Year: 2023

The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency issued guidance on managing risks associated with third-party relationships on June 6, 2023. The new guidance replaces prior guidance by the banking agencies on thirdparty relationships identified in the release. The agencies describe the guidance as a broad, principles-based approach in response to comments on the prior draft guidance released in July of 2021 requesting that the guidance address specific topics or types of relationships. Read More

Indiana, Montana and Tennessee joined six other states in enacting consumer data privacy laws. The other states with consumer data privacy laws are California (effective Jan. 1, 2020), Virginia (effective Jan. 1, 2023), Colorado (effective July 1, 2023), Connecticut (effective July 1, 2023), Utah (effective Dec. 31, 2023) and Iowa (effective Jan. 1, 2025). With the exception of the California consumer data privacy law, all the recently enacted privacy data laws are very similar. Importantly, all the state consumer date privacy laws except California include an exemption for financial institutions and data subject to the privacy provisions of the Gramm-Leach-Bliley Act. The laws give a consumer certain rights over the data collected about the consumer by businesses, including the right to know the consumer data being collected and restrict its use. Additionally, the laws require specific provisions in contracts between businesses that collect consumer data and their service providers. The Montana law will take effect October 1, 2024. The Tennessee law will take effect July 1, 2025. The Indiana law will take effect January 1, 2026. Read More

Compliance with the New York Commercial Finance Disclosure Law (“CFDL”) is required by August 1, 2023. The CFDL applies to multiple types of commercial financing products and requires providers to deliver disclosures when “extending a specific offer” for commercial financing in amounts of $2.5 million or less to a “recipient,” defined as a person who applies for commercial financing and is made a specific offer of commercial financing by a provider. See our ALERTS dated Feb. 10, 2023, Sept. 29, 2022 and Sept. 27, 2021. Read More

On May 1, 2023, both chambers of the Florida legislature passed HB 1267, amending the Consumer Finance Act, Florida’s licensed lender statute. Most notably, the proposed amendments would modify the interest rate provision for loans up to $25,000 from the current tiered rate caps to a flat maximum rate of 36% per annum for all loans up to $25,000. The interest rate cap for loans greater than $25,000 was not affected. The bill also proposes to increase the statutorily mandated grace period on delinquency charges to 12 days (up from the current 10 day grace period). Read More

On May 4, the Consumer Financial Protection Bureau (“CFPB”) published a report on medical credit cards and installment loans, highlighting the Bureau’s continued interest in the effect of medical debt on consumers. See our ALERTS of Feb. 15, 2022 and March 22, 2022. The report briefly details the history of medical credit cards and loans and highlights the problems and consumer risks the CFPB believes to be inherent in such specialty financing products, such as the expanded uses of medical credit cards and “confusing” product structures and advertising. Read More

Turning away industry commentators, the Consumer Financial Protection Bureau (“CFPB”) has declared merchant cash advances “credit” for purposes of small business data collection under the Equal Credit Opportunity Act, 15 U.S.C. §§ 1691 et seq. (“ECOA”), with potentially important further compliance implications for merchant cash advance providers, many of whom take the position that their merchant cash advances are true “sales” of future accounts receivable, not “credit” per se. See Small Business Lending Data Collection under the Equal Credit Opportunity Act (Regulation B) (consumerfinance.gov) (effective 90 days after date of publication in the Federal Register, with compliance dates for select institutions as early as October 1, 2024); see our Alert of Mar. 28, 2023. Read More

TEXAS BANKERS ASSOCIATION CHALLENGES CFPB SMALL BUSINESS LENDING DATA RULE

The Texas Banker’s Association (“TBA”) filed suit against the Consumer Financial Protection Bureau (“CFPB”) in the U.S. District Court for the Southern District of Texas challenging the CFPB’s final rule implementing Section 1071 of the Consumer Financial Protection Act which will require banks collect and report information about small business credit applications. Texas Bankers Association vs. CFPB, No. 7:23-cv-00144 (S.D. Tex. Filed Apr. 26, 2023); see our Alert of March 28, 2023. Read More

Add Connecticut, Minnesota and South Carolina to your scorecard of states proposing broad anti-evasion provisions for licensing statutes. See Connecticut SB 1033: SB1033 | Connecticut 2023 | AN ACT CONCERNING VARIOUS REVISIONS TO THE BANKING STATUTES. | TrackBill; Minnesota SF 1635: S1635-1 (mn.gov); South Carolina S 518: Bill Text: SC S0518 | 2023-2024 | 125th General Assembly | Introduced | LegiScan. These states follow Illinois, Hawaii, New Mexico and Maine, which have already adopted versions of such provisions. See, e.g., our Alert of July 20, 2021. These broad provisions are typically targeted at disfavored “bank partnership”, fintech and other lending programs. Read More

Colorado appears to want a second bite at the state opt-out apple. A bill introduced to limit charges on smaller consumer loans includes a provision that would revive Colorado’s explicit rejection of federal usury preemption by way of Section 525 of the Depository Institutions Deregulation and Monetary Control Act of 1980 (“DIDMCA”). See Colorado HB 1229 (passed house on third reading without further amendment on April 11; introduced in Senate on April 12; enacting a new Colo. Rev. Stat. § 5-13-106.). Colorado already opted out of federal preemption once before and previously repealed its opt-out. See Colo. Rev. Stat. § 5-13-104; repealed in 1994 by Colo. Sess. Laws ch. 272, § 12 (eff. July 1, 1994). Colorado is one of a number of states that have adopted some version of the Uniform Consumer Credit Code, which can repudiate contractual choice-of-law and venue provisions that do not choose a borrower’s state of residence and often contain broad territorial provisions that can deem transactions with state residents to have been “made” in the adoptive state. Read More

California finalized the new privacy regulations that implement Proposition 24, the California Privacy Rights Act of 2020 (“CPRA”). See our prior ALERTS dated Nov. 4, 2020. The regulations are the latest piece in a complex 18-month rulemaking process that began in September of 2021. The regulations implement the CPRA, as passed in 2020 and effective January 1, 2023, and are the first full rulemaking conducted by the newly created California Privacy Protection Agency. The new regulations build upon the California Consumer Privacy Act of 2018 (“CCPA”) and the regulations implementing the CCPA promulgated by the California Attorney General in May of 2022. Read More