Last Week, This Morning

May 27, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

As part of the New York State budget deal for fiscal year 2025-2026, New York enacted the Buy-Now-Pay-Later Act ("BNPL Act"). BNPL products typically allow consumers to pay for purchases at the point of sale in four or fewer installments with no interest. The BNPL Act imposes licensing and examination obligations on BNPL lenders, even in connection with zero-interest transactions. The BNPL Act expressly limits BNPL products to the state civil usury cap of 16% per year and mandates the Superintendent of the Department of Financial Services to set other limitations on fees and charges.

The BNPL Act also expressly requires BNPL providers to maintain a number of different policies and procedures, including underwriting policies and procedures that must be submitted as part of licensing applications. Factors considered in underwriting must also be disclosed to the consumer. The BNPL Act imposes other disclosure requirements and, notably, states that disclosures must comply with Regulation Z, which implements the federal Truth in Lending Act. TILA generally applies to consumer-purpose credit transactions that provide for a finance charge and/or are payable in more than four installments. BNPL products, typically, do not provide for a finance charge and are payable in four or fewer installments.

Among other provisions, the BNPL Act also imposes dispute resolution standards and consumer data privacy protections.

The BNPL Act will take effect on the 180th day after the DFS promulgates rules to effectuate the provisions of the Act.

Amicus Brief(ly): Other states also require licensing for non-bank BNPL providers. Since the CFPB announced that it will not prioritize enforcement actions based on the guidance from the Chopra-led CFPB, states have predictably begun to pick up the pace of substantive regulation of the product. New York regrettably follows the lead of other states that are treating BNPL products - specifically designed not to be loans by virtue of the typical pay-in-4 and zero interest/finance charge features - as credit subject to TILA and other disclosure requirements that do not otherwise apply because of those product features. This story is not fully written; we anticipate that industry advocates will weigh in on the DFS rulemaking to try and have an impact on the final rule, which will trigger the effective date of the statute.

New Jersey Governor Phil Murphy recently signed Senate Bill 3525, which requires financial institutions to allow mortgagors to make biweekly mortgage payments (defined as every two weeks), in which any amount paid in excess of the total annual contractual mortgage payments due must be applied to the mortgage loan principal, and make semi-monthly mortgage payments (defined as occurring twice each month) in the amount of half of the total monthly contractual mortgage payment due. The new law also requires financial institutions to allow mortgagors to pay additional amounts toward the mortgage loan principal without the imposition of any penalty.

In addition, the law provides that if, at the time an escrow analysis is performed, the analysis projects an escrow shortage or otherwise results in an increase to escrow amount payments, the financial institution must notify the mortgagor of any change in payments and apply any excess payments by the mortgagor first to unsatisfied escrow payments and then to the mortgage loan principal, without the imposition of a penalty. The mortgagor may elect to submit a payment to the financial institution to reduce or eliminate any projected escrow shortage.

The new law will take effect on November 1, 2025, and will apply to mortgage agreements entered into on or after that date.

Amicus Brief(ly): Mortgage loan servicers have some work to do in order to get programming, statements, and other systems updated to address the payment changes that this New Jersey law allows. Importantly, the law does not instruct lenders to disclose the payment options in mortgage loan closing documentation and does not ask servicers to address those payment options in monthly statements or otherwise. We will be watching for some kind of guidance in that regard. Even without disclosure rules, however, the payment options have to be there for New Jersey borrowers, with an emphasis on the ability to make payments in amounts that exceed the scheduled payments. The escrow material, added in amendments to the original version of the bill, addresses how servicers should deal with the re-calculation of escrow amounts to determine surplus or deficiency when a borrower opts for something other than a monthly payment, which is important because RESPA's rules assume monthly payments.

On May 19, the Government Accountability Office issued a report titled "Artificial Intelligence: Use and Oversight in Financial Services." The report examines the benefits and risks of AI use in the financial services industry, federal financial regulators' oversight of AI use by financial institutions, and federal financial regulators' use of AI tools to oversee financial institutions and financial markets.

The GAO found that financial institutions are using AI in areas such as credit decisions, customer service, and risk management and that federal financial regulators are integrating AI into their general agency operations and supervisory and market oversight activities. However, many regulators informed the GAO that AI outputs inform staff decisions but are not used as sole decision-making sources.

