January 18, 2023
CFPB Bites of the Month - 2022 Annual Review - Credit Cards
In this article, we share a timeline of our monthly "bites" for 2022 applicable to the credit card industry. As evidenced by the timeline, federal regulators (primarily the CFPB) are beginning to renew their focus on credit card regulation post-CARD Act (2010). Given the developments outlined below, we expect that the CFPB again will be diving into credit card oversight in 2023 and the coming years.
So, what happened in 2022?
1. The CFPB outlined steps it will take on credit card interest and "junk fees"
On January 19, 2022, the CFPB announced various plans related to credit card interest and "junk fees." From 2018 to 2020, the CFPB estimates that Americans paid roughly $120 billion per year in credit card interest and fees. As a result, the CFPB announced plans to ensure that there is robust and fair competition in the credit card market by:
- Uncovering unfair, anti-competitive practices.
- Using rulemaking under Section 1033 of the Dodd-Frank Act to make it easier to compare, switch, or refinance credit cards.
- Scrutinizing fees the CFPB has dubbed "junk fees."
The CFPB promised to keep the public updated on changes to the credit card market and actions taken to ensure the credit card market is working effectively.
2. CFPB Issues Credit Card Late Fees Report
On March 29, 2022, the CFP released a credit card late fees report. The Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act) created various protections for cardholders, including limiting charges for penalties and limits on interest rate increases. According to the CFPB:
- Many major issuers charge the maximum late fee allowed by law.
- Borrowers on subprime cards and private label cards are particularly susceptible to late fee charges.
- Late fee volume fell when stimulus checks arrived in 2020 and 2021, particularly for households with lower credit scores.
- Low-income areas, areas with high shares of Black Americans, and areas with lower economic mobility all bear more of the late fee burden.
According to the report, late fees continued to bolster the bottom line for credit card companies, especially private label and subprime specialist issuers.
It is somewhat curious that the CFPB would focus on late fees in light of the limitations placed on penalty fees by the CARD Act in 2010. Those limitations, among other things, establish a safe harbor for the amounts of late fees that issuers may impose and the frequency with which issuers may impose late fees. The CFPB appears to be suggesting that its prior limitations on such fees are insufficient to protect cardholders, despite that the CFPB itself enacted the rules on which the issuers typically rely to charge such fees.
3. The CFPB says that suppressing credit card payment data has potential for harm
On May 25, 2022, the CFPB announced that it sent letters to credit card company CEOs asking them to explain the accuracy of consumer payment information reported to consumer reporting agencies. According to recent CFPB research, about half of the largest credit card companies contribute exact data to credit reporting companies about borrower's monthly payment amounts. Several of the largest credit card companies have suppressed actual payment amount information that they had previously provided or furnished on consumers. The CFPB indicated that suppressing actual payment amount information has the potential to impact consumers' ability to access credit at the most competitive rates.
4. CFPB Supervisory Highlights target credit dispute responses
On May 26, 2022, the CFPB further explained concerns regarding credit card disputes. According to the recent CFPB Supervisory Highlights, examiners had found credit card companies were sending unclear notices to consumers at the end of dispute investigations. The CFPB noted that the Fair Credit Reporting Act ("FCRA") requires furnishers to conduct reasonable investigations about disputes and then "report the results of the investigation to the consumer" generally within 30 days, addressing specific information required by the FCRA. After CFPB examinations, some credit card furnishers revised their notices to comply with the FCRA.
5. The CFPB announced rulemaking related to credit card late fees and late payments
On June 22, 2022, the CFPB published an Advance Notice of Proposed Rulemaking, the CFPB announced that it was seeking information from credit card issuers, consumer groups, and the public regarding credit card late fees and late payments. The CFPB is also seeking data about card issuers' revenue and expenses, the potential deterrent effect of late fees, and the role late fees play in credit card companies' profitability. Public input will inform revisions to Regulation Z, which implements the CARD Act and the Truth in Lending Act. The deadline for submitting comments was July 22, 2022.
6. The CFPB issued an Advisory Opinion addressing privacy of personal data
On July 7, 2022, the CFPB issued an advisory opinion indicating that companies using and sharing credit reports and background reports must have a permissible purpose under the Fair Credit Reporting Act (FCRA). The CFPB's Advisory Opinion indicates that credit reporting companies and users of credit reports have specific obligations to protect the data privacy. The advisory also reminds covered entities of potential criminal liability for certain misconduct.
