CFPB's Final Rule Creating a Registry of Nonbank Public Orders

On June 3, 2024, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) published its final rule creating a registry (“Registry”) of nonbank covered persons subject to certain agency and court orders (“Final Rule”). The Final Rule is effective on September 16, 2024, but the implementation dates vary based on type of entity (as discussed below).

In short, under the Final Rule, nonbank covered persons subject to certain final public orders obtained or issued by a government agency in connection with the offering or provision of a consumer financial product or service must report the existence of the orders and related information to a CFPB Registry. The CFPB will publish the Registry. Additionally, supervised nonbanks must file annual reports regarding compliance with registered orders. While not part of the proposed rule, the Final Rule provides a one-time registration option for nonbanks that are subject to an order that is published on the Nationwide Multistate Licensing System (“NMLS”) Consumer Access website, and such nonbanks would not be subject to the requirement to file annual compliance reports.

The Bureau is adopting this Final Rule to collect information to facilitate the Bureau’s supervision of certain companies. The Bureau believes it will more effectively be able to monitor and to reduce the risks to consumers posed by entities that violate consumer protection laws. It also will make this information available for use by the public and other regulators. The Rule makes clear that the Bureau may use the information submitted to the Registry to support its objectives and functions, including examination and enforcement.

Key Terms

Covered Law: A covered law includes, to the extent that the violation of law found or alleged arises out of conduct in connection with the offering or provision of a consumer financial product or service:

1. A Federal consumer financial law (e.g., CFPA, UDAAP, TILA, RESPA, EFTA);
2. Any other law as to which the Bureau may exercise enforcement authority;
3. The prohibition on unfair or deceptive acts or practices (“UDAP”) under Section 5 of the Federal Trade Commission Act, or any rule or order issued under that authority;
4. A State law prohibiting UDAP that is identified in Appendix A of the Rule;
5. A State law amending or otherwise succeeding a law identified in Appendix A, to the extent that such law is materially similar to its predecessor; or
6. A rule or order issued by a State agency for the purpose of implementing a prohibition on UDAP contained in a State law described in paragraph (4) or (5).

Covered Nonbank: A covered person that is not any of the following: (1) an insured depository institution or insured credit union; (2) a person who is a covered person solely due to being a related person; (3) a State; (4) a natural person; (5) a motor vehicle dealer within the meaning of 12 U.S.C. 5519(a), except to the extent such a person engages in functions that are excepted from the application of 12 U.S.C. 5519(a) as described in 12 U.S.C. 5519(b); or (6) a person that qualifies as a covered person based solely on conduct that is the subject of, and that is not otherwise exempted from, an exclusion from the Bureau’s rulemaking authority under 12 U.S.C. 5517. The preamble to the Rule notes that an affiliate of an insured depository institution, insured credit union, or related person could be subject to the Rule if it is not itself an insured depository institution, insured credit union, or related person.

Covered Order: A final public order issued by an agency or court, whether or not issued upon consent, that: (1) identifies a covered nonbank by name as a party subject to the order; (2) was issued at least in part in any action or proceeding brought by any Federal agency, State agency, or local agency; (3) contains public provisions that impose obligations on the covered nonbank to take certain actions or to refrain from taking certain actions; (4) imposes such obligations on the covered nonbank based on an alleged violation of a covered law; and (5) has an effective date on or later than January 1, 2017.

NMLS-published covered order: A covered order that is published on the NMLS Consumer Access website, www.NMLSConsumerAccess.org, except that no covered order issued or obtained at least in part by the Bureau shall be an NMLS-published covered order.

Supervised registered entity: A registered entity that is subject to supervision and examination by the Bureau pursuant to 12 U.S.C. 5514(a), with limited exceptions (e.g., does not include a service provider that is subject to the Bureau’s examination and supervision solely in its capacity as a service provider).

Registry Requirements (§ 1092.202)

The Registry requirements apply only with respect to covered orders with an effective date on or after the effective date of the Rule, or that remain in effect as of the effective date of this Rule.

