June 4, 2024
CFPB Non-Bank Enforcement Order Registry Coming this Fall
Constitutionality concerns cleared, the Consumer Financial Protection Bureau (CFPB) on June 3 issued its final rule creating a registry identifying covered nonbanks subject to government agency enforcement orders. The rule's release was accompanied by a statement from Director Chopra naming companies with prior enforcement orders and touting the CFPB's Repeat Offender Unit.
The rule is effective September 16, 2024. Covered entities operating under covered orders are required to register as early as October 16, 2024.
The final rule applies to "covered nonbanks" - a wide range of "covered persons" under 12 U.S.C. 5481(6) that are not in one of these categories: (i) insured depositories and credit unions, (ii) a person who is covered solely due to be a "related person" (e.g., certain consultants, contractors, and shareholders), (iii) States, (iv) natural persons, (v) certain motor vehicle dealers, and, clarifying an issue raised in comments, and (vi) certain persons that qualify as covered persons only because of conduct excluded from CFPB rulemaking (e.g., certain charitable contribution activities).
The rule covers non-depository consumer lenders, investment advisors, real estate-related consumer financial services, loan servicers, consumer vehicle finance providers, payments providers, consumer reporting companies, consumer data furnishers, and consumer debt collection agencies.
Registration of Covered Orders
Generally, a covered nonbank with a covered order in effect on or after September 16, 2024 must register and submit information to the CFPB about the entity and the covered order.
A covered order is a final, written public order (including consent orders) effective on or after January 1, 2017 obtained by a federal, state, or local agency and issued by an agency or court with public provisions requiring or limiting certain actions based on alleged violations of covered laws. Covered orders may be issued upon consent or settlement, and include those obtained after a contested or litigated hearing or lawsuit.
Covered laws are enumerated in the rule, and include federal consumer financial laws, other laws enforced by the CFPB (e.g., Military Lending Act), and certain federal and state unfair, deceptive, or abusive acts or practices (UDAAP) laws. The final rule does not cover state usury, unconscionability, RICO, and certain tribal laws.
What must be registered with the CFPB?
Covered nonbanks with covered orders must submit identifying corporate information, affiliates subject to the order, a copy of the covered order (with nonpublic portions redacted), the issuing agency, effective date, date of expiration, covered laws, and the identifying docket number or case information about the order.
Annual Written Statement
Some larger covered non-banks subject to CFPB supervision must have a senior executive attest annually to their oversight of activities subject to covered orders. Generally, this requirement applies to nonbanks subject to CFPB supervision with at least $5 million in qualifying annual receipts. An attesting executive designated by the covered nonbank must describe steps taken to review and oversee in the prior year activities subject to the order, and to attest whether the covered nonbank identified any violations or noncompliance with applicable obligations in public provisions of its order.
Addressing regulatory burden concerns from mortgage lenders and servicers, the agency provided an option by which a covered nonbank may alternatively choose to file a special one-time registration of any covered orders published on the Nationwide Multistate Licensing System (NMLS) Consumer Access web site, unless the order involves the CFPB.
Timing
Initial registrations by covered nonbanks must be filed in the applicable submission period, depending on the type of nonbank:
Nonbank Type Registration Submission Period
Larger Participant CFPB-Supervised Nonbanks October 16, 2024 - January 14, 2025
Other CFPB-Supervised Covered Nonbanks January 14, 2025 - April 14, 2025
All Other Covered Nonbanks April 14, 2025 - July 14, 2025
Updates to the initial registration must be made within 90 days of: updates to the nonbank's identifying or administrative information, amendments to covered orders, new covered orders, or terminations or expirations of registered covered orders.
Written Statements are due for CFPB-Supervised Nonbanks, as applicable, on the following schedule:
Nonbank Type Written Statement Deadline
Larger Participant CFPB-Supervised Nonbanks March 31, 2025
(for all registered covered orders registered - effective date from Oct. 16, 2024 to Dec. 31, 2024)
Other CFPB-Supervised Covered Nonbanks March 31, 2026
(for all registered covered orders registered - effective date from Jan. 14, 2025 to Dec. 31, 2025)
When do registration obligations expire?
Covered orders are subject to registration until they are deemed to expire under the final rule or all relevant provisions are fully terminated. A covered order may be terminated by an agency or court, or it may terminate under its own terms on a date expressly provided for in the covered order. A covered order that does not expressly provide for a termination date and is not terminated earlier is deemed to expire 10 years after its effective date. If the order expressly provides for a termination date that is longer than 10 years, the order is not deemed to expire until the expressly provided termination date.
The agency suggests that it may publish certain information identifying registered covered nonbanks and covered orders, as well as summary reports, on its website.
Next Steps
Potentially covered entities offering financial services should work with experienced legal counsel to prepare for the coming registration deadlines. Companies subject to prior federal, state, or local enforcement orders will need to review the complex new rule to determine its applicability. Covered entities will need to determine early whether they need to prepare registration documentation only, or if they will also need to designate an attesting executive and the company's annual written statement. Either process increases the company's exposure to litigation in relation to its compliance system and representations about it. Thus, adequate time should be allocated to compliance preparedness and corporate communications response.