For the consumer finance industry, 2023 was all about the Consumer Financial Protection Bureau (CFPB or Bureau). As Goodwin predicted last year, the uptick in regulatory and enforcement activity observed in 2022 was a harbinger of the deluge in store for 2023.
On the regulatory front, the CFPB released a flurry of proposed rules and informal guidance documents in 2023. As for proposed rules, in November the CFPB announced a proposed rule to supervise fintech companies that offer digital wallets and payment applications, invoking its authority to supervise "larger participant[s] of a market for other consumer financial products or services" as the CFPB defines by rule. The stated purpose of supervising companies that offer these services is to assess their compliance with federal consumer financial law, obtain information about their activities and compliance systems, and detect and assess risks to consumers and consumer finance markets. In its current form, the rule would extend the Bureau's supervisory jurisdiction over more than a dozen of the largest and most prominent fintech companies.
Another noteworthy example is the CFPB's October announcement of a proposed rule that would accelerate the shift to open banking by requiring companies to share data at the consumer's direction. The rule's stated objective is to provide consumers with certain "personal financial data rights" that will enable them to switch service providers more easily and have greater authority over how financial institutions keep and share their information.
And in January, the CFPB proposed a rule requiring nonbanks that are subject to its supervisory authority to "register each year in a nonbank registration system . . . information about their use of certain terms and conditions in form contracts for consumer financial products and services that pose risks to consumers." The "terms and conditions" the proposed rule targets are those that the Bureau characterized as seeking to impose limitations on consumer rights, primarily (1) limitations on the claims a consumer can bring in a legal action, (2) limitations of liability, (3) limitations on collective legal actions, and (4) arbitration agreements.
At the same time, the CFPB has continued to rely on informal guidance documents, including advisory opinions, to communicate its compliance expectations. In October, for example, the CFPB issued its first-ever guidance concerning Section 1034(c) of the Consumer Financial Protection Act (CFPA), which requires financial institutions to comply with consumer requests for information concerning their account. The CFPB's advisory opinion interpreted Section 1034(c) to "grant[] consumers a right to request and receive account information" concerning their account without restrictions, such as fees, that would "unreasonably impede[]" their access to such information.
The number of publicly announced enforcement actions by the CFPB also increased year over year. Though most such actions continue to be resolved through publicly announced consent orders, 2023 was notable for the number of lawsuits (nine) filed by the CFPB in federal court. The parties' inability to reach a mutually agreeable resolution of these actions is one of many indications that the CFPB's settlement demands have become increasingly unacceptable to the industry. Nowhere is this reality more evident than in the CFPB's campaign to rein in so-called corporate recidivists. In 2023, the CFPB initiated five enforcement actions against companies it explicitly characterized as "repeat offenders," and in its press releases announcing other actions, it suggested that companies with multiple unrelated violations of law may fall in the same category. In matters involving corporate recidivists, the CFPB has not been content with large civil money penalties but instead has demanded — and in some instances, obtained — structural changes to the company or individual liability for corporate officers.
Another area in which the CFPB focused its enforcement energies in 2023 was on so-called junk fees charged by financial institutions. In July, in the wake of launching its junk-fees initiative in 2022, the CFPB entered into a nine-figure consent order with a national bank to resolve allegations that the bank had "double-dipped" on fees by assessing multiple nonsufficient funds fees for the same transaction under some circumstances. And in October, the CFPB announced that because of its supervisory examinations conducted over the prior year, consumer finance companies refunded $140 million in fees to consumers, including "surprise" overdraft fees, nonsufficient funds fees, and fees for "worthless" services or services not actually provided. This initiative presaged the Bureau's January 2024 announcement that it was proposing a rule under which large financial institutions would be required to treat overdrafts as loans, subject to the Truth in Lending Act (TILA) and other consumer protection laws.
Goodwin's anecdotal evidence suggests that the CFPB also launched an unprecedented number of new examinations and investigations in 2023, promising a heightened level of enforcement activity in 2024 and beyond. In 2023, the CFPB announced the creation of a Repeat Offender Unit within its Office of Supervision to detect repeat offenses and identify their root cause. In addition to junk fees, during 2023, CFPB examiners and investigators have continued to assess consumer finance companies for compliance with the full suite of federal consumer financial laws, including, most notably, the CFPA, Real Estate Settlement Procedures Act (RESPA), TILA, Fair Debt Collection Practices Act (FDCPA), Electronic Fund Transfer Act (EFTA), and the Fair Housing Act (FHA).
Though other federal and state agencies took a back seat to the CFPB, they were far from absent in the regulatory and enforcement space in 2023. For example, in March, the California Department of Financial Protection and Innovation (DFPI) proposed regulations under the California Financial Law that would define non-employer-offered earned-wage access (EWA) products as loans. Also in 2023, several states made significant updates to their mini-Telephone Consumer Protection Act (TCPA) laws, including in New York, where the penalty for violating the statute nearly doubled. And states continued to lead the way on policing allegedly unfair, deceptive, and abusive acts or practices that occur in connection with attempts to collect a debt.
