January 22, 2024

CFPB Bites of the Month - 2023 Annual Review - Banking

Eric L. Johnson, Justin B. Hosie, Laura J. Bacon, Ryan S. Stinneford and Thomas P. Quinn, Jr.

In this article, we share a timeline of our monthly "bites" for 2023 applicable to banks along with some additional related information. CFPB activity relevant to banks coalesced around five general issues: (1) bank fees, (2) access to financial information, (3) account servicing, (4) abusive practices, and (5) fair lending and data collection rules.

Bite 1: Scrutiny of Bank Fees

The CFPB paid particular emphasis to bank fees in 2023. A key focus was on fees the CFPB considered to be "junk fees" - i.e. fees that were unavoidable, came as a surprise to consumers, or were otherwise abusive.

• CFPB Takes Action Against a Bank for Alleged Overdraft "Fee Harvesting" - On December 7, 2023, the CFPB announced an action against a bank that allegedly mislead consumers and failed to provide proper disclosures when it enrolled them in overdraft programs over the phone. The CFPB alleged that the bank failed to describe overdraft service in writing before consumers opt-in to overdraft coverage, violating the Electronic Funds Transfer Act. The CFPB also claims that bank employees omitted key cost information when enrolling customers over the phone. The CFPB's order requires the bank to refund $5 million to affected consumers and pay a $1.2 million penalty to the CFPB's civil penalty fund.
• CFPB Publishes Special Junk Fees Update Edition of Supervisory Highlights - On October 11, 2023, the CFPB published a special edition of its Supervisory Highlights, focused on fees the CFPB (and FTC) call "junk fees." The CFPB took issue with institutions charging a variety of "junk fees," including fees for: (1) multiple payment re-presentments returned unpaid; (2) authorized positive, settle negative overdrafts; (3) printing and mailing undelivered statements; and (4) depositing checks that are returned unpaid. This special edition also referenced a circular on overdraft fees, a bulletin on returned deposit fees, and an advisory opinion on pay-to-pay fees.
• CFPB and OCC Take Action Against Large National Bank for Representment Fees and Credit Card Account Opening and Rewards Points Issues - On July 11, 2023, both the CFPB and the Comptroller of the Currency (OCC) took action against a large national bank, ordering payment of more than $100 Million to customers and $150 Million in penalties. The CFPB alleged the bank was "double-dipping" on fees, withholding credit card rewards, and opening accounts without authorization. The OCC also claimed that the bank's fee practices were illegal. The agencies allege that the bank had a policy of charging customers $35 for insufficient funds and allowed these fees to be repeatedly charged for the same transaction. The CFPB also claims that the bank withheld promised credit card account bonuses, such as cash rewards or bonus points, to tens of thousands of consumers, and denied sign-up bonuses due to system failures. The bank also allegedly opened credit card accounts without consumers' knowledge and obtained credit reports to do so. As a result, the bank was required to stop repeat offenses, pay redress to consumers, pay a $60 million penalty to the OCC, and pay a $30 million penalty to the CFPB.
• CFPB Issues Guidance about "Fake Account" Creation and Fees -- On May 10, 2023, the CFPB issued a circular about "fake account" creation and fees. The CFPB says that it has received complaints that banks are reopening closed accounts after consumers complete all the required steps to close an account, and then assessing overdraft and nonsufficient funds fees. Plus, the CFPB claims that banks are charging account maintenance fees upon reopening, even if the consumer was not required to pay account maintenance fees before account closure. Director Chopra stated that when a bank unilaterally chooses to reopen an account in someone's name after they closed the account, that it's a "fake account," and called the fees charged "junk fees." The CFPB's circular indicates that banks risk violating the federal prohibition on unfairness by unilaterally reopening closed accounts. According to the CFPB, consumers often cannot reasonably avoid the risk of substantial injury caused by this practice because they cannot control: a third party's attempt to debit or deposit money, the process and timing of account closure, or the terms of deposit account agreements. The CFPB also asked for consumer complaints involving banks and asked whistleblowers to come forward with information.

Bite 2: Access to Financial Information

In addition to the above-described actions aimed at bank fees, the CFPB also looked to several dormant provisions of the Consumer Financial Protection Act in an effort to provide consumers with improved - and free - access to their financial information.

