CFPB Issues Final Rule Creating Registry To Identify Nonbank Repeat Offenders

As part of its ongoing efforts to reduce what it views as corporate recidivism, the Consumer Financial Protection Bureau (CFPB) issued a final rule on June 3, 2024 that will require certain nonbank financial companies to register with the CFPB when they become subject to final agency orders alleging violations of consumer financial laws (Final Rule).¹ For nonbank financial companies subject to the CFPB’s supervisory authority, a senior executive will also be required to provide a written “attestation” to the CFPB on an annual basis noting whether the executive is aware of any violations or instances of noncompliance with any registered orders. Those same companies will also be required to maintain records sufficient to provide reasonable support for the written attestation for five years after it is submitted. In addition to compliance obligations created by the Final Rule, nonbank financial companies with registered orders should prepare for increased scrutiny from the CFPB’s Repeat Offender Unit (ROU) and increased penalties in any future CFPB settlements.

Overview

Covered Companies. The registration requirement applies to non-depository consumer financial services companies under the CFPB’s jurisdiction (Covered Companies)² that have entered into final, written, public orders — including consent orders — with an effective date on or after January 1, 2017 that were issued in connection with an action or proceeding brought by a government agency (whether federal, state, or local) alleging a violation of (a) federal consumer financial laws, (b) other laws enforced by the CFPB, or (c) certain federal and state unfair, deceptive, or abusive acts or practices (UDAAP) laws³ (Covered Orders).

Notably, for existing orders with an effective date on or after January 1, 2017, the Final Rule applies only if the orders are still in effect on September 16, 2024. Any Covered Company that entered into an order on or after January 1, 2017, but whose order expires or is terminated by September 15, 2024, is exempt from the registration requirement.

Additionally, the Final Rule contains a limited, one-time “alternative registration” option for otherwise Covered Orders that are published on the Nationwide Multistate Licensing System & Registry Consumer Access website.⁴

Information Reported. Covered Companies with Covered Orders will be required to register with the CFPB and submit a copy of the Covered Order as well as (1) identity information (e.g., the Covered Company’s legal name and principal place of business); (2) administrative information (e.g., information regarding a Covered Company’s affiliates); and (3) information about the Covered Order (e.g., the effective date, the date of expiration, all covered laws found to have been, or alleged to have been, violated, etc.).⁵ Any changes to the information reported must be reported to the CFPB within 90 days of the change.⁶

The Attestation Requirement. For Covered Companies that are also subject to the CFPB’s supervisory authority,⁷ a senior executive of the company will need to submit a signed written statement for each Covered Order. The attestation must include (1) a description of the steps that the executive has taken to review and oversee the steps the nonbank took to comply with the Covered Order during the preceding calendar year and (2) whether, to the executive’s knowledge, the Covered Company identified any violations or noncompliance with any obligations imposed in the order’s public provisions during the prior calendar year.⁸ The “attesting executive” for each Covered Order must be the highest-ranking duly appointed senior executive officer (1) whose duties include ensuring the entity’s compliance with federal consumer financial law, (2) who has knowledge of the entity’s systems and procedures for achieving compliance with the Covered Order, and (3) who has control over the entity’s efforts to comply with the Covered Order.⁹

Notably, although the CFPB “may publish” information about the registered entities or Covered Orders on its website, the written attestations will be treated as confidential supervisory information.¹⁰ The names and titles of the attesting executives will, however, be published in the public registry.¹¹

Reporting Timelines

Registration Deadlines. The Final Rule will become effective on September 16, 2024, and registration requirements for Covered Companies begin as early as October 16, 2024.

Initial registration deadlines are governed by the size of the Covered Company and whether the company is supervised by the CFPB. Submissions for “larger participant”¹² Covered Companies are due between October 16, 2024 and January 14, 2025. All other CFPB-supervised Covered Companies must register any Covered Orders between January 14, 2025 and April 14, 2025. Submissions for any remaining Covered Companies are due between April 14, 2025 and July 14, 2025.

After the submission period begins, Covered Companies must report any new orders or modification, termination, or abrogation of existing orders within 90 days.¹³ Registration requirements apply to a Covered Order until it expires or is terminated by an agency or court.¹⁴

Attestation Deadlines. In general, CFPB-supervised institutions will be required to submit their attestations annually on or before March 31 each year. The first written attestations for larger CFPB-supervised institutions will be due by March 31, 2025, but attestations for 2024 will only be required for Covered Orders with effective dates between October 16, 2024 and December 31, 2024. For all other CFPB-supervised nonbanks, the first written attestation is required on March 31, 2026 and will apply to all Covered Orders with an effective date on or after January 14, 2025 through December 31, 2025.¹⁵

Key Takeaways

1. Registration will lead to enhanced scrutiny.

The Final Rule is conspicuously silent on the direct consequences, if any, of having to register a Covered Order with the CFPB.¹⁶ However, the CFPB has explicitly stated that the registry is part of the CFPB’s efforts to reduce recidivism by corporate offenders,¹⁷ including the individuals behind the corporation.¹⁸ In addition to the reputational damage that may be associated with being labeled as a “repeat offender,” Covered Companies with at least one Covered Order registered with the CFPB should expect enhanced scrutiny from the CFPB’s ROU. As discussed in our May 2024 Advisory, the ROU operates within a broad mandate in conjunction with the CFPB’s Offices of Supervision and Enforcement. As such, ROU scrutiny may result in a variety of adverse consequences for Covered Companies, up to and including increased monetary penalties in any future settlements with the CFPB.

2. The Final Rule does not apply to court orders approving settlements with private parties.

Although the Final Rule refers to the registration of “court orders,” the rule uses that term to refer to court orders approving or implementing agency actions, not court orders approving settlements with wholly private plaintiffs.¹⁹ This is notable because many consumer financial statutes at both the state and federal level provide for a private right of action. Under the Final Rule, if a Covered Company were to settle a putative class action with private plaintiffs suing under a state UDAAP law (and no agency was involved), the Covered Company would not be required to register; however, if the Covered Company settled the same claim with a state attorney general, the Covered Company would be required to register.

3. The Consumer Financial Protection Act does not explicitly authorize an attestation requirement.

This is not the only attestation requirement in the financial services space. For example, Section 302 of the Sarbanes-Oxley Act (SOX) of 2002 requires the chief executive officer and chief financial officer of publicly traded companies to personally certify the accuracy and completeness of their company’s financial reports.²⁰ However, unlike SOX, the Consumer Financial Protection Act (CFPA) does not contain an explicit certification requirement; rather, the CFPB is relying on the general powers Congress granted the CFPB in the CFPA to impose this mandate.²¹ And, perhaps in response to a wave of industry challenges to prior CFPB actions, the Final Rule devotes significant energy to justifying the CFPB’s authority to implement the Final Rule. Nevertheless, we anticipate legal challenges to the rule.

4. The attestation requirement poses particular challenges that can create complications for Covered Companies.

The New York State Department of Financial Services’ Parts 500 and 504 rules are other examples of attestation requirements for financial services companies. Under Parts 500 and 504, the Board of Directors or a senior officer must attest annually to the organization’s cybersecurity or BSA/AML/OFAC compliance controls.²² As regulated entities and their advisers learned in implementing the New York rules, there is a significant compliance burden associated with preparing to make such attestations, often including numerous sub-certifications from departments throughout the organization. Attestations to the CFPB will become even more complicated for Covered Companies when another regulator, such as a state regulatory agency, issues examination findings to the Covered Company bearing on the company’s compliance with laws and regulations.

For more information about how the CFPB registry may impact your business, please contact any of the authors of this Advisory or your usual Arnold & Porter contact.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.