In addition, the GAO found that, unlike other federal financial regulators, the National Credit Union Administration does not have certain key tools to oversee credit unions' AI use. First, the GAO found that the NCUA's model risk management guidance is insufficient because it does not provide its staff or credit unions with the necessary detail on how credit unions should manage model risks, including AI models. Therefore, the report recommends that the NCUA update its model risk management guidance to aid its oversight of credit unions' AI use. Second, the GAO found that the NCUA lacks the authority to examine third-party technology service providers that credit unions increasingly rely on for AI-driven services and, therefore, recommends that Congress consider granting the NCUA the authority to examine such service providers.

Amicus Brief(ly): AI is everywhere lately, and it appears that the federal financial regulators are almost all in step with the industry's use of and reliance on AI to help make certain functions more efficient and effective. The exception, as noted above, is NCUA, which evidently agreed with the GAO's observations and recommendations about the tools NCUA is missing to effectively oversee the use of AI by credit unions. We have seen the other regulators address the use of AI in various contexts, including underwriting, in their supervisory materials. The report also identifies that the regulators themselves are relying in part on AI in some of their supervisory work, though - as noted above and as is typical when it comes to AI - not exclusively and subject to human review and potential intervention. The report reminds readers that AI brings with it not only benefits and process improvements, but the potential for bias and cyber risk. We like to read reports like these so our readers do not have to. While it is interesting, the report does not land in the category of reports we'll recommend to readers for important takeaways.

President Trump recently signed resolutions to repeal the Consumer Financial Protection Bureau's final rules titled "Overdraft Lending: Very Large Financial Institutions" and "Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications." The resolutions passed the House and Senate before being sent to Trump. The Congressional Review Act grants Congress and the President the power to nullify federal agency rules.

On December 30, 2024, the CFPB adopted the final rule on overdraft fees, which applies to banks and credit unions with more than $10 billion in assets. According to the CFPB's press release about the rule, the rule "close[s] an outdated overdraft loophole that exempted overdraft loans from lending laws" by not treating overdraft fees as finance charges. The rule gave covered banks and credit unions three options to manage overdrafts: they could cap their overdraft fee at $5, they could charge a fee that covers no more than their costs or losses, or they could continue to extend overdraft loans if they comply with standard requirements governing other loans, like credit cards, including giving consumers a choice as to whether to open the line of overdraft credit, providing account-opening disclosures that would allow comparison shopping, sending periodic statements, and giving consumers a choice to pay automatically or manually.

On December 10, 2024, the CFPB adopted the final rule on digital payments, which confirmed the agency's supervisory authority, under the Consumer Financial Protection Act, over nonbank companies offering digital funds transfer and payment wallet applications by defining "larger participants" in the market to include such companies that handle more than 50 million covered consumer payment transactions per year. Under the CFPA, the CFPB has supervisory authority over "larger participants" of markets for consumer financial products and services, as defined by CFPB rules. The final rule established increased oversight over larger, nonbank market participants in the payments ecosystem, specifically those in the "general-use digital consumer payment applications" market. This market includes providers of funds transfer and payment wallet functionalities through digital applications for consumers' general use in making payments to other persons for personal, family, or household purposes. Examples include consumer financial products and services that are commonly described as "digital wallets," "payment apps," "funds transfer apps," "peer-to-peer payment apps," "person-to-person payment apps," and "P2P apps."

Amicus Brief(ly): When it comes to deregulation and reversing course from its Chopra days, the CFPB has kept its word as evidenced by this final step repealing two of the rules finalized during the flurry of rulemaking we saw in December 2024. These two rules are officially undone, in a victory for industry and for consumers who benefit from overdraft protection even when they are charged a fee to have their financial institution pay the overdraft.

Georgia Governor Brian Kemp recently signed the Georgia Courts Access and Consumer Protection Act (Senate Bill 69), which governs providers of third-party litigation financing in the state.

The Act, among other things, requires litigation financiers to register with the Georgia Department of Banking and Finance and provide specified information for registration; prohibits persons affiliated with any foreign person or principal from registering as a litigation financier; sets forth certain disclosures that must be provided in any litigation financing agreement; and renders discoverable the existence, terms, and conditions of a litigation financing agreement in the underlying lawsuit.

