Last Week, This Morning

May 11, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On May 4, the Federal Trade Commission announced that it obtained a proposed consent order with a data broker and its subsidiary that will resolve allegations that the companies collected and sold sensitive and precise location data obtained from hundreds of millions of mobile devices that could be used to trace the movements of consumers, including visits to sensitive locations such as health facilities, places of worship, or military buildings, without the consumers' consent.

The proposed order prohibits the companies from selling, licensing, transferring, sharing, or disclosing sensitive location data in any products or services unless they obtain a consumer's affirmative express consent and the location data is used to provide a service directly requested by the consumer. In addition, the companies are required to: (1) establish and implement a "sensitive location data program" to develop a comprehensive list of sensitive locations and to prevent the sale, licensing, transfer, sharing, or disclosure of sensitive location data; (2) implement a supplier assessment program designed to confirm that consumers have provided consent for the collection and use of all location data obtained by the data broker or subsidiary; (3) submit incident reports to the FTC when the companies determine a third party shared consumers' sensitive location data in violation of contractual requirements; (4) allow consumers to request the name of any business or individual to which the data broker or subsidiary has sold their sensitive location data and provide them with an easy way to withdraw consent for the sale of their device's precise location data; and (5) create a data retention schedule that will require the deletion of data on an established timeframe.

Amicus Brief(ly): The FTC and state attorneys general have been remarkably consistent with their enforcement actions related to consumer data use issues. This consent order features allegations that have become common threads in such actions - data collection without consumer consent and the sale of such data for some other commercial use. As we have said before, we expect continued attention to consumer data issues without regard to state or federal political leanings; these data use issues have appeared in published consent orders in states run by both Republicans and Democrats. The warning signs are there for any company that gathers, uses, stores, and (sometimes) buys or sells consumer data: if you are not disclosing how you collect data and what you do with it and seeking consumer consent for your intended use of that data, a government investigation and enforcement action may be on the horizon.

A homeowner obtained a home equity line of credit secured by a deed of trust on his home. The homeowner defaulted, and the alleged beneficiary of the deed of trust, RRA CP Opportunity Trust 1, directed the trustee to initiate nonjudicial foreclosure proceedings. The loan servicer, Real Time Resolutions Inc., executed a beneficiary declaration on behalf of RRA, stating that RRA was both the beneficiary of the homeowner's deed of trust and the "holder" of his HELOC agreement. The homeowner sued RRA, Real Time, and the trustee in federal district court, alleging state and federal law claims and seeking to block the trustee's sale. The federal court granted the defendants' motion to dismiss in part and deferred ruling on the remaining claims, certifying questions of state law to the Supreme Court of Washington.

The Washington Deed of Trust Act permits a deed of trust to be foreclosed nonjudicially by trustee's sale. The Washington high court explained that "[i]f the deed of trust grants the trustee the power of sale and the borrower defaults, the beneficiary may direct the trustee to foreclose the deed of trust and sell the property in a trustee's sale. But the DTA imposes many procedural prerequisites to such a trustee's sale. One of those prerequisites is at issue in this case: the requirement that 'before the notice of trustee's sale is recorded, transmitted, or served, the trustee shall have proof that the beneficiary is the holder of any promissory note or other obligation secured by the deed of trust.' A sworn declaration by the alleged beneficiary that it is the holder of the note or other obligation is sufficient proof [emphasis added]." Real Time executed such a declaration on behalf of RRA.

The homeowner argued that one cannot be the holder of a nonnegotiable instrument and that the HELOC agreement at issue is a revolving line of credit that is nonnegotiable. The Washington high court agreed with the homeowner, concluding that "the HELOC agreement is nonnegotiable. To be 'negotiable,' an instrument must contain an 'unconditional promise or order to pay a fixed amount of money, with or without interest or other charges described in the promise or order.' The HELOC agreement at issue here provides that the borrower may request loans up to a stated credit limit - but it does not state the amount actually advanced to the borrower. [The homeowner's] HELOC agreement - like all HELOCs and revolving lines of credit of this sort - therefore flunks the negotiability test. It is not a negotiable instrument." The high court also concluded that "under Washington's DTA, RRA cannot be the 'holder' of a nonnegotiable instrument. The plain language of the relevant statutes, in context, combined with our prior case law interpreting that language, compel the conclusion that 'holder' in this context means the holder of a negotiable instrument as defined in the UCC." As such, RRA could not proceed with the nonjudicial foreclosure and sale because it could not satisfy the prerequisite to nonjudicial foreclosure under the DTA that it is "the holder of any promissory note or other obligation secured by the deed of trust."

