Last Week, This Morning

September 15, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On September 5, President Trump signed H.R. 2808, the Homebuyers Privacy Protection Act, effective March 4, 2026. The HPPA amends the Fair Credit Reporting Act to prevent consumer reporting agencies from furnishing consumer reports under certain circumstances. Specifically, the new law adds 15 U.S.C. 1681b(c)(4) to address the treatment of prescreening report requests. If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless:

(1) the transaction consists of a firm offer of credit or insurance; and

(2) that other person:

(a) has submitted documentation to that agency certifying that such other person has the authorization of the consumer to whom the consumer report relates; or

(b)(i) has originated a current residential mortgage loan of the consumer to whom the consumer report relates; (ii) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or (iii) is an insured depository institution or credit union and holds a current account for the consumer to whom the consumer report relates.

The new law defines the terms "credit union," "insured depository institution," "residential mortgage loan," and "servicer."

The HPPA further requires the Comptroller General of the United States to study the value of trigger leads received by text message with input from state regulatory agencies, mortgage lenders, depository institutions, consumer reporting agencies, and consumers and submit to Congress, in one year, a report of the study's findings and determinations.

House Committee on Financial Institutions Chairman French Hill applauded passage of the bill, which he stated in a press release "put[s] clear, commonsense guardrails around the sale of trigger leads" and "'protects homebuyers' personal financial information, while encouraging competition and choice in the mortgage market.'"

Amicus Brief(ly): This development has been in the pipeline for a while, but it made it through and is now law. Besides consumers, mortgage brokers will be most directly affected by the new law prohibiting lead generation through trigger leads. Consumers may be better off or worse off, depending on who you ask. On one hand, trigger leads allow consumers the benefit of increased competition for their mortgage loans (but only after they applied for one, which put them on the trigger lead list). More competition typically leads to better pricing options and at least an opportunity for consumers to consider what alternatives the market has to offer for a long-term, considerable financial commitment. On the other hand, consumers have plenty of reasons to stick with the mortgage broker or lender they start with, whether because they have an existing, familiar relationship with the provider or because they shopped effectively and selected that broker or lender. So, the thinking goes, why do they need to receive unsolicited credit offers that are not firm offers of credit? Either way, a couple of states beat Congress to the punch, but the trigger lead ban is now a function of federal law.

On September 9, the Department of Justice's U.S. Trustee Program, which is responsible for overseeing the administration of bankruptcy cases and private trustees, announced that it obtained more than $1.1 million in civil penalties in a U.S. Trustee's adversary proceeding against a loan modification business and its president and sole member, the business's managing attorney, local counsel for the business in Louisiana and her law firm, and several independent contractors for the business for their individual and collective roles in connection with events leading up to the filing of a deficient pro se Chapter 13 petition by a homeowner to stop an impending foreclosure on his home. The U.S. Bankruptcy Court for the Western District of Louisiana concluded that the defendants engaged in a clear and consistent pattern of violating the Bankruptcy Code by orchestrating the filing of deficient pro se bankruptcy petitions for clients solely to prolong the clients' foreclosure proceedings and continue billing clients.

Prior to filing his Chapter 13 bankruptcy petition, the homeowner in this case had sought mortgage loan modification assistance from the defendants to avoid a foreclosure sale of his home. The homeowner paid a retainer to the defendants for their legal representation, followed by multiple monthly payments debited from his bank account. The U.S. Trustee alleged that the defendants never obtained mortgage relief for the homeowner pre-petition. Instead, the U.S. Trustee alleged that, with the foreclosure sale date approaching, the defendants sent the homeowner a "bare-bones" bankruptcy petition - listing only the mortgage creditor and lacking required documents - and told the homeowner how to file the petition on his own. The homeowner filed the bankruptcy petition pro se. The bankruptcy court quickly dismissed the petition for failure to provide proof of required pre-bankruptcy credit counseling and failure to pay the filing fee. Meanwhile, the defendants allegedly continued to withdraw monthly payments from the homeowner's bank account for their loan modification services for six more months. The U.S. Trustee also alleged that the defendants pressured the homeowner to file another bankruptcy case and allow them to continue to negotiate a loan modification. The homeowner ultimately hired a different bankruptcy attorney.

