CFPB Issues Final Rule Requiring Certain Nonbanks To Report Final Public Orders And Submit Annual Compliance Reports

On May 22, 2024, the Consumer Financial Protection Bureau (CFPB) issued a Final Rule (the Rule) requiring certain nonbank "covered persons" to report certain final public orders issued by a local, state, or federal government agency or court arising from "the offering or provision of a consumer financial product or service" to a registry that will be established by the CFPB (Registry). Additionally, the Rule requires certain supervised nonbanks to submit annual reports certifying their compliance with the registered public orders. The Rule, which will take effect Sept. 16, 2024, has been in the works since the Bureau announced the Proposed Rule and request for comments in December 2022. The CFPB also issued a condensed Executive Summary detailing the Rule's requirements and the CFPB's implementation plans. The Rule amends 12 CFR chapter X by adding Part 1092.

'Covered Persons' and Excluded Persons

"Covered person" generally means a person "participat[ing] in offering or providing consumer financial products or services." The Rule uses the term "covered nonbank" and excludes the following persons:

• Insured depository institutions and credit unions;
• Persons who are covered persons solely due to being a related person, i.e., "as provided in the Dodd-Frank Act (such as controlling shareholders, consultants, and independent contractors, if the person is a covered person only because the person is a "related person" and not a covered person for another reason);"
• U.S. states, including federally recognized Indian tribes;
• Natural persons;
• Motor vehicle dealers that are predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both, within the meaning of 12 U.S.C. 5519(a), except to the extent such a person engages in functions that are excepted from the application of 12 U.S.C. 5519(a) as described in 12 U.S.C. 5519(b); or
• Persons that qualify as covered persons based solely on conduct that is the subject of, and that is not otherwise exempted from, an exclusion from the Bureau's rulemaking authority under 12 U.S.C. 5517.

Covered Laws Under the Rule

The Rule's reporting requirement applies to certain covered orders that "[i]mpose[] such obligations on the covered nonbank based on an alleged violation of a covered law." "Covered law" specifically includes the following categories of consumer financial services laws, "to the extent that the violation of law found or alleged arises out of conduct in connection with the offering or provision of a consumer financial product or service":

• "A Federal consumer financial law;
• Any other law as to which the Bureau may exercise enforcement authority;
• The prohibition on unfair or deceptive acts or practices under section 5 of the Federal Trade Commission Act, 15 U.S.C. 45, or any rule or order issued for the purpose of implementing that prohibition;
• A State law prohibiting unfair, deceptive, or abusive acts or practices that is identified in appendix A of this part;
• A State law amending or otherwise succeeding a law identified in appendix A, to the extent that such law is materially similar to its predecessor; or
• A rule or order issued by a State agency for the purpose of implementing a prohibition on unfair, deceptive, or abusive acts or practices contained in a State law described in paragraph (4) or (5) [the preceding two bullet points]."

As indicated in the categories of covered laws, the Rule includes Appendix A, which contains specific state statutes identified by the CFPB as state laws prohibiting unfair, deceptive, or abusive acts or practices.¹ A public order issued to a covered nonbank under the authority of the laws listed in Appendix A will need to be reported to the Registry if the order arises from the offering or provision of a consumer financial product or service and meets all other requirements for a "covered order," which are detailed below.

Registration Requirement and 'Covered Orders'

The Rule requires covered nonbanks "identified by name as a party subject to a covered order" to "register as a registered entity with the nonbank registry," and provide updated information thereafter.

Specifically, a covered nonbank must submit a filing containing the required information either within 90 days after the applicable Registry implementation date (including qualifying orders predating the applicable Registry effective date, which includes those orders with effective dates beginning Jan. 1, 2017), or 90 days after the effective date of any applicable covered order, whichever is later. A covered nonbank must also submit an amendment filing within 90 days of the amendment of any applicable covered order, and must submit a revised filing if any covered order is "terminated, modified, or abrogated," by its own terms or because of an action by the government agency or court.

A "covered order" under the Rule is described in the Executive Summary as an order which:

• "Is a final, public order issued by an agency or court;
• Identifies a covered nonbank by name as a party subject to the order;
• Was issued at least in part in any action or proceeding brought by any Federal agency, State agency, or local agency;
• Contains public provisions that impose obligations on the covered nonbank to take certain actions or to refrain from taking certain actions;
• Imposes obligations on the covered nonbank based on an alleged violation of a covered law [see "Covered Laws Under the Rule" section above]; and
• Has an effective date on or after January 1, 2017."

