Last Week, This Morning

September 21, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On September 15, the Federal Trade Commission published frequently asked questions on price transparency to help auto dealers better understand how to comply with the FTC Act with respect to vehicle price advertising. The FAQs include:

• Why is the FTC focused on price transparency?
• What needs to be included in the advertised price, and what can be left out?
• In what advertisements do dealers have to be transparent and truthful about pricing?
• For internet advertisements with a price, must all webpages list the actual price?
• Can the MSRP or discounts and rebates be included in advertisements?
• How should document fees be disclosed?
• How should dealers also comply with state laws governing document fees and disclose the actual price of a vehicle accurately?
• How should a processing fee be disclosed in a vehicle leasing advertisement?
• How should dealers account for price negotiations and optional items when advertising prices?
• Can dealers advertise a car that is in transit, in the dealers' inventory but at an offsite location, or recently sold?
• Can dealers use a representative photo of a particular vehicle in an advertisement?
• Who is responsible for accurately disclosing price in advertisements - dealers, third-party advertisers, or original equipment manufacturers?

Amicus Brief(ly): These timely FAQs from the FTC reflect its consistent position on price advertising. Earlier this year, the FTC sent a letter to 97 dealers reminding them of the rules around deceptive advertising and the consequences for breaking those rules. The response to the first FAQ specifies that the FTC is focused on truthful advertising because when dealers are inconsistent in their price advertisements (e.g., when some include mandatory fees in price advertisements and others do not), price comparisons become unreliable, distorting the market and making it function inefficiently. As regular readers know, the state attorneys general are focused on price advertising as well. Dealers should review the FAQs with interest, check state law rules for specifics about price advertising, and go forward with clear, truthful price advertisements for vehicles dealers actually have in their inventories. Otherwise, a visit from the FTC, a state attorney general, or both may be on the horizon.

On September 16, the Conference of State Bank Supervisors released a new supervisory resource - the CSBS Artificial Intelligence Supervisory Framework - to provide state examiners with a tool to assess the use and risks of AI at state-chartered banks and state-licensed nonbank financial institutions. The framework also serves as a resource for regulated financial institutions to assess their own AI programs and AI risk management and to bring awareness to the types of information that a state examiner may request regarding an institution's AI-based products, services, and tools. According to the CSBS, each state regulatory agency will determine the extent to which this framework is incorporated into its supervisory program.

Amicus Brief(ly): This resource, assuming the state bank supervisors adopt it or something like it, seems very useful for financial institutions that are trying to manage AI use in their organizations. It includes, among other things, materials on governance and oversight, AI inventory and use cases, and third-party risk management. The resource is new enough that we are not aware of any states adopting it yet, but state-chartered banks can check their work against this resource ahead of that adoption, knowing that when the states adopt or adjust examination guidelines or other supervisory resources specific to the peculiar risks of AI, they will likely base those guidelines on this CSBS resource. Non-banks, whether they are involved in bank partnership lending or otherwise, can also use this resource as a guide for best practices in their oversight of the use of AI in their organizations.

On September 17, the Federal Deposit Insurance Corporation issued a proposed rule to promote parity between state-chartered banks and national banks, stating that recent litigation involving the Illinois Interchange Fee Prohibition Act concerning payment card transactions has created uncertainty as to the application of state laws to state-chartered banks that offer services outside their home state.

The IFPA, enacted in 2024, prohibits card issuer banks, card networks, and acquirer banks from charging or receiving interchange fees on the tax and gratuity portions of payment card transactions and restricts the use of payment card transaction data. After the IFPA's enactment, several trade associations and other parties sued the Illinois attorney general, arguing that various federal laws preempted the IFPA. In addition, the Office of the Comptroller of the Currency, which believed that the IFPA would create a complex and potentially unworkable standard for national banks attempting to comply with the state law, issued an interim final rule that clarified that a national bank's power under the National Bank Act to charge non-interest charges and fees includes the power to charge and collect interchange fees for processing credit and debit card transactions, regardless of whether those fees are set by the bank or a third party. The OCC also issued an interim final order that confirmed that federal law preempts the IFPA. A federal district court thus granted a permanent injunction preventing Illinois from enforcing the IFPA against national banks, federal savings associations, payment card networks, and banks chartered by states other than Illinois that are subject to Section 24(j) of the Federal Deposit Insurance Act. Because the parties to the litigation disagreed as to which state-chartered banks are subject to Section 24(j), the FDIC issued this proposed rule. While the plaintiffs in the IFPA litigation asserted that Section 24(j) extends national bank preemption broadly to out-of-state state banks, the Illinois AG argued that Section 24(j) extends such preemption only to out-of-state state banks' branches "physically located" in Illinois, which would potentially leave aspects of many state banks' operations subject to the IFPA.

Accordingly, the FDIC's proposed rule "recognize[s] parity between out-of-State State banks (State banks that are chartered by their home State but doing business in a host State) and national banks doing business in another State (a host State) without establishing a branch in such host State. The rule would clarify that when host State law does not apply to national banks, then host State law would not apply to out-of-State State banks offering services in the host State with or without a branch. Instead, the chartering State's law would apply to such banks offering services in the host State regardless of whether they branch into the host State. In addition ..., the proposed rule also would enhance consistency in the application of host State law among State banks that offer services outside their chartering States. Under the proposed rule, out-of-State State banks that offer services in a host State without a branch would be treated the same as out-of-State State banks that perform the same services through a branch."

