To keep you informed of recent activities, below are several of the most significant federal and state events that have influenced the Consumer Finance Services industry over the past week:

Federal Activities

State Activities

Federal Activities:

• On September 21, the Consumer Financial Protection Bureau (CFPB) outlined a plan for rulemaking under the Fair Credit Reporting Act (FCRA) that could significantly impact the entire consumer data ecosystem. The proposed rulemaking could redefine “data brokers” and “data aggregators,” and extend FCRA regulation to businesses that do not currently meet the FCRA’s definition of “consumer reporting agency.” The CFPB’s plan could also impose stricter rules for obtaining consumer consent, and increase compliance requirements and risks for both new and existing members of the FCRA-regulated consumer data ecosystem. The proposed rulemaking could also impact consumer reporting agencies (CRAs), furnishers of data to CRAs, sources of data for “data brokers” and “data aggregators,” and end users of data obtained from CRAs and/or “data brokers”/”data aggregators.” CFPB Director Rohit Chopra indicated that a proposed rule would likely be issued in 2024. For more information, click here.
• On September 20, the Senate Banking, Housing, and Urban Affairs Committee held a hearing on artificial intelligence (AI) in financial services. In his opening statement, Chair Sherrod Brown (D-OH) alleged that AI could cause significant changes in our financial system. “Increasingly, banks, brokers, and insurance companies are employing AI to process data, decide who can get a loan, and tailor financial products to customers. With the advent of this new and potentially transformative technology, we have a responsibility to assess what AI means not just for our financial system, but for the American people.” Brown further argued that “we have a responsibility to ensure this technology is used – when it is used at all – to protect consumers and savers, while promoting a fair and transparent economy[.]” Senator Mike Rounds (R-SD) also expressed some caution around AI but warned that overregulating new technologies is not a solution that supports innovation. For more information, click here.
• On September 19, the CFPB issued guidance regarding the legal requirements that creditors must follow when using AI and complex models. The guidance requires lenders to use specific and accurate reasons when taking adverse actions against consumers, meaning creditors may not simply use CFPB sample forms if they do not reflect actual reasons for denying credit or changed credit conditions. For more information, click here.
• On September 19, Chair of the Securities and Exchange Commission’s (SEC) Crypto Assets and Cyber Unit David Hirsch stated that the SEC is not finished bringing enforcement actions against cryptocurrency companies. The agency particularly says it will continue focusing on bringing enforcement actions against decentralized finance projects and exchanges, and will also target intermediaries like brokers, dealers, clearing agencies, or any other actors. However, the SEC acknowledged that its litigation rate has been unusually high, and the agency understands that it cannot pursue every enforcement case it desires. For more information, click here.
• On September 19, the U.S. District Court for the District of Columbia denied a motion for summary judgment filed by the National Association of Mutual Insurance Companies (NAMIC), challenging the disparate-impact rule as exceeding the U.S. Department of Housing and Urban Development’s rulemaking authority. NAMIC argued that the disparate-impact rule is unlawful because: (a) it would cause protected characteristics to be used and considered by insurers in a pervasive way, which it argued is contrary to the Fair Housing Act (FHA); (b) it forces insurers to consider the protected characteristics that state laws prohibit from consideration; (c) it conflicts with the FHA insofar as the rule allows a claim to be established solely on statistical disparities; and (d) it violates the FHA insofar as the rule allows a prima facie showing with nothing more than evidence of statistical disparities. The court ultimately rejected all four NAMIC arguments as “unconvincing.” The rule, which was first promulgated in 2013 and later reinstated under the Biden administration, establishes that a policy is unlawful if it causes or “predicably will cause a discriminatory effect” on a protected class that is not otherwise “necessary to achieve one or more substantial, legitimate, nondiscriminatory interests.” For more information, click here.
• On September 18, the CFPB released a final rule that revised the threshold dollar amounts triggering certain provisions implementing the Truth-In-Lending-Act and its amendments that impact loans under the Home Ownership and Equity Protection Act of 1994 (HOEPA) and qualified mortgages (QM). The thresholds will take effect on January 1, 2024, as follows:
  • For HOEPA loans, the adjusted total loan amount threshold for high-cost mortgages will be $26,092, and the adjusted points-and-fees dollar trigger for high-cost mortgages will be $1,305.
  • For QMs, the thresholds for the spread between the annual percentage rate and the average prime offer rate will be 2.25 or more percentage points for a first-lien covered transaction with a loan amount greater than or equal to $130,461; 3.5 or more percentage points for a first-lien covered transaction with a loan amount greater than or equal to $78,277 but less than $130,461; 6.5 or more percentage points for a first-lien covered transaction with a loan amount less than $78,277; 6.5 or more percentage points for a first-lien covered transaction secured by a manufactured home with a loan amount less than $130,461; 3.5 or more percentage points for a subordinate-lien covered transaction with a loan amount greater than or equal to $78,277; or 6.5 or more percentage points for a subordinate-lien covered transaction with a loan amount less than $78,277″; and
  • For all QM categories, the adjusted thresholds for total points and fees will be “3%of the total loan amount for a loan greater than or equal to $130,461; $3,914 for a loan amount greater than or equal to $78,277 but less than $130,461; 5%of the total loan amount for a loan greater than or equal to $26,092 but less than $78,277; $1,305 for a loan amount greater than or equal to $16,308 but less than $26,092; and 8% of the total loan amount for a loan amount less than $16,308.”

