Welcome to a new (and noticeably colder) month and the latest edition of Cabinet News and Views. Our team has had another very busy week examining regulatory activity on hot topics in artificial intelligence, climate change, cryptocurrency and personal data, as well as the ongoing dialogue on Basel 3.1.
In this issue, we start with the leftovers we promised last week (just in time for the colder temperatures). I provide an update on the U.S. interagency climate-related risk management principles for large financial institutions, which now include clarification on their applicability to foreign banks and the different roles of an institution’s board of directors versus its management. My colleague in Washington, D.C., Mercedes Kelley Tunstall, and I provide another look at the Federal Reserve’s debit interchange proposal. Mercedes offers two more reports this week, including a second installment of her analysis on the CFPB’s proposed rule on personal data financial rights; and on Monday’s announcement that the Biden administration has issued an Executive Order regarding artificial intelligence. Also from Monday’s news is a report by my colleagues, Mike Gambro and Maurine Bartlett, on the SEC’s new order exempting brokers and dealers from certain review and recordkeeping requirements related to fixed income securities.
Reporting from London, my colleague, Alix Prentice, discusses two topics. She provides an analysis of the latest UK PRA discussion paper covering securitization capital requirements in the context of Basel 3.1. Alix also shares an update from the UK Treasury on its plans to facilitate and regulate the use of fiat-backed stablecoins in the country’s payment chains. Finally, my colleagues on our firm’s global litigation team, Jason Halper and Timbre Shriver, offer an in-depth look into the U.S. Treasurer Department’s guiding principles for private sector financial institutions that have made net-zero commitments.
We're always here for comments and questions. Just drop me a note here.
Daniel Meade
Partner and Editor, Cabinet News and Views
Last week, the Federal Reserve Board (“FRB”), Federal Deposit Insurance Corporation (“FDIC”), and Office of Comptroller of the Currency (“OCC”) (together, the “Agencies”) released a final interagency Principles for Climate-Related Financial Risk Management for Large Financial Institutions (the “Principles”).
The final Principles are substantially similar to what each of the Agencies issued separately over the course of 2021 and 2022, as we discussed here. In response to comments, the final guidance includes changes from the proposal that include clarification that the guidance is applicable to large foreign banking organizations and the different roles of an institution’s board of directors vs. management. Like the proposed guidance, the final Principles contain “high-level principles covering six areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. Additionally, the final principles describe how climate-related financial risks can be addressed in the management of traditional risk areas.” Consistent with the proposed guidance, the Principles are applicable to institutions supervised by the Agencies with $100 billion or more in total assets. The Agencies reiterated that they neither prohibit nor discourage large financial institutions from providing services to customers of any specific class or type generally permissible under law, just that they need to consider the “physical and transition risks.”
The issuance of the Principles garnered dissent among FRB and FDIC Board members. At the FRB, Governors Waller and Bowman (both Republicans) dissented. Similarly, the two Republican members of the FDIC Boars, Vice Chair Hill and Director McKernan dissented. All four dissent statements have in common what Gov. Waller possibly most concisely stated: “I don’t believe the risks posed by climate change are sufficiently unique or material to merit special treatment relative to other risks.” While the Principles bear some similarity to the Basel Committee Principles, the politics of climate-related financial risks are different in the United States than they are in Europe, and the U.S. Agencies do make clear that the principles are about managing the risks presented by climate change, not managing climate change itself.
As we mentioned last week, the Federal Reserve Board (“FRB”) announced proposed changes to Regulation II (Debit Card Interchange Fees and Routing), which is the implementing regulation of the Durbin Amendment to the Dodd-Frank Act that required the FRB to establish a cap on debit interchange fees that is reasonable and proportional to the cost incurred by the debit card issuer.
The Federal Reserve last touched on Regulation II in 2012, basing the calculation of the interchange fee caps upon numbers from 2009 and 2010. The proposal is based on expense numbers from 2021, and the FRB stated “that the costs incurred by covered issuers in connection with debit card transactions have changed significantly over time,” with “transaction-processing costs on which the Board based the base component [having] nearly halved, the issuer fraud losses on which the Board based the ad valorem component [having] fallen, and the fraud-prevention costs on which the Board based the fraud prevention adjustment [having] risen.”
Under the current rule, the interchange fee received by a covered debit card issuer (e.g., not subject to small institution exemption) for a debit card transaction (note, Reg. II does not apply to credit card transactions, but Sen. Durbin has introduced S. 1838 to require the FRB to issue rules on credit card transactions and competition amongst credit card networks) can be no more than the sum of: (i) 21 cents (the “base component”); (ii) 5 basis points multiplied by the value of the transaction (the “ad valorem component”; and (iii) for issuers that meet certain requirements, a fraud-prevention adjustment of one cent per transaction. As a result of those lower costs and expenses noted above, the FRB is proposing to adjust all three components of the interchange cap. The proposal lowers the base component from 21.0 cents to 14.4 cents, and the ad valorem component from 5 basis points to 4 basis points. But, the proposal would increase the fraud-prevention adjustment from 1.0 cent to 1.3 cents.
