Troutman Pepper Partners Kim Phan and James Kim discuss the firm's expanded capabilities in the fintech world, recent compliance issues for fintech companies, the CFPB's dormant authority to supervise certain nonbank entities and its potential impact on fintech companies, as well as the CFPB's trend to name individuals in enforcement actions.
Please join Troutman Pepper Partners Kim Phan and James Kim as they discuss the firm's expanded capabilities in the fintech world, recent compliance issues for fintech companies, the CFPB's dormant authority to supervise certain nonbank entities and its potential impact on fintech companies, as well as the CFPB's trend to name individuals in enforcement actions.
Kim Phan, a partner in the firm's Privacy + Cybersecurity Practice Group, counsels fintech companies in federal and state privacy and data security statutes and regulations throughout product development, marketing, and implementation. Kim ranks high in Chambers and The Legal 500 for her privacy and data security work with fintech companies. As a partner in the Consumer Financial Services Practice Group, James Kim leverages his experience as a former CFPB senior enforcement attorney to provide the industry knowledge and expertise that fintechs and financial institutions require when launching new products or facing regulatory scrutiny. Chambers ranks James highly for his work in fintech and consumer finance enforcement and investigations.
Troutman Pepper’s Fintech Capabilities and Trending Issues Impacting Fintech Companies
Date Aired: 6/30/2022
[KIM PHAN]
Welcome to the Consumer Finance Podcast. Today I’ll be filling for your usual host, Chris Willis, the co-practice leader of Troutman Pepper’s Consumer Financial Services Regulatory Group. My name is Kim Phan and I’m also a partner in Troutman Pepper’s CFS Regulatory Group, as well as our Cybersecurity, Information Governance and Privacy Group.
For today’s podcast, we are joined by James Kim to discuss issues related to fintech. But before we jump into our interview for today, I want to remind you about our great blog ConsumerFinancialServicesLawMonitor.com where you can see all kinds of news and developments about everything affecting consumer finance. And if you like our podcast, please leave us a review on your podcast platform of choice. We’re available on all the major ones. Just hit that review button and tell us what you think.
So, James, you and I and a number of other CFS folks recently joined the firm. What have you learned so far about Troutman’s fintech capabilities, and specifically, what are you bringing to the table that some of our Troutman clients might be interested in?
[JAMES KIM]
Thanks Kim. I’m very happy to join you today for today’s podcast. My practice and what I do is the same, I’m happy to continue it here at Troutman with my current colleagues and partners. What’s exciting I think is all of the kind of new capabilities and a stronger platform that Troutman brings to the fintech practice. We have a really deep corporate bench to do everything that a client would need. I think full service is really something that’s very exciting on the corporate front. IP, copyright, trademark is an important need area for a lot for fintech clients. Protecting a lot of their trade secrets as well as intellectual property. And then I think your area, privacy, data security, your joining, and I’d love to hear your thoughts about it, what is a very deep and strong and well-rounded team here. I’m exciting to kind of contribute and be part of this great team that focuses on fintech, consumer financial services, to be able to better service our clients.
[KIM PHAN]
Yep. Personally, I love the fact that the fintech capabilities that we now have at Troutman are really soup to nuts from the beginning to the end of a fintech’s lifecycle. When they’re just emerging as new fintech companies throughout their funding series, throughout internal setup of policies and procedures and compliance programs, to regulatory engagement and litigation. We really like have it all, as a one-stop shop for fintech companies. But let me ask you, fintech is really a shorthand for financial technology, and I know that it comes as quite a few different types of entities—payment processors, normal marketplace lenders, money transmitters. Who, in your mind, amongst the world of fintechs, make the most sense to engage Troutman and our services?
[JAMES KIM]
You are correct that fintech is extremely broad, right, because it’s the intersection of technology and financial services, and nowadays everybody to varying degrees is going to use, or wants to use, technology to better offer and deliver its products to its customers. So, I think the focus is really in our strength which is consumer or retail banking and financial services and the ecosystem around it, right? So, the companies that are actually touching the consumers, and all of their business partners, service providers, the banks that support them, so it’s that ecosystem that focuses on what I would say are consumer retail products, is really our core strength.
[KIM PHAN]
You mention that ecosystem, and one of the areas that’s more in my world, the privacy and data security world, is the reality that in that ecosystem, there’s lots of different parties involved in any one particular consumer transaction. And you may be aware that there is this emerging patchwork of state privacy laws. So far, we’ve got California, Virginia, Colorado, Utah and most recently, Connecticut, who the governor signed into law, their privacy law, just yesterday. So, it is a challenging environment for I think fintechs who are just trying to get their feet under them to comply with the basics of regulatory requirements, and then you add this on top of it, and the sensitivity that has to be treated toward personal information. Do you tend to find that fintech companies have internal capabilities that are well built out for their legal compliance functions, or is it something that they’re often looking to outside counsel to advise?