The CFPB says that using insufficient matching procedures, such as name-only matching, can result in credit reporting companies providing reports to entities without a permissible purpose, which would violate consumers' privacy rights. Likewise, the CFPB indicated that companies violate the law in providing credit reports of multiple people as "possible matches." The CFPB further takes the position that disclaimers about insufficient matching procedures do not cure violations. The CFPB also said that users of consumer reports must ensure that they do not obtain a credit report when they lack a permissible purpose for doing so. The advisory opinion addresses the criminal liability provisions in the Fair Credit Reporting Act.
7. CFPB issued a circular about data security practices
On August 11, 2022, the CFPB issued a circular reminding regulators that financial companies violate federal law when they fail to safeguard consumer data. The circular provides guidance to other regulators, describing examples of circumstances in which organizations can be held liable for data security protocols. According to the circular, liability can arise for failing to implement multi-factor authentication, inadequate password management, and failing to update software in a timely manner.
8. CFPB Says furnishers have an obligation to investigate consumer disputes
On September 14, 2022, the CFPB and FTC once again addressed furnishers' duty to investigate credit disputes. The two agencies jointly filed an amicus brief in the U.S. Court of Appeals for the Third Circuit noting that when a consumer submits a dispute to a credit reporting company and the dispute is passed along to the furnisher, the furnisher is required to investigate and report the results of its investigation back to the credit reporting company. The brief indicates that a furnisher can't avoid that obligation by claiming a dispute is "frivolous." Furnishers are required to inform consumers about additional information needed, rather than just ignoring potentially frivolous disputes.
9. Federal Appeals Court Finds CFPB Funding Unconstitutional
On October 19, 2022, a three judge panel of the U.S. Circuit Court of Appeals for the Fifth Circuit decided unanimously, that "Congress's decision to abdicate its appropriations power under the Constitution, i.e., to cede its power of the purse to the Bureau, violates the Constitution's structural separation of powers." As a result, the court reversed the judgment of the district court, rendered judgment in favor of the trade associations suing the CFPB, and vacated a 2017 CFPB rule.
10. CFPB Kicks Off Personal Financial Data Rights Rulemaking
On October 27, 2022, the CFPB released an outline of options and proposals aimed to strengthen consumers' access to, and control over their financial data. The CFPB indicated that this is a first step before issuing a proposed rule on data rights that would implement section 1033 of the Dodd-Frank Act. Under the proposals, the CFPB would require firms to make a consumer's financial information available to them or to a third party at that consumer's direction.
11. CFPB Proposes Registry to Detect So-Called "Repeat Offenders"
On December 12, 2022, the CFPB proposed to start a registry of organizations it calls "repeat offenders." The registry would include organizations involved in prior consent orders with government agencies. This proposal would require certain nonbank financial firms to register with the CFPB when they become subject to certain local, state, or federal consumer financial protection orders. The CFPB says that the registry will help unify the efforts of consumer financial protection enforcers, as well as provide the increased transparency and coordination. Comments will be due in February of 2023.
12. The CFPB is pursing discrimination in consumer finance, beyond credit transactions, using its unfairness authority
On March 16, 2022, the CFPB announced changes to its supervisory operations to address discrimination, including in situations where fair lending laws do not apply. The CFPB indicated that in examinations, it plans to scrutinize discriminatory conduct related to advertising, pricing, and other areas to ensure that companies are testing for and eliminating discrimination.
Government regulators and private plaintiffs have commonly relied on the Equal Credit Opportunity Act (ECOA), a fair lending law which covers extensions of credit. However, under this new approach, certain discriminatory practices may also trigger liability under the Consumer Financial Protection Act (CFPA), which prohibits unfair, deceptive and abusive acts and practices (UDAAPs). The CFPB published an updated exam manual for evaluating UDAAPs, which notes that discrimination may meet the criteria for "unfairness."
The CFPB said it will examine for discrimination in all consumer finance markets, including credit, servicing, collections, consumer reporting, payments, remittances, and deposits. CFPB examiners will require supervised companies to show their processes for assessing risks and discriminatory outcomes, including documentation of customer demographics and the impact of products and fees on different demographic groups.
On September 29, 2022, the U.S. Chamber of Commerce, American Bankers Association, Consumer Bankers Association, and other organizations filed a complaint in the Eastern District of Texas against the CFPB. The plaintiffs claimed the CFPB exceeded its statutory authority when it revised its UDAAP exam manual in March. They also claimed that changes were arbitrary and capricious, and violated the Administrative Procedure Act's notice and comment requirements.