In this episode of The Consumer Finance Podcast, Chris Willis and Jesse Silverman delve into the recent activities of the Consumer Financial Protection Bureau (CFPB) that pose significant risks to retailers and merchants.
In this episode of The Consumer Finance Podcast, Chris Willis and Jesse Silverman delve into the recent activities of the Consumer Financial Protection Bureau (CFPB) that pose significant risks to retailers and merchants. They discuss various proposed rules, including those related to buy now, pay later, open banking, data brokers, and digital wallets, and how these could impact businesses that utilize consumer payment data. The conversation also covers the potential implications of becoming subject to CFPB supervision, including the rigorous compliance expectations and the extensive examination process. Jesse and Chris emphasize the importance of retailers and merchants getting educated on these developments and considering proactive steps to mitigate risks.
Consumer Finance Podcast: Why Retailers and Merchants Should Pay Attention to the CFPB
Host: Chris Willis
Guests: Jesse Silverman
Date Aired: September 12, 2024
Chris Willis: Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper's Consumer Financial Services Regulatory Practice. Today,
Jesse Silverman and I are going to talk about why retailers and merchants should care about what the CFPB is doing.
Before Jesse and I get into that, let me remind you to visit and subscribe to our blogs, troutmanpepperfinancialservices.com and consumerfinancialserviceslawmonitor.com. Don't forget about our other podcasts. We have the FCRA Focus all about credit reporting. We have Unauthorized Access, which is our privacy and data security podcast. We have Payments Pros, which is all about the payments industry; The Crypto Exchange all about crypto; and our newest podcast, Moving the Metal, which is all about the auto finance industry. All those podcasts are available on all popular podcast platforms.
If you like this podcast, let us know. Leave us a review on your podcast platform of choice, and let us know how we're doing. If you enjoy reading our blogs and listening to our podcast, the best way to do it is through our handy mobile app. It's available for both iOS and Android. Just head to your App Store and type in Troutman Pepper and give it a try.
Now, as I said, today I'm joined by my colleague Jesse Silverman, who's been on the podcast before. We're going to be talking about some recent activities of the CFPB that pose a fair amount of danger to merchants and retailers. Jesse, welcome to the podcast, and thanks for coming on to talk about this with me.
Jesse Silverman: Thanks for having me, Chris. It's always a pleasure.
Chris Willis: I think by way of historical introduction, we might say, well, merchants and retailers might not be thinking much about the CFPB. But there's been plenty of times in the Bureau's history when somebody got surprised by the CFPB's exercise of jurisdiction in an unexpected way. Mobile telephone companies were one example that I remember quite vividly.
Jesse Silverman: I think that that's right, and I think everyone is surprised until they're no longer surprised. Quite honestly, I think at this point, those of us in the industry, as a former CFPB enforcement attorney myself, I've learned long enough ago to never be surprised.
Chris Willis: Yes, exactly.
Jesse Silverman: Here, I just want to add one important point as we'll go through. The retailers should not be surprised because the director's general counsel of the CFPB, they're very clear on what they want to happen. They are not hiding the ball on this, as we'll go into, so retailers should be prepared.
Chris Willis: Yes. Let's get into that because the CFPB is, as you noted, quite publicly cooking something up for retailers and merchants. Let's just go ahead and get into that. What are the things that the CFPB is up to that should cause retailers and merchants to stand up and pay attention?
Jesse Silverman: Right now, there's several different rules that are being proposed. Some of which directly impact merchants and retailers and others just hint at a broader strategy of the CFPB that those merchants, retailers will care about. Over the last several months, year, it starts with buy now, pay later. Comments were due in, I believe, August 1st. Basically, in short, the CFPB was applying credit card rules to buy now, pay later.
We can – lots of other people have discussed the challenges of just turning a pay in for product into a credit card, most notably that there's no access device. But we could certainly talk about that another time. But it increases the requirements on those buy now, pay later offers. Some of those may well be retailers offering those types of products historically not believing that that was credit and not treating it as such. This is now something that retailers may very well have to care about.
There's open banking rules, what people know as the 1033 rule. The rule, it outlined the qualifications to become recognized industry standard setting. I mean, in general, the rule states that consumers are the owners of their financial data and requires data providers, mostly financial institutions, to establish electronic facilities for the transfer of the customer data. Again, it's colloquially known as the open banking.
Again, as a philosophical matter, consumers having control of their data is certainly a positive trend. However, as you're going to see, really at the end of the day, this comes down to data, data control and data usage. That is going to be the theme that is running throughout, and so I’m just going to flag it right now at the top of the episode. If you're a retailer who leverages their own internal payments data and maybe you leverage your own internal payments data to build products, to improve services, to target customers, your own customers with advertising, the CFPB is very clear that those are activities that they would like to constrain.