[JAMES KIM]
I think it varies, but with earlier stage companies, it’s I think rare for them to have that capability in-house. And I think in certain instances, those are not issues that they’re particularly sensitive to, understandably, right? I mean the founders are trying to get a business off the ground. They’re trying to acquire customers and scale the business and meet a lot of the targets and milestones set by their venture capital backers. I think compliance is something that they’re aware of, but it’s probably not top of mind and certainly should not be a blocker or create undue friction for them to grow their business. It is important to incorporate some, I think, selective or prioritize compliance with regulatory concepts and issues from the beginning so that you build it the right way. I’ve had fintech clients get off the ground and be successful and grow for a couple of years. They reach an inflection point where they’re trying to partner with a bank or raise capital with more sophisticated institutional investors that have greater sensitivity to compliance issues. When they go through that diligence process, either with a counterparty and traditional financial institution or more sophisticated institutional investors, the question is harder and there’ll be often regulatory issues become more prominent and so I’ve seen fintech clients kind of have to backfill on those issues. And to a certain extent that might be just unavoidable and that’s just kind of the path to growth. But I think there are ways to minimize that or be strategic early on to incorporate, like I said, certain select compliance regulatory issues, not all, to make it not only more painless down the road, but to help from a business perspective, like a better valuation, get better pricing on debt, whatever the business terms are that you’re negotiating with your counterparty or your investors.
[KIM PHAN]
Yeah, it is a complex regulatory compliance environment that fintechs live in. And, in addition to state laws and regulations, we of course have to consider the federal, including and especially, the CFPB, the Consumer Financial Protection Bureau. And my understanding is that the CFPB is, and has, announced that they’re going to be bringing to the forefront what they characterize as a dormant authority to supervise certain non-bank entities. Can you tell us more about that development and how it might impact fintech companies?
[JAMES KIM]
This is, I think, a very important recent announcement from the CFPB that appears by all indications to be focused specifically on fintechs. And let me explain why. So, before I do that, let’s take a step back here, right? The backdrop is the CFPB has a new director, Rohit Chopra. Mr. Chopra before he was or is the current director of the CFPB, he was a commissioner of the Federal Trade Commission, and he has a pretty substantive public record at the FTC, on focusing on technology companies. So, you can, everybody can look it up. He has a track record of making comments that are often critical of large technology companies. And I think he carries that with him here at the CFPB, right? So, I think he feels that fintechs at technology companies have been largely unregulated or under regulated, and so he’s trying to address those gaps, and this is one of the important moves. What is this move? So, let’s start with the legal fundamentals. Under Title X of Dodd Frank, which is the statute that created the CFPB and gives it its powers, in Section 1024, the statute lays out the grounds or the areas in which the CFPB can supervise non-banks. Right? So, this is a different section and statute that talks about the CFPB supervision of banks or depository institutions. And that one’s pretty straight forward. Banks that are over $10 billion in assets. For non-banks, supervision by the CFPB falls into a few categories.
One is you offer a product that automatically gives the CFPB supervisory authority over you. And what are those products? Where if you offer or originate them, you are automatically under the CFPB supervisory authority. Those are mortgages, private student loans and small dollar or payday loans. So, kind of category one is you offer one of these special, what Congress deemed to be kind of special products that require heightened immediate scrutiny.
The second bucket is you’re a larger market participant. So, if you’re offering a product other than those three, the CFPB must engage in public rulemaking to define larger market participant for a particular market. So, the rules have to define both the market and what the threshold is for being a larger market participant. Auto finance is one. Student loan servicing is another. Right? And so, there are final rules in place that define those markets and define whether you’re a larger market participant or not, and if you are a larger market participant, the CFPB has authority to supervise—meaning conduct examinations.
The third category is this dormant authority that Mr. Chopra is now – very publicly, very directly, warning companies, specifically fintechs, that he’s going to exercise, and that is, I call it a catch-all. It’s this kind of catch-all backstop for the bureau. It’s any other company that doesn’t fall under one of the existing or other supervisory buckets, that engages in or has engaged in, right, so past or present tense, conduct that poses risk to consumers. Now if that sounds subjective and unclear to you, I think that’s intentional, right? It’s meant to give the CFPB wide discretion to choose whether or not to assert this catchall supervisory authority. Now there is a procedural process that they have to follow. It’s not a rule making process, it’s something much shorter where they give notice to a company that they intend to assert this catch-all supervisory authority and you get to respond to it before the bureau makes its decision. So, there is a little bit of procedural due process, I’d say very limited, and ultimately the decision lies with the director, but it’s this catch-all authority. So, anybody else that doesn’t already fall under supervisory authority that engages in conduct that poses risk.
