April 26, 2022

CFPB Alert from Hudson Cook, LLP: CFPB Flexes Supervisory Authority Over Nonbanks

Lucy E. Morris and Kristen Yarows

Nonbank lenders, fintech firms, and smaller entities that do not meet the CFPB's threshold of a "larger participant" in defined areas have avoided CFPB supervision, but that is changing. On Monday, the CFPB issued a press release stating that it has begun to invoke its supervision authority over nonbanks whose activities the CFPB has reasonable cause to determine pose risks to consumers. The CFPB implemented this provision through a procedural rule in 2013, and the authority is not specific to any particular consumer financial product or service. CFPB Director Rohit Chopra stated that the CFPB is beginning to use this dormant authority because of the "rapid growth of consumer offerings by nonbanks" and that this authority will "hold nonbanks to the same standard that banks are held to."

The 2013 rule outlines several steps that the CFPB must take when invoking this authority. First, the initiating official from the CFPB issues a Notice of Reasonable Cause that the entity has engaged in conduct that poses risks to consumers based on complaints or information from other sources. This conduct may involve potentially unfair, deceptive, or abusive acts or practices, or other potential violations of federal consumer financial law. While the CFPB does not define how it will determine which entities pose risks to consumers, it stated that it may review complaints from its database, whistleblower complaints, judicial opinions, administrative decisions, news reports, or information from state and federal partners to make determinations. After receiving the notice, the entity has 30 days to provide a written response and can request an opportunity to provide a supplemental oral response in a meeting with the CFPB. The staff has 45 days to provide the Director with a recommended determination, and the Director then has 45 days to issue a final decision. When the CFPB implemented the 2013 rule, it considered public comments and decided that all aspects of a proceeding relate to the CFPB's supervisory process and should be deemed confidential supervisory information. However, the CFPB has now decided something different.

The CFPB's press release announced that it is issuing a new procedural rule that gives the Director the authority to make final decisions and orders public. The rule is effective immediately, but the CFPB will accept comments for 30 days and may amend the rule if it receives comments warranting change. Although the CFPB noted that a "central principle of the supervisory process is confidentiality," it decided there were countervailing interests that necessitated a procedural mechanism to determine when a decision and order should be made publicly available. Specifically, the CFPB highlighted the public interest in transparency and the opportunity to use an order as a precedent in the future after it is publicly released. After a decision and order, the entity has seven days to submit a response on the issue of confidentiality, and then the Director determines whether the decision and order will be released on the CFPB's website in whole or in part.

The CFPB's recent supervision changes could create serious implications for nonbank lenders, fintech firms, and other nonbank covered persons who are not otherwise subject to the Bureau's exam authority. While the CFPB did not previously assert supervisory authority over these entities, that is no longer the case. Nonbank lenders and others who thought they did not need to worry about having a robust compliance management system should reconsider. In particular, entities should pay close attention to consumer complaints to identify issues that may pose risks to consumers.