2023 Key Trends: By the Numbers
In 2023, Goodwin tracked 73 publicly announced federal and state enforcement actions related to consumer finance, an increase from 66 such actions tracked in 2022.
Of the actions tracked, 22 (30%) were initiated or joined by state enforcement officials and agencies, representing a slight decrease from the nearly 38% of actions that involved state actors in 2022. California led state-level enforcement in 2023 with six actions, followed closely by Massachusetts, Minnesota, and Washington with five such actions each. State enforcement covered a variety of issues, but most state actions in 2023 concerned debt collection and settlement and auto lending. State efforts resulted in total recoveries of about $43 million (including joint state-federal recoveries), a decrease in total recoveries from the $1.9 billion recovered in 2022 but more in line with historic trends.
On the federal side, the total number of publicly announced enforcement actions stayed relatively steady year over year, with 54 such actions reported in 2023, including three joint state–federal actions. The number of actions initiated or resolved publicly by the CFPB increased from 23 in 2022 to 30 in 2023. However, the number of publicly announced enforcement actions from other federal agencies declined. The Federal Trade Commission (FTC) initiated or resolved 13 such actions, including one joint action with the CFPB, down from 14 reported in 2022. In 2023, the Department of Justice (DOJ) and Department of Housing and Urban Development (HUD) announced six and one enforcement actions, respectively, consistent with the general level of enforcement activity in the prior year.
What to Watch for in 2024
We expect the CFPB to continue to lead the way on enforcement and regulation in 2024, both on its own and in partnership with other federal and state agencies. Through the advisory opinions and proposed rules it promulgated in 2023, the CFPB laid the groundwork for an even more active 2024 as it looks to expand its supervisory jurisdiction and enforcement reach. The enforcement and regulatory activity of the CFPB and other federal agencies may become even more frenzied as 2024 progresses in light of the impending election and a potential transfer of power. It would not be unusual for agencies like the CFPB and FTC to seek to resolve pending investigations and enforcement actions prior to the upheaval that a potential transfer of power could cause. Agencies may also publish guidance and finalize proposed rules in an effort to "lock in" their successors, particularly if subsequent administrations are expected to have different policy priorities. And even if President Biden secures a second term, it remains an open question whether agency leaders — such as Rohit Chopra at the CFPB and Lina M. Khan at the FTC — who have driven the agendas of their agencies will continue at the helm for a second term.
Further, in January 2024, the Office of Inspector General (OIG) issued an Evaluation Report (Report) concluding that the CFPB should "enhance certain aspects of its enforcement investigations process." The Report focuses on the efficiency of the CFPB's Office of Enforcement (Enforcement) in carrying out investigations — specifically, the timing of those investigations and Enforcement's practices for tracking and monitoring matters. After covering Enforcement's resources and staffing procedures, the Report examines statistics concerning the efficacy and investigation timeline of Enforcement's activities. For example, the Report states that Enforcement has not met its goal to "file or settle 65 percent of its enforcement actions within 2 years of the investigation opening date in any of the 5 years since fiscal year 2017" and that the percentage of enforcement actions filed or settled within a two-year period "fluctuated during the period, with a high of 62 percent in FY 2018 and a low of 36 percent in FY 2019." The Report recommends that Enforcement track the timing expectations described in its guidance and reinforce the guidance on documentation requirements for its matter management system. As a result, we anticipate a noticeable uptick in CFPB enforcement activity in 2024, as previewed by the Bureau's flurry of activity in December 2023.
Below are the key areas of regulatory and enforcement focus we expect to see in 2024.
Artificial Intelligence
All eyes will be on AI in 2024. The CFPB's Chopra has said that AI will be a priority of his agency in 2024, particularly with respect to how lenders have used (and will continue to use) AI to automate decisions about access to credit.
We expect to see this play out in 2024 in a few ways. During 2024, the CFPB is expected to finalize its proposed rule that would require covered financial institutions to implement quality control standards for the use of automated valuation models to prevent discrimination. Once these rules are finalized, we can expect the CFPB to stringently examine for and enforce compliance with these rules. In addition, last fall, the CFPB issued a circular about certain legal requirements that lenders must adhere to when using AI to make credit decisions. The guidance reinforced that lenders and creditors may not rely on the checklist of reasons provided in the sample forms (codified in Regulation B) to satisfy their obligations under the Equal Credit Opportunity Act (ECOA) if the reasons do not "specifically and accurately" indicate the principal reason(s) for the adverse action. We expect that the CFPB will be closely watching to ensure that creditors are adhering to the guidance.
