October 19, 2026
Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)1" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.
On October 12, the Conference of State Bank Supervisors, a national organization of financial regulators that manages the Nationwide Multistate Licensing System & Registry on behalf of state regulators, launched a job analysis survey for state-licensed mortgage loan originators. The purpose of the survey is to gather information to help ensure that the SAFE MLO National Test remains current and continues to reflect the work that MLOs perform and the skills and knowledge that they need. According to the CSBS's press release announcing the survey's launch, MLOs nationwide will receive an email invitation from the CSBS to take the survey, which will be conducted through November 6.
The Secure and Fair Enforcement for Mortgage Licensing Act of 2008 established standards for the licensing and registration of MLOs. The SAFE Act requires that the NMLS program develop and maintain a qualified test to measure MLO candidates' knowledge of key topics, including ethics, federal and state mortgage lending laws, and laws and regulations covering fraud, consumer protection, fair lending, and the nontraditional mortgage marketplace.
|
On October 14, in response to a recent report by the Office of the Comptroller of the Currency, the Consumer Financial Protection Bureau announced a new initiative to investigate debanking of businesses and individuals and whether the large national banks featured in the OCC's report and other CFPB-supervised financial institutions have complied with federal consumer financial laws. The CFPB's press release states: "Previously, the CFPB reviewed its Examination Manual, guidance, regulations, and other materials used to regulate or examine financial institutions under its authority to ensure that they do not contain reputation risk concepts that could result in unlawful debanking. The CFPB has also been reviewing consumer complaints, as well as supervisory and enforcement data, for evidence of potential unlawful debanking[] and is pursuing its own investigations[] based on that data." The CFPB encourages consumers to submit complaints if they believe they have been debanked.
The OCC's recent report, "Guaranteeing Fair Banking for All Americans," found that nine of the largest national banks under its supervision engaged in debanking by maintaining policies or engaging in practices that denied or restricted financial access on the basis of a customer's political or religious beliefs or a customer's otherwise lawful business activities. The report focused on the period between January 2020 and September 2025.
The CFPB's announcement and the OCC's report are intended to implement President Trump's executive order - "Guaranteeing Fair Banking for All Americans" - issued in August 2025. The EO stated that "[f]inancial institutions have engaged in unacceptable practices to restrict law-abiding individuals' and businesses' access to financial services on the basis of political or religious beliefs or lawful business activities," resulting in unlawful discrimination against individuals and businesses in credit transactions and undermining public trust in banking institutions and their regulators. The EO requires federal banking regulators to eliminate "reputation risk or equivalent concepts that could result in politicized or unlawful debanking" from their guidance documents, manuals, and other materials used to regulate or examine financial institutions. Federal banking regulators must also conduct reviews to identify financial institutions that have had any past or current policies or practices that have influenced the financial institution to engage in politicized or unlawful debanking and to take remedial action, including levying fines and issuing consent decrees.
|
On October 13, the U.S. Department of the Treasury announced a trio of enforcement actions against Bank of America, N.A. The Financial Crimes Enforcement Network entered into a Consent Order that imposed a $1.2 billion penalty against the bank for its failure to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. The Office of the Comptroller of the Currency's Consent Order assessed a $750 million civil money penalty against the bank for its deficient and ineffective Bank Secrecy Act/anti-money laundering (BSA/AML) compliance program, which will be credited against the $1.2 billion FinCEN penalty. The bank also agreed to pay in excess of $11.6 million to the Office of Foreign Assets Control to settle claims alleging violations of numerous sanctions programs, including those targeting Iran, Russia, narcotics, and global terrorism.
According to Treasury's press release announcing the enforcement actions and penalties, FinCEN's investigation uncovered deficiencies related to the bank's suspicious transaction identification and reporting and customer due diligence processes. Treasury claimed that the bank substantially relied on actions by third parties rather than its own controls to identify potentially suspicious activity and allegedly allowed such activity to continue for extended periods without investigation, resulting in late reporting to law enforcement, even after testing highlighted significant problems. In addition, the bank's customer due diligence processes allegedly failed to account for customers' extensive reliance on payments from unknown third parties, and Treasury claimed that the bank failed to sufficiently respond to red flags involving these customers—including potential ties to narcotics trafficking proceeds—even after compliance personnel escalated their concerns. As a result of these deficiencies, according to Treasury, the bank failed to timely report to FinCEN over $5 billion in suspicious transactions, with over $1 billion of this activity implicating national security-related and other risks. As part of its Consent Order with FinCEN, the bank admitted that it willfully violated the BSA and failed to implement and maintain an AML program that met the minimum requirements of the BSA and FinCEN's implementing regulations, conduct due diligence for correspondent accounts for foreign financial institutions, and file Suspicious Activity Reports. The Consent Order requires the bank to work with a third party to identify and report suspicious transactions that went undetected and to undergo an independent review of the effectiveness of its suspicious activity monitoring, customer due diligence, and foreign correspondent account due diligence programs, as well as its data governance framework as it pertains to information used in its AML program.
Treasury's press release noted that the OCC's $750 million penalty was based on the determination that the bank's BSA/AML compliance program remained deficient and ineffective, even after the bank agreed to a cease-and-desist order with the OCC in 2024 that required the bank to address these deficiencies. The bank allegedly did not complete many of the significant steps needed to establish an effective BSA/AML compliance program, resulting in the bank allegedly failing to properly monitor trillions of dollars in transactions and causing large numbers of late SARs, many of which had indicia of money laundering. In addition, the bank's BSA Officer and staff allegedly lacked sufficient skills, expertise, and training to effectively manage its BSA/AML program, and the BSA audit function failed to identify longstanding BSA concerns that examiners subsequently uncovered.