• CFPB Proposes Rule on Personal Financial Data Rights to Jumpstart Competition and Accelerate Shift to Open Banking - On October 19, 2023, the CFPB announced that a proposed rule to give consumers more control over financial data and new protections against data misuse. The proposal implements Section 1033 of the Consumer Financial Protection Act, which requires the CFPB to implement personal financial data sharing standards and protections. According to the CFPB, this rule will ensure that consumers can access their data without paying "junk fees," give people a legal right to grant third parties access to information about their financial accounts, and help consumers walk away from bad service by facilitating portability of their data. It will also prohibit companies receiving consumer data from using it for anything but the specific purpose requested by the consumer. Under the proposal, the requirements would be implemented in phases, with larger providers being subject to them first. In addition, community banks and credit unions that have no digital interface at all with their customers would be exempt from the rule's requirements. In prepared remarks, CFPB Director Chopra said that this rule will help decentralize the financial services market, give consumers more control, and allow smaller institutions and startups to compete fairly with major market players.
• CFPB Issues Advisory Opinion on "Junk Fees" Charged by Banks on Consumers Requesting Account Information - On October 11, 2023, the CFPB also issued an advisory opinion regarding a statute prohibiting large banks and credit unions from imposing unreasonable obstacles on customers related to basic information about their own accounts. Specifically, Section 1034(c) of the Consumer Financial Protection Act requires large banks and credit unions to provide account information upon request to customers when the information is in their control or possession. This includes information such as balances, interest rates, and transaction history. The CFPB says that large banks are shifting away from a relationship model of banking and are charging so-called "junk fees" to respond to account information inquiries. The CFPB says this practice impedes customers from obtaining information that they are entitled to under federal law. The advisory opinion says that charging fees to respond to an information request violates the CFPA, but that as a matter of prosecutorial discretion, the CFPB does not intend to seek monetary relief for potential violations described in the opinion that occur before February 1, 2024.

Bite 3: Account Servicing Issues

Not to be lost in the CFPB emphasis on fees, regulators also kept an eye on account servicing issues.

• CFPB and OCC Announce Action Against Large Bank for Issues Related to Servicing of Unemployment Benefit Prepaid Cards -- On December 19, 2023, the CFPB and OCC announced an action against a large bank. The CFPB claimed that the bank kept consumers from accessing their unemployment benefits. The bank allegedly froze tens of thousands of accounts without providing the customers with a reliable and quick way to regain access and failed to provide provisional account credits while investigating potentially unauthorized transfers. These alleged actions happened during the pandemic, while the bank had contracts with at least 19 states to deliver unemployment benefits. The consumers whose accounts were frozen lost access to their benefits until they were able to verify their identities to unfreeze their accounts, but the bank allegedly did not have a system in place for the identity verification. According to federal law, when accountholders report unauthorized transfers, banks must provide provisional account credits if their investigations take more than 10 days, and the CFPB and OCC alleged that this bank failed to provide those credits. The CFPB required the bank to pay $5.7 million to consumers, a $15 million penalty to the civil penalty fund, and change its practices regarding limiting account access and issuing provisional credits. The OCC also separately fined the bank an additional $15 million.
• CFPB Reaches $9 Million Settlement with Large Bank for Alleged Credit Card Servicing Issues - On May 23, 2023, the CFPB announced a $9 Million settlement with a large bank. The settlement resolved allegations that the bank failed to appropriately manage and respond to card disputes and fraud claims. According to the CFPB, federal law requires issuers to investigate billing allegations, send consumer notifications, and issue refunds as appropriate. The CFPB claimed in a 2020 lawsuit that the bank violated the Truth in Lending Act and Regulation Z by improperly denying customer reports of fraud, failing to provide refunds, failing to provide required notices, and referring customers who called for credit counseling to collections. The bank will pay a $9 Million fine and must change its dispute practices, plus properly address valid billing error notices and unauthorized use claims.

