February 3, 2023 - Of Interest

A&B ABstract:

On January 11, 2023, the Consumer Financial Protection Bureau (the “CFPB” or “Bureau”) announced a proposed rule to establish a public registry and require nonbanks supervised by the agency to register their use of certain terms and conditions contained in “take it or leave it” form contracts for consumer financial products or services that “attempt to waive consumers’ legal protections,” “limit how consumers enforce their rights,” or “restrict consumers’ ability to file complaints or post reviews” (the “Proposed Rule”). The purpose of Proposed Rule’s registration system is to allow the CFPB to prioritize oversight of nonbanks that use the covered terms and conditions based on the agency’s perception these provisions pose risks for consumers.

The CFPB seeks public comment on the practical utility of collecting and publishing this information as well as ways to minimize the burden of the information collection on respondents. The comment period closes on April 3, 2023.

The Proposed Rule

The Proposed Rule would require annual registration by most nonbanks subject to the CFPB’s jurisdiction, with limited exceptions. “Specifically, a “supervised nonbank” would be defined to mean a nonbank covered person that is subject to supervision and examination by the Bureau, except to the extent that such person engages in conduct or functions that are excluded from the Bureau’s supervisory authority pursuant to 12 U.S.C. 5517 or 5519. A “supervised nonbank” would include any nonbank covered person that (1) offers or provides a residential mortgage-related product or service, any private educational consumer loan, or any consumer payday loan, (2) is a larger participant engaged in consumer reporting, consumer debt collection, student loan servicing, international money transfers, and auto financing, or (3) is subject to a CFPB order issued pursuant to 12 U.S.C. 5514(a)(1)(C).

Those excluded from the scope of the Proposed Rule would include, among others, persons subject to CFPB supervision and examination solely in the capacity of a service provider; natural persons; persons with less than $1 million in annual receipts resulting from offering or providing all consumer financial products and services as relevant to the activities noted in (1) through (3) above. Also exempt from the rule would be a person that has not, together with its affiliates, engaged in more than de minimis use of covered terms and conditions (i.e., fewer than 1,000 times in the previous calendar year) and a person that used covered terms or conditions in covered form contracts in the previous calendar year solely by entering into contracts for residential mortgages on a form made publicly available on the Internet required for insurance or guarantee by a Federal agency or purchase by Fannie Mae, Freddie Mac, or Ginnie Mae.

Under the Proposed Rule, a “covered term or condition” would be subject to the rule’s reporting requirements. A “covered term or condition” would be defined as “any clause, term, or condition that expressly purports to establish a covered limitation on consumer legal protections applicable to the offering or provision of any consumer financial product or service.” In turn, “covered limitation on consumer legal protections” would be defined to mean any covered term or condition in a covered form contract:

Precluding the consumer from bringing a legal action after a certain period of time;
Specifying a forum or venue where a consumer must bring a legal action in court;
Limiting the ability of the consumer to file a legal action seeking relief for other consumers or to seek to participate in a legal action filed by others;
Limiting liability to the consumer in a legal action including by capping the amount of recovery or type of remedy;
Waiving a cause of legal action by the consumer, including by stating a person is not responsible to the consumer for a harm or violation of law;
Limiting the ability of the consumer to make any written, oral, or pictorial review, assessment, complaint, or other similar analysis or statement concerning the offering or provision of consumer financial products or services by the supervised registrant;
Waiving, whether by extinguishing or causing the consumer to relinquish or agree not to assert, any other identified consumer legal protection, including any specified right, defense, or protection afforded to the consumer under Constitutional law, a statute or regulation, or common law; or
Requiring that a consumer bring any type of legal action in arbitration.

In the Proposed Rule, the CFPB acknowledges that there may be overlap in the types of covered terms and conditions, so some contract provisions may fall into more than one category. The Proposed Rule currently proposes to limit the collection of terms and conditions that expressly attempt to establish the covered limitation. Any contract containing a covered term would be considered a “form contract” provided it was (1) included in the original contract draft presented to the consumer, (2) was not negotiated between the parties, (3) is intended for repeated use in transactions between the company and consumers and contains a covered term or condition.

Supervised nonbanks covered by the Proposed Rule would be required to collect and submit this information through the CFPB’s registration system. Under the Proposed Rule, the registry of terms and conditions would be publicly available, rather than limited to government regulators or CFPB staff. The CFPB supports the public availably of this data on the grounds that it will lead to more informed consumers and provide other regulators the opportunity to identify covered terms and conditions that are explicitly prohibited by the laws they enforce or supervise. The proposed format for the registry is similar to another recent CFPB proposed rule which proposes to establish a public registry of regulatory actions involving certain nonbanks subject to CFPB supervision. We previously discussed this proposed rule in another blog post.

