from setting aside the rule, especially since no one has “reasonably relied” on the rule as it has been stayed and never went into effect. As to other rules issued by the agency, the respondents countered that Congress could “legislatively ratify” some or all of the agency’s existing rules and that only “‘timely’ claims can lead to relief” in past adjudications. Additionally, the respondents noted that many of the Bureau’s rules were issued outside the six-year limitations period prescribed in 28 U.S.C. § 2401(a). This includes a substantial portion of its rules related to mortgage-related disclosure. Even for challenges filed within the time limit, courts can apply equitable defenses such as “laches” to deny retrospective relief and prevent disruption or inequity, the respondents said.
CFPB launches medical-debt inquiry with HHS and Treasury
On July 7, the CFPB, Department of Health and Human Services, and the Treasury Department announced they are looking into high-cost specialty financial products such as medical credit cards and installment loans used by patients to pay for health care. These products, the agencies explained, were once primarily used to pay for medical treatments not traditionally covered by health insurance but may now be more widely used even when medical care may be covered by insurance or financial assistance. The agencies released a request for information (RFI) seeking feedback on a range of topics, including costs associated with medical payment products, how prevalent the products are, health care providers’ incentives to offer these products to patients, and whether patients fully understand the risks and consequences associated with medical payment products.
Specifically, the agencies are soliciting comments “on whether these products may allow health care providers to operate outside of a broad range of patient and consumer protections.” Feedback is also requested on whether use of these products is contributing to health care cost inflation, displacing hospitals’ provision of financial assistance, causing patients to pay inaccurate or inflated medical bills, increasing the amount patients must pay due to financing costs, or otherwise contributing to consumer harm, including through downstream credit reporting and debt collection practices. The agencies also want to know if using these products is creating disparities across different demographic groups, as well as policy options to protect consumers from harm.
The agencies commented that the RFI will assist in their understanding of consumer harms and financial challenges caused by specialty medical payment products and will serve to guide next steps, including future Bureau actions focusing on credit origination, debt collection, and credit reporting practices of the financial companies that originate and service these products.
Comments on the RFI are due within 60 days of publication in the Federal Register.
Additionally, the Bureau is hosting a hearing on July 11 to address medical billing and collection concerns with a focus on medical payment products.
FTC proposal would ban deceptive reviews
On June 30, the FTC introduced a proposed rule to combat deceptive review practices and ensure consumer protection in light of the impact and progression of technology and artificial intelligence. The rule seeks to prohibit the creation and sale of fake consumer reviews, prevent review hijacking, and restrict the manipulation of reviews through incentives. Under the proposed rule, businesses would be prohibited from creating or selling reviews by individuals who do not exist or lack real experience with the product or service. Additionally, the proposed rule prohibits businesses from providing compensation or incentives in exchange for consumer reviews expressing specific sentiments, whether positive or negative. To enhance transparency and integrity, the proposed rule also includes provisions related to insider reviews and testimonials. It also emphasizes the importance of transparency by requiring disclosure of relationships in insider reviews and testimonials. Under these provisions, officers and managers of companies would be required to disclose their relationships when writing reviews or testimonials about their products or services. Businesses would also be obligated to disclose relationships in testimonials written by insiders. Moreover, the FTC's proposed rule targets businesses that create or control websites claiming to provide impartial opinions about a particular category of products or services, including their offerings. Further, it prohibits businesses from using unjustified legal threats, intimidation, or false accusations to prevent or remove negative consumer reviews. This provision aims to preserve the independence and authenticity of consumer reviews, preventing businesses from manipulating public perception through controlled review websites. Considering the widespread influence of social media, the rule would prohibit businesses from selling or buying fake followers or views.
The FTC is currently seeking public comments on the proposed rule.
Highlights from the CFPB’s 2022 fair lending report
On June 29, the CFPB issued its annual fair lending report to Congress which outlines the Bureau’s efforts in 2022 to fulfill its fair lending mandate. Much of the Bureau’s work in 2022 was directed towards unlawful discrimination in the home appraisal industry and addressing redlining. According to the report, the CFPB also honed its efforts on factors that influence fair access to credit which included insight into factors affecting consumers’ credit profiles. The report highlights one fair lending enforcement action from 2022, where the CFPB and DOJ filed a joint complaint and proposed consent order against a company for allegedly violating ECOA, Regulation B, and the CFPA by discouraging prospective applicants from applying for credit. Notably, the Bureau notes that under section 704 of ECOA, it must refer any cases with instances of a creditor being believed to have engaged in a “pattern or practice of lending discrimination” to the DOJ. According to the report, the FDIC, NCUA, Federal Reserve Board, and CFPB collectively made 23 such referrals to the DOJ in 2022, a 91 percent increase from 2020. Five of the 23 matters were sent by the CFPB, four of which involved alleged racial discrimination in redlining, and one involving alleged discrimination in underwriting based on receipt of public assistance income. The report also discusses the CFPB’s risk-based prioritization process that resulted in initiatives concerning small business lending, policies and procedures on exclusions in underwriting, and the use of artificial intelligence. Moving forward, the Bureau will continue its collaborative approach with other agencies and prioritize areas such as combating bias in home appraisals, redlining, and the use of advanced technologies in financial services. Additionally, the report states that by focusing on restorative outcomes, comprehensive remedies, and equal economic opportunities, the CFPB aims to create a fair, equitable, and nondiscriminatory credit market for consumers.