On June 3, the Consumer Financial Protection Bureau (CFPB) published a final rule to create a registry of nonbank companies that have entered into consent agreements or who have otherwise been found by the bureau to be in violation of laws under their jurisdiction. The new regulations require debt collectors, mortgage lenders, payday and other nonbank lenders, credit reporting agencies, and other nonbank financial services companies to report regulatory actions taken against them at the federal and state levels. The CFPB believes the registry will allow consumers, watchdogs and prosecutors to identify and address bad actors more easily.
Overview of the Final Rule
The new rule will require nonbank companies to notify the CFPB when it has been determined by a court or agency that a company violated a consumer protection law and is subject to a court order or consent order. When the rulemaking was initially proposed in December 2022, the CFPB said that the regulation would, “enhance market monitoring and risk-based supervision efforts” with the goal of tracking “repeat offenders.” The CFPB estimates that at least 1,5000 and as many as 7,750 companies will be included in the registry. The database will include orders and sanctions against companies issued from state, federal and local governments and courts. Companies also must report consent orders they are required to abide by as part of settlement deals. Covered companies will be required to file annual reports with the CFPB, including an affirmation signed by a senior executive that the company is complying with any existing orders and consent decrees.
Compliance Considerations
The final rule requires covered nonbank companies to report final agency and court orders and judgements to the CFPB. Senior executives will also be required to provide a written attestation that the company is complying with existing orders. An order must by disclosed to the CFPB if it:
- Is a final, public order issued by an agency or court;
- Identifies a covered nonbank by name as a party subject to the order;
- Was issued at least in part in any action or proceeding brought by any federal agency, state agency or local agency;
- Contains public provisions that impose obligations on the covered nonbank company to take certain actions or to refrain from taking certain actions;
- Imposes obligations on the covered nonbank company based on alleged violation of a covered law, which includes federal consumer financial laws, other laws enforced by the CFPB, and certain unfair, deceptive or abusive acts or practices laws at both federal and state levels; and
- Has an effective date on or after Jan. 1, 2017. If the order does not have an effective date identified, the date of issuance is the effective date. If an issuing agency or court stays or suspends an order’s effectiveness, the order will be considered to not have an effective date until the stay or suspension has been lifted.
A covered nonbank company must submit identifying information about itself, such as its legal name and address, as well as the names of affiliates that are subject to the same order. Companies must submit a complete and accurate copy of the order to the CFPB, as well as identifying information such as docket or case tracking numbers. Covered companies must also identify all covered laws found to have been violated, or in the case of consent orders, alleged to have been violated.
CFPB-supervised covered nonbanks must submit an annual attestation signed by a senior executive confirming that the company is complying with existing orders. The attestation must describe the steps the executive has taken to review and oversee the company’s activities subject to the order for the previous calendar year. The attestation must also describe any violations or noncompliance with obligations imposed in the order’s public provisions. CFPB-supervised nonbanks must maintain records to support the written statement for five years.
Covered nonbank companies must file a notice with the CFPB within 90 days of the date of any modification or termination of an order. Companies must continue to abide by registration requirements for covered orders until the order expires or all relevant provisions are fully terminated. Covered orders that do not provide for an expiration date and are not otherwise terminated are deemed to expire 10 years after the effective date.
The CFPB may publish information about registered covered nonbanks and covered orders on its website. However, the written statement will be treated as confidential and not publicly available.
Changes from the Proposal and Reactions
Industry groups raised numerous concerns about the proposed rule during the public comment period, arguing that the rule was burdensome and unnecessary given existing reporting requirements. The CFPB responded to those comments by making some adjustments to the final rule, but the final rule is largely in line with the proposal. In particular, the CFPB modified the final rule so that nonbank mortgage lenders who have already recorded enforcement actions in a nationwide licensing system will be able to use a simplified filing process for the CFPB system. Unfortunately, despite numerous objections from various trade organizations, the CFPB retained the requirement for senior executives to submit a written statement regarding the company’s compliance with existing court orders and enforcement actions. The final rule received muted reaction on Capitol Hill, where House Financial Services Committee Republicans quickly called for the CFPB to rescind the final rule, calling the rulemaking overtly partisan and regulatory overreach.
Next Steps
The rulemaking is the latest step in the CFPB’s focus on nonbank entities, and it also outlines steps the CFPB may take in the future affecting financial institutions. The first corporate registrations for large nonbank companies are expected to be filed in January 2025. Other CFPB-supervised covered nonbanks must register by April 14, 2025, and all other covered nonbanks must register by July 14, 2025. The database will be available to the public and accessible by state attorneys general and other regulators, as well as investors and creditors performing due diligence research. The Brownstein Financial Services and Government Relations teams are ready to assist with compliance and outreach related to this rulemaking.
While it is unclear whether this rule will qualify for the time frame in which the Congressional Review Act (CRA) will give the 119th Congress an opportunity to roll it back, there have been some recent rumors about a significantly shortened July work period later this summer. The CRA enables Congress to issue a joint resolution of disapproval to invalidate a final rule in its entirety. The joint resolution of disapproval must be introduced within a 60-day legislative day lookback period, and any major changes to the number of in-session days on the calendar would lengthen the lookback period from the original estimated time frame of late-May to mid-June.
This document is intended to provide you with general information regarding the CFPB's final nonbank registry rule. The contents of this document are not intended to provide specific legal advice. If you have any questions about the contents of this document or if you need legal advice as to an issue, please contact the attorneys listed or your regular Brownstein Hyatt Farber Schreck, LLP attorney. This communication may be considered advertising in some jurisdictions. The information in this article is accurate as of the publication date. Because the law in this area is changing rapidly, and insights are not automatically updated, continued accuracy cannot be guaranteed.