Last Week, This Morning

April 21, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On April 11, the Consumer Financial Protection Bureau announced that it will not prioritize enforcement or supervision actions with respect to entities that do not satisfy future deadlines to submit registration information under the CFPB's final rule titled "Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders." According to the CFPB's announcement, "[t]his policy applies to, but is not limited to, the ... April 14, 2025 registration deadline for entities subject to 12 CFR 1092.206(a)(2) and July 14, 2025 registration deadline for entities subject to 12 CFR 1092.206(a)(3). The Bureau will instead continue to focus its enforcement and supervision activities on pressing threats to consumers. The Bureau is further considering issuing a notice of proposed rulemaking to rescind the regulation or narrow its scope."

The final rule establishing the non-bank registry was finalized on June 3, 2024. The final rule requires covered nonbank entities that offer or provide consumer financial products or services to register certain final, public orders, including consent and stipulated orders, issued against them by government agencies or courts. Certain entities, such as insured depository institutions, insured credit unions, motor vehicle dealers, federally recognized Indian tribes, and natural persons, are excluded from the final rule. The final rule also requires covered nonbank entities to identify an executive responsible for the entity's efforts to comply with the order in the registry and submit an annual written statement that includes information: (1) describing the steps the executive has taken to review or oversee the nonbank entity's activities subject to the order during the preceding calendar year, and (2) attesting whether, to the executive's knowledge, during the preceding calendar year the entity identified any violations or noncompliance with the obligations imposed by the order in the registry.

Amicus Brief(ly): It is a pleasure to see this registry go away. There did not seem to be any redeeming value to it for the industry or for consumers because reporting a consent order does not tell the whole story about how the parties got there. In fact, if the registry were to have remained in place, it is likely that companies would have settled investigations with the government with less frequency because once a consent order was in place, despite the facts or the reason the company decided to settle, the company would have to tell on itself by posting the consent order to the public registry. That potentially bad publicity - beyond what the government might have said in its press release about the settlement - seemed like enough to cause companies to think twice about negotiating a settlement they would not have a chance to explain in the registry. Good riddance.

In March 2024, the U.S. Chamber of Commerce, three bank trade groups in Texas, the American Bankers Association, and the Consumer Bankers Association sued the Consumer Financial Protection Bureau and its then-director, Rohit Chopra, in the U.S. District Court for the Northern District of Texas challenging the CFPB's final rule titled "Credit Card Penalty Fees (Regulation Z)." On May 10, 2024, the court granted the plaintiffs' motion for a preliminary injunction. Last week, on April 15, the court granted the CFPB and co-plaintiffs' joint motion to vacate the final rule, stating that the rule fails to allow card issuers to "charge penalty fees reasonable and proportional to violations," in violation of the Credit Card Accountability and Disclosure Act and the Administrative Procedure Act.

The CFPB's rule, finalized on March 5, 2024, limited penalty fees on credit cards issued by so-called "Larger Card Issuers" (issuers that, together with their affiliates, have one million or more open credit card accounts). Reg. Z prohibits card issuers from imposing fees for violating the terms or other requirements of a credit card account under an open-end (not home-secured) consumer credit plan, such as a fee for a late payment, unless the fee is proportionate to the card issuer's cost for the violation or complies with safe harbors set forth in Section 52 of Reg. Z. Prior to the final rule, Section 52 set a safe harbor of $30 generally for penalty fees, except that it set forth a safe harbor of $41 for each subsequent violation of the same type that occurs during the same billing cycle or in one of the next six billing cycles. The CFPB's final rule repealed the late fee safe harbor dollar amount for Larger Card Issuers and adopted a late fee safe harbor amount of $8. The final rule also eliminated a Larger Card Issuer's ability to charge a higher late fee safe harbor amount for subsequent violations of the same type that occur during the same billing cycle or in one of the next six billing cycles. In addition, under the final rule, the provision in Reg. Z that provides for annual adjustments to the safe harbor dollar amounts to reflect changes in the Consumer Price Index did not apply to the $8 safe harbor amount for late fees.

