Debevoise & Plimpton attorneys caution financial technology companies that recent actions by the Consumer Financial Protection Bureau signal it intends to take an expansive view of its jurisdiction. They offer several steps fintechs can take to prepare for this extra scrutiny.
Financial technology companies, particularly fledgling startups, are primarily concerned with ensuring they have a thriving business model that can attract sufficient funding, especially with darkening economic forecasts.
Although legal and regulatory concerns factor into the development of a business model or raising capital, the Consumer Financial Protection Bureau may not be top of mind for many fintechs. But the CFPB has always had broad supervisory and enforcement authority over non-banks.
Certain recent actions by the CFPB signal it intends to take an expansive view of its jurisdiction over non-banks that participate in the consumer financial services ecosystem. Therefore, fintechs must prepare now for added scrutiny.
Actions against fintechs include efforts to supervise or otherwise regulate technology companies that operate in the payments space or collect, analyze, and monetize consumer financial data. The CFPB published an interpretive rule asserting enforcement authority over digital marketers that deliver content to consumers on behalf of consumer financial service companies. The CFPB also announced an intent to supervise entities it deems to "pose a risk" to consumers.
Jurisdiction and Power to Investigate
Congress granted the CFPB the authority to police markets for consumer financial products or services, including consumer credit products, deposit-taking activity, payment processing, and debt collection, to name just a few.
The agency does this by supervising and enforcing violations of law against those that offer or provide consumer financial products or services or provide a material service to a consumer financial services provider. And this can include fintechs.
The banking industry and consumer advocates are urging greater scrutiny of nonbank financial services providers by petitioning the CFPB to develop rulemaking to define larger participants in the market for personal loans so that large non-depository lenders also would be subject to CFPB supervision.
Accordingly, fintechs in the consumer financial marketplace—whether partnered with banks or acting alone—may be subject to the CFPB's supervision.
Risk of Penalties, Injunctive Relief
CFPB scrutiny can lead to penalties and injunctive relief. For example, in May the CFPB entered into a consent order with two payment processors and their owners that required them to pay $3 million in penalties and refund over $8 million in fees.
The CFPA is also authorized to seek injunctive relief in enforcement actions. Recent statements by CFPB Director Rohit Chopra have made clear that the agency is seeking to enforce "limits on activities or functions of a firm" to promote "structural" changes at financial services firms to prevent future violations.
In December 2021, the fintech LendUp Loans was effectively "shuttered" when the CFPB found it to be in violation of a previous consent order and prohibited the firm from making new loans, collecting on outstanding loans, or selling consumer information.
Reputational Harm
Perhaps the most damaging threat of CFPB scrutiny is the reputational hit that may come with a public enforcement action or even mere disclosure of an investigation.
Consumer trust is critical to the brand of any company that contributes to the offering of a consumer product, particularly in an arena that used to be the province of banks. Any reputational damage also could affect a fintech's relationships with its investors, and impair future fundraising efforts.
Finally, a CFPB action could impact a fintech's relationship with other US or state regulators, and may hinder their efforts to obtain any necessary state licenses.
Preparing for the Future
It's clear, then, that fintechs ignore the CFPB at their peril as they scale their operations. So what can fintechs do to prepare for this scrutiny?
First, knowledge of the regulatory landscape in which a fintech operates is critical. This means taking the time to look at recent CFPB guidance, enforcement actions, and regulations in the relevant market. Have similarly situated fintechs been the subject of a consent order or scrutiny in some other way? What lessons can be learned from those companies and regulatory actions?
For example, the CFPB is increasingly focused on how consumer data is collected and used to provide consumer financial products or services and ensuring that consumers have control over their own data. And the CFPB is working on a final rule that would allow consumers to have more control and more choice with respect to their personal data, without creating what Chopra calls "an underworld" where companies try to monetize access to financial data.
Second, fintechs should analyze their touch points with consumers in light of CFPB guidance. Are there any stress or risk points?
For example, fintechs could consider the data they collect on consumers, the adequacy of their cybersecurity measures and policies surrounding that data, whether they sell any consumer data, and if so, whether consumers are given proper disclosures at the time they are prompted to provide their information.
Finally, fintechs should hire counsel who are familiar with their business, customers, and compliance programs and who understand the CFPB's processes to avoid being caught flat-footed and unaware if they become the subject of CFPB scrutiny.
Setting in motion these easy to follow steps will help fintechs mitigate the legal and reputational risks that come with CFPB scrutiny.
Originally Published by Bloomberg Law
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.