The CFPB issued its final rule, titled the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders Final Rule, on June 3, 2024. The rule will require certain nonbank entities to register certain covered enforcement or court orders, and comply with ongoing, attested reporting requirements on the entity’s compliance with such orders. The rule is effective on September 16, 2024, with registrations available beginning on October 16, 2024 pursuant to a tiered implementation approach (discussed further below).

Immediately after announcement of the final rule, the Conference of State Bank Supervisors (CSBS) issued a statement expressing its disappointment with the CFPB’s decision. The CSBS also reinforced the concerns previously expressed by state regulators during the consultation process, and in the CSBS’s comment letter, which it submitted along with the American Association of Residential Mortgage Regulators, the National Association of Consumer Credit Administrators, the North American Collection Agency Regulatory Association, and the Money Transmitter Regulators Association. Those concerns included the impact on small nonbank firms as well as the impact on state supervision and enforcement efforts.

“Covered Nonbank”

The rule applies to any “covered nonbank”, which is defined as a “covered person” under the Dodd-Frank Act, but excluding the following: (1) insured depository institutions or insured credit unions; (2) entities who are “covered persons” solely due to being a “related person” under the Dodd-Frank Act (e.g., controlling shareholders or independent contractors); (3) a State; (4) a natural person; (5) certain motor vehicle dealers; or (6) entities that qualify as “covered persons” solely because of conduct excluded from the CFPB’s rulemaking authority, such as activity related to charitable contributions.

“Covered Orders”

The rule applies to final, written public orders (“order” to include any written order or judgement in an investigation, matter, or proceeding) issued by agencies or courts, whether or not issued as a consent order, that meet the following criteria:

• Identifies a covered nonbank by name as a party subject to the order;
• Was issued at least in part in any action or proceeding brought by any Federal agency, State agency, or local agency;
• Contains public provisions that impose obligations on the covered nonbank to take certain actions or to refrain from taking certain actions;
• Imposes obligations on the covered nonbank based on an alleged violation of a “covered law”, which includes, but is not limited to, Federal consumer financial laws, other laws enforced by the CFPB, and certain unfair, deceptive, or abusive acts or practices laws, rules or orders at both Federal and State levels identified in the final rule; and
• Has an effective date on or after January 1, 2017 (however, note the Registration Information section below with respect to the impact of effective dates on which covered orders must be registered).
  • Note: An order is effective on the date specified in the order. If an order does not have an effective date identified, the date of issuance is the effective date. If the issuing agency or a court stays or otherwise suspends an order’s effectiveness, the order’s effective date for purposes of the final rule is delayed until the stay or suspension is lifted.

Registration Information

Covered nonbanks must register information on covered orders that either: (1) remain in effect as of September 16, 2024, or (2) have an effective date on or after September 16, 2024. The information that must be registered is outlined below.

• Identifying Information – This category will include basic identifying information for the covered entity.
• Administrative Information – This category may include information about the covered entity’s affiliates that are registered with respect to the same order.
• Covered Order Information – This category will include the following at minimum:
  • A pdf upload of the fully executed covered order, with any non-public portions redacted as necessary.
  • The issuing and initiating (if different) agency(ies) or court(s).
  • The effective date of the covered order, and the date of expiration (if any).
  • The covered laws found to have been violated, or for consent orders, those alleged to have been violated.
  • Any docket, case, tracking or other identifying numbers for the order.

Notably, certain aspects of the required information appears subject to change, as the final rule states that it will issue future “filing instructions” to specify the form and manner for electronic filings and submissions.

Annual Written Statement by Attesting Executive

Perhaps the most concerning aspect of the rule for industry is the requirement, applicable only to CFPB-supervised covered nonbanks, to review and submit certain written statement information, on an annual basis, regarding the registered covered orders. In addition, this requirement only applies to covered orders with an effective date on or after the applicable implementation date (as opposed to the broader requirement to register any covered orders that remain in effect through the effective date of the regulation).

Specifically, CFPB-supervised covered nonbanks must provide: (1) the name and title of an attesting executive with respect to each of the registered covered orders; and (2) an annual written statement, signed by the attesting executive, for each registered covered order.

The final rule states that the attesting executive shall be the company’s “highest-ranking duly appointed senior executive officer (or, if the supervised registered entity does not have any duly appointed officers, the highest-ranking individual charged with managerial or oversight responsibility for the supervised registered entity) whose assigned duties include ensuring the supervised registered entity’s compliance with Federal consumer financial law, who has knowledge of the entity’s systems and procedures for achieving compliance with the covered order, and who has control over the entity’s efforts to comply with the covered order.”

As part of the annual written statement, the attesting executive is required to:

• Describe the steps the executive has taken to review and oversee the entity’s activities subject to the order during the preceding calendar year; and
• Attest whether, to the executive’s knowledge, during the preceding calendar year the entity identified any violations or instances of noncompliance with any applicable obligations imposed in the order’s public provisions.

Further, the CFPB-supervised covered nonbanks are required to maintain records sufficient to provide reasonable support for the written statement for 5 years after its submission.

Timing

Again, the final rule is effective on September 16, 2024, and registration can begin at the earliest on October 16, 2024. The rule provides for a tiered implementation of the requirement to initially register a covered order, and then separate timing requirements for ongoing registrations and for the submission of the annual written statements.

Registration of Existing Covered Orders During Implementation Period

For initially registering an existing covered order, the covered nonbank must register the order within the later of (1) the end of the applicable implementation submission period, or (2) 90 days after the effective date of the covered order.