Comments are due within 60 days after the date the proposed rule is published in the Federal Register, which is expected shortly.

Amicus Brief(ly): The proposed rule is designed to put state-chartered banks on level ground with national banks when the state banks do business in multiple states, but this rulemaking will almost certainly be put to the test if the final rule looks like the proposed rule. The National Bank Act and the Federal Deposit Insurance Act do not really align in whether and how they empower banks to do banking business. State-chartered banks have had good footing for interest rate exportation since the passage of the DIDMCA in 1980, and since Riegle-Neal they have had guidelines for interstate branch business. But because state banks derive their powers primarily from state law, their ability to preempt other states' laws has been far more arguable than it has been for national banks. State banking regulators and consumer advocates have shown us that they are not fond of the concept of broader preemption powers for state banks, so downstream rulemaking challenges are likely. We are not sure how the courts will treat the OCC's preemption position with respect to interchange fees - recent preemption jurisprudence from the Supreme Court puts the onus on national banks seeking to preempt state laws to demonstrate how those state laws "significantly interfere" with the banks' exercise of federal powers, and Chevron deference to regulators' interpretations is a thing of the past. Nevertheless, the FDIC will be an advocate for state banks in this attempt to preempt Illinois state law and level the playing field for state and national banks in an effort to promote a competitive dual banking system. We will be watching for developments.

On September 14, Massachusetts Attorney General Andrea Campbell announced that her office entered into a consent judgment with debt collection and debt buying companies and their owner for alleged unfair and deceptive debt collection practices in violation of the Massachusetts Consumer Protection Act.

Among other claims, the AG specifically alleged that the defendants' seizure of consumers' vehicles and threats to sell them at auction were attempts to coerce payment from a consumer on the alleged debt, which was "completely unrelated to any car loan the consumer may have had," rather than to satisfy the debt because the balance of the consumer's vehicle financing obligation was comparable to or exceeded the amount the defendants could expect to obtain if the vehicle was sold at auction, and the defendants knew they would not realize a profit from the vehicle's auction. In addition, the defendants allegedly misrepresented to consumers that they would be paid before the lienholder if the vehicle went to auction. The AG also alleged that the defendants did not follow the legal procedure for making these types of seizures because they seized vehicles that they knew, or should have known, were exempt from seizure by law. Massachusetts law exempts from seizure certain vehicles that are necessary for the alleged debtor's personal transportation or to secure or maintain employment and that do not exceed a specified wholesale resale value. The AG also maintained that the defendants seized vehicles not owned by the alleged debtors and seized vehicles after their debt collection license had lapsed. Finally, the defendants allegedly engaged in the unauthorized practice of law by filing debt collection actions or appearing in legal proceedings without the assistance of an attorney, overstated prejudgment interest in court filings, and collected debts outside the applicable statute of limitations.

The settlement prohibits the defendants from buying, selling, transferring, assigning, or collecting debts allegedly owed by Massachusetts consumers, effectively providing over 6,000 Massachusetts consumers with approximately $52 million in relief from alleged debts. The settlement also permanently bars the defendants from seeking a debt collector license in Massachusetts and from engaging in any collection activity from or within Massachusetts, even on debts allegedly owed by non-Massachusetts consumers. The settlement also imposes a monetary judgment of $650,000, which is suspended based on the defendants' inability to pay.

Amicus Brief(ly): To the extent the allegations in this Massachusetts matter are true, we can see why the Massachusetts AG went after these companies the way it did. The consent judgment tells the story two years after the AG filed its suit - the companies and their owner are barred from ever getting a debt collector license in Massachusetts and are subject to a significant suspended penalty. There are clear avenues in each state's laws for creditors and debt collectors (or debt buyers) to use to recover collateral and some consumer assets, but efforts to make those recoveries must be carefully executed in accordance with those state laws. Pushing the envelope may lead to some short-term financial gains, but state regulators and enforcement agencies will start asking questions if consumers are informing them about aggressive debt collection.

On September 17, Texas Attorney General Ken Paxton advised businesses of a scam involving demand letters sent to Texas businesses alleging that their websites are using certain tracking technologies that constitute unlawful "wiretapping" under the California Invasion of Privacy Act. The letters demand immediate payment from the recipient to avoid litigation. Letters may include screenshots of the recipient's website and a draft complaint. The AG advises businesses not to respond directly, or provide payment, to the sender. Instead, the AG advises businesses to: (1) consult with legal counsel experienced in privacy and website-tracking litigation; (2) with the assistance of counsel, review their websites' use of pixels, cookies, analytics tools, and similar technologies; and (3) monitor evolving state and federal privacy laws and court decisions regarding website-tracking technologies.

Amicus Brief(ly): Good advice from the Texas AG, though we would advise businesses to take steps two and three even if they have not taken step one. An ounce of prevention is worth a pound of cure, right? It is critical for businesses to understand how privacy laws impact their websites and consumer portals and how tracking of consumers' visits to the site can implicate privacy laws. There has never been a better time to retain privacy counsel who can help assess potential exposure and craft disclosures, consent forms, and other means of ensuring that consumers know whether and how a website is going to gather and use their data and what they can do to limit that data gathering and use.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.