Amicus Brief(ly): And that is that. As the new-look CFPB works to unwind a number of the Chopra-led CFPB's moves, dismissing this litigation over the late fee rule is a relief for the banks that would have been subject to the rule if it had survived the litigation. Late fees offer not only a disincentive to non-payment but also compensation to banks for programming and administering systems to track late payments, adjust accounts, and notify consumers of missed payments. Eight dollars does not go very far anymore, so the safe harbor in the rule was likely insufficient compensation to banks for the work involved in processing late payments. With this rule vacated, banks can set their fees at market-appropriate amounts that are "reasonable and proportional to violations" again.

According to an April 16 Consumer Financial Protection Bureau internal memo, the "Bureau will focus its enforcement and supervision resources on pressing threats to consumers, particularly service members and their families, and veterans. To focus on tangible harms to consumers, the Bureau will shift resources away from enforcement and supervision that can be done by the States. All prior enforcement and supervision priority documents are hereby rescinded."

The memo also states that the CFPB will:

• decrease supervision "events" by 50%, with a focus on conciliation, correction, and remediation of harms subject to consumer complaints;
• shift its focus back to depository institutions, as opposed to non-depository institutions;
• focus on mortgages, FCRA/Regulation V data furnishing violations, FDCPA/Regulation F relating to consumer contracts/debts, fraudulent overcharges and fees, and inadequate controls to protect consumer information resulting in actual loss;
• focus on redressing tangible harm by getting money back directly to consumers, rather than imposing penalties on companies;
• deprioritize participation in multi-state exams, deprioritize supervision where states have ample regulatory and supervisory authority, and minimize duplicative enforcement where state regulators or law enforcement authorities are currently engaged or have concluded an investigation into the same matter;
• eliminate duplicative supervision and coordinate exam timing with other federal regulators and minimize duplicative enforcement where another federal regulator is already engaged;
• not pursue supervision under novel legal theories, instead focusing on areas that are clearly within its statutory authority; and
• not engage in redlining or bias assessment supervision or enforcement based solely on statistical evidence and pursue only matters with proven intentional racial discrimination and identified victims.

Finally, the memo states that the CFPB will deprioritize:

• loans or other initiatives for "justice involved" individuals;
• medical debt;
• peer-to-peer platforms and lending;
• student loans;
• remittances;
• consumer data; and
• digital payments.

Amicus Brief(ly): It appears that the CFPB has come to terms with the reality that a wave of the hand cannot make it go away and that Congress would have to act to undo the CFPB as we have come to know it. To that end, this internal memo reflects a shift in gears to a more pragmatic approach to the CFPB's mission. The memo reflects some of the more recent public statements from the Bureau with respect to regulatory priorities and sounds pretty consistent with what we saw from the CFPB under the prior Trump administration's leadership. Regulated entities should note the adjusted enforcement and supervision priorities while maintaining focus on regulatory compliance concerns that could lead to state enforcement actions or private litigation. The CFPB is not the only sheriff out there.

On April 15, the Federal Housing Administration published Mortgagee Letter ("ML") 2025-12 - Tightening and Expediting Implementation of the New Permanent Loss Mitigation Options - which modifies and replaces certain provisions in ML 2025-06 - Updates to Servicing, Loss Mitigation, and Claims - published January 16, 2025, and provides revised and updated loss mitigation guidance.

The new ML will permanently sunset, on September 30, 2025, the emergency loss mitigation policies implemented by the FHA at the onset of the COVID-19 pandemic. Many of those policies were intended to be temporary but have been extended for years. The ML moves the effective date of the new permanent loss mitigation options to October 1, 2025, from February 2, 2026. The ML limits borrowers to one permanent loss mitigation option every 24 months versus every 18 months under the prior policy. The ML also announced that the Trump administration will continue its review of the entire FHA permanent loss mitigation waterfall to ensure the policy protects taxpayers while mitigating financial risks to the Mutual Mortgage Insurance Fund. The FHA will continue to review how the available home retention options could be improved to better incent reperformance and ensure a borrower's ability to repay. The Department of Housing and Urban Development will also conduct an overall evaluation of the Payment Supplement tool to determine if it should remain a part of HUD's loss mitigation program.

Amicus Brief(ly): This clean-up adjustment by the FHA will allow servicers to remove COVID-19 protocols from their servicing procedures at a time when most people have moved past grave concerns about COVID, acknowledging that it's something we'll have to live with. But servicers should also watch for updates and prepare for potential adjustments they'll have to make when the administration completes its review of the loss mitigation waterfall described in the new ML.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.