CFPB Issues Long-Awaited Short-Term Lending Final Rule

by Pepper Hamilton LLP

Pepper Hamilton LLP

The real impact on the high-cost loan industry is restricting the ability to attempt to collect a loan using any type of pull transaction more than twice.

On October 5, the CFPB issued it long-anticipated Payday, Vehicle Title, and Certain High-Cost Lending Rule covering certain short-term loans. The final regulation, published more than 15 months after it was proposed in June 2016, differs substantially from the initial proposal. The Rule, interpretations and accompanying materials are almost 1,700 pages long. This is a summary of the highlights of the final Rule to help clients and other interested parties understand the scope of the Rule and how it could affect their lending business. Based on the substantial changes made to the final Rule, it is not anticipated that it will dramatically alter the current high-cost lending landscape. In addition, the Rule will not take effect for some time — 21 months after publication in the Federal Register — bringing into question whether it will survive in its present form.

What types of consumer loans are covered?

The Rule covers three types of loans:

  1. Short-terms loans with a term of 45 days or less: closed-end loans where the consumer is required to pay the entire amount within 45 days of consummation; open-end loans where the consumer is required to pay the entire balance of any advance within 45 days.

  2. Longer-term balloon payment loans: closed-end and open-end loans where the consumer is required to pay the entire balance or advance more than 45 days after consummation or receipt of any advance in at least one payment that is more than twice as large as any other payment. Also covered are longer-term balloon payment loans where there are multiple advances and paying the minimum payment may not fully amortize the outstanding balance by a specified date or time and the final payment could be more than twice the amount of any other minimum payments.

  3. Longer-term loans: Loans that have annual percentage rates (APRs) of 36 percent or higher at consummation (for open-end plans as measured at consummation and the end of any billing cycle) and have a “leveraged payment mechanism,” an automated clearing house (ACH) payment plan, a check, or any other “pull” type of payment device. These types of loans are only subject to the Rule’s requirements limiting payment withdrawals and required disclosures and recordkeeping.

What are the requirements for covered loans?

If a loan is a short-term loan or a longer-term balloon payment loan, then the Rule deems it an unfair and abusive practice to make the loan without determining a consumer’s ability to repay the loan. This requires the lender to determine a consumer’s ability to make the loan’s payments while also meeting the consumer’s major financial obligations, which include basic living expenses, without needing to reborrow for 30 days. For an open-end plan, the lender is required to make this determination if a consumer seeks an advance more than 90 days after the lender’s last determination of their ability to repay.

How is ability to repay determined?

A lender has a number of options to determine ability to repay. While there are other ways to do this, the lender:

  1. Is permitted to obtain a consumer’s statement of his or her net income and payment obligations.

  2. Must verify a consumer’s payment obligations using a national consumer credit report.

  3. Must project the consumer’s residual income or debt-to-income ratio during the calendar month with the highest payment(s) under the loan.

In addition, the lender must also ensure the consumer does not have a sequence of more than three covered short-term or balloon payment loans taken out within 30 days of each other. Once the three-loan sequence is met, there is a required 30-day cooling-off period before other covered loans can be made.

How does the principal step-down option work?

A lender can assist a consumer to pay down the principal balance of an outstanding short-term loan without meeting the ability-to-repay requirements so long as the lender does not take a security interest in a motor vehicle and:

  1. The loan is not open-end credit.

  2. The loan being repaid is less than $500, and the second and third covered loans made within 30 days of the prior loan reduce the principal by at least a third from the prior loan. The loan must amortize completely during the term of the loan.

  3. The lender ensures the consumer does not have a sequence of more than three covered short-term or balloon payment loans taken out within 30 days of each other or six covered loans during any consecutive 12-month period. Once repaid, the 30-day cooling-off period begins.

  4. Certain required disclosures are provided to the consumer. The first disclosure must be provided at the beginning of the first sequence of loans and must advise the consumer of the principal step-down requirement for subsequent loans. Another disclosure must be provided at the time of the third loan in the sequence and must advise the consumer that two similar loans have been taken out without a 30-day cooling-off period and that the third loan must be smaller in amount than the prior two loans and that a 30-day cooling-off period is required.

What are the restrictions on the use of ACH withdrawals?

The restrictions on the use of what are called “leveraged payment mechanisms,” ACH withdrawals, PIN and signature debit card withdrawals, remotely created checks, internal transfers, or any other type of “pull transactions” apply to all three types of covered loans — short-term loans, longer-term balloon loans and longer-term loans.  

A lender is required to:

  1. Provide a written notice before its first attempt to withdraw a payment and before subsequent attempts that deviate from the scheduled amounts or dates or involve a different payment mechanism.

  2. When two consecutive withdrawal attempts have failed due to insufficient funds, a lender is not permitted to attempt another withdrawal from the same account unless the lender obtains a new specific authorization to make further withdrawals.

What is a registered information system?

Lenders subject to the ability-to-repay requirements and under the principal step-down option are required to furnish certain loan data to information systems registered with the CFPB and to pull a consumer report from the systems in the course of making covered short-term loans or longer-term balloon payment loans.

Reporting must be done at origination, updated if changes occur while the loan is outstanding, and when repaid or charged off.

Registered information systems must be able to receive the furnished information, generate a consumer report, have a federal consumer financial law compliance program, have an independent security assessment program done periodically, and be able to comply with the Rule.

What are the record retention requirements?

Lenders must develop and follow policies and procedures to comply with the Rule and retain evidence of compliance for 36 months.

What does the CFPB say about trying to evade the Rule?

The Rule has a simple statement that prohibits lenders from taking any action “with the intent of evading the requirements” of the Rule. The interpretation for this section discusses this issue in more depth and provides an example but, as did the initial proposal, raises serious questions about how lenders can operate in ways to avoid the Rule’s ability-to-repay requirements by structuring products that by their terms are outside of the Rule’s coverage.

Pepper Points

  1. While we will continue to review the extensive 1,700 pages of additional materials included in the Rule, which itself is only 57 pages long, the key takeaways are that the Rule focuses primarily on loans of less than 45 days, but the payment restrictions apply to any loan with a 36 percent or greater APR where a leveraged payment mechanism is used. So the real impact on the high-cost loan industry is restricting the ability to attempt to collect a loan using any type of pull transaction more than twice. This restriction may have profound implications for collecting such loans from consumers and may give rise to innovative “push” transactions, including those initiated by the consumer, such as automatic payments from a bank account.

  2. While the high-cost lending industry has been moving away from the classic two-week “payday” loan for many years, the Rule will no doubt hasten its demise. The costs of underwriting such loans and the restrictions on rollovers will surely make these types of loans less profitable than those longer-term, installment loans that are prevalent in the marketplace today.

  3. That being said, the ability-to-repay requirements have been substantially simplified, as evidenced by the ability to use stated income and expenses and rely on third parties to validate debts and other obligations. These changes from the initial proposal may help lenders continuing to make the traditional type of payday loan.

We will continue to review this extensive Rule and would be glad to assist clients and others in dealing with its implications for their lending programs.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pepper Hamilton LLP | Attorney Advertising

Written by:

Pepper Hamilton LLP

Pepper Hamilton LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.