CFPB Portal for State and Local Orders Opens: Risks Remain

The Consumer Financial Protection Bureau (CFPB) recently promulgated a final rule requiring certain nonbank financial companies to register public orders issued by federal, state, or local agencies that contain prospective relief, requiring the company to take or refrain from taking specific actions. The CFPB has since implemented this rule through a new online portal, set to open for filings on October 16, 2024, with deadlines for compliance starting January 2025.

We previously explained the final rule and its ramifications in a contemporaneous LawFlash—including a company’s obligation to file with the CFPB, the public nature of the database, the required certification accompanying such filing, and the risks posed to businesses by these requirements.

The CFPB’s Circular clarifies the rule’s substantive legal requirements and and practical requirements. Of particular note, filing deadlines for covered nonbanks will go into effect on January 14, 2025 and end July 14, 2025, depending on the size and supervision status of the business. The portal requires registration and includes flow charts and explanatory documents to streamline the process.

Takeaways

Despite the CFPB’s efforts to streamline compliance, risks remain:

• Covered institutions must review all orders to which they are a party to determine whether filing is required, whether it is exempt, and what certifications and actions are required
• Because compliance is compulsory, covered institutions risk enforcement and other actions not only from the CFPB but also from other federal agencies, state attorneys general, state financial institution regulators, and possibly local and tribal regulators; this underscores the importance of compliance, especially in light of the increased scrutiny from multiple prosecutors and regulators
• This public database presents a centralized repository for plaintiff attorneys to locate potentially fertile matters for future litigation, which may carry potential brand risks for the company

The rule is a good example of a regulatory scheme where compliance is straight forward—an immediate filing requirement—but where the rule is designed for an additional purpose: to collect and centralize nominally public data. These duel aims create a federal enforcement risk for noncompliance with state and local matters, as well as other legal and brand risks stemming from the registry’s centralized nature and its ready availability to the plaintiff’s bar and various enforcement entities.