The implementation submission periods are outlined in the following table below, which are based on the 90-day periods following the “implementation dates” defined in the final rule:

During these implementation submission periods, entities must register covered orders that:

• Have an effective date from January 1, 2017 through the start of the covered nonbank’s submission period; and
• For covered orders issued prior to September 16, 2024, the covered order remains effective as of September 16, 2024.

The CFPB’s Executive Summary includes the following examples for illustration of the timing requirements:

“Assume an Other CFPB-Supervised Covered Nonbank has the following orders (that otherwise meet the definition of a covered order): 1) an order that took effect on January 1, 2016, and that expires on January 1, 2026, 2) an order that took effect on January 1, 2017, and that expires on October 30, 2025, and 3) an order that becomes effective on January 1, 2025, and that expires on January 1, 2031. During the applicable implementation submission period, the Other CFPB-Supervised Covered Nonbank:

• Would not register the first order (effective January 1, 2016) because it took effect before January 1, 2017.
• Must register the second order (effective January 1, 2017) because it took effect on or after January 1, 2017 (and prior to the start of the applicable submission period) and remained in effect as of September 16, 2024.
• Must register the third order (effective January 1, 2025) because it took effect on or after September 16, 2024, and prior to the start of the applicable submission period.”

Ongoing Registration Timing for New Orders

After the start of the entity’s implementation submission period, covered nonbanks must comply with ongoing requirements to register new covered orders and submit updates to existing covered orders. The following timing requirements apply:

Written Statement Submission

The written statements required from the attesting executive must be filed annually, on or before March 31^st of each year, and cover any orders registered during, or prior to, the preceding calendar year. Again, unlike the broader requirement to register consent orders that remain in effect as of the effective date of the final rule (September 16, 2024), the annual written statement requirement only applies to covered orders with an effective date on or after the applicable implementation date.

In light of the tiered implementation approach, the following notable time frames will apply to the different categories of covered nonbanks:

• For Larger Participant CFPB-Supervised Covered Nonbanks that register by December 31, 2024, the first written statement submission is required by March 31, 2025. That submission will cover registered covered orders with an effective date from October 16, 2024, to December 31, 2024.
• For Other CFPB-Supervised Covered Nonbanks, the first written statement submission is required on March 31, 2026, and will cover registered covered orders with an effective date on or after the beginning of their implementation submission period of January 14, 2025 to December 31, 2025.

The CFPB’s Executive Summary also provides the following notable example to illustrate the timing requirements, in light of the registration date:

“If on or before December 31, 2026, a CFPB-supervised covered nonbank has three previously registered applicable orders (first registered prior to January 1, 2026) and two new orders (effective between January 1, 2026, and December 31, 2026, and registered, or required to be registered, by March 31, 2027), the covered nonbank would file written statements for each of those five orders on or before March 31, 2027. However, if a CFPB-supervised covered nonbank timely registers its first covered order between January 1, 2027, and March 31, 2027, and thus did not qualify as a supervised registered entity at any point during 2026, it does not need to file a written statement until March 31, 2028.”

End of Registration Requirements

The ongoing registration requirements apply to a covered order until it is deemed to expire under the final rule, or until all relevant provisions are fully terminated. As examples, a covered order may be terminated by an agency or court, or may terminate under its own terms on a date provided for in the covered order.

If the covered order does not expressly provide for a termination date, and is not terminated earlier, it is deemed to expire 10 years after its effective date pursuant to the final rule (apparently, regardless of any state law that might provide for an earlier termination date). However, if the order expressly provides for a termination date that is longer than 10 years, the order is not deemed to expire until the expressly provided termination date.

The final rule also requires notice to the CFPB within 90 days of the date of any modification, termination, or abrogation of the order. If either expiration or termination occurs, or the order is modified such that it is no longer a covered order, then after a covered nonbank files a final notice with the CFPB, the covered nonbank is relieved of further registration obligations with respect to that order.

Optional Alternative Registration for NMLS-Published Covered Orders

In recognition of the overlapping enforcement action publication function of the Nationwide Multistate Licensing System (NMLS), the final rule provides a one-time, alternative registration option for a covered order. This option is only available if the order is published on the NMLS and was not issued by the CFPB (either in whole or in part). If this option is elected, the covered nonbank must still file certain limited information on the CFPB registry (the nature of which is still to be determined), but is not required to register any changes to the covered order, or to file the annual written statements with respect to the order.

We note that this alternative option was not included in the CFPB’s proposed rule. Accordingly, it appears to be a limited concession to the concerns voiced during the comment period about the redundancy of the NMLS enforcement action publication function and the CFPB’s registry.

Published Information

The final rule states that the CFPB may publish certain information about registered covered orders on its website, but that the annual written statement submitted by the covered nonbank will be treated as confidential supervisory information.

Outlook

Industry will be rightfully concerned about this latest initiative of the CFPB. In particular, the annual written statement requirements will likely create untenable dilemmas for compliance personnel engaged in routine compliance management functions, against the backdrop of frequently vague and overbroad enforcement action terms. There is also the clear issue of the CFPB encroaching on the purview of its fellow regulators, which has been repeatedly voiced by those very regulators.

We think it is likely that this rule will be challenged in court, and we note the scant support for this initiative in the language of the Dodd-Frank Act. Specifically, the registration provision found in Section 1022(c)(7) of Dodd-Frank merely authorizes the following:

“The Bureau may prescribe rules regarding registration requirements applicable to a covered person, other than an insured depository institution, insured credit union, or related person.”

We further note that Section 1022(c)(7) requires that the CFPB consult with state agencies for any such registration system, stating:

“In developing and implementing registration requirements under this paragraph, the Bureau shall consult with State agencies regarding requirements or systems (including coordinated or combined systems for registration), where appropriate.”

[View source.]