The high court clarified that its conclusion does not deprive lenders or their assigns of judicial remedies.

Amicus Brief(ly): We have no quarrel with the court's explanation of how the "holder" rules in the UCC work and how the HELOC agreement discussed in the case was not a "negotiable instrument." An open-end credit plan cannot be a negotiable instrument by its nature (notwithstanding case law out of Nevada that the court in this case recites but is nevertheless wrong). But at least some of us find ourselves aligned more with the dissent in this case, wondering why the majority is talking about negotiable instruments under the UCC in the first place - the mortgage law in Washington does not require that. Sometimes "holder" just means "owner" and is not a reference to the holder of a negotiable instrument and constrained by the UCC. Either way, this is an important case for HELOC lenders in Washington seeking to enforce HELOCs when consumers default. It appears that HELOC lenders can use nonjudicial foreclosure for their deeds of trust; they just have to ensure that at the time they need to enforce those security instruments, the beneficiary of the deed of trust is also the holder (i.e., owner - not a UCC "holder") of the HELOC agreement and has the right to enforce the deed of trust. Otherwise, judicial foreclosure is the remedy.

On May 5, the Massachusetts Division of Banks entered into a $1.9 million settlement with a third-party loan servicer to resolve allegations that it conducted business in Massachusetts without the appropriate registration, in violation of Massachusetts General Laws Chapter 93, Section 24A(b), and Code of Massachusetts Regulations Title 209, Chapter 18.00 et seq.

In addition to the hefty fine, the third-party loan servicer must establish, implement, and maintain adequate internal policies and procedures to ensure that it refrains from engaging in any business activity that requires licensing or registration from the DOB prior to obtaining the appropriate license or approval from the DOB. The settlement agreement states that, without limiting the commissioner's discretion as set forth in the applicable laws and regulations in determining whether to issue a registration to the loan servicer, any such application will not be denied solely as a result of any of the issues resolved by the settlement agreement.

The DOB notes in the settlement agreement that, upon being made aware that a third-party loan servicer registration was required, the loan servicer immediately cooperated with the DOB.

Amicus Brief(ly): Ouch. That's a big, serious penalty for unlicensed activity. Massachusetts licenses both servicers and debt collectors, and the debt collector license gives a licensee authority to act as a third-party servicer (but the reverse is not true). The settlement here reflects that the subject of this agreement did not admit that it did anything wrong, agreeing to settle the DOB's claims in the interest of moving on. We do not have much information from the DOB about the servicer's business model and any arguments the company may have made about why it did not need the third-party loan servicer registration. If there were questions or doubts about the applicability of registration before this servicer entered the Massachusetts market, the servicer could potentially have saved considerable money by approaching the regulator in advance to gauge the DOB's position on its business model.

Several individuals who obtained residential mortgage loans from Bank of America brought a putative class action against the bank, alleging that it failed to pay interest on their mortgage escrow accounts in violation of New York's interest-on-escrow law. The bank argued that the New York law is preempted by the National Bank Act, and, therefore, as a national bank, it did not have to comply with the state law. The trial court concluded that nothing in the NBA or other federal law preempts the New York law on the question of interest on escrow. In a prior decision, the U.S. Court of Appeals for the Second Circuit reversed, finding that because the New York law "would exert control over" national banks' power to "create and fund escrow accounts," the law is preempted. See Cantero v. Bank of America, N.A., 2022 U.S. App. LEXIS 25864 (2d Cir. (E.D.N.Y.) September 15, 2022).

In 2024, the U.S. Supreme Court concluded that the Second Circuit court "did not conduct the kind of nuanced comparative analysis required by [Barnett Bank of Marion County, N.A. v. Nelson, 1996 U.S. LEXIS 2161 (U.S. (11^th Cir. (M.D. Fla.)) March 26, 1996)], but instead distilled a categorical test that would preempt virtually all state laws that regulate national banks." See Cantero v. Bank of America, N.A., 2024 U.S. LEXIS 2367 (U.S. (2d Cir. (E.D.N.Y.)) May 30, 2024). According to the Supreme Court, the Dodd-Frank Act of 2010 provides that the NBA preempts a state law "only if" the state law: (1) discriminates against national banks as compared to state banks; or (2) "prevents or significantly interferes with the exercise by the national bank of its powers," as determined "in accordance with the legal standard for preemption" that the Supreme Court articulated in Barnett Bank. Because the New York interest-on-escrow law does not discriminate against national banks, the Supreme Court found that the preemption question should be analyzed under the "prevents or significantly interferes" standard in accordance with Barnett Bank, a case that "did not draw a bright preemption line." Because the Second Circuit did not apply the preemption standard in a manner consistent with the Dodd-Frank Act and Barnett Bank, the Supreme Court vacated the case and remanded it back to the Second Circuit.

