Articles

February 27, 2024

CFPB Supervision Alert: CFPB Issues First Risk-Based Supervision Order

Lucy E. Morris and Kristen Yarows

On February 23, the Consumer Financial Protection Bureau announced its first decision designating a nonbank lender for supervision based on potential risk to consumers. As the CFPB emphasized in its press release, however, the CFPB's order is not a finding that the lender has engaged in wrongdoing.

The CFPB's first public supervisory designation comes after an April 2022 announcement that it planned to start invoking its supervision authority over nonbanks whose activities the CFPB has reasonable cause to determine pose risks to consumers regarding the offering or provision of consumer financial products or services. Director Chopra announced that the CFPB planned to use this "dormant" authority to supervise nonbanks and issued a new procedural rule. We previously wrote about this here. After accepting comments, the CFPB updated the procedural rule again in November 2022.

Section 1024(a)(1)(C) of the Consumer Financial Protection Act, 12 USC 5514(a)(1)(C), grants the Bureau authority to supervise nonbank covered persons when the Bureau has reasonable cause to determine that the entity is engaging, or has engaged, in conduct that poses risks to consumers. In 2013, the CFPB issued a procedural rule that outlined the steps the Bureau must take to invoke this authority, including issuing a Notice of Reasonable Cause to the entity and providing the nonbank entity an opportunity to respond to the Notice. The updated 2022 procedural rule made a notable change by allowing the Director to publicize the final decisions and orders, even though the procedural process is considered Confidential Supervisory Information and publication could have reputational consequences for a company. For the first time since the CFPB updated the procedural rule, the CFPB has published an order, although with some redactions for consumer privacy and for "good cause."

In the CFPB's 2023 Summer Supervisory Highlights, it noted that it entered discussions with several entities across various markets about the supervision program. The CFPB issued several Notices of Reasonable Cause and several entities voluntarily consented to the CFPB's supervisory authority. Until last week, the CFPB had not published a decision or order designating an entity for risk-based supervision. In establishing the procedural rule, the CFPB specifically highlighted a desire for transparency and the ability to use an order as precedent in future supervision designations.

The published Order provides some clarity on the Bureau's interpretation of the "reasonable cause" standard, the meaning of "risk" under the statute, and the use of unverified consumer complaints on the CFPB's portal. The Order specifies that the Bureau does not need to determine that an entity has violated federal consumer protection laws or regulations to determine that the Bureau has reasonable cause to determine that the entity poses risks to consumers. In the Order, the Director noted that section 1024(a)(1)(C) does not specify the character or magnitude of "risks to consumers" that is required to subject an entity to supervision because "Congress intended to grant the CFPB significant discretion in determining whether the character and magnitude of the risks posed by a particular covered person's conduct merit supervision." Although "risk" is not defined in the statute, the CFPB looks to the dictionary definition and states that it refers to "the possibility of loss or injury." The CFPA does not define "reasonable cause," but in the Order, the Director states, "Whatever the precise meaning of 'reasonable cause,' it must be less demanding than the default preponderance-of-the-evidence standard generally applicable in noncriminal matters." The Order also notes that the Bureau can rely on consumer complaints in its portal in making a risk-based supervision determination. The Order states that section 1024(a)(1)(C) allows risk designation to be "based on complaints . . . or information from other sources," and because Congress did not reference "verified complaints" or a similar qualifier, Congress did not intend to limit the types of complaints that can serve as the basis for a risk determination. The CFPB's publication of its first supervisory order should serve as a reminder for companies to pay close attention to their compliance management systems and consumer complaints. Nonbank entities that were not previously subject to the CFPB's supervisory authority might not be so lucky anymore.

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.