Last Week, This Morning

July 13, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

Please Note: Next week's edition of "Last Week, This Morning" will be sent out on Tuesday, July 21, and not Monday.

On July 9, the Consumer Financial Protection Bureau issued a notice requesting information about potential regulatory changes that could reduce regulatory compliance burdens on mortgage lenders and promote consumers' access to mortgage credit.

On March 13, President Trump issued Executive Order 14393 - "Promoting Access to Mortgage Credit" - which provides, in part, that certain federal regulations have increased compliance costs associated with mortgage origination, resulting in reduced access to mortgage credit for consumers and higher costs for mortgage borrowers. In its notice, the CFPB specifically seeks information on potential regulatory changes pertaining to the integrated mortgage disclosures under the Truth in Lending Act (Regulation Z) and the Real Estate Settlement Procedures Act (Regulation X), TILA's right of rescission, and reverse mortgages. The notice provides specific questions for the public to address regarding these topics and provides an overview of the TILA-RESPA Integrated Disclosure Rule and the Loan Estimate and Closing Disclosure forms, TILA's right of rescission, and reverse mortgage disclosure requirements.

Comments are due by August 10, 2026.

Amicus Brief(ly): You can probably imagine the comments the CFPB will receive in response to this request for information. Consumer advocates will say that the Bureau should leave in place the disclosure requirements and the thresholds that trigger them, while industry advocates will state that less is more and that mortgage loans can be closed with less expense to the consumer if not for the extensive disclosure requirements that exist today. Each has a point, but it is not clear how the CFPB can change statutory disclosure requirements by rulemaking (that is an issue for the CFPB no matter what administration is calling the shots). The stated goal of EO 14393 is laudable - expanding access to mortgage loans works well for both consumers and the industry that serves them. We will continue to watch the CFPB's rulemaking journey with interest to see how it satisfies the requirements of the EO within the confines of what TILA and RESPA allow.

Effective July 6, the Maryland Office of the Attorney General, Consumer Protection Division, adopted new rules to further define what constitutes an "abusive" practice under the Maryland Consumer Protection Act. Section 13-303 of the MCPA states that a person may not engage in any unfair, abusive, or deceptive trade practice in:

• the sale, lease, rental, loan, or bailment of any consumer goods, consumer realty, or consumer services;
• the offer for sale, lease, rental, loan, or bailment of consumer goods, consumer realty, or consumer services;
• the offer for sale of course credit or other educational services;
• the extension of consumer credit;
• the collection of consumer debts; or
• the purchase or offer for purchase of consumer goods or consumer realty from a consumer by a merchant whose business includes paying off consumer debt in connection with the purchase of any consumer goods or consumer realty from a consumer.

In addition to the unfair, abusive, or deceptive trade practices outlined in Section 13-301 of the MCPA, the new rules provide that "abusive" practices include a practice that:

• materially interferes with the ability of a consumer to understand a term or condition of a consumer product or service; or
• takes unreasonable advantage of: (a) a lack of understanding on the part of the consumer of the material risks, costs, or conditions of the product or service; (b) the inability of the consumer to protect the interests of the consumer in selecting or using a consumer product or service; or (c) the reasonable reliance by the consumer on a person to act in the interests of the consumer.

Amicus Brief(ly): Unsurprisingly, Maryland's definition of an "abusive" practice very closely tracks the Consumer Financial Protection Bureau's definition that derives from the Dodd-Frank Act. The "abusive" standard did not exist before Dodd-Frank, and the CFPB has not yet developed a body of law to which states can look for an understanding of how to apply the standard. One reason for the lack of substantial enforcement material on "abusive" practices may be that the industry does not often go out of its way to "materially interfere" with a consumer's ability to understand the terms of credit, and the industry tries not to take unreasonable advantage of vulnerable consumers. The exceptions, though, are the reason for the rule. For now, Maryland has adopted a regulation that extends beyond consumer credit to reach sales of goods and services and rental and lease arrangements. If we all keep everything above board, we are not likely to see Maryland develop the "abusive" standard any more than the CFPB has.