On May 5, after revisiting whether federal banking law preempts New York's interest-on-escrow law under the Barnett Bank standard and banking preemption precedents, the Second Circuit again held that the New York law is preempted. First, the Second Circuit found that the New York law affects a national banking power - the power to offer mortgages. Next, the Second Circuit concluded that the state law is preempted because "it affects a broad federal grant of power to set the terms of mortgage-escrow accounts and it impedes national banks' ability to offer those accounts efficiently." According to the court, the New York law is "akin to" the laws the Supreme Court has struck down for significantly interfering with a national bank's powers. One judge dissented, concluding that New York's interest-on-escrow law does not significantly interfere with the exercise of any national banking power.

The First Circuit has reached the opposite conclusion with respect to a Rhode Island interest-on-escrow law, holding that the Rhode Island statute requiring lenders to pay interest on mortgage escrow accounts is not preempted by the NBA where the lender is a national bank. See Conti v. Citizens Bank, N.A., 2025 U.S. App. LEXIS 24453 (1^st Cir. (D.R.I.) September 22, 2025).

Amicus Brief(ly): A circuit split on this question about interest on escrow may give the Supreme Court another chance to clarify its stance on national bank preemption. With Chevron deference to the Office of the Comptroller of the Currency's position on preemption in the rear view mirror and recent Supreme Court jurisprudence in the Cantero case making clear that it, pursuant to the Dodd-Frank Act, is looking to the Barnett Bank standard for preemption determinations, national banks are in murkier waters today than they were in the early 2000s when the OCC's strong stance favoring national bank preemption of state laws felt like the law of the land. National banks have to be able to articulate how a state law interferes with their exercise of NBA powers, and they have to be convinced by their arguments because they may have to defend those arguments in court. It would be pretty neat if Congress could step in and write a clear preemption standard into the NBA and make all of this easier on banks and the courts (and, humbly, compliance lawyers and professionals).

On May 2, Iowa Governor Kim Reynolds signed House File 2329, which takes effect on July 1, 2026. H.F. 2329 raises the maximum permitted rates that may be charged by licensees under the Regulated Loan Act to 3% per month (36% per year). Under current Section 536.13(7)(d), which was not amended by the bill, these maximum rates apply to both closed- and open-end loans made by licensees.

Prior to the enactment of H.F. 2329, the RLA empowered the superintendent of the Iowa Division of Banking to establish the maximum rate of interest for loans made by licensees with an unpaid principal balance of $30,000 or less. The superintendent had promulgated a regulation most recently in 2020 to authorize a tiered system of maximum rates for such loans. We anticipate that the superintendent's regulation will be amended or repealed soon in order to be aligned with the amended provisions of the RLA.

Note that supervised financial organizations (a defined term that includes all banks and credit unions) are not required to obtain a license under the RLA and so derive their rate authority from the Iowa Consumer Credit Code and the Money and Interest Chapter. H.F. 2329 does not amend those maximum rate provisions. The maximum finance charge for a closed-end loan under the ICCC (which applies to loans with an amount financed of $73,400 or less for 2026) is 21% per year. Open-end loans are not subject to a maximum finance charge under the ICCC as long as they are calculated in accordance with Section 537.2402. In addition, H.F. 2329 does not change the maximum rate that may be charged on a title loan under Section 537.2403 of the ICCC.

Certain fees charged by lenders are expressly authorized by Section 537.2501 of the ICCC. H.F. 2329 also amends the maximum "service charge" that may be imposed under that section of the ICCC from 10% of the amount financed or $30 to either 3% of the amount financed or $100.

Amicus Brief(ly): Iowa has maintained a relatively low interest rate cap on consumer loans for a long time. It is a big jump for licensees subject to the current interest restrictions to get to 36% on balances up to $30,000 (right now, licensees may charge 36% only on the first $3,000 of a loan of $30,000 or less). There is little doubt that beyond the goal of simplifying the interest rate regime for consumer loans in Iowa, the Iowa legislature recognizes that many states allow lenders (banks or non-bank licensees) to make loans at interest rates that exceed the 21% annual rate that Iowa banks may charge. This is a welcome change. DIDMCA historians will recall that Iowa and Puerto Rico were the only U.S. jurisdictions to opt out of Section 521 of the Act back in the early 1980s. It appears that Iowa is leaving its state banks behind again with this new law, though, effectively leaving their interest rates capped at 21% while allowing non-banks in Iowa to charge up to 36% on the same loans.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.