A covered order's effective date is the date as stated in the order or the date of issuance. A covered order under the Rule will cease to be a covered order as of the later of (i) 10 years after its effective date; or (ii) if the covered order expressly provides for a termination date more 10 years after its effective date, the expressly provided termination date.

The Rule contains a "safe harbor" provision that allows a person to submit a notice to the Registry that it is not registering based on a good-faith basis that it believes that it is not a covered nonbank or that a certain public order is not a covered order. If the underlying circumstances change to make the person subject to the registration requirements, it must then comply with the registration and reporting requirements.

One-Time Alternative Registration Method for NMLS-Published Covered Orders

The Rule provides for a one-time, alternative registration method for covered orders that have already been published on the Nationwide Multistate Licensing System (NMLS) database of regulatory actions. The CFPB will determine the required information for such submissions. A covered nonbank that completes the one-time submission of NMLS-published covered orders information to the CFPB Registry will have no further reporting obligations with respect to those covered orders.

CFPB Publication of Registry Information Collected

The CFPB will publish the covered order information reported by nonbank persons on the Registry's public website. The public-facing information will not include "administrative information," which includes contact information for those nonbank persons reporting to the Registry and other information submitted to facilitate its administration, including "safe harbor" submissions for the annual reporting requirement (see the following section).

Annual Reporting Requirement and Designation of Senior Executive for Supervised Registered Entities

The Rule also contains additional reporting requirements for certain nonbank covered persons that are "supervised registered entities," which are "generally, covered nonbanks that are subject to CFPB supervision and have at least $5 million in qualifying annual receipts." These supervised registered entities subject to a covered order must designate a senior executive as its "attesting individual." This attesting individual must be the highest-ranking senior executive or other highest-ranking individual charged with managerial and oversight responsibilities, including oversight of the entity's compliance with federal consumer finance laws.

These supervised registered entities must submit an annual written statement by March 31, in the form specified by the CFPB, with updated information on any covered orders reported to the CFPB Registry by the entity. In the written statement, the attesting executive individual must (i) describe the steps they have taken to "review and oversee the supervised registered entity's activities subject to the applicable covered order for the preceding calendar year" and (ii) attest whether, to their knowledge, the "supervised registered entity during the preceding calendar year identified any violations or other instances of noncompliance with any obligations" resulting from a reported covered order.

The supervised registered entity must maintain sufficient records to "provide reasonable support for its written statement ... and to otherwise demonstrate compliance with the requirements" of the Rule for five years after each written statement submission. The annual written statement will not be included in the information that the CFPB publishes.

The Rule contains a good faith "safe harbor" provision that allows a person to submit a notice to the CFPB indicating its good faith belief that it is not a supervised registered entity or that an order in question is not a covered order, and that it therefore is not subject to these requirements.

Rule Impact on the Consumer Finance Industry and Industry Feedback

Consumer advocates and industry participants have reacted to the Proposed Rule, and now the final Rule, with a mixture of praise and concern. Conference of State Bank Supervisors (CSBS) President and CEO Brandon Milhorn voiced the CSBS's objections:

A number of state regulatory groups co-signed CSBS's comment letter opposing the Proposed Rule:

• American Association of Residential Mortgage Regulators
• National Association of Consumer Credit Administrators
• North American Collection Agency Regulatory Association
• Money Transmitter Regulators Association

The CFPB has framed the Rule and the Registry as a helpful one-stop shop where the CFPB, regulators, consumers, and industry participants will be able to view all applicable local, state, and federal enforcement orders easily for an industry participant. CFPB Director Rohit Chopra stated in his remarks on the Rule:

Director Chopra argued that if such a Registry were around in the early 2000s prior to the 2008 crash, concerns state regulators had raised against certain industry participants would have been more visible. By way of example, Director Chopra pointed out that the state of North Carolina "took 71 mortgage enforcement actions between 2004 and 2008." Director Chopra reiterated CFPB's intent to "better identify and act on enforcement trends, identify and monitor repeat offenders, and most importantly, ensure consumers are protected from any endemic risks."

