InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
FINRA report covers new topics including cryptoassets
On January 9, FINRA released a report on regulatory oversight titled “2024 FINRA Annual Regulatory Oversight Report.” The report integrates FINRA’s regulatory operations programs as a source of information for firms to strengthen their compliance standards. The report outlines new topics, including Crypto Asset Developments, OTC Quotations in Fixed Income Securities, Advertised Volume, and the Market Access Rule.
With respect to Crypto Asset Developments, the report focuses on surveillance themes and effective practices including best practices for due diligence. On the topic of OTC Quotations in Fixed Income Securities, the report highlights amendments to the rules governing publication of quotations by broker-dealers in a quotation medium. Further, with respect to Advertised Volume, FINRA highlights Rule 5210, which prohibits member firms from publishing transactions that are not believed to be a bona fide purchase or sale of a security.
The report notes that the SEC’s Market Access Rule prohibits firms that provide market access from “jeopardiz[ing] their own financial condition.” Findings include insufficient controls and failure to consider additional data. Effective practices include pre-trade fixed-income financial controls and soft blocks, among others. The report also covers several other topics including Cybersecurity, AML Fraud and Sanctions, Reg BI and Form CRS, and Consolidated Audit Trail.
NYDFS offers guidance to insurers on AI models
On January 17, NYDFS issued a guidance letter on artificial intelligence (AI) intended to help licensed insurers understand NYDFS’s expectations for combating discrimination and bias when using AI in connection with underwriting. The guidance is aimed at all insurers authorized to write insurance in New York State and is intended to help insurers develop AI systems, data information systems, and predictive models while “mitigat[ing] potential harm to consumers.”
The guidance letter states that while the use of AI can potentially result in more accurate underwriting and pricing of insurance, AI technology can also “reinforce and exacerbate” systemic biases and inequality. As part of the letter’s fairness principles, NYDFS states that an insurer should not use underwriting or pricing technologies “unless the insurer can establish that the data source or model… is not biased in any way” with respect to any class protected pursuant to New York insurance law. Further, insurers are expected to demonstrate that technology-driven underwriting and pricing decisions are supported by generally accepted actuarial standards of practice and based on actual or reasonably anticipated experience. It was last noted that these rules build on New York Governor Hochul’s statewide policies governing AI.
New York State floats BNPL legislation in FY 2025 budget
On January 14, New York proposed its FY 2025 budget: Transportation, Economic Development and Environmental Conservation Article VII Bill, which includes an article, cited as the “Buy Now Pay Later Act” (the “Act”). The Act includes new licensing provisions, requiring buy now pay later (BNPL) financing providers (referred to as “lenders” within the Act) to pay a fee and file a written application to receive a license in order to provide BNPL loans. BNPL lenders would also be required to submit an affidavit of financial solvency, disclose their license on their website, app, or other consumer interface, and list the license in the terms and conditions of any BNPL loan offered and entered by the licensee. Licensees would also be subject to supervisory investigations. The Act would further require BNPL lenders to (i) maintain policies for ensuring the accuracy of data that may be reported to credit agencies; (ii) disclose certain loan terms; (iii) engage in limited ability-to-repay analyses; (iv) refrain from charging unfair, abusive, or excessive fees; and (v) abide by certain restrictions and disclosure requirements relating to the use of consumer data, among other things.
NYDFS orders digital currency trading company to pay $8 million
On January 12, NYDFS announced that it had entered into a consent order with a digital currency trading company after an investigation that found the company responsible for compliance failures that violated NYDFS’s virtual currency and cybersecurity regulations, leaving the company vulnerable to illicit activity and cybersecurity threats.
NYDFS found that the company failed to meet its compliance obligations due to (i) deficiencies in the company’s AML program; (ii) failure to file compliant suspicious activity reports; (iii) failure to conduct required OFAC screening; and (iv) failure to maintain an adequate cybersecurity program. In connection with the settlement, the company will surrender its BitLicense, the license required to be held by any company conducting virtual currency business in New York state and pay an $8 million penalty.
Massachusetts State Appeals Court orders a consumer has standing to sue in state court under the FCRA without federal standing
On January 11, the Massachusetts Court of Appeals ordered that an employee has standing to sue in state court, despite lacking standing to sue in a federal court. The employee (plaintiff) sued a prospective employer for allegedly conducting a background check in a manner that violated the FCRA. The defendant successfully sought to have the case moved from state court to federal court. In federal court, the defendant was granted a motion to dismiss on the grounds that plaintiff lacked standing under Article III, which requires that the plaintiff allege a “concrete” injury. Ultimately, the case was remanded to state court, where the Superior Court dismissed the FCRA claims. The plaintiff appealed, and the appellate court ruled that the plaintiff had alleged facts sufficient to support standing to sue in state court, as the applicable standard did not require a showing of “concrete” harm.
District Court denies motion to dismiss State Attorneys’ General case against “subprime lender”
On January 12, the U.S. District Court for the Eastern District of Pennsylvania denied a defendant’s motion to dismiss a case brought by five State Attorneys General (State AGs) from Pennsylvania, New Jersey, Oregon, Washington, and D.C. seeking to enforce the CFPA. The State AGs allege the defendant engaged in “predatory lending practices” that violate state and federal law. As covered by InfoBytes, in Spring 2022, the CFPB issued an interpretive rule clarifying that states have the authority to enforce federal financial consumer protection laws, such as the CFPA. This interpretive rule led to partisan attacks claiming the CFPB was “colluding” with state regulators, as covered by InfoBytes here.