Not surprisingly, this Reg. II proposal looks to rekindle the same battle over interchange splits between banking trade groups and retailer trade groups that occurred back in 2012. The Bank Policy Institute, the Consumer Bankers Association and The Clearing House (together, the “Banking Trades”) came out immediately with a statement in opposition to the proposal. The National Retail Federation argued for lowering the cap just at the announcement of the meeting. Governor Michelle Bowman was the only dissenting vote on issuing the Reg. II proposal. In her statement, Gov. Bowman noted some of the same themes of the Banking Trades in that the data does not seem to support the argument that retailers’ cost savings are being passed on to consumers.
Comments on the proposal are due 90 days after publication in the Federal Register, which had not yet occurred as we went to press.
As we reported last week, the Consumer Financial Protection Bureau (“CFPB”) released a proposed rule addressing “personal data financial rights.” Comments are due on December 29, 2023. Please review last week’s post for a general overview of the proposed rule. This week’s installment discusses the entities that would be required to comply with the provisions of the rule, should it be adopted as proposed.
The proposed rule focuses on ensuring that open banking is prioritized initially with respect to electronic payments. The scope of consumer financial products and services governed by the proposed rule includes “Regulation E accounts” (i.e., demand deposit (checking) accounts, savings accounts and prepaid cards accounts), “Regulation Z credit cards” (i.e., credit cards, charge cards and hybrid prepaid cards), as well as any service that allows for the facilitation of payments using Regulation E accounts or Regulation Z credit cards. Accordingly, the entities intended to be governed by the proposed rule include not only financial institutions, but also “any other person that controls or possesses information” concerning the covered consumer financial products or services. This means that even if the entity does not maintain financial accounts itself and merely provides services to facilitate payments, or to allow consumers to better optimize their spending through the use of personal financial management tools, then that entity would need to comply with the rule. The proposed rule provides one example of a non-bank entity that would be governed, specifically stating, “a digital wallet provider is a data provider.” 1033.120(c)(3).
While the proposed rule purports to extend to non-banks providing services such as digital wallets, it also covers not just financial institutions, but also all entities deemed to be “card issuers” for purposes of Regulation Z, the implementing regulation for the Truth In Lending Act. It is important to remember that the definition of “card issuer” in Regulation Z extends far beyond just the “person that issues a credit card.” It also includes any entity considered to be the agent of the person that issues a credit card. 12 C.F.R. 1026.2. While the Official Staff Commentary to this section of Regulation Z remarks that “merely providing services relating to the production of credit cards or data processing for others . . . does not make one the agent of the card issuer,” the definition of card issuer does pull in a wide variety of fintechs and other companies that are under contract with the person that issues the card to provide services supporting the card.
Importantly, the obligations applicable to data providers cover only “covered data in the data provider’s control or possession concerning a covered consumer financial product or service that the consumer obtained from the data provider.” 1033.211. The emphasized language is taken directly from the Consumer Financial Protection Act, 12 U.S.C. 5533(a). The CFPB’s only statements regarding whether a data provider, such as a fintech supporting a credit card issuing bank (i.e., which would be deemed to be a card issuer), is also a party from whom the consumer “obtained the credit card” for purposes of the obligations relating to covered data are 1) the conclusion that the catch-all provision of the definition of data provider (i.e., any other person that controls or possesses information regarding the covered product or service) is intended to “cover all consumer-facing entities involved in facilitating the transactions” and 2) the observation that “adopting a broad definition could help avoid creating unintentional loopholes as the market evolves.”
The proposed rule also covers two other sets of entities and imposes separate obligations on them. “Authorized third parties” are those entities who “seek access to covered data from a data provider on behalf of a consumer” so that they can provide a product or service the consumer requested. 1033.401. Authorized third parties are required to: 1) provide an authorization disclosure; 2) certify that they will limit the “collection, use, and retention of covered data to what is reasonably necessary to provide the consumer’s requested product or service”; and 3) only use the data for servicing or processing the product or service requested (as well as to satisfy legal process, etc.). In counterpoint to the definition of “data provider,” “authorized third parties” do not provide the covered consumer financial products and services, but instead act upon that data to provide separate products and services. Today, these third parties can receive the data and use it in keeping with the terms of their privacy policy. Under the proposed rule, these third parties would only be able to use the data to provide their product and services, regardless of the terms of their privacy policy.