The U.S. Trustee alleged that this conduct by the defendants was not an isolated practice but was an extensive nationwide foreclosure defense scheme that violated the Bankruptcy Code by directing hundreds of the defendants' distressed homeowner clients to file incomplete pro se bankruptcy petitions using the defendants' designated petition preparers solely to prolong the defendants' client billing under the pretense of gaining additional time to complete the loan modification process and avoid foreclosure. The court agreed with the U.S. Trustee, finding that the defendants violated provisions of the Bankruptcy Code governing bankruptcy petition preparers, debt relief agencies, and attorneys, resulting in at least 186 abusive bankruptcy filings. Two attorney defendants were temporarily suspended from practice before the bankruptcy court and referred to attorney disciplinary authorities. Two other attorney defendants were also referred to attorney disciplinary authorities.

Amicus Brief(ly): Good for the DOJ and the U.S. Trustee for putting a stop to this regrettable practice of playing with the bankruptcy courts. It is not uncommon for consumers to file bankruptcy petitions to slow or prevent severe consequences for non-payment of debt, like mortgage foreclosure or personal property repossession. In fact, Chapter 13 of the Bankruptcy Code is there specifically to allow financially troubled debtors an opportunity to reset their obligations, develop a payment plan, and pay creditors back through the plan. The system is not designed, though, to facilitate a program like the one alleged here, where the defendants allegedly offered no actual assistance with the bankruptcy petition but took fees for what looks like advice about how to delay - but not effectively avoid - the inevitable. Fraud and deception remain high on the DOJ's list of priorities, and, if the allegations in this case are true, it sounds like the DOJ got an important win in this adversary proceeding.

On September 11, the Federal Trade Commission announced that two individuals involved in an allegedly illegal student loan debt relief operation entered into proposed orders permanently banning them from the debt relief industry and requiring them to turn over their assets. In addition, the proposed orders ban one of the individuals from the telemarketing industry and prohibit the other individual from violating the Telemarketing Sales Rule. Further, the proposed orders prohibit both individuals from:

• falsely claiming to be affiliated with any person, corporation, or government entity;
• charging consumers illegal upfront fees;
• making any misrepresentations about other products or services; and
• using false statements to collect consumers' financial information.

The amended complaint filed by the FTC in March 2025 alleged that the two individuals, as well as Superior Servicing, LLC, other companies, and another individual, pretended to be affiliated with the Department of Education or its loan servicers to convince student loan borrowers that their student loan debt relief program was legitimate. The defendants allegedly required borrowers to pay upfront fees, totaling millions of dollars, that the defendants falsely claimed would be applied to the borrowers' student loan balances when, in reality, the borrowers received virtually nothing in return.

The proposed orders impose a monetary judgment of more than $45.9 million that will be partially suspended, due to the individuals' inability to pay, after they pay more than $1.6 million and turn over approximately $560,000 in personal and business assets. If either individual is found to have materially misrepresented his finances, the full amount of the monetary judgment would become immediately due.

Previously, the U.S. District Court for the District of Nevada entered a temporary restraining order and a preliminary injunction against Superior Servicing. The FTC will continue its litigation against the third individual named in the complaint as well as the corporate defendants.

Amicus Brief(ly): Similar to the case made by the DOJ and the U.S. Trustee referenced above, the claims here involve misleading or deceptive practices by providers purporting to offer debt relief services to troubled borrowers. To the extent the allegations in this case are true (given the permanent industry ban and significant penalty, it seems like there may be something there), they offer a convenient example of the practices that led so many states to prohibit the imposition of "advance fees" by debt relief providers. Federal and state enforcement agencies appear to remain focused on the pursuit of claims of consumer deception and violations of state and federal law prohibiting such practices, as they should be.

On September 11, the Federal Trade Commission announced that it issued orders to seven companies that operate consumer-facing AI chatbots - Alphabet, Inc., Character Technologies, Inc., Instagram, LLC, Meta Platforms, Inc., OpenAI OpCo, LLC, Snap, Inc., and X.AI Corp. - seeking information on their advertising, safety, and data handling practices.