The defendant is a state-licensed and regulated “subprime installment lender” operating in 28 states. As noted in the opinion, the defendant offers loans between $1,000 and $25,000, with terms between 12 and 60 months and charges interest at rates ranging from 18.99% to 35.99% with an average APR of 28%, and average loan size of around $3,650.
In addition to the complaint regarding subprime loans, the State AGs assert that the defendant “deceptively ‘adds-on’” various insurance options to consumers’ loans and targets a financially vulnerable population: those with a credit score of 629 or less who “often already have significant… debt[.]”. The State AGs seek injunctive and other relief.
District Court dismisses FDCPA class action for lack of standing
Recently, the U.S. District Court for the Eastern District of New York dismissed a class action lawsuit alleging that a debt collector’s (defendant) collection notice violated the FDCPA by including two different balances absent any explanation, leaving plaintiff confused and unable to pay the debt. Plaintiff also alleged she suffered emotional harm and expended time and money as a consequence of defendant’s letter.
The district court held that plaintiff’s “mere” allegations of wasted time, resources, and efforts after receiving the collection letter do not establish injury-in-fact. Furthermore, the allegations do not support standing because “the burdens of bringing a lawsuit cannot be the sole basis for standing.” Additionally, in response to claims of emotional harms, the district court found that the allegations are “virtually identical to those that have been rejected in other similar FDCPA cases.” Ultimately, the district court found that “[p]laintiff does not clearly allege facts that demonstrate standing to pursue her claims in federal court, and the Court consequently lacks jurisdiction over this action.”
OCC releases January enforcement actions
On January 17, the OCC released a list of recent enforcement actions taken against national banks, federal savings associations, and individuals currently and formerly affiliated with such entities. Included is a notice of charges seeking cease and desist orders against three subsidiary banks of the same bank holding company (see here, here, and here), which alleged that each bank engaged in unsafe or unsound practices relating to an investment strategy concentrated in long-term securities. The unsafe practices, the OCC explained, exposed each bank to excessive interest rate risk without adequate sources of contingency funding and contingency capital. The OCC further alleged that each bank failed to mitigate such risk in a timely manner.
CFPB issues two opinions that stress FCRA compliance for consumer reporting companies
On January 11, the CFPB issued two advisory opinions to consumer reporting companies, reminding them of FCRA obligations. The first advisory opinion addresses background screening companies and inaccuracies that appear on consumer reports. The CFPB highlights how some consumer reporting companies will use a disposition date to start the seven-year reporting period for records of arrests and other non-conviction record information, instead of “date of entry,” resulting in consumer reports including older information than FCRA permits.
Consumer reporting companies must begin the seven-year time limit for criminal charges from the time of the original charge if a person is found not guilty. The CFPB added that inaccurate consumer reports can impact consumer access to employment and housing, and they require consumers to engage in a lengthy process to correct inaccuracies. This advisory opinion underscores that consumer reporting agencies must employ reasonable procedures to ensure accurate reporting, in line with FCRA obligations. Additionally, when reporting public record information, companies should avoid duplicative or legally restricted data and include disposition information for arrests, charges, or court filings.
The second advisory opinion addresses file disclosure obligations under the FCRA and clarifies that consumers can trigger a consumer reporting agency’s file disclosure requirement without using specific language like “complete file.” The opinion further confirms that consumer reporting companies must disclose both the original source and all intermediary or vendor sources that have furnished information to the CRA. To meet FCRA standards, a file disclosure must be understandable to the average consumer, helping them identify inaccuracies, dispute incomplete or incorrect information, and understand the impact of adverse information. The FCRA requires consumer reporting companies to provide a disclosure reflecting the information given or potentially given to a user, including presenting criminal history information in the format seen by users, enabling consumers to check for inaccuracies and dispute any errors.
The CFPB interprets the requirement to disclose “all information in the consumer’s file,” to include information that formed the basis of any summarized information that a CRA provided to a user. The CFPB also warns that the FCRA stipulates that “‘any person who willfully fails to comply with any requirement imposed under this title with respect to any consumer is liable to that consumer in an amount equal to’ actual or statutory damages” up to $1,000 per violation, punitive damages as determined by the court, and associated costs and reasonable attorney's fees.
26 State Attorneys General opine on FCC’s Notice of Inquiry regarding AI telemarketing
On January 17, the State Attorneys General from 26 states submitted reply comments to the FCC’s Notice of Inquiry (the Notice) on how artificial intelligence (AI) technologies are impacting consumers. The information gleaned in response to the Notice is intended to help the FCC better protect consumers from AI-generated telemarketing in violation of the TCPA. The State AGs urged that any AI-generated voice should be considered an “artificial voice” under the TCPA to avoid “opening the door to potential, future rulemaking proceedings” that allow telemarketing agencies to use AI-assisted technologies in outbound calls without the prior written consent of a consumer.