Complying with the Rule may add another layer of compliance efforts and tracking required for covered nonbanks' compliance departments. Industry participants should consider closely evaluating the Rule's timing and substantive aspects of its delineations of what constitutes a "covered order," how long such covered orders will need to be reported, and so forth. The annual written statement will require a senior executive to ensure ongoing compliance with such orders throughout the year.

Implementation of the Rule

The CFPB will implement the Rule in a phased manner for three different categories of covered nonbanks – further, there are separate implementation timeframes for submitting covered orders to the Registry, and for CFPB-supervised covered nonbanks' first submissions of annual written statements.

The Executive Summary explains the three categories of covered nonbanks as:

• "Larger Participant CFPB-Supervised Covered Nonbanks;
• Other CFPB-Supervised Covered Nonbanks (i.e., CFPB-supervised covered nonbanks that do not meet the definition of larger participant under the CFPB's regulations); and
• All Other Covered Nonbanks (i.e., generally covered nonbanks that are not supervised by the CFPB)."

The Executive Summary provides a table akin to the following, displaying the registration submission period and registration deadline for each of the categories of covered nonbanks; we have duplicated and modified the table to include each category's first due date for submitting the annual written statement following registration, as applicable.

As noted in the Executive Summary, the CFPB has issued or proposed the following interpretive rules detailing the determination of "larger participants" in the following markets:

• Automobile Financing – Defining Larger Participants of the Automobile Financing Market and Defining Certain Automobile Leasing Activity as a Financial Product or Service
  • "Under the Final Rule, a nonbank covered person that engages in automobile financing is a larger participant of the automobile financing market if it has at least 10,000 aggregate annual originations." (from p. 4 of this rule).
• Student Loan Servicing – Defining Larger Participants of the Student Loan Servicing Market
  • "To identify the larger participants of this market ... the Bureau is adopting a test based on the number of accounts on which an entity performs student loan servicing. The Final Rule defines the criterion "account volume," which reflects the number of accounts for which an entity and its affiliated companies were considered to perform student loan servicing as of December 31 of the prior calendar year. An entity is a larger participant if its account volume exceeds one million." (from p. 7 of this rule).
• Consumer Reporting – Defining Larger Participants of the Consumer Reporting Market
  • "The final rule adopts the proposed test for qualifying as a larger participant of the consumer reporting market: More than $7 million in annual receipts resulting from relevant consumer reporting activities." (from III. Summary of the Final Rule of this rule).
• Consumer Debt Collection – Defining Larger Participants of the Consumer Debt Collection Market
  • "The Final Consumer Debt Collection Rule adopts the proposed test for qualifying as a larger participant of the consumer debt collection market: more than $10 million in annual receipts resulting from relevant consumer debt collection activities. However, the Final Consumer Debt Collection Rule excludes from the definition of annual receipts those receipts that result from collecting debts that were originally owed to a medical provider." (from III. Summary of the Final Rule of this rule).
• International Money Transfer – Defining Larger Participants of the International Money Transfer Market
  • "An entity is a larger participant if it has at least one million aggregate annual international money transfers." (from p. 8 of this rule).
• General-Use Digital Consumer Payment Application – (Proposed Rule) Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications
  • "A nonbank covered person would be a larger participant if it satisfies two criteria. First, the nonbank covered person (together with its affiliated companies) must provide general-use digital consumer payment applications with an annual volume of at least five million consumer payment transactions. Second, the nonbank covered person must not be a small business concern based on the applicable Small Business Administration (SBA) size standard." (from p. 6-7 of this proposed rule).

Footnotes

1. By way of example, Appendix A includes the following state statutes: Ala. Code sec. 8–19–5, "Unlawful trade practices" in the state consumer protection statutes; Ariz. Rev. Stat. sec. 6–611, "Prohibited acts" for banks and financial institutions; Cal. Bus. & Prof. Code sec. 17500, contained in an Article titled "False Advertising in General."

2. The Executive Summary states: "The CFPB has issued rules identifying the criteria for larger participants in the Automobile Financing, Student Loan Servicing, Consumer Reporting, Consumer Debt Collection, and International Money Transfer markets and has proposed a rule for the General-Use Digital Consumer Payment Application market."