In this issue. The Consumer Financial Protection Bureau (CFPB) finalized its Personal Financial Data Rights Rule; the CFPB issued a Consumer Financial Protection Circular (Circular) clarifying application of the Fair Credit Reporting Act (FCRA) to users and furnishers of consumer reports for employment purposes; the Office of the Comptroller of the Currency (OCC) finalized revisions to its recovery planning guidelines (Guidelines); the Federal Deposit Insurance Corporation (FDIC) Board of Directors released its semiannual update on the Deposit Insurance Fund (DIF) Restoration Plan (Plan); the FDIC extended the compliance date for subpart A of the official signs and advertising requirements rule; and the FDIC issued the 2025 notice of designated reserve ratio (DRR). These and other developments are discussed in more detail below
Regulatory Developments
CFPB Finalizes Personal Financial Data Rights Rule
On October 22, the CFPB finalized its Personal Financial Data Rights Rule under
Section 1033 of the Dodd Frank Act. The rule is intended to move
the US closer to an "open banking" system by allowing
consumers to more easily switch between financial institutions. The
final rule expands coverage from the proposed rule to cover not
only consumer data from bank accounts and credit cards but also
from mobile wallets and payment apps, requiring covered financial
institutions to build out application programming interfaces (APIs)
that allow consumers to access their data and to share it with
authorized third parties. The rule also establishes strict
limitations on a third party's use of consumer data and
requires a simple and straightforward means for a consumer to
revoke the third party's access to the consumer's data. The
rule will take effect 60 days after publication in the Federal
Register, with rolling compliance dates between 2026 and 2030 based
on the size of the covered financial institution.
"To make our banking and payments market more competitive, it needs to be open and decentralized using a common set of data standards, free of powerful gatekeepers and middlemen that can impose private regulations and extract fees."
— Rohit Chopra, Director, CFPB
CFPB Issues Circular Clarifying Application of FCRA to
Users and Furnishers of Consumer Reports for Employment
Purposes
On October 24, the CFPB issued a Circular clarifying that employers who use
consumer reports about workers to make employment decisions must
comply with the FCRA, including obtaining workers' permission
to procure a consumer report, providing notices before and upon
taking adverse action, and not using consumer reports for purposes
other than as permitted by the FCRA. Also, third parties furnishing
such consumer reports to employers are consumer reporting agencies
under the FCRA (i.e., report-makers who "assemble" or
"evaluate" consumer information or use consumer data to
train an algorithm to produce a report, score, or other assessment)
and must follow reasonable procedures to assure maximum possible
accuracy, disclose information in a worker's file to the worker
upon request, and investigate worker disputes alleging
inaccuracies. Materials that may qualify as consumer reports
include background dossiers, surveillance-based "black
box" AI or algorithmic scores, and other third-party reports
or scores assessing a current worker's risk level or
performance. Employment decisions for which a consumer report might
be used include hiring, promotion, reassignment, and retention. The
CFPB encouraged employers to review their current practices
regarding the use of consumer reports to ensure compliance with the
FCRA.
OCC Finalizes Revisions to Its Recovery Planning
Guidelines
On October 21, the OCC finalized revisions to its enforceable Guidelines
applicable to certain large insured national banks, federal savings
associations, and insured federal branches of foreign banks. The
revisions amend the Guidelines to apply to banks with at least $100
billion in assets, in place of the prior $250 billion threshold.
The OCC believes this new, lower threshold is appropriate, because
institutions with at least $100 billion have a risk level,
complexity, and interconnectedness that is greatly benefited by
recovery planning. The revisions also incorporate a testing
standard for recovery plans, clarify the role of non-financial risk
as it relates to recovery planning, and provide covered
institutions timelines for compliance, which includes development
of a testing framework and conducting that testing. The revisions
to the Guidelines are part of the OCCs broader efforts to ensure
that large banks are appropriately prepared for, and have
procedures in place to respond to, the financial effects generated
by severe stress. The revisions, published in the Federal Register,
become effective January 1, 2025 with staggered compliance
dates.
FDIC Extends Compliance Date for Subpart A of the
"FDIC Official Signs and Advertising Requirements, False
Advertising, Misrepresentation of Insured Status, and Misuse of the
FDIC's Name or Logo"
On October 17, the FDIC extended the compliance date for Subpart A of
its final rule, "FDIC Official Signs and Advertising
Requirements, False Advertising, Misrepresentation of Insured
Status, and Misuse of the FDIC's Name or Logo," from
January 1, 2025 to May 1, 2025 to allow financial institutions
additional time to establish the necessary compliance procedures.
The extension applies only to Subpart A of the final rule, which,
among other obligations, requires banks and non-banks to clearly
indicate when a product or institution is FDIC-insured
(differentiating deposit and non-deposit products), to display FDIC
signage in their digital channels, and to establish written
policies to comply with the final rule.
FDIC Board of Directors Releases Semiannual Update on
DIF Plan
On October 17, the FDIC Board of Directors released its semiannual update on the DIF Plan. As required
by the Federal Deposit Insurance Act (FDI Act), the FDIC Board of
Directors must adopt a restoration plan when the DIF's reserve
ratio – the ratio of the fund balance relative to insured
deposits – falls below the statutory minimum of 1.35%. In
September 2020, the FDIC established the Plan to restore the DIF
reserve ratio to at least 1.35% by the statutory deadline of
September 30, 2028, after extraordinary deposit growth during the
first half of 2020 caused the DIF reserve ratio to decline below
the statutory minimum. Between December 2023 and June 2024, the DIF
reserve ratio increased from 1.15% to 1.21%, due to growth in the
DIF balance and slower-than-average insured deposit growth, and the
FDIC now projects that the reserve ratio will remain on track to
reach 1.35% ahead of the statutory deadline.
FDIC Issues Notice of Designated Reserve Ratio for
2025
On October 17, 2024, the FDIC Board of Directors issued a
notice, pursuant to the FDI Act, designating
the DRR for the DIF to remain at 2% for 2025, based on certain
statutory factors, including risk of losses to the DIF, economic
conditions generally affecting insured depository institutions,
preventing sharp swings in assessment rates, and other factors that
the FDIC Board of Directors may determine to be appropriate, such
as viewing the DRR as a long-range, minimum goal to reduce the risk
of a large rate increase during a crisis.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