I'll add on the additional AI. If you're using that data to train your AI or to train AI, the CFPB is coming for you. Again, I didn't want to bury the lead there. Then there's the data broker rule. CFPB will be issuing proposed rules under the Fair Credit Reporting Act to address business practices used by companies that assemble and monetize data. It's going to ensure companies, including data brokers, comply with The Fair Credit Reporting Act.
I haven't seen the rule. It's still being proposed. But if you're monetizing that consumer data, it's very likely that you're going to fall into this data broker rule. Certainly, if you're selling that data to anyone, again, for targeted advertising, to train AI, right? Again, I'm going to highlight that one again. To sharpen your chatbots, to sharpen other people's chatbots. You're very likely to come under the requirement.
Then there's the LPR, the larger participants of a market for general use digital consumer payment applications which, of course, rolls right off the tongue. Another way to think about that one is digital wallets. If you are creating, using, leveraging digital wallets, you're going to be covered under this proposed rule. You're going to be covered by the CFPB. There are some exclusions in there, especially if you're only using it for your own customers. This is not a the world is ending. Again, all of these highlight that the CFPB is encroaching very much so on merchants and retailers.
Chris Willis: Certainly, all those things pose a threat to retailers and merchants. But some of them might be sort of lulled into an action thinking that retailers and merchants have an exemption from CFPB's authority, as well as their view that they don't offer or provide a financial product or service. They'd be thinking, “First of all, I don't have a financial product or service, so I'm not subject to the Bureau's jurisdiction. And on top of that, isn't there a merchant exception in Dodd-Frank?” Can you talk about that for a second, Jesse?
Jesse Silverman: Sure, absolutely. Frankly, I think that's what many of them are thinking right now. There's a couple of different ways to run into trouble there as a merchant, as a retailer. One, you could become a service provider to a covered person. Meaning, let's say if you're a retailer, you're partnered with a financial institution. You could be considered a service provider to that financial institution.
Again, this is another one of those situations where Rohit Chopra, the Director of the CFPB, has been pretty clear on his intent to leverage that particular provision to expand the scope of the CFPB. He said they're going to use appropriate authorities to conduct supervisory examinations of non-banks operating consumer payment platforms. Again, these non-banks operating consumer payment platforms, it could be any of the large digital wallets like the ones that you have on your phone. That is one potential path in, and many of those are, in fact, retailers who have their own wallet. They are not financial institutions themselves.
Then the other issue is that Seth Frotman the General Counsel of the CFPB, has been cleared. There are two broad exemptions within Dodd-Frank very specifically for retailers. However, as Seth Frotman, the GC, has pointed out, those exemptions are solely because, right? I'll take that back a step. Seth Frotman provided testimony. He said, “The CFPB is concerned in their companies, including but not limited to big tech companies with business interests across a vast array of product lines.”
Again, many of those big tech companies, those are retailers, right? Those are merchants. May today or in the future be using payment data across their products for purposes such as behavioral targeting or individualized marketing. There are lots and lots and lots of merchants who use that data for exactly those purposes. Companies may also be finding other ways to monetize this data such as by sharing detailed payment information with data brokers or other third parties.
The statute does contain a relevant exception with respect to certain sellers of non-financial goods or services who engage in financial data processing, solely because they transmit or store payment data exclusively for the purpose of the consumer paying for the goods. Again, I want to focus right there because this is what Seth is focusing on, solely because. Now, I'm going to go back to what Seth is saying. By its terms, the exclusions relate only to payment processing by a seller that is necessary to affect the sale of non-financial goods or services. That exemption exists only to the extent you are using that data to affect the sale. If you are using that payment data for anything else, the general counsel of the CFPB does not believe that that exclusion applies to you.
Again, I don't think that they are hiding what they are coming for. In fact, every opportunity to provide testimony, both the director and the general counsel are very clear that they would like to expand this jurisdiction.
Chris Willis: Jesse, you mentioning that as an example made me think of another thing, too. If, in fact, you have a merchant who's selling data to a data broker and that data broker, as a result of the rulemaking, the FCRA rulemaking that you mentioned a moment ago, now becomes a consumer reporting agency because of these expansive interpretations that the Bureau is making of the FCRA. Then the merchant, even if it's not a CRA itself, is all of a sudden a furnisher. It gets the joy of being a furnisher, which all of our financial institution clients know so well.
