The centralized repository would assist the CFPB and law enforcement in detecting patterns of misbehavior and recidivism adversely affecting consumers.

On June 3, 2024, the Consumer Financial Protection Bureau (CFPB) finalized a rule (Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders) (the Rule) to track judicial and regulatory enforcement orders against nonbank financial firms, and to report on such orders in a publicly available registry.

The Rule, first proposed in December 2022, would require nonbank firms to begin reporting to the CFPB when they become subject to a “public written order imposing obligations based on violations of certain consumer protection laws.” The Rule aims to help the CFPB, state attorneys general, state regulators, law enforcement agencies, and consumers detect certain patterns of illicit behavior, especially by repeat offenders.

This is the first rule promulgated pursuant to Section 5512 of the Consumer Financial Protection Act (Section 1022(c)(7) of the Dodd-Frank Act[1]), which the CFPB asserts grants it the authority to register covered nonbanks.

The Rule will go into effect on September 16, 2024. Reporting obligations, however, will be phased in over time, with the following deadlines (covered orders must be registered within a 90-day window prior to the deadline):

• January 14, 2025, for nonbanks that the CFPB supervises under its larger participant authority
• April 14, 2025, for all other nonbanks that the CFPB supervises
• July 14, 2025, for nonbanks that the CFPB does not supervise

Who Is Covered?

The Rule applies to certain nonbanks that are “covered persons” under the Dodd-Frank Act. It would not apply to insured depository institutions (banks), insured credit unions, and certain other entities and persons, but would apply to nonbanks that offer or provide consumer financial products or services, including the following:

• Nonbank parent holding companies of banks and credit unions
• Payment companies
• Credit reporting companies
• Payday lenders
• Mortgage lenders
• Auto lenders
• Debt collectors

What Is Reportable?

Under the Rule, CFPB-supervised covered nonbanks must report to the CFPB a range of publicly available final orders that they are subject to as a result of federal, state, or local enforcement actions. Such orders can stem from agency or judicial action, but must be the result of violations of consumer protection laws.

Reportable orders must contain provisions that impose obligations on the covered nonbank to take or refrain from taking certain actions, based on an alleged violation of a covered law (including federal consumer financial laws, and certain federal and state laws governing unfair, deceptive, or abusive acts or practices).

Consent orders or stipulated orders brought under consumer protection laws must also be reported, whether or not they admit or deny wrongdoing.

The Rule requires the reporting of orders going back to January 1, 2017, and companies must report any new orders or changes to existing orders (such as an amendment, termination, or abrogation) within 90 days.

CFPB-supervised covered nonbanks with over $5 million in annual receipts are also required to submit an annual compliance attestation signed by a senior executive for each applicable order, confirming compliance with the order(s) and reporting any instances of noncompliance. Entities must maintain records sufficient to provide reasonable support for the written statement for five years after the submission. Executive attestations, however, will not be publicly available in the CFPB’s registry, and will be treated as CFPB confidential supervisory information.

A covered nonbank is relieved of further registration obligations (and annual attestations, if applicable) with respect to an order if it files a final notice with the CFPB describing the order’s expiration or termination, or that the order is modified such that it is no longer a covered order.

Conclusion

CFPB Director Rohit Chopra said in a statement that the new registry “will help the CFPB and other law enforcement agencies monitor and track repeat offenders,” and will help consumers easily appraise companies based on readily-available enforcement track records. Consumer groups have also lauded the Rule for its objective to promote transparency and reduce consumer risks.

Industry participants subject to the Rule (namely the Nationwide Multistate Licensing System & Registry for mortgage lenders[2]) will likely challenge it, arguing that it is excessive or duplicative, puts undue pressure on executives tasked with individual accountability and attestation, and was promulgated potentially beyond the CFPB’s statutory authority. The Rule also does not include an appeal or delisting process, preventing companies from challenging a prejudicial report in the registry. Companies could therefore be less willing to self-report violations or reach settlements with regulators, even on a no-fault basis.

Despite persistent challenges, the CFPB has been emboldened to advance its rulemaking agenda in the wake of a US Supreme Court decision validating its current funding structure. Consumer protection rulemakings, or the CFPB’s defense of them in federal court, are therefore unlikely to abate any time soon.

Not all lawmakers, however, are aligned with the CFPB’s agenda. Efforts are underway to not only overhaul the CFPB’s leadership structure, but funding structure as well, with specific ramifications for the Rule. On June 4, 2024, the House Appropriations Committee released a spending bill that would bring the CFPB under the congressional appropriations process. The bill also has specific sections that would prohibit the CFPB from using any allocated funds for some key recent rulemakings, including the Rule.[3] The bill must now run the gauntlet of congressional review and approval, but if passed, would severely hamper the CFPB’s recent efforts and curtail its reach.

Latham & Watkins will continue to monitor developments in this area.

Endnotes

[1] 1022(c)(7): REGISTRATION. — (A) IN GENERAL. —The Bureau may prescribe rules regarding registration requirements applicable to a covered person, other than an insured depository institution, insured credit union, or related person. (B) REGISTRATION INFORMATION. —Subject to rules prescribed by the Bureau, the Bureau may publicly disclose registration information to facilitate the ability of consumers to identify covered persons that are registered with the Bureau. (C) CONSULTATION WITH STATE AGENCIES. —In developing and implementing registration requirements under this paragraph, the Bureau shall consult with State agencies regarding requirements or systems (including coordinated or combined systems for registration), where appropriate.

[2] According to the CFPB, “registrants with orders published in the NMLS Consumer Access website may use a simplified filing process.”

[3] Section 504: None of the funds made available by this Act may be used to implement or enforce the Consumer Financial Protection Bureau’s rule entitled “Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders”.