Treasury's press release also announced that the bank settled its potential civil liability for 475 apparent violations of multiple OFAC sanctions programs, which allegedly occurred when the bank channeled correspondent banking payments through blocked banks due to technical and human error, allowed designated individuals to make payments and withdraw funds due to poor sanctions alert calibration, failed to promptly update watchlists following OFAC designations, and mishandled business accounts associated with blocked persons due to human error. The press release noted that the more than $11.6 million settlement with the OFAC, which included no reduction to the base penalty, including no mitigation for remedial measures or cooperation, reflected the OFAC's determination that the bank's apparent violations were non-egregious but largely not voluntarily self-disclosed. According to the press release, as part of the settlement, the bank has made significant compliance commitments regarding training, testing and audit, and future communication and cooperation with the OFAC.
The press release stressed the importance of financial institutions complying with AML/CFT (Combating the Financing of Terrorism) programs and sanctions requirements to protect U.S. national security and provided compliance considerations and whistleblower tips.
|
The U.S. Court of Appeals for the Ninth Circuit recently decided a case in which a consumer visited a company's website to shop for internet services. The consumer began a five-step process of purchasing services. She inputted her address, chose her internet service option and pricing, and customized her selection. At step four, she inputted her name, email address, phone number, and birthday, selected that she had read and accepted the terms and conditions, and clicked to proceed. In between steps four and five, the company obtained the consumer's credit report, ostensibly to thwart identity theft and determine whether to charge her a deposit, which it would include in the pricing details in step five. When the consumer reached step five, she decided not to place an order for the services.
The consumer filed a class action complaint against the company for willful violations of the Fair Credit Reporting Act. She claimed that the company did not have a permissible business purpose to obtain her credit report because she did not complete the purchase and that she and other class members were entitled to statutory and punitive damages. The company claimed that it was entitled to a defense "because its understanding of [the] FCRA, even if erroneous, was not objectively unreasonable and, therefore, not reckless and 'willful.'" The trial court denied the company's motion for a directed verdict and motion for judgment as a matter of law based on this defense and allowed the case to proceed to a jury trial, which resulted in a judgment in favor of the consumer and the class for $28 million in statutory damages and $112 million in punitive damages. The Ninth Circuit reversed the trial court's judgment accepting the jury's verdict, finding that the company's reading of the FCRA was not objectively unreasonable.
The FCRA allows a party to obtain a credit report from a consumer reporting agency if the party has a legitimate business need for the report in connection with a business transaction initiated by the consumer. The parties disagreed about whether the company willfully violated this provision. The appellate court found that it did not need to make that determination because the company was entitled to the safe harbor defense recognized by the U.S. Supreme Court in Safeco Insurance Company of America v. Burr. The appellate court noted that, in order to establish the defense, a party charged with an FCRA violation must show that: (1) its reading has a foundation in the text; (2) courts of appeal have not construed the FCRA provision at issue; and (3) there was no authoritative guidance from an agency that would have alerted the party to avoid its construction of the provision.
Turning to the first element, the appellate court noted that it was reasonable for the company to find that the consumer initiated a business transaction by completing four of five steps of the purchase process where the term "initiated" is not defined in the FCRA. Addressing the second element, the appellate court found that there is no appellate court decision addressing the question of when a business transaction has been initiated under the FCRA. Finally, addressing the third element, the appellate court found that an advisory opinion from the Federal Trade Commission to the Chief Counsel of the Texas Automobile Dealers Association discussing under what circumstances a dealership can obtain the credit report of a person who visits the dealership's showroom and a discussion of that advisory opinion in an FTC staff report were "not sufficiently specific to [the company's] online process to have warned the company that its statutory interpretation was incorrect." Therefore, the appellate court found that the company established the Safeco defense as a matter of law.
One concurring opinion expressed "regret" that the appellate court did not resolve the question of when a business transaction has been initiated by a consumer in the context of an online transaction.
|
The U.S. Court of Appeals for the Fifth Circuit recently decided a case in which a couple signed a promissory note to purchase a mobile home and real property in Mississippi that was secured by a deed of trust in favor of a mortgage lender. The first mortgage payment was due on September 1, 2022. The borrowers missed the September 1, 2023, and October 1, 2023, payments. The lender notified the borrowers that the loan was in default and that the amount to cure was $2,021.98. In November 2023, the borrowers began sending the lender partial payments of varying amounts, but the lender returned each partial payment as insufficient to cure the default. On April 9, 2024, the lender posted a Notice of Sale on a county courthouse, notifying the public that a foreclosure sale would take place on May 9, 2024. On April 10, 2024, the lender sent the borrowers a letter stating that the amount to cure was then $8,149.91. The borrowers continued sending partial payments, but the lender returned each payment to them. After the foreclosure sale, the borrowers sued the lender, seeking to set aside the sale. The trial court granted the lender's motion for summary judgment.
The Fifth Circuit affirmed the trial court's decision. The appellate court rejected the borrowers' assertion that a genuine issue of fact existed as to whether the Notice of Sale was properly posted at the courthouse. The appellate court agreed with the trial court that the Notice of Sale was signed and dated by the land records clerk and included all relevant information required by statute and that the borrowers offered only unsupported allegations that the notice was not physically posted on the courthouse.
The appellate court also rejected the borrowers' assertion that the lender improperly rejected their attempts to reinstate the loan by making partial payments. The appellate court concluded that, under Weems v. Transamerica Mortgage Co., a 2000 Mississippi Supreme Court case, lenders need not accept partial payments, regardless of their number, when none constitutes payment in full. Further, the clear language of the borrowers' deed of trust allowed the lender to return partial payments that were insufficient to bring the loan current.
|