Missouri Governor Mike Kehoe recently signed House Bill 2637, which adds section 565.260 to the Crimes Code to establish the offense of unlawful tracking of a motor vehicle and to prohibit a person from knowingly installing, concealing, or otherwise placing an electronic tracking device in or on a vehicle without the consent of all owners of the vehicle for the purpose of monitoring or following an occupant or occupants of the vehicle unless an exception applies. One permissible exception is the installation of such a device by a lienholder or agent of a lienholder acting to track the movement or location of a vehicle in order to repossess the vehicle. Another permissible exception is the installation of such a device by a vehicle rental or leasing company for the purpose of tracking or managing vehicles owned by such company or providing services to customers.

The new law is effective on July 1, 2027.

Amicus Brief(ly): Over the past few years, the states have learned about how vehicle manufacturers have gathered, shared, and sold driving data, both with and without express prior consent from consumers. With that information, the states are getting more direct and specific in their legislation designed to combat data use practices that omit a consumer consent option. Missouri cuts right to the chase with this new law, making it a crime to install tracking devices or software in vehicles without the consent of the vehicles' owners. The state offers logical exceptions to the rule, but the message is clear: Missouri does not want consumers' driving data tracked without their consent. Simple enough.

On July 8, the company that operates the peer-to-peer payment application "Cash App" reached a $45 million multistate settlement with the attorneys general of 46 states to resolve allegations of inadequate information security that exposed users of Cash App to fraud, coupled with inadequate customer service to assist users of the app with questions or concerns. The state AGs specifically alleged that the company made misrepresentations to users about the security of Cash App and stated that the app worked like a bank, with the same protections including Federal Deposit Insurance Corporation insurance. The company allegedly knew that fraud on its platform was rising and failed to warn users and strengthen protections against fraud. The AGs also alleged that the company actively marketed Cash App to unbanked and underbanked consumers, who may be particularly vulnerable to fraud. In addition, the AGs alleged that the company failed to investigate unauthorized transactions and issue refunds to users who had been victims of fraud.

The AGs alleged that the following policies facilitated the proliferation of fraud on the Cash App platform:

• The company's sign-up process was designed to be fast and frictionless with minimal identity verification, making it easier for fraudsters to create multiple accounts and use them to commit fraud.
• For many years, Cash App had no live phone support, even though it told customers who needed help to call. Users who needed help could only message through the app or on social media. Some Cash App customers who needed help - or just wanted to talk to customer service - searched online for a phone number and often ended up calling fake 1-800 numbers run by scammers posing as Cash App. Those scammers would then take over accounts or drain users' other financial accounts. The company allegedly knew these actions were happening and did not warn users or set up a phone line with live customer service until years later.
• The company ran a social media promotion called Cash App Fridays, encouraging users to publicly post their $cashtag - a unique Cash App identifier - for a chance to win a weekly prize. Fraudsters would use this information to identify and target those users, contacting them through the app, telling them they had won, and tricking them into handing over their login information. The company allegedly knew about these scams but continued running the promotion.

Under the settlement, the company has agreed to:

• maintain customer support that can resolve fraud complaints, account lockouts, and other problems;
• offer live support 24 hours a day, with a human available by phone at least 13.5 hours a day and by live chat at least 18 hours a day;
• stop making false or misleading claims about Cash App's safety and how it protects users from fraud;
• discontinue marketing practices known to increase fraud on the platform;
• directly educate consumers about common types of fraud; and
• fulfill its legal obligations to investigate fraud claims and reimburse users for unauthorized transactions.

The AGs' settlement also requires the company to honor the consumer redress provisions of a prior settlement it entered into with the Consumer Financial Protection Bureau in the final days of the Biden administration, which require the company to pay at least $75 million and up to $120 million to compensate consumers nationwide.

Amicus Brief(ly): The intent of Cash App suited consumers just fine - low-friction access to a payment system that allows them to move money around without much hassle from sign-up through implementation. But the implementation part of that plan seems to have left out some important features, if the allegations in the settlement are true (especially the allegation that the provider claimed to have fraud protections in place that were not actually available). Specifically, it appears that it was a little too easy to sign up for the app and then to trick other users out of their money. In addition, the provider evidently did not staff a customer service function that could have both helped consumers out of the foreseeable fraud jams and identified the trending fraud so the provider could do something about it. The guardrails imposed by the settlement should allow consumers to use the app with more confidence and to get help quickly if they experience fraud from other users of the app.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.