InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
CFPB issues guidance on “excessive” account information fees, returns $140 million to consumers
On October 11, the CFPB issued an advisory opinion concerning consumers’ requests for information regarding their accounts with large banks and credit unions (financial institutions). According to the Bureau, Section 1034(c) of the Consumer Financial Protection Act (the “law”) requires insured depository institutions that offer consumer financial products or services and that have total assets of more than $10 billion, as well as their affiliates, to “comply in a timely manner with consumer requests for information concerning their accounts for consumer financial products and services, subject to limited exceptions.” The advisory opinion includes the following guidance and interpretations:
- Requirements of the law apply even if a customer does not expressively invoke the law.
- Requirements of the law apply to consumer requests for information including information that appears on periodic statements or in online portals including: (i) the amount of the balance in a deposit account; (ii) the interest rate on a loan or credit card; (iii) individual transactions or payments; (iv) bill payments; (vi) recurring transactions; (vii) terms and conditions; and (viii) fee schedules.
- The term “supporting written documentation” in the law requires financial institutions to provide, upon request, “written documents that will substantiate information provided in response to consumer questions, or that will assist consumers with understanding or verifying information regarding their accounts.”
- Financial institutions must provide account information and documentation that is in their “control” and “possession.” This excludes (i) confidential commercial information; (ii) information collected to prevent fraud or money laundering or detecting or making any report regarding unlawful conduct; (iii) information required by law to be kept as confidential; and (iv) supervisory information and nonpublic information.
- The law does not contain language stating or suggesting that financial institutions cannot impose unreasonable conditions on consumer information, but there is no reason Congress intended for the law to allow financial institutions to do so. Generally, the Bureau believes requiring fees and obstacles that impede a consumer’s ability to access their rights granted by the law is a violation of the provision. A financial institution could violate this law by imposing “excessively long wait times to make a request to a customer service representative, requiring consumers to submit the same request multiple times, requiring consumers to interact with a chatbot that does not understand or adequately respond to consumers’ requests, or directing consumers to obtain information that the institution possesses from a third party instead,” among other things.
- There is no fixed time limit for an institution to respond to a consumer’s request, but the CFPB does not view the timing requirements of this law to differ from the timing requirements of other applicable federal laws or regulations.
- Responses must provide all information requested accurately to be considered compliant.
CFPB Director Rohit Chopra delivered remarks on a press call, in which he emphasized that the Bureau’s investigations have uncovered many examples of junk fee-related misconduct by large financial institutions. He reminded consumers that financial institutions should not charge them excessive fees when trying to manage their finances. “Congress passed a law a decade ago requiring heightened customer service standards," said Chopra. "To date, this law has not been enforced. We are changing that.” Chopra also announced that later this month, the CFPB will propose rules to create more competition in banking to make switching financial institutions for better rates and less junk fees, more accessible.
The CFPB additionally issued the results of its recent oversight inspections of major financial institutions, which resulted in financial institutions refunding $140 million in junk fees, $120 million of which were for “surprise overdraft fees and double-dipping on non-sufficient funds fees.”
FTC announces second request for public comment on rule to ban “junk fees”
On October 11, the FTC released a notice of proposed rulemaking meant to prohibit unfair and deceptive, costly fees, also known as “junk fees.” After announcing its Advance Notice of Proposed Rulemaking last year (covered by InfoBytes here), and after considering more than 12,000 public comments, the FTC determined that some businesses misrepresent overall costs by omitting mandatory fees from advertised prices until consumers are “well into completing the transaction,” and fail to adequately explain the nature and amount of fees. The Commission is seeking another round of comments for its proposed rule, which, for any entity that “offers goods or services” to consumers, would prohibit:
- Offering, displaying, or advertising an amount a consumer may pay without “clearly and conspicuously” disclosing the “total price,” which must be displayed “more prominently than any other pricing information.”
- Misrepresenting “the nature and purpose of any amount a consumer may pay.”
- Disclosing “any other pricing information” besides the total price “more prominently” than disclosures of the total price in an “offer, display, or advertisement.”