The Federal Communications Commission (FCC) has also jumped on the AI bandwagon. Last fall, the FCC issued a Notice of Inquiry, seeking to better understand the implications of emerging AI as part of its ongoing efforts to protect consumers from unwanted and illegal telephone calls and text messages under the TCPA. We will likely see rulemaking or other guidance in 2024 as a result of these inquiries.
Repeat Offenders
We expect the CFPB's focus on fighting corporate recidivism to continue and expand in 2024. On the regulatory front, the CFPB is expected to finalize its proposed rule requiring nonbank financial companies to register with and report to the CFPB when they become subject to any local, state, or federal agency or court orders. The CFPB has said that its proposal will enhance market monitoring and risk-based supervision efforts to ensure that the CFPB and its enforcement partners can more easily identify repeat offenders. On the enforcement front, we expect the Bureau to continue to stretch the definition of "repeat offender" to include even conduct unrelated to previous violations with the objective of "naming and shaming" large financial institutions and, as conditions of settlement, demanding ever-more-punitive civil money penalties, individual liability for corporate officers, and structural changes to companies.
Junk Fees
During 2024, the CFPB is also expected to finalize its proposed rule that would lower the immunity provision for credit card late fees to $8 for a missed payment, end the automatic annual inflation adjustment of that amount, and ban late-fee amounts that are more than 25% of the consumer's required payment. The CFPB's efforts in this regard are part of its campaign against junk fees. To date, the Bureau has been focused on a relatively discrete set of junk fees — primarily late fees, overdraft fees, and "pay to pay" fees — but we expect it to publish additional guidance and initiate enforcement actions in 2024 that target a wider range of fees, such as fees that consumers incur by requesting information about their financial account and account maintenance fees.
Open Banking and Consumer Financial Data Rights
Also in 2024, the Bureau is likely to finalize the rule proposed in October 2023 to encourage "open banking." Under the Personal Financial Data Rights rule, financial institutions would be required to honor consumers' requests to share their financial data with other financial institutions and would be subject to certain restrictions on their use of consumer data. Moreover, in announcing the proposed rule, the CFPB emphasized that this was only its first proposal for implementing standards and protections for the sharing of personal financial data and that the Bureau intends to propose additional rules in the future to cover other financial products and services.
Fair Lending
Though fair lending is a consistent area of focus for federal regulators and enforcement agencies, we expect to see a specific focus in 2024 on police discrimination based on immigration status. Late last year, the CFPB and DOJ issued a joint statement reminding financial institutions that all credit applicants are protected from discrimination on the basis of national origin, race, and other characteristics covered by the ECOA, regardless of their immigration status. The statement was prompted by an influx of complaints from consumers — often a harbinger of enforcement actions — asserting that their credit applications were denied because of their immigration status. Other likely areas of focus, based on regulatory and enforcement developments in 2023, include appraisal discrimination and the risks of disparate impact when AI is used in the credit application process.
General-Use Digital Wallets and Payment Applications
Another rule that will likely be finalized in 2024 is the CFPB's proposal to supervise certain large nonbank companies that offer digital wallets and payment applications. As proposed, the rule would authorize the CFPB to examine nonbanks that facilitate at least five million transactions per calendar year via general-use digital consumer payment applications. Upon publication of the final rule, we expect that the Bureau will promptly launch examinations of at least some of the estimated 17 nonbank financial companies that meet this requirement.
Earned-Wage Access
We also expect the CFPB to publish new guidance in 2024 on EWA products, also known as income-based advances. In 2020, the CFPB issued an advisory opinion that aimed to resolve regulatory uncertainty regarding whether certain types of EWA products met the definition of credit under Regulation Z, but since issuing that guidance, the CFPB has repeatedly expressed concern that the industry is mispresenting the advisory opinion. In a November 27, 2023, comment letter on the California DFPI's proposal to require the registration and examination of EWA providers, the Bureau emphasized that it "plans to issue further guidance to provide greater clarity concerning the application of the Truth in Lending Act in this market." We expect the CFPB to issue such guidance — potentially in the form of an advisory opinion — in the first half of 2024.
Constitutional Challenges
Finally, 2024 will see the long-awaited resolution of challenges to the constitutionality of the CFPB's funding mechanism under the Appropriations Clause when the U.S. Supreme Court issues its decision in CFSA v. CFPB, No. 22-448 (U.S.). Based on the tenor of oral argument, we expect the CFPB to survive this challenge, but resolving the Appropriations Clause issue is unlikely to end efforts to invalidate the CFPB through judicial review. Litigants have already begun to press a distinct, yet similar, challenge to the constitutionality of the CFPB: that the broad delegation of spending authority to the CFPB violates the nondelegation doctrine. If this argument gains traction in the lower courts in 2024, the U.S. Supreme Court may be called upon for a third time to decide the fate of the CFPB.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
