By Mercedes Kelley Tunstall

Partner | Financial Regulation

While many Federal agencies, including the prudential bank regulators, have decided to hold back moving forward with initiatives until after the inauguration in January, the Consumer Financial Protection Bureau ("CFPB") has been on a tear to get as many rules, interpretations and enforcement actions through their pipelines before the inauguration. Since the election, the CFPB has issued, or been part of issuing, all of the following:

• On December 4, the CFPB, along with the Federal Reserve, the Federal Deposit Insurance Corporation, the Financial Crimes Enforcement Network, the Office of the Comptroller of the Currency, and that National Credit Union Administration, issued an Interagency Statement on Elder Financial Exploitation.  Explaining that the statement “does not replace previous guidance on this subject issued by any of the agencies, does not interpret or establish a compliance standard, and does not impose new regulatory requirements or establish new supervisory expectations”, the agencies nevertheless issued the statement to “raise awareness and provide strategies to supervised institutions for combating elder financial exploitation.” Elder financial exploitation is defined in the statement as “the illegal use of an older adult’s funds or other resources for the benefit of an unauthorized recipient.” Accordingly, supervised institutions are told to enhance (or create) their risk-based policies, transaction monitoring practices, employee training and complaint processes to better “identify, measure, control and mitigate” this kind of exploitation, while also ensuring that none of these steps result in “in age discrimination that is impermissible under the Equal Credit Opportunity Act ("ECOA").” Some of the most effective measures to help with this kind of exploitation are identified as including: 1) transaction holds and disbursement delays; 2) using trusted contacts that employees can contact to doublecheck on transactions; 3) filing SARs when there is suspected elder financial exploitation; and 4) reporting identified exploitation to local law enforcement agencies and to the U.S. Department of Justice’s National Elder Fraud Hotline.
• On December 3, the CFPB proposed a new rule to stop data brokers from selling sensitive personal data, in a bid to “protect Americans from crime and illegal foreign surveillance.” Asserting that adversaries like the Chinese government “don’t need to hack anything” because “data brokers – the outfits that collect and sell detailed information about our personal and financial lives – are making this data available to anyone willing to pay”, Rohit Chopra, in his prepared remarks, describes the proposed rule as a means of cracking down “on a range of misuses of our data.”  In effect, the proposed rule will extend the protections of the Fair Credit Reporting Act ("FCRA") to data brokers. The FCRA is the world’s oldest federal privacy statute and has withstood the test of time since it first was passed in 1970. This is the rule that governs the use of credit reports and credit bureaus and provides significant rights to individuals to control their sensitive personal information. The statute is quite complex and we will publish a more in-depth explanation of how the proposed rule accomplishes extending the terms used by the FCRA to data brokers, but effectively, the CFPB proposes to treat data brokers as consumer reporting agencies, adjust the definition of consumer report, restrict marketing uses of consumer reports, and updates how “clear consent” must be provided by consumers for their data to be shared.  The CFPB provided a useful Fact Sheet that provides high-level detail on the proposed rule. Comments must be received on or before March 3, 2025.
• On December 2, the CFPB finalized its thresholds under Regulation Z for the dollar amounts that trigger protections and Regulation Z coverage.  Specifically, the threshold for minimum interest charges is unchanged at $1.00; high-cost mortgage loans subject to HOEPA protections have an adjusted total dollar amount of $26,968 and the corresponding fee amount will be $1,348; the qualified mortgage spreads in the annual percentage rate and the average prime offer rate will be 2.25 more when the first-lien transaction has a loan amount of greater than or equal to $134,841, 3.5 or more for first-liens with an amount greater than or equal to $80.905 and less than $134,841, and 6.5 or more for a first-lien with a loan amount less than $80, 905; and finally, “for all categories of QMs, the thresholds for total points and fees in 2025 will be 3 percent of the total loan amount for a loan greater than or equal to $134,841; $4,045 for a loan amount greater than or equal to $80,905 but less than $134,841; 5 percent of the total loan amount for a loan greater than or equal to $26,968 but less than $80,905; $1,348 for a loan amount greater than or equal to $16,855 but less than $26,968; and 8 percent of the total loan amount for a loan amount less than $16,855.”