The proposed rule would also grant the FTC more robust enforcement authority to seek refunds for harmed consumers and impose monetary penalties of up to $50,120 per violation. The proposed rule also requires businesses to include any mandatory costs for ancillary goods or services in their price disclosures.
The FTC is working alongside the CFPB, OCC, FCC, HUD and the Department of Transportation to develop and implement rules banning junk fees. The CFPB has also issued guidance emphasizing that large banks and credit unions are prohibited from imposing unreasonable obstacles on customers, such as charging excessive fees, for basic information about their accounts. Further, the White House has called on federal agencies “to reduce or eliminate hidden fees, charges, and add-ons for everything from banking services to cable and internet bills to airline and concert tickets.”
The Commission is seeking public input on 37 questions, with comments due 60 days after publication in the Federal Register.
FTC data spotlight reveals social media as primary source for scams over other contact methods
On October 6, the FTC released a data spotlight showing that more scams have originated on social media than on any other method of contact with consumers, accounting for $2.7 billion in consumer losses from 2021 to 2023. The FTC reports that the most frequently reported frauds in 2023 were online shopping scams on social media. However, promotions of fake investment opportunities, mostly those relating to cryptocurrency, on social media had the largest overall monetary losses. The FTC also provided a list of tips for consumers to limit their risks of fraud on social media, including restricting who can contact them on these platforms.
Fed finalizes rule establishing capital requirements for supervised insurers
On October 6, the Fed approved a final rule to implement a rule establishing capital requirements for insurers it supervises. The final rule includes the Building Block Approach (BBA) framework, which is a regulatory framework for assessing capital requirements for insurance companies, tailored to their specific risks by leveraging state-based requirements. It sets a minimum standard comparable to the 8 percent minimum total capital ratio for insured depository institutions (IDIs).
Specifically, the rule requires a Fed-supervised insurance organization (SIO) to aggregate the available capital and required capital of its top-tier company with its subsidiaries to determine whether the aggregate ratio meets the Board’s minimum requirement and “capital conservation buffer.” Among other things, the final rule gives SIOs two options to show compliance with Section 171(b) of Dodd-Frank: (i) demonstrate that it meets, on a fully consolidated basis, the minimum risk-based capital requirements that apply to IDIs; or (ii) demonstrate that it meets the minimum IDI risk-based capital requirements on a partially consolidated basis, excluding the assets and liabilities of certain subsidiary insurers. Should SIOs choose the second option, there are two possible treatments for unconsolidated insurance subsidiaries: (i) “a deduction from qualifying capital of the aggregate amount of the outstanding equity investment in the subsidiary, including retained earnings”; or (ii) “inclusion of the net investment in the subsidiary as an asset subject to a risk weight of 400 percent, consistent with the current treatment of certain equity exposures under the regulatory capital rules applicable to IDIs.”
Governor Michelle Bowman commented that although she supports the final rule, she cannot support the delegation of authority to staff within the current package. Concerned that the package grants broad authority to staff to make various determinations regarding the rule’s application, Bowman argues that the Board should have the opportunity to review specific cases where such authority would be exercised and suggests that it would be more appropriate to establish clear guidelines for the use of delegated authority in the context of actual determinations.
The Fed noted that the final rule is “substantially similar” to the 2019 proposed rule. The final rule is effective on January 1, 2024.
NY proposes amendments of debt collector rules
On September 30, the New York City Department of Consumer and Worker Protection (Department) published proposed amendments to its rules relating to debt collectors. The proposed amendments to its 2020 rules, which require debt collectors to inform consumers about language access services, come in response to the CFPB’s 2020 updates to the FDCPA, and the Department’s 2022 public hearing, among other things. The proposed rule (i) repeals a section requiring debt collection agencies to give consumers certain disclosures when collecting on time-barred debt; (ii) requires debt collection agencies to maintain an annual report identifying certain actions taken by the agency in any language; (iii) expands the list of required records to cover compliance with relevant laws and rules, as well as a monthly log of all debt collection-related communications by any medium between the agency and the consumer; and (iv) adds definitions relating to communications with consumers, such as “attempted communication,” “clear and conspicuous,” “covered medical entity,” “limited-content message,” “original creditor” and “originating creditor.”
