Last Week, This Morning

October 21, 2024

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

The Consumer Financial Protection Bureau recently announced that it issued a consent order against a private dispute resolution company, resolving allegations that the company engaged in deceptive and unfair acts and practices in violation of the Consumer Financial Protection Act and permanently banning the company from arbitrating disputes that concern a consumer financial product or service.

The dispute resolution company provided an online dispute resolution platform. This platform was used by a vocational training company that operated a vocational training program and provided "income share" loans to students in that program. In 2023, the vocational training company was shut down by the CFPB and certain state attorneys general for its alleged illegal lending practices in connection with the income share loans.

The current consent order alleges that the dispute resolution company had commenced arbitrations with consumers who had allegedly defaulted on income share loans from the vocational training company. Specifically, the CFPB alleges that the dispute resolution company did not have the ability to arbitrate the vocational training company's claims against consumers because none of the income share loan agreements contained an arbitration clause permitting arbitration on its platform. The CFPB also alleges that the dispute resolution company misrepresented itself as a neutral and impartial arbitrator for consumer debt arbitrations by failing to disclose that it had a financial interest in consumers settling with the vocational training company because the vocational training company promised to pay the dispute resolution company contingency fees for each claim that it settled. Finally, the CFPB alleges that the dispute resolution company required consumers to agree to its terms of service, which purported to bind consumers to the dispute resolution process, before they could view or respond to the vocational training company's claims that they defaulted on income share loans, thereby infringing on consumers' ability to "obtain information," "engage in live testimony," and "contest jurisdiction."

In addition to the permanent arbitration ban, the consent order prohibits the company from making misrepresentations to consumers related to arbitration proceedings and imposes a nominal civil penalty of $1 because of the company's inability to pay.

Amicus brief(ly): The allegations in this consent order are not so common as to provide much useful guidance for other players in the alternative dispute resolution space. The consent order permanently prohibits the provider from conducting arbitrations in connection with consumer financial disputes while also prohibiting the provider in other dispute resolution contexts from misrepresenting its services - including representations about its neutrality and the binding and enforceable nature of its awards. Most often, in the orderly resolution of consumer financial disputes through arbitration, the parties turn to and follow the written arbitration agreement or arbitration clause that is part of a credit agreement, but the facts of this case (which the provider denied) indicate that there was no arbitration or dispute resolution provision in the consumer agreements. Arbitration providers looking for a takeaway from this consent order may find that it's as simple as confirming that their agreements, when invoked, give them the requisite authority to arbitrate disputes and that the creditors with which they work are not misrepresenting anything about the arbitration process.

On October 15, the Office of the Comptroller of the Currency, the Consumer Financial Protection Bureau, and the Federal Reserve Board published a final rule in the Federal Register that adjusts the dollar threshold for exempting higher-priced mortgage loans from special appraisal requirements. Based on the Consumer Price Index in effect as of June 1, 2024, the exemption threshold will increase from $32,400 to $33,500, effective January 1, 2025. The Dodd-Frank Act added special appraisal requirements for higher-priced mortgage loans to the Truth in Lending Act, including that creditors obtain a written appraisal based on a physical visit to the interior of the home before making a higher-priced mortgage loan. The rules implementing these requirements contain an exemption for loans of $25,000 or less, adjusted annually to reflect changes in the CPI.

Amicus brief(ly): This is another dollar-amount adjustment for mortgage lenders and brokers to note as it increases the exemption threshold for the appraisal rules for comparatively small higher-priced mortgage loans. Those rules require lenders to obtain written appraisals based on a physical visit to the interior of the property (i.e., no drive-by appraisals, no broker price opinions), to obtain a second appraisal from a different provider under certain circumstances (i.e., "flipping" cases where the seller just acquired the subject property before re-selling it), to obtain that second appraisal at no charge to the consumer, etc. With the exemption threshold increase to $33,500 for next year, there will be a few more of these rare loans that do not qualify for the additional appraisal protections.

On October 16, the Federal Trade Commission finalized amendments to its Negative Option Rule, now titled the "Rule Concerning Recurring Subscriptions and Other Negative Option Programs." The Negative Option Rule now applies to all negative option programs in any media. The final rule provides that the following acts and practices are unfair or deceptive within the meaning of Section 5 of the FTC Act:

• misrepresenting any material fact made while marketing goods or services with a negative option feature;
• failing to clearly and conspicuously disclose material terms prior to obtaining a consumer's billing information in connection with a negative option feature;
• failing to obtain a consumer's express informed consent to the negative option feature before charging the consumer; and
• failing to provide a simple mechanism to cancel the negative option feature and immediately halt charges.