The final set of entities that would be covered by the proposed rule are so-called “data aggregators.” Data aggregators are entities that are “retained by and [that provide] services to the authorized third party to enable access to covered data.” In sum, data aggregators must be disclosed by name to consumers within the authorization disclosure provided to them by authorized third parties and are also required to limit their use of the covered data, in the same manner as authorized third parties are required to limit their use.
Stay tuned for two more parts on this proposed rule in the coming weeks – one installment will discuss the technology aspects of the rule, and another installment will look at how this proposed rule would work with existing laws like Regulation E, the Fair Credit Reporting Act and Gramm-Leach-Bliley.
On October 30, 2023, the White House announced that President Biden had issued an Executive Order regarding artificial intelligence (“AI”). The Executive Order was accompanied by a Fact Sheet summarizing the eight policy goals on AI that the White House wanted to emphasize: 1) creating new standards for AI safety and security; 2) bipartisan privacy protections at the Federal level; 3) ensuring AI advances equity and civil rights; 4) ensuring consumers are benefited, and not harmed, by AI; 5) ensuring workers are protected and supported as AI develops; 6) promoting innovation and competition so that AI development can occur at large and small companies; 7) advancing American leadership in AI abroad; and 8) ensuring responsible and effective use of AI by the Federal Government. The White House previously issued an AI Bill of Rights in February 2023.
The Executive Order directs executive agencies, including the Department of Treasury and the United States Department of Housing and Urban Development (“HUD”), to undertake a variety of actions to operationalize aspects of the Executive Order’s broad policy goals. In addition, the Executive Order makes recommendations to both Federal consumer protection agencies, the Federal Trade Commission (“FTC”) and the Consumer Financial Protection Bureau (“CFPB”), to take aligned action. Because both the FTC and the CFPB are independent regulatory agencies that are not part of the Executive Branch, the White House is constrained only to making recommendations.
While most of the Executive Order dealt with technology, workforce and social concerns raised by AI developments, there were specific directives regarding financial services. Specifically:
This summary of directives to the Department of the Treasury and HUD (and encouragements to the CFPB and the FTC) in the Executive Order directly impacts the financial services industry, but there are other aspects of the Executive Order that will necessarily affect financial services, as well. For example, the Executive Order also seeks to address risks posed by synthetic content (i.e., the use of AI to generate deep-fake photographs, voice recordings and video recordings), instructing the Secretary of Commerce to work with other agencies to develop “science-backed standards and techniques for 1) authenticating content and tracking its provenance; 2) labeling synthetic content, such as using watermarking; 3) detecting synthetic content; . . . 4) testing software used for the above purposes; and 5) auditing and maintaining synthetic content.” Ever vigilant regarding phishing and other types of fraudulent attempts that trick customers into accessing their online accounts or even sending funds from their accounts, synthetic content issues are bound to become an increasing point of focus for financial services fraud teams.
Highlighting the risks of synthetic content generally, Vice President Kamala Harris noted in remarks that she gave at the U.S. Embassy in London regarding the Future of Artificial Intelligence on November 1, “when people around the world cannot discern fact from fiction because of a flood of AI-enabled mis-and disinformation . . . is that not existential for democracy?” In a Fact Sheet accompanying Vice President Harris’ speech in London, it was announced that the White House had voluntary commitments from 15 leading AI companies to develop mechanisms dealing with synthetic content, but also recognized that all nations must “support the development and implementation of international standards to enable the public to effectively identify and trace authentic” digital content and to distinguish it from “harmful synthetic AI-generated or manipulated” content.
On October 30, the Securities and Exchange Commission issued an order exempting brokers and dealers from the information review and recordkeeping requirements under Rule 15c2-11 in connection with providing quotations on 144A fixed income securities.
Further details are discussed in our recent Client and Friends Memo here authored by Mike Gambro and Maurine Bartlett.
The UK’s banking regulator, the Prudential Regulation Authority (“PRA”) has published a Discussion Paper (DP3/23) covering securitisation bank capital in the context of: (1) the Basel 3.1 output floor and capital requirements for securitisation exposures; (2) a review of the hierarchy of methods for determining capital requirements for securitisation exposures; and (3) the scope of the framework for simple, transparent and standardised (“STS”) securitisations, as covered in the PRA’s consultation on the Implementation of the Basel 3.1 standards (CP16/22). DP3/23 aims to collect data and feedback from firms prior to transferring the firm-facing requirements in the Securitisation Chapter of the Capital Requirements Regulation (“CRR”) into PRA rules in alignment with Basel 3.1 standards.
Next Steps
The consultation period ends on 31 January 2024, and the PRA envisages additional engagement with the industry to gather data. The transfer of firm-facing CRR rules to the PRA is planned to take place in the second half of 2024.