FDIC proposes additions to its safety and soundness standards
On October 5, the FDIC issued a notice of proposed rulemaking that would add a new appendix to the agency’s safety and soundness standards. The new appendix, which would be Appendix C, “is intended to promote strong corporate governance and risk management at FDIC-supervised institutions that have total consolidated assets of $10 billion or more by proposing corporate governance and risk management guidelines.” The proposed guidelines would describe the general obligations of the board of directors, requiring the board to be active and involved in protecting the interests of the institution, adopt a code of ethics for the institution’s operations, and form a Risk Committee within the institution’s committee structure. The proposed guidelines would also require institutions to establish a risk management program that includes a “three-line-of-defense model” for risk monitoring and reporting, as well as require institutions to create and maintain a risk profile and risk appetite statements that are communicated to all employees to encourage compliance.
Fed's Bowman discusses research of regulatory thresholds, deposits
On October 4, Federal Reserve Governor Michelle Bowman delivered a speech at the Fed’s annual Community Banking Research Conference, calling for more research on regulatory thresholds and the deposit insurance framework. In her remarks, Bowman discussed the importance of evidence-based research around community banks and their role in the U.S. banking system, especially in light of recent bank failures. “Research and evidence-based rulemaking can insulate the banking system from wide swings in policy over time,” she said, adding that before rulemaking, the agency must have a comprehensive understanding of both the root causes of bank failures and the costs and consequences of potential reforms.
Bowman additionally discussed needed reforms to bank merger policy, particularly to include nonbank competitors and credit unions in the analysis of the competitive landscape. Bowman argued that the use of a narrower view on competitive concerns has led to increasingly long application and review periods for mergers, which can increase negative outcomes.
Regarding community bank thresholds, Bowman noted contradictions and inconsistencies how community banks are defined, and accordingly regulated, across the regulatory system. For example, while the Dodd-Frank Act defined community banks as those institutions with less than $10 billion in total consolidated assets, the Community Reinvestment Act regulation includes asset thresholds well below the “common understanding of what a community bank is.” “Are these asset size thresholds properly calibrated, and are the impacts, costs, and benefits to institutions and to customers when banks cross these different thresholds rational? Are these thresholds creating the right incentives to promote prudent lending while appropriately balancing risk?” Bowman asked. She suggests leveraging business models in tailoring rules, instead of looking only at asset-size thresholds.
Another area in need of research in the wake of recent bank failures, Bowman suggested, is bank funding models and deposit infrastructure. Thanks to modern technology, consumers can withdraw funds faster than ever, so deposit insurance parameters are worth revisiting to ensure it can “support banking sector stability in the face of the challenges posed by today's technology,” Bowman said.
FHFA OIG report reveals Federal Home Loan banks did not meet credit risk expectations
On September 21, FHFA Office of Inspector General (OIG) released a report on Federal Home Loan Bank Supervisory Activities in 2023 in Response to Market Disruptions (report), to evaluate the Division of Federal Home Loan Bank Regulation (DBR) risk assessment. DBR is responsible for supervising the Federal Home Loan (FHL) Bank System “to ensure the safe and sound operation of FHL banks.” The OIG addressed March bank failures and how the DBR scrutinized the FHL banks’ member credit risk management practices and, more broadly, into the system’s role in lending to troubled members. The report found that DBR examiners, in response to the increased risk environment, adjusted its supervisory activities and examination planning. Additionally, the OIG noted that DBR intends to conduct a comprehensive assessment of credit risk management across the entire FHL bank system to address concerns regarding systemic vulnerabilities. The report also revealed that in the review of examiner compliance, although DBR mostly followed procedure and requirements, “in certain instances, examiners did not describe primary worksteps in their pre-examination analysis memoranda, as required by DBR procedures.”
According to the report, FHFA also ordered an assessment of six FHL banks during or after the March market disruption, “in response to the abrupt increase in demand for FHLBank advances and the collapse of several member banks.” The report notably revealed that home loan banks’ credit risk management “fail[ed] to meet existing expectations.” As a result, DBR is preparing a supervisory letter for all the FHL banks and an advisory bulletin on member credit risk.
