CFPB ‘Repeat Offender’ Registry Sparks Concerns of Overreach

The CFPB’s plan to create a registry of all settlements reached by nonbank consumer finance companies is intended to spot bad actors, but some are worried the effort would hamper state and local enforcement.

The Consumer Financial Protection Bureau on Dec. 12 proposed requiring any nonbank consumer finance firm to register any consent order, judgment, or other enforcement action from a state, local, or federal authority or regulator. An executive would be required to attest to the company’s compliance. And although even nonbank entities with just one violation would be included, the agency is considering making public what it’s calling a “repeat offender” registry.

The goal, according to the CFPB, is to provide a centralized database so that all regulators—and potentially the general public—have a tool to identify patterns of bad behavior by companies, including those who hop from locale to locale.

“Often you have an entity that violates the law in one state and picks up and moves to someplace else,” CFPB Director Rohit Chopra told the Senate Banking Committee Dec. 15. “This helps everyone coordinate and detect fraudsters which often rip off people all across the country.”

But the proposed database, which is now open for public comment, has raised some concerns that the CFPB could use it as a new enforcement tool, complicating efforts by state and local authorities to get companies to settle violations if doing so will land them on the registry—and the CFPB’s radar.

It’s “a possible power grab by the CFPB, to know what other agencies are looking at so the CFPB can follow suit, or go after them for non-compliance, or simply have more control over nonbanks,” said Allison Schoenthal, the co-chair of Goodwin Procter LLP’s banking and consumer financial services practice group.

Most nonbanks aren’t subject to federal oversight. The CFPB examines some of the largest players in those markets, but typically state and local regulators take the lead with nonbank institutions, a category that includes nonbank mortgage lenders, fintechs such as buy-now-pay-later companies, debt collectors, insurance companies, and money market funds, among others.

One-Stop Shop

State and local regulators aren’t required to report any enforcement actions, consent orders, or judgments they enter into with nonbank entities that provide certain financial services to consumers but aren’t subject to the same level of oversight as traditional banks. The nonbank entities aren’t required to report such settlements either.

That can leave state financial regulators, city consumer protection agencies, and consumers unaware of a company’s history of violations, according to the CFPB and consumer advocates.

“One of the things we are seeing, especially with regards to financial technology firms and newer financial technology products, is there’s this gap of oversight,” said Rachel Gittleman, financial services outreach manager at the Consumer Federation of America.

The CFPB hasn’t shied away from the potential for greater enforcement. In announcing the proposal, it said the registry may be used to spot serial offenders and subject them to enhanced supervision by its own examiners.

“This would be a remarkably ready place where you could identify trends,” said Jenny Lee, a Reed Smith LLP partner and former CFPB enforcement attorney.

Extended Reach

But the prospect of centralization has caused concerns, particularly regarding the potential for the CFPB to attempt to enforce state and local laws that aren’t under its purview.

“This could be used as a hook to give the CFPB leverage to enforce other agencies’ state consent orders,” Sen. Pat Toomey (R-Pa.) said at the Banking Committee hearing.

Chopra responded that, although there is often a federal equivalent of state or local consumer financial protection laws, that’s not always the case, and Toomey’s concerns will be taken seriously.

Although the CFPB doesn’t have the authority to enforce state consumer finance laws, there have been instances where the bureau has gone after companies for state violations, indirectly.

Take the CFPB’s long-running enforcement action against online lender CashCall Inc., which made loans that violated state interest rate caps. The CFPB sued the company in 2013—not for the loans, per se, but for falsely telling consumers that the loans were not in violation of state law, a breach of the CFPB’s unfair, deceptive, and abusive acts and practices (UDAAP) standard.

The CFPB could potentially use a national database of settlements and judgments to bring similar cases, Lee, of Reed Smith, said.

State Complications

Critics note that a federal registry could make it harder for state and local agencies to reach settlements, because companies may fear a listing that will potentially bring them under CFPB scrutiny, if they aren’t already.

In some instances, state and local agencies prefer to keep settlements confidential and don’t necessarily want them reported, Lee said.

The CFPB said it consulted with state and local enforcement agencies when drafting its proposed rule, as required by the 2010 Dodd-Frank Act, which created the bureau.

The Conference of State Bank Supervisors, a national organization of state bank regulators, confirmed that it was consulted during the drafting process. The organization, in a statement, declined to comment on the discussions and said it was still considering whether and how to respond to the proposal.