On June 3, 2024, the Consumer Financial Protection Bureau imposed a new set of regulatory obligations on nondepository consumer-financial companies that are currently subject to a court or administrative order enforcing a host of federal or state consumer-protection laws. The Bureau’s new rule creates a public registry of such orders dating back to January 1, 2017. It requires covered entities to submit the orders and information about them to populate the registry. And it requires covered entities subject to CFPB supervision to also file annual statements about their ongoing compliance with these orders and to self-report any violations or noncompliance that the supervised entity identified during the prior year. The rule marks a new assertion of regulatory oversight by the CFPB with consequential implications, creating increased risks of investigation and enforcement by the Bureau and other regulators and the potential for increased public scrutiny. For supervised nonbanks, the rule may also increase the risk of examination by CFPB officials based on the nonbanks’ annual statements.

The final rule, entitled “Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders,” goes into effect on September 16, 2024. According to the Bureau, the registry will allow the CFPB, other regulators, and the public to monitor entities that have violated or allegedly have violated consumer-protection laws. Below is an overview of the rule’s core components:

• Who Is Covered: The rule applies to most nonbank “covered persons,” as defined by the Consumer Financial Protection Act—i.e., entities that offer a consumer-financial product or service and are subject to regulation by the CFPB. The rule does not apply to insured depository institutions and insured credit unions, “related persons,” certain motor-vehicle carriers, natural persons, states (including federally recognized Indian tribes), and entities that are a covered person solely due to conduct outside the CFPB’s rulemaking authority.

• Which Orders Are Covered: To fall within the rule, an order must be final and issued publicly in an action or proceeding brought by a federal, state, or local agency. The final rule thus does not apply to orders entered in litigation among private parties. The order must also identify by name the nonbank subject to the order, and it must require that nonbank to take or stop certain actions based on violations or alleged violations of a covered consumer-protection law—including, for example, the CFPA, TILA, EFTA, § 5 of the FTC Act, and state laws prohibiting unfair and deceptive trade practices. Finally, the order must have gone into effect no earlier than January 1, 2017, and must still be in effect on September 16, 2024.

• Filing Requirements:  Covered entities must file the order and related information in the registry. While the CFPB has not yet published instructions on exactly how and what to file, the final rule outlines the expected filing’s contents. The filing will include identifying and administrative information about the nonbank. It will also include a copy of the order; the name of the agency or agencies that obtained the order; if a court issued the order, the name of the court; the order’s effective date; the order’s expiration date (if any); and the covered laws at issue in the order. Covered entities must make their initial filings during the applicable implementation period, discussed below. After that, filings are due 90 days after the effective date of the covered order. Similarly, when a covered order is amended, the corresponding filing in the registry must also be revised within 90 days.

• Additional Obligations on Supervised Nonbanks: Nonbanks subject to CFPB supervision must comply with additional filing and record-keeping requirements.  For each covered order, the supervised nonbank must designate an executive to complete reporting requirements for that order. That executive must file an annual confidential statement about oversight of activities subject to the covered order and compliance with the order’s requirements. The supervised nonbank must keep records to support the written statement for five years after submitting it.

• Implementation Period: The Bureau is implementing the new rule in stages, beginning with supervised larger participants in a market defined by CFPB regulations, then supervised nonbanks that are not larger participants, and finally all other covered nonbanks. Unless the final rule’s effective date is delayed, the initial registration period for supervised larger participants will begin October 16, 2024, and run through January 14, 2025. The initial period for other supervised nonbanks is January 14, 2025, through April 14, 2025. Finally, all other covered entities must submit their initial filings from April 14, 2025, through July 14, 2025. After the implementation periods end, nonbanks must continue to meet the rule’s filing requirements on an ongoing basis for any new covered orders or amendments to prior registrations.

• Limitation on Reporting: Nonbanks must comply with any ongoing reporting requirements until the order is no longer covered by the rule. That occurs when the order is terminated, modified, or abrogated by an agency or court or the order terminates by its own terms. A covered order without a termination date and that does not terminate earlier for some other reason expires, for purposes of the final rule, 10 years after the order takes effect. A nonbank must submit a revised filing to the registry within 90 days of the modification, termination, abrogation, or expiration of a covered order. Once an order is no longer covered, the nonbank no longer has ongoing reporting obligations for that order.

• Publication: The final rule allows the Bureau to publish information on its website about covered nonbanks and covered orders, including summaries of information submitted to the registry.

Nonbanks should carefully consider their reporting obligations. Failure to comply with the rule would likely be considered a violation of the CFPA, which could subject the company to a penalty. Additionally, nonbanks and especially supervised nonbanks should consider whether their reporting obligations increase their exposure to investigation, enforcement, examination, or litigation.

The Bureau’s rule is likely to have negative real-world consequences for both government agencies and the companies that they regulate. Most government settlements allow companies to neither admit nor deny the facts alleged. In the past, companies were willing to settle on these terms. But because the Bureau’s rule applies even to orders that merely allege violations, companies might be more reluctant to settle, even if they may do so without admitting liability. This could impose significant burdens on not only the CFPB, but also the FTC, state attorneys general, and other regulators, who depend on being able to settle most of their enforcement actions. Further, because the new rule imposes additional burdens on CFPB-supervised entities, companies might be more willing to fight being designated a larger participant in a particular market or a company that “poses risks” to consumers, either of which would subject them to the Bureau’s supervisory authority and the extra obligations imposed by the new rule.