CFPB’s Request for Comment on the Proposed Rule

The CFPB is seeking comment on a range of issues related to the Proposed Rule, including:

The prevalence of the covered terms and conditions;
Potential impacts of collecting and publishing this information;
Reasons why the information should not be publicly disclosed;
The burden of collecting and filing these provisions;
The use of form contracts purchased from third parties; and
Other entities that may be affected by the proposed rule.

The period for public comment ends on April 3, 2023.

Is the establishment of a Public Registry likely?

The CFPB currently has thirty-seven (37) rules that have been proposed but not implemented, of which only five of were proposed since the start of the Biden Administration. Most notably, neither the CFPB’s proposed rule for small business lending data collection from September 1, 2021 or its proposed rule for credit card late fees and late payments from June 22, 2022 have been finalized. Since the substance of this rule is limited to the collection and publication of contract terms, rather than the prohibition of any behavior, enactment might be more likely. The recent Fifth Circuit decision in Community Financial Services found the CFPB’s funding structure unconstitutional and vacated the agency’s Payday Lending Rule on those grounds. Accordingly, any rule promulgated by the CFPB would likely be susceptible to legal challenges.

Takeaway

The Bureau’s focus on seeking public disclosure of covered terms and conditions reflects a continued focus on the content of form contracts used in connection with consumer finance products and services of nonbanks. The public nature of the registry could lead to increased scrutiny of contract provisions from the Bureau, other regulators, and the public, increasing reputational risk to covered entities as well as the likelihood of heightened enforcement activity by Federal and State regulators. Accordingly, entities that would be subject to the Proposed Rule’s requirements should carefully review the Proposed Rule and consider commenting thereon.

In his 2022 speech “Reining in Repeat Offenders” at the Distinguished Lecture on Regulation at the University of Pennsylvania Law School, the director of the Consumer Financial Protection Bureau (CFPB) stated that “[a]chieving general deterrence is an important goal for the CFPB” and “the role of individual liability cannot be discounted.” To that end, the CFPB recently proposed an enforcement order registry that would, among other things, require certain larger participant nonbanks subject to the CFPB’s supervisory authority to designate a senior executive who is responsible for and knowledgeable of the nonbank’s efforts to comply with the orders identified in the registry to attest regarding compliance with covered orders and submit an annual written statement attesting to the steps taken to oversee the activities subject to the applicable order for the preceding calendar year and whether the executive knows of any violations of, or other instances of noncompliance with, the covered order.

It is not surprising that one of the major questions that has arisen about financial institution (FI) insurance coverage is the extent of coverage for regulatory enforcement actions. Other questions arise in interpreting the scope of FI insurance coverage for terms such as a pending and prior claim, the performance of professional services, invasion of privacy (and whether data breaches are covered), and fraud. These terms can be particularly important in the heavily regulated financial services industry. Accordingly, financial institutions need to understand FI coverage options and the negotiable terms.

Are regulatory enforcement actions included in coverage terms?

Responding to inquiries from agencies such as the CFPB, Securities Exchange Commission (SEC), Department of Justice, attorneys general, and federal and state banking agencies can be disruptive and expensive. As a threshold matter it is important to understand the extent of insurance coverage, including the kind of inquiry that is covered. The first step is to make sure you understand which regulators are covered when there is an inquiry or enforcement action. Ideally, financial institutions would have coverage for claims from any federal or state agency.

Is there coverage for costs incurred in responding to informal inquiries?

For example, there may be coverage for an informal document request and employee interview by a government agency. Many policies now offer some coverage of a formal government agency civil investigative demand (CID) or subpoena to a financial institution, and it is important to understand the specific scenarios in which such a CID or subpoena is covered.

When facing an ongoing government investigation, is it subject to the excess policy’s “pending and prior claim” exclusion?

In a recent case, the policy language provided that the excess policy did not apply to “any amounts incurred by the Insureds on account of any claim or other matter based upon, arising out of or attributable to any demand, suit or other proceeding pending or order, decree, judgment or adjudication entered against any Insured on or prior to July 31, 2011.” The court ruled that the parties had agreed to exclude from the excess policy coverage any claim as defined in the language of the primary policy.

The court also ruled that an ongoing SEC investigation, even though it was not being covered by any insurance policy, was a claim as defined under the primary policy and thus was subject to the pending and prior claim exclusion of the excess policy. This case emphasizes the importance of understanding the definitions of a claim within the relevant policies.

What are some considerations for losses arising out of the performance of professional services?