The FTC is seeking to understand what steps, if any, companies have taken to evaluate the safety of their chatbots when acting as companions, mitigate potential negative impacts, limit or restrict children's or teens' use of these platforms, and apprise users and parents of the risks associated with the products.

As part of its inquiry, the FTC is seeking, among other data, information about how the companies:

• monetize user engagement;
• impose and enforce age-based restrictions;
• process user inputs;
• share user data with third parties;
• generate outputs;
• measure, test, and monitor for negative impacts before and after deployment;
• develop and approve characters, whether company- or user-created;
• employ disclosures, advertising, and other representations to inform users about features, capabilities, the intended audience, potential negative impacts, and data collection and handling practices; and
• monitor and enforce compliance with rules, terms of service, or other policies governing use of the product or service.

The companies must file their reports within 45 days after the date of service of the orders.

Amicus Brief(ly): It feels like it's not too early, and probably not too late, to declare consumer data use and protection to be 2025's "hot" regulatory issue. We have seen federal and state regulators over the past year consistently pursue companies that harvest and use consumer data without consent, especially when they share or sell that data. This FTC information-gathering effort will reveal to the FTC the ways major companies take, process, and monetize consumer data. The announcement of this inquiry notes that these companies have direct access to children online and expresses a concern that the companies may be seeking and developing a form of trust with young people by using AI chatbots to mimic human characteristics. We will see what comes of this inquiry, whether it be guidance, a rulemaking, or some form of investigation and enforcement action.

On September 8, the Office of the Comptroller of the Currency issued two bulletins announcing actions to eliminate politicized or unlawful debanking in accordance with Executive Order 14331 - "Guaranteeing Fair Banking for All Americans."

In Bulletin 2025-22, the OCC clarified how it considers politicized or unlawful debanking in licensing applications filed by a bank and in assessing a bank's record of performance under the Community Reinvestment Act. According to the bulletin, "[t]he OCC reviews licensing filings by banks seeking to engage in various corporate activities or by entities seeking a federal charter or license. The OCC reviews these filings for specific evaluative factors under applicable statutes and regulations. Politicized or unlawful debanking by banks implicates certain evaluative factors for such licensing filings, which range from the convenience and needs of the community to be served, fair access to financial services, fair treatment of customers, and the transaction's impact on depositors, other creditors, and customers. Relevant filings include new charters, conversions, fiduciary powers, branching, business combinations, voluntary liquidation, changes in control, changes in directors and senior executive officers, and substantial asset changes. As part of its holistic review of licensing filings, the OCC considers, on a case by case basis, a bank's record of and policies and procedures designed to avoid engaging in politicized or unlawful debanking consistent with the applicable evaluative factors. Similarly, in assessing an insured bank's performance under the CRA, the OCC considers the bank's record of meeting the credit needs of its entire community, including low- and moderate-income neighborhoods, consistent with the bank's safe and sound operation. As part of this examination, whether a bank has engaged in politicized or unlawful debanking is a factor the OCC may consider, on a case by case basis, in determining the bank's CRA rating."

In Bulletin 2025-23, in light of EO 14331, the OCC reminds banks of the limited circumstances under which they are allowed to release customers' financial records to government agencies under the Right to Financial Privacy Act. Banks are also reminded to ensure the proper use of voluntary suspicious activity report filings, stating that "they should not use voluntary SARs as a pretext to improperly disclose customers' financial information or evade the RFPA."

Amicus Brief(ly): The OCC is following up on the current administration's focus on perceived grievances against banks for disassociating themselves in the past with certain customers based on what the banks called business risk but the administration alleges to be unfair and politically motivated debanking of good customers whose politics do not align with those of the banks or the mainstream. Observers are right to identify that "fair banking" takes on a different meaning in the executive order and this guidance than references to "fair banking" in years past. Specifically, these actions do not appear to be focused on reaching the traditionally underbanked or consumers protected under fair banking and fair lending laws. Rather, they are focused on ensuring that banks do not push customers away based on their politics. Where banks may have cited safety and soundness concerns for turning certain customers away based on perceived alienating politics, they can potentially take some comfort in knowing that the OCC will not be focused on those concerns when banks take steps to retain customers with potentially divisive political leanings.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.