Bite 4: Abusive Conduct in Consumer Financial Markets

On April 3, 2023, the CFPB issued a policy statement explaining the federal prohibition on "abusive conduct" and summarizing a decade of CFPB activity. The CFPB noted that abusive conduct generally includes (1) obscuring important features of a product or service or (2) leveraging certain circumstances—like gaps in understanding, unequal bargaining power, or consumer reliance—to take "unreasonable advantage." The policy statement also describes how abusive conduct can arise from the use of what the CFPB calls "dark patterns," business practices that trick or manipulate consumers to make choices, often harmful, that they would not otherwise have made.

Bite 5: Fair Lending and Data Collection Rules

The CFPB remained active in the enforcement of fair lending and data applicant data collection requirements.

• CFPB Orders Large Bank to Pay $12 Million Penalty for HMDA Data Collection Violations - On November 28, 2023, the CFPB announced that it has ordered a large bank to pay a $12 million penalty for violations of the Home Mortgage Disclosure Act. According to the CFPB's allegations, hundreds of loan officers at the bank failed to ask mortgage applicants certain demographic questions as required under federal law, and then falsely reported that the applicants had chosen not to respond. Over a three-month period, the loan officers reported that 100% of applicants chose not to provide their demographic data over at least a three-month period. The CFPB also alleged that the bank failed to adequately oversee accurate data collection and ignored the known problem for years. The CFPB also claimed that the bank was a "repeat offender" based on other fines and penalties previously imposed.
• CFPB Settles With Large Bank Over Alleged Discrimination on Immigration Status - On November 8, 2023, the CFPB announced a settlement with a large national bank over allegations that it discriminated against credit card applicants based on their immigration status. The CFPB alleged that the bank identified consumers it suspected to be of Armenian descent by surname, with particular emphasis placed on applicants with suspected Armenian surnames located in Glendale, California (home to approximately 15% of all Armenian Americans). Because the bank suspected that such consumers presented a higher risk of fraudulent credit card activity, the CFPB alleged that the bank applied stricter scrutiny and were more likely to negatively assess and/or deny credit card applications received from such applicants. The CFPB alleged that because of these practices the bank was more likely to deny credit to applicants of Armenian origin when compared to similarly situated applicants. The bank also allegedly provided false or misleading reasons for the denial of such applicants in adverse action notices. The CFPB alleged that these activities violated the Equal Credit Opportunity Act prohibition against discriminating on the basis of national origin. The CFPB required the bank to pay $ 1.4 million to affected consumers, and $ 24.5 million fine in addition to other corrective action.
• CFPB Issues Guidance on Adverse Action Notices - On September 19, 2023, the CFPB published a Consumer Financial Protection Circular discussing adverse action notification requirements. In this circular the CFPB expressed concern with the use of the "checklist of reasons" model form adverse action notices found in the Appendices to Reg B if the reasons do not specifically and accurately state the principal reason why adverse action was taken. The CFPB is particularly concerned with this occurring when creditors artificial intelligence or complex underwriting algorithms that do not consider information that is found on the credit application or in the applicant's consumer report. To address this concern, the CFPB recommended that should modify the checklist of reasons, or use the "other" check box along with an appropriate narrative description, if the model form does not reflect the principal reasons for the adverse action taken. The CFPB cautioned that a creditor would not be in compliance if it disclosed adverse action reasons that are too broad, vague or simply to not inform the applicant of the principal reason why adverse action was taken.

Conclusions and a Look Ahead

While most of the headlines and emphasis remained (rightfully so) on issues related to fee income issues, the CFPB was active on several regulatory fronts. With 2024 being an election year, we expect fee income related issues to continue to be at the forefront of regulatory activity. The CFPB has already moved forward on this front, publishing a Proposed Rule regarding overdraft fees on January 17, 2024.

If we had to select a potential dark horse issue for further regulator activity during the upcoming year, it will be interesting to see more detail about where and how the CFPB regulates consumer information access. Banks are entrusted with massive amounts of data regarding consumers and their financial accounts. As noted above, the CFPB has expressed a regulatory desire to ensure that this information is accessible to consumers without impediment. It will be fascinating to witness how this issue develops throughout 2024.

Still hungry? Please join for our next CFPB Bites of the Month. Here is our lineup for 2024. If you missed any of our prior Bites, request a replay on our website