Lawyers for Debevoise & Plimpton are warning fintech firms that recent actions by the Consumer Financial Protection Bureau indicate that it intends to take an expanded view of its jurisdiction. They offer several steps that fintechs can take to prepare for this additional scrutiny.
Fintech companies, especially fledgling startups, are primarily concerned with ensuring that they have a thriving business model that can attract sufficient funding, especially with a clouded economic outlook.
Although legal and regulatory concerns are considered in developing a business model or raising capital, the Consumer Financial Protection Bureau may not be a priority for many fintechs. But the CFPB has always had broad supervisory and enforcement power over non-banks.
Some recent actions by the CFPB indicate that it intends to take a broad view of its jurisdiction over non-banks that participate in the consumer financial services ecosystem. Therefore, fintechs should prepare now for greater scrutiny.
Actions against fintechs include efforts to oversee or otherwise regulate technology companies that operate in the payments space or collect, analyze and monetize consumer financial data. The CFPB published a rule of interpretation assert enforcement power over digital marketers who provide content to consumers on behalf of consumer financial services companies. The CFPB too announcement an intention to monitor entities that it considers “at risk” to consumers.
Jurisdiction and power to investigate
Congress granted to the CFPB the authority to control markets for consumer financial products or services, including consumer credit products, depository activities, payment processing and debt collection, to name a few.
The agency does this by overseeing and enforcing violations of the law against those who offer or provide consumer financial products or services or provide a material service to a consumer financial service provider. And that can include fintechs.
The banking industry and consumer advocates urge greater scrutiny of non-bank financial service providers in petition the CFPB to develop regulations to define the major players in the personal loan market so that large non-custodial lenders are also subject to CFPB oversight.
As a result, consumer financial market fintechs, whether in partnership with banks or acting alone, may be subject to CFPB supervision.
Risk of sanctions, injunction measures
The CFPB’s review may result in sanctions and injunctions. For example, in May the CFPB entered into a consent order with two payment processors and their owners forcing them to pay $3 million in penalties and reimbursing over $8 million in fees.
The APFC is also authorized to seek an injunction in enforcement measures. Recent statements by CFPB Director Rohit Chopra made it clear that the agency was seeking to impose “limits on a company’s activities or functions” to promote “structural” changes in financial services firms to prevent future violations.
In December 2021, fintech LendUp Loans was effectively “firmwhen the CFPB found it was in violation of a prior consent order and barred the company from making new loans, collecting outstanding loans or selling consumer information.
Damage to reputation
Perhaps the most damaging threat of CFPB review is the reputational damage that can come from a public enforcement action or even the mere disclosure of an investigation.
Consumer trust is essential to the brand of any company that contributes to the offering of a consumer product, especially in an area that was once the domain of banks. Any reputational damage could also affect a fintech’s relationship with its investors and harm future fundraising efforts.
Finally, action by the CFPB could impact a fintech’s relationships with other U.S. or state regulators, and could hamper their efforts to obtain necessary state licenses.
Preparing for the future
It is therefore clear that fintechs are ignoring the CFPB at their peril as they expand their operations. So what can fintechs do to prepare for this intense scrutiny?
First, knowledge of the regulatory landscape in which a fintech operates is essential. This means taking the time to review recent CFPB guidelines, implementing measures and relevant market regulations. Have similarly situated fintechs been subject to a consent order or otherwise reviewed? What lessons can be drawn from these companies and regulatory actions?
For example, the CFPB is more and more concentrate on how consumer data is collected and used to provide financial products or services to consumers and ensure that consumers are in control of their own data. And the CFPB is working on a final rule that would allow consumers to have more control and more choice over their personal data, without creating what Chopra calls “an underground worldwhere companies try to monetize access to financial data.
Second, fintechs should analyze their consumer touchpoints in light of CFPB guidelines. Are there points of stress or risk?
For example, fintechs could review the data they collect about consumers, the adequacy of their cybersecurity measures and policies surrounding that data, whether they sell consumer data, and, if so, whether consumers receive appropriate information at the time they are asked to provide their information.
Finally, fintechs should hire attorneys who know their business, customers, and compliance programs and who understand CFPB processes to avoid being caught off guard and oblivious if they come under scrutiny from the CFPB. CFPB.
Having these easy-to-follow steps in place will help fintechs mitigate the legal and reputational risks that come with CFPB scrutiny.
Originally published by Bloomberg Law
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.