Many FI policies have exclusions for loss arising out of the performance of professional services, which distinguish claims covered by a company’s errors and omissions (E&O) insurance. It is important to understand the effect of these exclusions, which are illustrated in recent court decisions.

In one recent case, a court held that a bank’s policy’s professional services exclusion precluded coverage for all insureds, not just those delivering the services. The exclusion in the case provided that there was no liability for claims “made against any Insured alleging, arising out of, based upon, or attributable to the Organization’s or any Insured’s performance of or failure to perform professional services for others….” The court held that the phrase “any Insured” made the insurer’s obligations jointly held, which prohibited recovery from any insured.

However, the policy at issue in this case did not have a severability provision. The court’s opinion suggests that a professional services exclusion in a policy with a severability provision would preclude coverage only for those who actually performed the professional services.

Another consideration is the broad language that was used in the clause in this case—it uses words like “arising out of,” “based upon,” or “attributable to” the professional services provided. Companies should ensure that the clause serves its purpose and does not preclude too much coverage.

Another issue involving professional services exclusions, particularly for banks, are fee cases. Overdraft fees, as well as a lot of other fees, including junk fees, have been a focus of regulators. One court has considered the question of insurance coverage for a bank’s obligation to repay overdraft fees. In this case, a bank customer filed suit against the bank, seeking relief from “unfair and unconscionable assessment and collection of excessive overdraft fees.” The bank filed suit against its insurer for refusing to pay defense costs in the lawsuit.

The policy at issue had a duty-to-defend clause covering claims “for a Wrongful Act committed by an Insured or any person for whose acts the Insured is legally liable while performing Professional Services, including failure to perform Professional Services.” However, the policy also had an exclusion “for Loss on account of any Claim … arising from … any fees or charges.” The court affirmed the denial of the companies’ entitlement to payment for defense costs, ruling that the fees exclusion absolved the carrier of an obligation to pay such costs. Cases like these reinforce the importance of understanding defense costs coverage for these kinds of overdraft fee cases.

How does an exclusion for invasion of privacy impact cyber breaches?

It is not uncommon for policies to have clauses that exclude claims based on invasion of privacy. Recent cases underscore the importance of understanding whether such clauses exclude coverage for claims in cyber breaches.

A court recently held that the Los Angeles Lakers were not entitled to insurance coverage for allegations that the team violated the Telephone Consumer Protection Act (TCPA). The court ruled that “because a [TCPA] claim is inherently an invasion of privacy claim, [the insurer] correctly concluded that the underlying [TCPA] claims fell under the Policy’s broad exclusionary clause.”

This decision could affect coverage of cyber-liability claims involving cybersecurity and data privacy, which are becoming increasingly common and which often touch on invasion of privacy issues. Companies should understand their exclusionary clauses on this score.

What is “final” for purposes of an insurance policy’s fraud exclusion?

Many FI insurance policies exclude coverage if the insured is found to have engaged in fraud. Often, the exclusion is only triggered after a “final” judicial determination that the excluded conduct has occurred. The issue of what a “final” determination is can affect the coverage for a claim.

Financial institutions should look for fraud exclusions in their FI policies to determine whether such exclusions refer to a “final, non-appealable adjudication” or a “final judgment.” In a New York state case, after a former CEO was sentenced for the commission of various fraud crimes, he filed an appeal of his convictions. While the appeal was still pending, however, his insurer asked to be relieved of its obligation to defend the plaintiff because the fraud exclusion in its policy was triggered upon a final judgment against its insured.

The former CEO filed suit against his insurer, but the appellate court affirmed the trial court’s ruling that the insurer was no longer obligated to pay his defense. The court held that the imposition of the criminal sentence was a “final judgment,” which appropriately triggered the fraud exclusion in the policy. The court explained that even if an appeal is successful, the finality of the sentence is not changed.

This case shows how important it is to understand the contours of a policy’s fraud exclusion.

Defense Costs: Duty to Defend v. Duty to Indemnify

Finally, a company needs to consider whether it wants to have primary control over the defense of a covered claim or wants the insurer to have primary control. An advantage of having the insurer control the defense—a “duty to defend” policy—is that the coverage requirements can be a bit more broad in many states. The main advantage of the company having primary control of the defense in a so-called “duty to indemnify” policy is that the company gets wider latitude in choosing lawyers that they trust and know to have the appropriate experience to handle the matter. Under either of these arrangements, the carrier would pay covered defense costs.

Conclusion

As trends in enforcement shift, it is increasingly important to understand liability coverage. Financial institutions should consider reaching out to experienced insurance brokers and attorneys to assist them in reviewing and analyzing the terms and features of their policies in the evolving enforcement climate.

Archives for February 3, 2023