FCC updates rules to curb robocallers
On September 21, the FCC adopted rules that would strengthen and modernize the requirements that providers under the Voice over Internet Protocol (VoIP) need to abide by to obtain direct access to telephone numbers. The rules impose guardrails to make it more difficult for those who make illegal robocalls to access telephone numbers, which the FCC stated helps to protect national security and law enforcement, safeguard the nation’s finite numbering resources, reduce the opportunity for regulatory arbitrage, and further promote public safety. The FCC finalized the rules after the FCC sought comment in 2021 under the Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, which directed the FCC to examine its rules regarding direct access to telephone numbers.
The rules require an applicant seeking direct access to telephone numbers to:
- Provide certifications regarding its compliance with FCC robocall rules, FCC interconnected VoIP provider rules, and timely filing of FCC Forms 477 and 499.
- Submit disclosures on and continue to update its ownership structure, including related foreign entities, to reduce the risk that U.S. numbering resources reach bad actors abroad.
- Comply with applicable business-related state laws and registration requirements.
The rules codify the FCC’s role in completing direct access application review and rejection and the authorization revocation process.
Additionally, the rules instruct the North American Numbering Council to study numbering use to inform the FCC’s future rulemaking. The rules also seek comments on a variety of topics, including further reforms on new direct access applications, duties of existing direct access authorization holders, and whether direct access applicants should disclose a list of states where they will provide initial services.
The rules will take effect 30 days after publication in the Federal Register.
CFPB announces consumer reporting rulemaking
On September 21, the CFPB announced the beginning of its anticipated rulemaking regarding consumer reporting, including a proposal to remove medical bills from credit reports. This announcement builds upon a hearing the CFPB held in July 2023 on medical billing and collections, highlighting its range of negative impact on marginalized communities (covered by InfoBytes here). In the CFPB’s announcement, Director Rohit Chopra emphasized the inconsequential “predictive value” of medical bills in credit reports despite their prevalence in American households, thus the agency's goal is to alleviate the burden on individuals facing medical debt. The Bureau’s press release highlighted components to its outline of proposals and alternatives under consideration, such as (i) prohibiting consumer reporting companies from including medical bills in consumers’ credit reports; (ii) prohibiting creditors from relying on medical bills for underwriting decisions; and (iii) prohibiting debt collectors from leveraging the credit reporting system to pressure consumers into paying their debts. The rule would not prevent creditors from accessing medical bill information, such as validating need for medical forbearances, or evaluating loan applications for paying medical debt.
In addition to the proposed removal of medical debt from consumer reports, the Bureau’s outline includes other notable proposals regarding consumer reports. The Bureau’s proposals include:
- As previously covered by InfoBytes, applying the FCRA to data brokers by altering the FCRA definitions of “consumer report” and “consumer reporting agency”, to “address whether and how the FCRA applies to newer actors and practices in the credit reporting marketplace, including questions such as coverage of data brokers and certain consumer reposting agency practices regarding marketing and advertising.” In particular, the Bureau is also considering a proposal that would provide that data brokers selling “consumer reports” containing consumers’ payment history, income, and criminal records would be considered a consumer reporting agency. The Bureau is also exploring clarifications on when data brokers qualify as consumer reporting agencies and furnish consumer reports.
- Clarifying whether “credit header data” qualifies as a consumer report, which could limit the disclosure or sale of credit header data without valid reasoning.
- Clarifying that certain targeted marketing activities that do not directly share information with a third party nevertheless are subject to the FCRA.
- Proposing a definition of the terms “assembling” and “evaluating” to include intermediaries or vendors that “transmit consumer data electronically between data sources and users.”
- Clarifying whether and when aggregated or anonymized consumer report information constitutes or does not constitute a consumer report. Specifically, the Bureau contemplates providing that a data broker’s sale of particular data points such as “payment history, income, and criminal records” would “generally be a consumer reports, regardless of the purpose for which the data was actually used or collected, or the expectations of that data broker
- Establishing the steps that a company must take to obtain a consumer’s written instructions to a obtain a consumer report.
- Addressing a consumer reporting agency’s obligation under the FCRA to protect consumer reports from a data breach or unauthorized access.