Jesse Silverman: If the day they have to learn about Metro 2 reporting is going to be the day that they've decided to join another field.
Chris Willis: Yes, for sure.
Jesse Silverman: Yes. That is very true. Frankly, they have proposed changes and made actual changes. Sometimes, even for me, and I've been doing this for 25 years now, it's hard for me at times to see the ripple on implications. The one that you just highlighted, that's a perfect example of a follow-on implication. If you're selling data, the data broker becomes a consumer reporting agency. I now become a furnisher. It is very hard at times to see all of these larger implications.
This is why when I talk to merchants and retailers now, I'm trying to highlight that this is a real risk that is going on right now. If everyone doesn't start paying attention, by the time they do, it might be too late. These changes might be too far gone. Frankly, a lot of these changes, they have – the retailers and merchants themselves have particularized understanding of how it will impact their business that I don't have, right? I've been doing my best to try and talk to everyone to understand not just what the rule says in the proposed rule because those are easy enough for me to understand. But how does the rubber hit the road, and how will that impact the business?
Chris Willis: We've talked about all the different things that the Bureau is doing that may impact retailers and merchants. But I want to focus in with you on one of those which is the payments larger participant rule. That's my shorthand for it, and I don't like your long, difficult, what to say version of it. Let’s call it the payments larger participant rule.
Let's say I'm a retailer and I become subject to the payments larger participant rule. Therefore, I'm subject to CFPB’s supervision, which means supervisory exams. What can they expect if they become subject to that? Obviously, they've probably never had an exam of any kind by any regulator.
Jesse Silverman: Correct. I think that that is one of the – I have spent a lot of time educating retailers on exactly that because very few would expect what the CFPB can do. I think the easiest way to describe it is once the CFPB has jurisdiction as a supervised entity. In this case, we're talking about the LPR, the larger participant rule for payments. If they have jurisdiction because of that particular rule, they're not limited to just examining your payments. They can examine every single aspect of your consumer finance business.
The other important part, what does examine mean? They can walk into your building any time and have unfettered access to your books and records or wherever it is that you're conducting that business, right? Denying access to those books and records could very well be a legal violation in and of themselves.
Chris Willis: That could give rise to a civil monetary penalty, by the way.
Jesse Silverman: Absolutely, absolutely. There's other little nuances as well, the attorney-client privilege. If you're a retailer and you're discussing these issues with your attorney, the CFPB does not believe that the attorney-client privilege applies to supervised entities. They have access to those records. Again, this is what they believe. I'm not making a statement on whether or not is legally supportable or not, but I know that that's what they believe.
Chris Willis: Well, Jesse, they’ve said it at least 10 times, so it's well-settled, right?
Jesse Silverman: Oh, yes. Absolutely. They have said it so long, and they relied on their own saying it. That is a big – there's nothing else quite like that in the retailer space, right? There's no one else who can just walk into your business and say, “Okay, I want to see all your books and records. I want to see how you've trained your call center operatives. I want to see how you record these particular records. I want to see your records for the last seven years.” It gives rise to a very, very significant cost.
As you know just as well as I do, these exams can be hundreds of questions over months, if not years. I think you told me once. Your longest follow-up questionnaire after the sort of on-site portion was 200-plus questions afterwards.
Chris Willis: No, it wasn't afterwards. It was during the on-site portion. It's how many follow-up requests the examiners got up to, and it was 250. That's my personal record.
Jesse Silverman: That is extraordinary.
Chris Willis: All with 24 to 48-hour turnaround, by the way.
Jesse Silverman: Any retailer who's listening to this, they can imagine what that would do to their business if they had to produce this volume of information in that period of time. It's very hard to get all of that right. Guess what? If you don't get it right, they're there watching, so the risk is material.
Chris Willis: Yes. Another couple of comments about supervision to follow yours, Jesse, I mean, as is obvious from the fact that they do such a thorough inquiry, it's like nothing anybody's ever seen. No enforcement investigation is ever as thorough as an examination, not even close. As a consequence of that, it is literally the most potent tool the CFPB has for finding out what's going on within a company. They will find stuff through supervision that they would never ever, ever, guess at from reading complaints or doing an enforcement investigation or anything like that. That's number one.
Number two, the other thing that comes along with supervision isn't just the Bureau's ability to discover all kinds of stuff in a very unfettered way. But it also comes with a truckload of expectations about your compliance management system. You mentioned this in terms of training and monitoring of call centers and stuff like that. But it will be into what’s your procedure for handling disputes, and how many days do you take to respond to complaints, and all this other stuff.