For more information, click here.

• On September 15, the Financial Crimes Enforcement Network (FinCEN) ordered Bancredito International Bank and Trust Corporation to pay $15 million to resolve an investigation into alleged “willful” Bank Secrecy Act (BSA) violations. The enforcement action includes a violation for failure to implement and maintain an Anti-Money Laundering (AML) program under 31 C.F.R. 1020.210(b). Bancredito allegedly processed millions of dollars in suspicious transactions through the U.S. on behalf of high-risk customers, providing correspondent accounts to foreign institutions without performing the due diligence and reporting required by the BSA. For more information, click here.
• On September 7, the International Organization of Securities Commissions (IOSCO) published a consultation report to highlight the IOSCO’s policy recommendations to address market integrity and investor protection in decentralized finance (DeFi). Key policy insights include that regulators should (1) analyze DeFi with a view to applying the principle of “same activity, same risk, same regulatory outcome;” (2) identify responsible persons in a DeFi arrangement subject to regulatory frameworks; (3) achieve common standards of regulatory outcomes; (4) require identification and address conflicts of interest; (5) identify and address material risks; (6) require clear, comprehensive, and accurate disclosures; (7) enforce applicable laws; (8) promote cross-border cooperation; and (9) understand the interconnections between DeFi, the broader crypto market, and traditional financial markets. For more information, click here.
• On September 7, the Bank of International Settlements published a bulletin titled, “The Oracle Problem and the Future of DeFi.” The bulletin discusses the implications of DeFi’s reliance on “oracles,” which are used to import real-world data into blockchain environments for use in smart contracts. The bulletin challenges whether oracles can adhere to the decentralization ethos of crypto given that full decentralization erodes blockchain efficiency. As a result, the bulletin authors conclude that crypto-based DeFi is likely to remain the preserve of crypto assets, rather than being used for real-world assets. For more information, click here.

State Activities:

• On September 21, New York Attorney General (AG) Letitia James announced an agreement with a private nonprofit liberal arts college to invest $3.5 million to protect students’ online data. The AG launched an investigation into the college’s data security infrastructure following a data breach in 2021 that impacted nearly 100,000 current and prospective students, faculty, and alumni. The investigation revealed that the college had not properly secured its network, nor had it updated its policies to account for new security concerns, making it susceptible to breach. The college must now invest $3.5 million to strengthen data encryption and security protocols. For more information, click here.
• On September 21, the California Department of Financial Protection and Innovation (DFPI) announced that it has ordered a Richmond, CA woman and four entities under her control to desist and refrain from an alleged securities fraud scheme impacting Tongan communities within the state. According to the DFPI order, Walker-Sumchai made several material misrepresentations and omissions to investors when offering and selling unqualified securities under the name of one of the entities for which she serves as the founder and CEO. The order alleges that, as a result of a scheme that functions similar to a Ponzi scheme, Walker-Sumchai received more than $11.8 million from investors. For more information, click here.
• On September 18, the New York State Department of Financial Services (NYDFS) issued proposed guidance that exhibits its expectations for coin-listing and delisting procedures. The NYDFS also issued updated guidance concerning its framework for how coins become designated to the NYDFS’ greenlist. These new guidance documents take the form of two letters addressed to virtual currency business entities. The first guidance document addresses the “General Framework for Greenlisted Coins” while the second guidance document addresses the “Proposed Updates to Guidance Regarding Listing of Virtual Currencies.” For more information about both guidance documents, click here.
• On September 18, AG James obtained a court order requiring three cash advance companies to cancel debt owed by several small businesses nationwide and repay all interest and overcharges collected. The AG sued the three companies in 2020 for a conduct that she found to be harmful to small businesses in New York and throughout the nation. Specifically, the AG found that the companies were charging excessive interest rates, fraudulently charging undisclosed fees, debiting excess funds from merchants’ banks accounts, and illegally obtaining judgments against merchants by filing false affidavits in state courts. For more information, click here.
• On September 14, Delaware Governor John Carney signed SB8. It takes effect six (6) months after its enactment into law. The bill protects patients from certain debt collection practices for medical debt. The bill also:
  • Prohibits large health care facilities and medical debt collectors from charging interest and late fees;
  • Requires health care facilities and medical debt collectors to offer reasonable payment plans;
  • Restricts collection action within certain time frames after the medical bill has been sent;
  • Requires certain notice and disclosures prior to taking collection action; and
  • Prohibits reporting the medical debt until one year after the patient was provided the invoice or three months after the most recent payment.

For more information, click here.