The CFPB's Fintech Power Grab

Federal and state banking regulators have been fighting for years over who has the right to regulate fintechs. The center of this battle has been a series of lawsuits brought against the Office of the Comptroller of the Currency (OCC) by various state banking regulators, including the New York Department of Financial Services. These actions were initiated to prevent the OCC from issuing special purpose national bank charters to non-depository fintech companies and to uninsured deposit-taking fintechs, which would enable the OCC to supervise these fintechs.

After sitting on the sidelines silently watching this battle for five years, the Consumer Financial Protection Bureau (CFPB) announced this April that it intends to begin using a "dormant" authority to conduct regulatory examinations of nonbank financial companies when they pose risks to consumers. This has created further confusion among fintechs over who will be supervising them.

CFPB's Past Exercise of Supervisory Authority

Before Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 in response to the 2008 financial crisis, only banks and credit unions were subject to federal supervision. The Dodd-Frank Act changed this by authorizing the CFPB to supervise larger participants in nonbank markets for certain consumer financial products and services, such as consumer reporting, debt collection, student loan servicing, international remittances, and auto loan servicing. It also authorized the CFPB to supervise all nonbank entities in the mortgage, private student loan, and payday loan industries, regardless of size.

The CFPB conducted rulemakings and began supervising these nonbanks in the decade after Dodd-Frank was enacted. This supervision included examinations, but the CFPB's supervisory activity was limited to the products and services identified in the Dodd-Frank Act.

CFPB's April 2022 Announcement

In April of this year, over a decade after Dodd-Frank was enacted, the CFPB announced that it is going to use a "dormant" power granted to the CFPB by the Dodd-Frank Act to begin conducting examinations of nonbanks without regard to the particular financial product or service offered. As described by the CFPB, this power is limited only by whether the CFPB has reasonable cause to determine the nonbank "poses risks to consumers."

The CFPB justified its decision to begin using this power by noting that it would allow the CFPB "to be agile and supervise entities that may be fast-growing or are in markets outside the existing nonbank supervision program." The CFPB did not explain how using this power would make it more agile. However, there is one way in which the CFPB's position seems intended to allow it to move quickly: by supervising a swath of nonbank financial services companies without getting any additional authorization from Congress to do so.

CFPB's Broad Assertion of Power

What makes the CFPB's announcement particularly striking is that many of the products and services that appear to fall within the purview of this new exercise of power did not exist, or existed in very different form, when Congress enacted the Dodd-Frank Act. One obvious example is cryptocurrency products, which Congress clearly was not contemplating when it voted on the Dodd-Frank Act. The CFPB's announcement came one month after President Biden issued an Executive Order calling for a whole-of-government effort to develop a digital asset framework, and it may be a preemptive move to stake out the CFPB's role in that framework. Other examples of products and services that could cause companies to be swept into the CFPB's new assertion of power include "buy now, pay later" (BNPL), peer-to-peer payments, and earned wage access.

Constraints on the CFPB's Power?

The CFPB's ability to examine fintechs is limited to companies that the CFPB has reasonable cause to determine did or will engage in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services. There are four key reasons, however, for thinking that these vague provisions may be a limited constraint on the CFPB's power:

(1) The CFPB receives a massive volume of consumer complaints that it can use as a basis for asserting the there is "reasonable cause" to determine that a company targeted in a complaint put consumers at risk. According to the CFPB, in 2021 alone it referred over 750,000 complaints that it received from consumers to approximately 3,400 companies for review and response. Many of the complaints sent to the CFPB appear to relate to fintechs. For example, the CFPB received approximately 20,900 money transfer, money service, and virtual currency complaints in 2021, of which 67% were sent to companies for review and response, 24% referred to other regulatory agencies, and only 8% found to be not actionable.

(2) The CFPB has intentionally avoided limiting the potential scope of its authority by providing definitions of "risks to consumers" or "reasonable cause," as these phrases are used in the rule it promulgated. During the rulemaking process in 2013, multiple commentators pointed out that failing to define these phrases would leave the rule ambiguous and asked the CFPB to provide clarification. The CFPB refused to do so. This may make it difficult for fintechs to refute an assertion by the CFPB that conduct described in a consumer complaint filed with the CFPB does not put consumers at risk of harm or is insufficient to meet the "reasonable cause" standard.

(3) The CFPB does the adjudicating. A nonbank company is given notice and an opportunity to dispute the CFPB's assertion of a right to examine the company. This may be a meaningful process, and only time will tell how the CFPB treats such disputes. As an external constraint on the CFPB's power, however, this process is of limited value given that the disputes are decided by the CFPB itself.

(4) The CFPB refused to make the process for disputing a determination of the CFPB's authority to examine a nonbank comply with the rules for a formal adjudication under the Administrative Procedure Act. In response to the comment that a "reasonable opportunity to respond" should include a hearing on the record, the CFPB asserted that it was using its discretion not to do so.

Despite these hurdles, it is expected that fintechs will challenge the agency's determinations, authority, and (as discussed below) its very constitutionality. While fintechs may seek to "short-circuit" the CFPB's contemplated administrative process by seeking a court declaration that the agency is unconstitutional, they should also be aware that the Administrative Procedure Act normally requires that an agency's administrative process be exhausted and that a "final agency action" be reached before an aggrieved party turns to court.

The CFPB's Long Game

At this point, it is difficult to know how aggressively the CFPB will use its power to examine nonbank fintechs such as cryptocurrency and BNPL service and product providers. Just because the CFPB's power appears to have limited external constraints does not mean that the CFPB will exercise its discretion to maximize its supervisory authority. There are, however, two main reasons to suspect that the CFPB will be seeking to expand its regulatory purview:

(1) CFPB Director Rohit Chopra stated after the April announcement that the CFPB believes that it has other "dormant" powers that it is considering using. In a blog post on June 17, 2022, he gave as one example the unused "authority to register certain nonbank financial companies to identify potential scammers and others that repeatedly violate the law." Requiring such registrations would further expand the scope of the CFPB's regulatory authority over fintechs.

(2) The CFPB has a practical ability to increase its supervisory activities, that is unusual for a federal agency. As U.S. Circuit Judge Edith H. Jones observed in a decision earlier this year, the CFPB's funding structure is removed from congressional review by permitting the CFPB to take money from the Federal Reserve to fund itself outside the Congressional appropriations process. Judge Jones—joined by Circuit Judges Jennifer Walker Elrod, Stuart Kyle Duncan, Kurt D. Engelhardt, and Andrew S. Oldham—said in that decision that this funding mechanism was unconstitutional. This opinion was a concurrence in the Fifth Circuit's en banc ruling and does not definitively resolve the issue of whether the CFPB is unconstitutional. It does, however, underscore the power this unique funding mechanism gives the CFPB has to enhance its own authority.

Regardless of the CFPB's intentions, it still is too early to know how the CFPB's effort to examine nonbank fintechs will play out. After all, the OCC clearly announced its intentions to begin issuing special purpose national bank charters to nondepository fintechs six years ago, and it still is unclear whether this will happen. One thing that is clear, however, is that the ongoing ambiguity and regulatory infighting is imposing unnecessary costs on U.S. fintechs and their customers. When fintechs do not know who will be regulating them or how the regulations will be applied, it makes it difficult to move forward with the development of innovative new products that consumers want. For this reason, battles for power among U.S. regulators often harm the very consumers in whose name they are fought.