The UK’s Treasury has released an Update on Plans for the Regulation of Fiat-backed Stablecoins. Following up on its January 2021 consultation on the UK regulatory approach to cryptoassets and stablecoins, the government’s intention at this stage is to “facilitate and regulate the use of fiat-backed stablecoins in UK payment chains.” This is being driven forward by bringing into regulatory scope the use of stablecoins in payment chains under the Payment Services Regulations 2017 (“PSRs”) alongside directly regulating, under the Financial Services and Markets Act 2000 (“FSMA”), the activities of: (i) issuing; and (ii) the custody of stablecoins issued in or from the UK. To that end, the Treasury intends to launch secondary legislation by early 2024 to bring those activities into the regulatory perimeter and the jurisdiction of the Financial Conduct Authority (“FCA”).
New FCA rules will include requirements for the assets backing the stablecoins, as well as requirements for redemption rights and capital provisioning. The FCA will have the power to require that the backing assets are held within a statutory trust on terms to be set out in the rules. Rules relating to the new custody activity will be based on the existing custody regime.
On September 19, 2023, the U.S. Treasury Department introduced nine guiding principles for private sector financial institutions that have made net-zero commitments. The principles are intended to highlight and encourage the adoption of best practices and promote consistency and credibility in the approaches taken to set and achieve net-zero commitments. The “Principles for Net-Zero Financing & Investment” are also intended to help attract private sector capital to address the economic and environmental impacts of climate change.
The nine principles focus on Scope 3 greenhouse gas emissions, which generally comprise the majority of financial institutions’ GHG emissions.
More than 100 U.S. financial institutions have independently made voluntary net-zero commitments, according to the Department. Alongside publishing its principles, the Treasury Department also highlighted key announcements related to transition planning. This included the Glasgow Financial Alliance for Net Zero’s (GFANZ) announcement that over 50 U.S. financial institutions – and more outside the U.S. – had committed to independently publish their net-zero transition plans over the coming year. The Treasury Department also applauded a $340 million commitment by philanthropic organizations, including the Bezos Earth Fund, Bloomberg Philanthropies, ClimateWorks Foundation, Hewlett Foundation and Sequoia Climate Foundation, to help financial institutions develop and execute their net-zero commitments.
Final Thoughts
The Treasury Department’s voluntary principles could encourage more U.S. financial institutions to make their own net-zero commitments. The principles build on existing guidance, including from the Science Based Targets Initiative, GFANZ, and the UK’s Transition Plan Taskforce (TPT) Disclosure Framework. This promotes the global alignment of various standards and frameworks, the importance of which we often discuss. But the federal government-backed principles have also drawn criticism amid the increasing politicization of climate-related issues in the U.S. One critic, West Virginia Treasurer Riley Moore, called the principles a bid to convince financial institutions “to leverage their economic power to transition the country away from the coal, oil and natural gas industries.” He added that “[t]his policy framework is a direct shot at West Virginia’s economy.”
We have written frequently about political criticisms of and challenges to climate and ESG-related initiatives, in particular in connection with the financial services sector, including federal efforts such as the launch of an ESG Working Group comprised of nine Republican members of the House of Representatives, led by Oversight and Investigations Subcommittee Chair Bill Huizenga, to “combat the threat to our capital markets posed by those on the far-left pushing environmental, social, and governance (ESG) proposals;” the introduction of a bill by two House Republicans to restrict investment managers from taking into account ESG considerations in investing on behalf of retirement funds; Republican members of the House Committee on the Judiciary sending letters to the steering committee members of Climate Action 100+, Ceres and CalPERS, requesting documents and seeking information regarding antitrust compliance by virtue of their participation in climate-related industry initiatives; and the introduction of four bills by Republican members of the House Financial Services Committee targeting various business and market activities that implicate ESG issues. At the state level, several Republican-controlled state legislatures, including Oklahoma and West Virginia, have enacted laws mandating divestment of state funds from asset managers deemed to “boycott the energy industry” or restricting investment managers from casting proxy votes for the purpose of furthering “non-pecuniary interests.”
However, as we commented in the context of the UK’s TPT Disclosure Framework, developing and implementing transition plans will enable organizations to direct strategy, promote coordinated, purposeful actions, support organizational transformation and enhance the information available to investors, allowing them to price risk and make capital allocation decisions. Elsewhere, in Hong Kong, for example, the Monetary Authority’s Executive Director urged banks to ramp up their net zero transition planning, providing them with high-level principles to guide such planning. As the U.S. Treasury principles emphasize, “appropriate transparency is part of a credible commitment and is necessary for external accountability.”
(This article originally appeared in Cadwalader Climate, a weekly newsletter on the ESG market.)