According to the FTC's news release, the final rule differs from the proposed rule in two significant ways. First, the proposed rule would have required sellers to provide annual reminders to consumers of the negative option feature. Second, the proposed rule would have prohibited sellers from forcing consumers to receive saves without first obtaining consumers' unambiguously affirmative consent. (A "save" was defined in the proposed rule to mean an attempt by a seller to present any additional offers, modifications to the existing agreement, reasons to retain the existing offer, or similar information when a consumer attempts to cancel a negative option feature.) The FTC is not adopting these provisions of the proposed rule at this time but plans to seek further comment on these provisions through a supplemental notice of proposed rulemaking.

Most of the final rule's provisions will go into effect 180 days after it is published in the Federal Register.

Amicus brief(ly): The FTC makes a somewhat rare positive comment about negative option programs in its overview of this rulemaking, noting that such programs "can provide substantial benefits for sellers and consumers." We usually hear regulators describe such programs pejoratively as somewhat (or, in some cases, very) predatory and/or deceptive. The final rule focuses on how to ensure that negative option advertising is not predatory or deceptive and requires factual, accurate statements about the program, full disclosure of terms and conditions, consumer express and informed consent to the negative option features, and, importantly, a simple mechanism to cancel the negative option and stop charges. If this were not a rulemaking, the requirements described in the rule would be best practices to avoid UDAP-type claims about negative option features. But it is a rule, now final, that marketers will have six months to prepare for before it is effective.

On October 17, the Consumer Financial Protection Bureau filed a lawsuit against a private student lender, two of its subsidiaries, and a controlling investor in connection with loans provided to students enrolled at schools that offered short-term vocational training programs. The CFPB generally alleges that the defendants made misrepresentations about the quality of the schools with which they partnered and about graduates' hiring rates and salaries. Specifically, the CFPB alleges that the defendants, among other things:

• deceived borrowers by telling them they had vetted partner schools' programs for outcomes and value when, according to the Bureau, the lender offered loans for many programs and schools that it had not vetted for quality or used unreliable data when it did conduct a vetting process;
• told potential borrowers that a school had passed their return-on-investment analysis even when the defendants internally acknowledged that they had low confidence in the school's claimed job placement rate; and
• failed to accurately disclose finance charges on loan documents and failed to disclose the annual percentage rates when required to do so in marketing materials.

The CFPB seeks, among other things, injunctive relief to prevent future violations and monetary relief in the form of redress to consumers and the imposition of civil money penalties.

Amicus brief(ly): The allegations in this complaint are serious and turn on themes we see often in complaints against private education lenders in the vocational school space. Specifically, the CFPB alleges that the lender made false and misleading promises to student loan applicants about the schools with which it partnered and the potential return on investment for a student who applied for and received a loan. The CFPB has been pushing hard to finish investigations with the national election coming up in a couple weeks. Filing this lawsuit appears to be a continuation of that effort as well as a reflection of the lender's apparent resistance to the claims made in the complaint. As with almost any such complaint like this, lenders would do well to read the allegations and audit their marketing and sales practices to check for potentially misleading (or untested and potentially untrue) statements and for Truth-in-Lending compliance in advertising that includes credit pricing information.

On October 16, the New York Department of Financial Services issued guidance to all DFS-regulated entities concerning how artificial intelligence can be a threat to cybersecurity and the strategies that may be used to mitigate AI-related threats. The guidance does not impose any new requirements beyond the obligations in the DFS's cybersecurity regulation codified at 23 NYCRR Part 500.

The guidance highlights certain AI-related threats to cybersecurity, including: the use of AI by cybercriminals to create deepfakes that allow them to target individuals via email, telephone, text, and other means to convince them to divulge sensitive information; the use of AI by cybercriminals to amplify the potency, speed, and scale of cyberattacks; the use of a product that incorporates AI typically requires the collection and processing of substantial amounts of nonpublic information, resulting in entities needing to protect substantially more data and providing an increased incentive for cybercriminals to target these entities; and vulnerabilities for entities that use AI or a product that incorporates AI due to their dependency on vendors and third-party service providers.

In addition to the discussion on AI-related risks and mitigation measures, the DFS's guidance notes that entities should also explore the substantial cybersecurity benefits that can be gained by integrating AI into cybersecurity tools, controls, and strategies.

Amicus brief(ly): This guidance from New York's DFS provides a number of useful risk assessment and mitigation concepts for providers using AI to gain efficiencies in operations. With the relatively recent proliferation of AI in the financial services space, especially in the context of credit underwriting and pricing, we have seen regulators warn about implicit bias in AI, the potential for misleading results from the use of AI, and the potential for cybersecurity threats. The DFS focuses on the cybersecurity angle in its guidance, warning providers about deepfakes and other malicious attempts by bad actors to use AI to gain access to and wreak havoc on a provider's system of record. This is definitely worth a download and read, even if you are not using AI in your business or you are not subject to New York's cybersecurity regulation.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.