Then there's this pressure that's constantly put on anybody who's subject to Bureau supervision to develop this large bank style compliance management system. That's also something very alien to retailers, expensive to build, and arguably sort of slowing down the business when the business doesn't want to get slowed down. All of those are also impacts of CFPB’s supervision, I think.
Jesse Silverman: Absolutely. I'll add one more sort of addendum to that. Having built many compliance management systems and the policies and procedures behind them to power it, the, A, number one easiest mistake that you can make as a company is to not follow your own policies and procedures, your own compliance management system. What you're doing when you're forced to create those, you're almost creating a shadow book of rules, a shadow book of statutes, and that's the lowest hanging fruit for CFPB supervision or enforcement.
Hey, you have a policy. You said that you were going to train your call center. If you found this type of behavior, you were going to do X, Y, and Z. This is what you said you were going to do, and you didn't meet your own standards. That's a violation of the law.
Chris Willis: Exactly. It’s the most opportunistic violation for them to claim because the defendant, whoever the subject of this, isn't in a great position to say, “Oh, no. I don't have to do that because it's already in their own policies and procedures.”
Jesse Silverman: As a longtime enforcement attorney, it was without a doubt the lowest of low-hanging fruit. When you found one of those, everything else was easy because there's no defense. I know I told you I was going to do these things, but I didn't really mean it.
Chris Willis: Yes, exactly. Let's round out this discussion. There's plenty, obviously, from this discussion for retailers and merchants to be worried about. From the rulemaking side, the substantive rulemaking side, like the larger participant rule, like open banking, like the data broker thing, like buy now, pay later. But there's also a lot to worry about with respect to becoming a larger participant subject to supervision.
What can retailers do about this? I mean, they can start to fret about it. That in and of itself is probably not very productive. What are the things? What are the options open to them that they should be considering?
Jesse Silverman: It’s a great question. I would say, first of all, the first option is it's time to get educated. I understand that for many years, the CFPB didn't matter, right? I absolutely understand that maybe the CFPB mattered because they were going to get involved on interchange fees. Maybe I like them. Maybe – again, where you fit on that spectrum, the important part to remember is just because the CFPB may have been your friend on interchange questions doesn't mean that they are going to be your friend forever.
I think the next steps would be take a look at the actual proposed rules that are out there right now, and we talked about a few of them; data broker, larger participant rule, open bank. Figure out does this impact my business, right? That's the first real question. I'll do – I'll give a shorthand. Do I use consumer payment data for anything other than consumer payments? If the answer is yes, do I sell it? Do I use it internally? If the answer to that is yes, then I'm probably going to be impacted by one or more of these proposed rules if they go final.
There is still an opportunity for many of these rules to provide feedback for some of them, and some of them we've missed the comment window. But there's still an opportunity for some of them to provide comments. There's an opportunity to work with your trade associations. Maybe that opportunity is to reach out to the CFPB. Maybe the opportunity is frankly to challenge some of these rules.
A number of these rules, in my own professional opinion, there's some weakness in those rules. I don't know that they're particularly well-supported factually or legally, so by no means are these a foregone conclusion.
Chris Willis: No. We’re guessing, of course, about what the larger participant rule and the data broker rulemaking will look like because neither of those is finalized yet. But we expect both of them to come out sometime later this year. They’ll be subject to challenge when they are finalized.
Jesse Silverman: Correct. Again, there's still opportunities with every single one of them. I mean, it's just a question of what that opportunity is, whether it's comments, challenge, legally, otherwise. Every single one of them has an opportunity. I mean, honestly, I would say reach out to us. Reach out to your lawyers. Just start doing the analysis to figure out how does this impact my business, and do I care?
The shortest hand I can come up with is are you using consumer data to facilitate your business in any other way. Train your models. Target advertising. Improve your products. Any of those, if the answer is yes, you are probably going to be impacted, and you probably care.
Chris Willis: Yes. This has been a great discussion, Jesse, as always. It's always great to have you on the podcast, so thanks for joining me today. Thanks to our audience for listening in today as well. Don't forget to visit and subscribe to our blogs, troutmanpepperfinancialservices.com and consumerfinancialserviceslawmonitor.com. While you're at it, why not head over to our website at troutman.com and add yourself to our consumer financial services email list? That way, we can send you copies of our alerts and advisories that we like to send out, as well as invitations to our industry-only webinars that we put on from time to time.
As I mentioned before, don't forget to check out our handy mobile app. Just search for Troutman Pepper in your app store. Find it and try it out. Of course, stay tuned for a great new episode of this podcast every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.