CFPB Order Makes it Clear: Nonbanks Should Prepare for CFPB Supervision

The CFPB recently published a decision and order subjecting a nonbank consumer lender to its supervisory authority based on its determination that the lender may be “engaging, or has engaged, in conduct that poses risks to consumers.”

This marks the first time the agency has made such a determination after a contested administrative proceeding, the CFPB said in a press release. As the CFPB acknowledged, it will serve as an important precedent guiding the agency’s exercise of this authority.

Here are five key takeaways:

1. The CFPB has unliteral authority to subject individual nonbank financial services companies to its supervisory authority.
2. The CFPB has set a low bar for what constitutes “reasonable cause” to believe a nonbank’s conduct poses risks to consumers.
3. Refusing to consent may delay CFPB supervision, but only for a matter of months.
4. The CFPB has only publicized risk to consumers determinations after a nonbank refused to consent to supervision.
5. Nonbank providers of consumer financial products or services that are not currently subject to supervision should prepare for it.

The CFPB has unilateral authority to subject individual nonbank financial services companies to its supervisory authority.

Congress expressly granted the CFPB supervisory authority over the thousands of nonbanks that offer residential mortgage loans, private education loans and payday loans. Congress also provided the CFPB two avenues to extend its supervisory authority over other nonbanks:

• The CFPB has authority to issue rules defining who is a “larger participant” in a market for a consumer financial product or service other than the markets for mortgage, private student and payday loans.
  • In its first four years, the CFPB issued five “larger participant” rules, which extended the CFPB’s supervisory authority to larger participants in the consumer debt collection, consumer reporting, student loan servicing, international remittances and automobile financing markets.
  • After nearly a decade, the CFPB recently proposed another larger participant rule for the “market for general-use digital consumer payment applications.”
• Congress authorized the CFPB to supervise any nonbank provider of consumer financial service products or services when “the Bureau has reasonable cause to determine … that [the nonbank] is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”

The CFPB issued a procedural rule in 2013 that governs Risks to Consumers Determinations. Under that rule, the process begins when the CFPB provides a notice to a nonbank setting forth the basis for a possible Risks to Consumers Determination. The recipient has the right to respond in writing and orally, and the CFPB Director makes the ultimate determination of whether reasonable cause exists to determine that the nonbank is engaging in conduct that poses risks to consumers.

Many nonbanks have “consented” to the CFPB’s supervisory authority pursuant to this rule, often as a term of a negotiated consent order resolving an enforcement action. Increasingly, however, nonbanks have “consented” pursuant to a procedure in which a company that receives a Risks to Consumers Notice can forgo its procedural rights and consent to supervision. In fact, last week’s press release stated that the CFPB has issued such Notices to nonbanks operating “across [the] consumer financial services” industry, and a recent edition of the CFPB’s Supervisory Highlights publication noted that “several entities have voluntarily consented to the CFPB’s supervisory authority” after receiving a Risks to Consumers Notice.

Last week’s order represents the first time a nonbank has refused to consent and chosen instead to insist on its procedural right to contest the Risks to Consumers Notice. Nonbanks that choose this route have a heavy burden. The statute provides that the CFPB will be both prosecutor and judge in these proceedings. Indeed, the proceeding that resulted in the recently published order was initiated by the Assistant Director for Supervision, a political appointee, and resolved by the CFPB’s Director, her immediate supervisor and the person who appointed her.

Nonbanks that receive a Risks to Consumers Notice may reasonably conclude they will be unlikely to persuade the Director to reach a different conclusion than Bureau staff, especially when such a determination does not commit the agency in any way. And while the CFPB concedes that the Director’s final determination is “final agency action” subject to judicial review under the Administrative Procedure Act, a district judge would not review the Director’s judgment de novo but would apply the APA’s deferential “arbitrary and capricious” standard. Accordingly, once the CFPB has decided a nonbank is engaging in conduct that “poses risks to consumers,” only a strong factual rebuttal is likely to persuade the Bureau otherwise.

The CFPB has set a low bar for what constitutes “reasonable cause” to believe a nonbank’s conduct poses risks to consumers.

