CFPB Proposes Public Enforcement Order Registry for Nonbank Financial Services Providers

On December 12, 2022, the Consumer Financial Protection Bureau published a proposed rule that would require nonbank covered persons to report certain public agency enforcement actions and court orders for publication in a publicly available, online database called the nonbank registration system (NBR). In addition to requiring that nonbank covered persons submit filings to the NBR within 90 days of the effective date of any applicable order, the proposal would require nonbank covered persons to appoint a senior executive to attest to compliance with any such orders on an annual basis. Interested parties may submit comments to the proposed rule through the Federal eRulemaking Portal, by email or via direct mail. Comments must be received by the CFPB on or before February 10, 2023.

Proposed registration and filing requirements

The CFPB proposes establishing the NBR pursuant to its authority under the Consumer Financial Protection Act to monitor markets for consumer financial products and services and to identify risks to consumers. Consistent with its ongoing focus on so-called repeat offenders, the CFPB noted that the NBR would help identify and prevent further consumer harm from companies that repeatedly violate consumer financial protection laws. The CFPB also noted in the proposed rule that a “public registry of agency and court orders issued or obtained in connection with violations of law would help the [CFPB] and the broader public monitor trends concerning corporate recidivism relating to consumer protection law, including areas where prior violations of law are indicia of risk to consumers.”

The proposed rule includes the following key provisions:

• Nonbank covered persons must register and submit to the NBR specific information about final, public orders issued by federal, state, or local agencies or courts.
• Nonbank covered entities would be required to submit the information within 90 days of the effective date of any such order and update the NBR within 90 days of amendment, modification, termination, extension, or any other change to the information originally filed.
• Orders triggering a filing obligation include those issued, at least in part, in any action or proceeding brought by a federal, state, or local agency and containing provisions that impose obligations based on alleged violations of certain consumer financial protection laws.
• Applicable consumer financial protection laws include federal consumer financial law, any other law over which the CFPB has jurisdiction to enforce, the prohibition on unfair or deceptive acts or practices under the Federal Trade Commission Act and related rules, and state laws and rules prohibiting unfair, deceptive, or abusive acts and practices.

The proposed rule also would require nonbank covered persons to appoint a senior executive to complete an annual attestation regarding the company’s compliance with orders filed with the NBR. The attestation would include a written statement that describes the steps the executive took to review and oversee the entity’s activities subject to the order and states whether, to the executive’s knowledge, the entity has identified any violations of or instances of noncompliance with an applicable order.

These ongoing and annual filing requirements resemble those already in place for many nonbank covered entities who must report regulatory enforcement actions and court orders to state regulators either directly or through the Nationwide Multistate Licensing System (NMLS). Nonbank covered entities must attest to the accuracy of their record, including the regulatory action disclosures, each time a filing is submitted in the NMLS and annually to satisfy license renewal requirements. Mortgage lenders that originate or service mortgages insured by the Federal Housing Administration must also submit notice to the Department of Housing and Urban Development (HUD) within 10 days of becoming the subject of allegations of violations of certain consumer financial laws or entering into agency or court orders that impose sanctions. HUD also requires mortgagees to attest to compliance with those reporting requirements on an annual basis, although it updated the annual recertification process in January 2020 to remove statements attesting to compliance with all applicable HUD regulations after many mortgagees declined to complete such sweeping attestations.

Many state regulators post orders online – either on agency websites or on the NMLS Consumer Access site – and state attorneys general and federal agencies regularly publish orders with press releases notifying the public and other regulators of enforcement actions against nonbank covered entities. According to the CFPB, some state agencies expressed concern “regarding possible duplication between any registration system the [CFPB] might build and existing registration systems.” However, the CFPB stated that making the NBR publicly available would “allow other regulators … tasked with protecting consumers to realize the same market monitoring benefits” and “enhance the ability of consumer advocacy organizations, researchers, firms conducting due diligence, and the media to locate, review, and monitor orders enforcing the law.”

The CFPB also indicated that it may consider the information filed in the NBR when making supervisory and even civil money penalty decisions. The CFPB noted that it considers nonbank covered persons’ compliance records “when prioritizing supervisory resources” and pointed to its congressional mandate to consider “an entity’s ‘history of previous violations’”¹ when assessing civil money penalties, strongly implying that prior violations of state laws may lead to more severe penalties in CFPB enforcement actions.

What does this mean for you?

The proposed rule indicates that the NBR and related filing requirements would not be implemented until January 2024 at the earliest. Additionally, the proposed rule is just that – a proposal – that may change after the CFPB receives and considers public comments. Nevertheless, industry should expect that the CFPB will establish an online, publicly available database of enforcement actions that will need to be updated regularly and very likely will require an annual certification of compliance – or disclosure of instances of noncompliance – with any orders that appear therein. Therefore, nonbank covered persons should be prepared to incorporate CFPB notice requirements into ongoing material event filing processes, and they should carefully consider any written attestations submitted by executive officers regarding compliance with ongoing orders.

If implemented as outlined in the proposal, the new registry will have far-reaching consequences for industry. First, reporting federal, state, and local enforcement actions and court orders has never been a pleasant task for industry, but these matters now will carry additional significance if they are publicly available in a single database. Although the CFPB emphasized the NBR’s utility for regulatory agencies and research, plaintiffs’ counsel also will use the data to identify potential targets for class action lawsuits. Additionally, the CFPB’s consideration of historical state law violations in assessing civil money penalties increases the risks associated with entering into any public enforcement orders, as they may lead to the CFPB imposing “repeat offender” penalty amounts despite no prior CFPB consent orders.

Finally, the annual attestation requirement is reminiscent of HUD’s annual recertification statements that were revised in January 2020 after industry declined to complete broad certifications of compliance with HUD rules. Similar to the CFPB’s current proposal, HUD previously required mortgagees to certify that during the applicable period, the mortgagee complied with “all HUD regulations and requirements necessary to maintain” HUD approval, including the FHA Single Family Housing Policy Handbook, which expressly required mortgagees to comply with all federal, state and local laws.² After that sweeping language was used to impose treble damages under the False Claims Act, many mortgagees declined to certify without risk-mitigating caveats – and HUD ultimately narrowed the recertification statements. The CFPB’s proposal presents similar concerns by requiring nonbank covered persons to attest to compliance with all agency and court orders reported in the NBR, or to proactively report instances of noncompliance or violations, regardless of materiality. As with the HUD certification statements, consent orders can contain broad language prohibiting violations of a number of consumer protection laws – even those that were not the basis of the order – such that attesting to compliance may present similar concerns of heightened risk.

Notes

1. 12 USC § 5565(c)(3)(D).
2. FHA Single Family Housing Policy Handbook 4000.1, I.A.6.c.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.