And it’s clear that fintechs are the focus of this. One, fintechs are mentioned in the press release. But two, fintechs have grown so much in the past several years that the regulators are just behind. They don’t have the time or the inclination to engage in public rule making which takes years to regulate and supervise a lot of these fast moving, emerging companies. So, I think the CFPB needs to kind of dust off this regulatory tool that it didn’t use very much in the past. So, I think, I’ll pause there, but that’s the headline and I’ll comment about some of the particulars about it in a little bit. But I just wanted to see if you had any thoughts or reactions to that supervisory kind of authority being exercised I think, in the near future.
[KIM PHAN]
Well, it certainly sounds like a very amorphous, booming threat against our listeners and reinforces the reality that the CFPB can pretty much do whatever they want. If they want to come for you, they’ll find a way. So that sounds like essentially what Chopra is saying here with this announcement. But I wanted to turn next to a CFPB risk that has not been formally announced, but I think it has been seen trending in CFPB enforcement actions. It’s the new risk and reality that the CFPB is increasingly pursuing individual liability in enforcement cases. Do you want to elaborate a little bit on that?
[JAMES KIM]
Yeah, so there’s no announcement here, but it’s a clear trend. So, we track consent orders and other enforcement actions over years since the inception of the bureau, certainly since when I was at the bureau and since I left, because it’s part of my practice. And we saw years ago under the first appointed director, Richard Cordray, that the CFPB used its authority to take enforcement action against individuals, and I’ll talk about the legal authority in a second. And the CFPB named individuals as well as the company in lawsuits and enforcement actions in consent orders and enforcement actions. That practice kind of fell by the wayside when the Republicans had leadership of the bureau. And now that Mr. Chopra is the director, it has picked up again, and again, no announcement, but the pattern is clear. I’d say the vast majority of consent orders that have come out or lawsuits that have come out under Mr. Chopra, you know he’s still within his first year or so, often name an individual as well as the company and in some cases multiple individuals. So, I think that’s the pattern that everyone needs to be aware of.
Let me explain the legal basis for the CFPB’s return to naming individuals in lawsuits and consent orders so that everyone understands where the authority comes from. In Title X of Dodd-Frank there’s a definition of related person, and in the statute the CFPB has the same authority over the related persons as they do covered persons. So, any company that offers a consumer financial product or service is a covered person. And then any related person to that covered person is equally subject to the CFPB’s authorities, including its enforcement authorities. I think the key part of the definition and I’m not going to read the whole thing, but I think the key part is related person includes any director, officer or employee charged with managerial responsibility, or a controlling shareholder. It’s interesting, the statute does not require that person to engage in any particular conduct. I think just by your role, you are a related person, and you can be named in a lawsuit or consent order. So that’s the legal basis. I think the important point for the audience is why. What is the purpose of the CFPB in naming individuals in lawsuits and consent orders. And I think the answer is – if we go back to critics, consumer advocates and certain lawmakers after the financial crisis in 2008, the criticism, or I think the cry at that point was hey, people caused the problem—not companies. It’s people making decisions at the companies. We need to hold individuals accountable. And so, I think Mr. Chopra believes that. He is ideologically and personally aligned and close with Elizabeth Warren, and that’s been a talking point of Senator Warren’s for a long time. And so, I think Mr. Chopra believes that. And I think he believes that to have a true deterrent effect, he needs to name individuals. Otherwise, companies will make these cold, calculated decisions to assume certain risks and potentially harm consumers because it’s just the cost of doing business.
[KIM PHAN]
Well James, thanks so much for being on the podcast today and for sharing your insights on the always evolving regulatory landscape for the fintech industry. We hope you return soon to discuss, in depth, some of the regulatory issues that were only hinted at during this very first of our fintech podcasts. And with that, I’d like to thank our audience for tuning in today. Be sure to subscribe to the podcast so you’ll get our episodes every Thursday when they come out. And don’t forget, we have lots and lots of other content in our blog, ConsumerFinancialServicesLawMonitor.com, or you can sign up to our email list at troutman.com, so that you can get copies of our webinar invitations, our client alerts, and other information about notable events happening in the consumer financial services world. And with that, I thank you and goodbye.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.