A litigation financier that agrees to provide $25,000 or more in funding pursuant to a litigation financing agreement may be jointly and severally liable for any award or order imposing or assessing costs or monetary sanctions for frivolous litigation against a consumer, an entity, or a legal representative of the consumer or entity arising from or relating to any civil action, administrative proceeding, legal claim, or other legal proceeding for which the litigation financier is providing litigation financing. However, where the litigation financier's right of repayment is a fixed amount set by contract, the liability of the litigation financier cannot exceed the right of repayment less the amount already extended.

Among other prohibitions, a litigation financier may not:

• direct or make decisions with respect to any civil action, administrative proceeding, legal claim, or other legal proceeding for which the litigation financier has provided financing or any settlement or other disposition thereof;
• pay or offer commissions, referral fees, rebates, or other forms of consideration to any person in exchange for referring a consumer or the consumer's legal representative to a litigation financier;
• accept any commissions, referral fees, rebates, or other forms of consideration from any person for providing any goods or rendering any services to the consumer;
• contract for, receive, or recover any amount greater than an amount equal to the share of the proceeds collectively recovered by the plaintiffs or claimants in a civil action, administrative proceeding, legal claim, or other legal proceeding seeking to recover monetary damages financed by a litigation financing agreement after the payment of any attorney's fees and costs owed in connection with such action, claim, or proceeding;
• advertise false or misleading information regarding its products or services;
• refer or require any consumer to hire or engage any person providing any goods or rendering any services to the consumer;
• attempt to secure a remedy or obtain a waiver of any remedy, including, but not limited to, compensatory, statutory, or punitive damages, that the consumer may or may not be entitled to pursue or recover otherwise; or
• offer or provide legal advice to the consumer.

Willful violations of the Act's provisions can result in a felony conviction, imprisonment, and a fine of up to $10,000. Most provisions of the Act are effective on January 1, 2026.

Amicus Brief(ly): This sweeping legislation will have a material impact on litigation financing companies operating in Georgia. The Act tracks other states' litigation financing laws by requiring registration to be a provider, but it is more detailed in its requirements and more restrictive in that it limits the ability of a finance source not based in the U.S. to obtain a license. From there the Act imposes disclosure requirements and other conduct limitations, including the clear restriction on the finance source's ability to impact the litigation, and imposes potentially significant penalties for compliance failures. Finally, litigation financing agreements are now discoverable, which will allow counterparties to identify the involvement of a third-party funding source in the lawsuit and assess whether the funding provider is impermissibly impacting the case based on the restrictions described above.

On May 16, Florida Governor Ron DeSantis signed Senate Bill 232, which amends Section 559.72 of the Florida Consumer Collection Practices Act to allow debt collectors to send email communications to a debtor between the hours of 9 p.m. and 8 a.m. Section 559.72 prohibits communications with a debtor between 9:00 p.m. and 8 a.m. in the debtor's time zone without the prior consent of the debtor, and the amendment creates an exception to this prohibition. The new law is effective immediately.

As specifically stated in the legislation, the Florida legislature found that Section 559.72 was "adopted before e-mail communication became commonly used, and that the only specific communication explicitly contemplated in [this provision] is telephone calls." The legislature is permitting email communications during that time period because "such contact is less invasive and less disruptive than telephone calls."

Amicus Brief(ly): Florida's debt collection statute applies broadly to any "person" collecting or attempting to collect consumer debts - not just to third-party collectors of defaulted debts but also to creditors collecting their own debts. Third-party debt collectors will recall that under the CFPB's Regulation F, the agency made clear in the Official Commentary that an attempt to communicate, even electronically, is presumed inconvenient if the debt collector sends that electronic communication during the 9 p.m. to 8 a.m. window, without regard to when the consumer reviews the electronic communication. Florida's approach is more sound in that a collector can send the communication any time, including during the hours federal law presumes to be inconvenient for the consumer, because an electronic communication like email is not as invasive or disruptive as a telephone call. Creditors and servicers not subject to the FDCPA score a win with this new law, but FDCPA debt collectors will take on some risk under federal law if they follow this less-restrictive Florida statute.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.