Last week’s order makes clear that the CFPB interprets its authority broadly. According to the CFPB, the requirement that it have “reasonable cause” to determine that a company poses risks to consumers provides it with “considerable discretion.” For example, this order was based on unverified complaints focused on:

• Potentially misleading oral statements about aspects of the product that contradict contractual terms governing the loan product.
• Debt collection practices that do not necessarily violate the existing law.
• Inaccurate credit reporting, “even to the extent [the Company] disputes some of the facts alleged by consumers.”
• The mere possibility that consumers’ frequent refinancing of loan obligations reflects unlawful behavior.

The CFPB made clear that it had not determined – and did not have to determine – the company actually had engaged in unlawful conduct. In its view, the purpose of an examination is to assess an institution’s compliance with federal consumer financial law, and that it need not reach any judgment regarding the legality of conduct in advance of an examination.

Indeed, it is difficult to draw a meaningful distinction between the Bureau’s standard for when it can make a Risks to Consumers Determination and when it can issue a Civil Investigative Demand (CID) to a company. The CFPB has authority to issue a CID whenever it has “reason to believe” that a person may possess facts relevant to a violation of law. The agency has repeatedly emphasized that it “is not required to show that it has probable cause to believe there is a violation of federal law before opening an investigation,” and that it can issue a CID “merely on suspicion that the law is being violated, or even just because it wants assurance that it is not.”

Just as the recipients of CIDs have failed to persuade the Director that the Office of Enforcement did not meet this low bar when it issued a CID, recipients of Risks to Consumers Notices are likely to have a difficult time persuading the Director that the Office of Supervision was wrong to say it had “reasonable cause” to determine the nonbank “is engaging, or has engaged, in conduct that poses risks to consumers.”

Refusing to consent may delay CFPB supervision, but only for a matter of months.

Although it’s only a single data point, the order issued last week does provide some indication of how long the process takes when a nonbank refuses to consent to supervision. It reveals that the Office of Supervision’s “notice” was issued on March 10, 2023, and that the final determination from the Director came on November 30, 2023. But that eight-and-a-half-month process may not represent a typical process because it reflects an additional three months related to supplemental briefing not contemplated by the procedural rules. Accordingly, nonbanks considering whether to contest the Office of Supervision’s Notice should assume that doing so will delay the final determination by approximately six months or even less.

The CFPB has only publicized risk to consumers determinations after a nonbank refused to consent to supervision.

Under the original procedural rule issued in 2013, determinations that a nonbank should be subject to supervision because the company may be engaged in conduct posing risks to consumers were regarded as confidential supervisory information. This is consistent with the treatment of information regarding the CFPB’s determinations of who to examine, which are similarly “based on the assessment by the Bureau of the risks posed to consumers” by different entities subject to its supervisory authority. Under longstanding CFPB rules, and consistent with the practice of other financial regulatory agencies with supervisory authority, the CFPB does not release confidential supervisory information except in very narrow circumstances.

Under the CFPB’s 2022 amendments to the procedural rule, however, the Director can decide to publish any determination that a nonbank may be engaging in conduct that poses risks to consumers, including those reached after the nonbank has exercised its statutory right to contest the determination and those resulting from consent.

Although the Bureau has publicly acknowledged that many nonbanks have consented to supervision, it has not published any of the resulting orders. By contrast, the only company to insist on its procedural rights has been rewarded with a public order suggesting – but not actually proving or demonstrating – that it is engaged in unlawful conduct. Thus, the CFPB’s discretionary decision to publicize a determination that a nonbank may be engaging in conduct that poses risks to consumers correlates perfectly with whether the nonbank insisted on its procedural rights. As a result (and putting aside the propriety of this practice), unless the CFPB rescinds the 2022 amendment to its procedural rule, a company that receives a Risks to Consumers Notice should consider whether to risk the negative publicity that would accompany a public Risks to Consumers Determination.

Nonbank providers of consumer financial products or services that are not currently subject to supervision should prepare for it.

The CFPB has a powerful tool to quickly determine that a nonbank consumer financial services company should be subject to examination. Nonbanks that are not subject to CFPB supervisory authority, but who might reasonably expect to make it onto the CFPB’s examination schedule based on the agency’s general risk prioritization factors and its policy priorities, should anticipate the possibility that they could receive a Risks to Consumers Notice at any time, and that whether they decide to exercise their procedural rights or not, they could soon be welcoming CFPB examiners on site.