• On November 21, the CFPB published a final rule regarding the definition of “Larger Participants” in the market for general-use digital consumer payment applications.  As written, the final rule sweeps tech companies that offer digital wallet technology solutions into the definition of a “Larger Participant” which has the effect of subjecting such companies to CFPB supervision and automatically makes such companies “covered persons” for purposes of the Consumer Financial Protection Act ("CFPA"). That means that any jurisdictional argument these companies may have had regarding whether they technically met the definition of “covered person” under the CFPA have been swept away. The definition of such “Larger Participants” is broad enough to affect a number of other companies, as well, of course.  But, the upshot is that most of those other companies have already accepted that they are “covered persons” or that they provide services to “covered persons” and are directly subject to the CFPA. For those companies, this rulemaking means that they are now also subject to supervision by the CFPB, which will be a change that could still be quite difficult for them. Interestingly, the effective date for the rule will be thirty days after it has been published in the Federal Register (and, it has not yet been published there, as of December 5). But, presuming that the final rule IS published prior to December 2, any “any nonbank covered person that qualifies as a larger participant would remain a larger participant until two years from the first day of the tax year in which the person last met the larger-participant test.” In other words, even if immediately after the inauguration, the new CFPB Director takes action to nullify the rule, any company that was identified as a Larger Participant would continue to be one until at least 2027.
• On November 29, the CFPB revised the date of applicability of its advisory opinion (published October 1) regarding medical debt collection from December 3 to January 2. In that opinion, the CFPB identified a variety of “illegal practices” they have observed medical debt collectors engaging in, including double billing, exceeding legal limits in interest rates charged for the overdue debts, falsified or fake charges, continuing collections activity even when the medical bills have not been substantiated, and mispresenting a consumer’s right to contest medical bills. 
• Also on November 29, the CFPB announced the maximum allowable charge for a consumer report requested by a consumer from a credit bureau to be $15.50 in 2025, which is the same as it was in 2024, based upon the Consumer Price Index. 
• A third announcement on November 29, the CFPB updated its internal procedures to reflect organizational changes, characterizing the updates as being “ministerial” in nature, although the last change described seems to have more than ministerial implications. All of the changes reflect the shift from references internally to the overall “Office of Enforcement” to it being called the “Enforcement Division” and updating the use of the phrase “Assistant Director” to be “Supervision Director” which allows the Bureau Director (e.g., Rohit Chopra) to also be the Supervision Director.
• On November 15, the CFPB issued its annual report on student loans focused on the 2023-2024 school year. In the related press release, the CFPB recounts that, “to assist struggling borrowers, the Department of Education implemented reforms resulting in billions of dollars in loan cancellation for almost 5 million borrowers and restored eligibility for 3 million formerly defaulted borrowers.”  But, the report identifies a variety of “servicing failures and legal challenges” that have “hampered the implementation of critical loan relief efforts” by: 1) causing borrowers to pay inflated amounts that jeopardize their financial well-being; 2) causing borrowers who chose to enroll in the Saving on a Valuable Education ("SAVE") plan to be in financial limbo while litigation plays out; and 3) causing borrowers to get stuck in “customer service doom loops” as they are shuffled between servicers, wait months for responses, and receive inaccurate information, with an average of eight months of time passing before their servicers resolve their issues.
• On November 13, the CFPB issued its “pilot study” regarding small business lending markets, entitled “Matched-Pair Testing in Small Business Lending Markets.”  As Director Rohit Chopra remarked in the related press release, “the results of our secret shopping are consistent with the longstanding concerns that small business loan borrowers experience different treatment based on their race.” The study was designed to examine “whether [b]lack testers received less favorable treatment than their white counterparts in four domains: (1) level of encouragement/discouragement to apply for financing; (2) information provided to the tester about available credit products and potential steering toward product types; (3) overall quality of treatment or customer service; and (4) business and credit information requested of the tester.” The results of the study found that there was statistically significant evidence of worse treatment with respect to #1 and #2. 
• On November 12, as we reported in the last Cabinet, the CFPB issued a report regarding state data privacy laws and perceived weaknesses in the main federal privacy protection law, the Gramm-Leach-Bliley Act.
• Since the election, the CFPB has also announced settlements in four cases, addressing overdraft fees, inactivity blocks and fees on prepaid funds made available to incarcerated individuals, student loan fees charged by servicers, and fees charged by credit repair companies.