Requirement to register and submit information regarding covered orders: Each covered nonbank that is identified by name as a party subject to a covered order must register as a registered entity with the Registry if it is not already so registered and must provide or update, as applicable, the information described in this Rule in the form and manner specified by the Bureau. Each covered nonbank required to register must submit a filing containing certain information (identifying information, administrative information, and certain information regarding covered orders, described below) to the Registry within the later of 90 days after the applicable Registry implementation date or 90 days after the effective date of any applicable covered order. Each registered entity must submit a revised filing amending any information to the Registry within 90 days after any amendments are made to the covered order or any of the information otherwise submitted changes.

Information regarding covered orders: A registered entity must provide the following information for each covered order: (1) a fully executed, accurate, and complete copy of the covered order, except non-public portions; (2) in connection with each applicable covered order: (i) information identifying the agency(ies) and court(s) that issued or obtained the covered order, as applicable; (ii) the effective date of the covered order; (iii) the date of expiration, if any, of the covered order, or a statement that there is none; (iv) all covered laws found to have been violated or, for orders issued upon the parties’ consent, alleged to have been violated; and (v) any docket, case, tracking, or other similar identifying number(s) assigned to the covered order by the applicable agency(ies) or court(s); and (3) if the registered entity is a supervised registered entity, the name and title of the attesting executive.

Expiration of covered order status: A covered order shall cease to be a covered order as of the later of: (1) 10 years after its effective date; or (2) if the covered order expressly provides for a termination date more than 10 years after its effective date, the expressly provided termination date.

Requirement to submit revised and final filings with respect to certain covered orders: If a covered order is terminated, modified, or abrogated, or if an order ceases to be a covered order, the registered entity must submit a revised filing to the Registry within 90 days after the effective date of such change.

Notification by certain persons of non-registration: A person may submit a notice to the Registry stating that it is not registering pursuant to this section because it has a good-faith basis to believe that it is not a covered nonbank or that an order in question is not a covered order. Such person must promptly comply with this Rule upon becoming aware of facts or circumstances that would not permit it to continue representing that it has a good-faith basis to believe that it is not a covered nonbank or that an order in question is not a covered order.

NMLS Option (§ 1092.203)

With respect to any NMLS-published covered order, a covered nonbank may elect to comply with a one-time registration option in lieu of complying with the ongoing registration requirements and the annual attestation (if a supervised registered entity) of the Rule. The covered nonbank must provide information that the Bureau determines is appropriate for the purpose of identifying the covered nonbank and the NMLS-published covered order, and otherwise for the purpose of coordinating the Registry with the NMLS. Upon providing such information, the covered nonbank shall have no further obligation under this Rule to provide information to, or update information provided to, the Registry regarding the NMLS-published covered order.

While not part of the original proposal, many, including industry and state regulators, commented on the overlap between NMLS and the proposed Registry. This one-time registration option is in response to those comments and concerns.

Annual Reporting (§ 1092.204)

The annual reporting requirement applies only with respect to covered orders with an effective date on or after the applicable nonbank registration implementation date.

A supervised registered entity is not required to comply with this section with respect to any NMLS-published covered order for which it chooses to comply with the one-time registration option.

Requirement to designate attesting executive: A supervised registered entity subject to a covered order must designate as its attesting executive for the covered order its highest-ranking duly appointed senior executive officer whose assigned duties include ensuring the supervised registered entity’s compliance with Federal consumer financial law, who has knowledge of the entity’s systems and procedures for achieving compliance with the covered order, and who has control over the entity’s efforts to comply with the covered order. The supervised registered entity must annually designate one attesting executive for each such covered order to which it is subject and for all submissions and other purposes related to that covered order under this Rule.

Requirement to provide attesting executive(s) with access to documents and information: A supervised registered entity must provide its attesting executive(s) with prompt access to all documents and information related to the supervised registered entity’s compliance with all applicable covered order(s) as necessary to make the written statements required by this Rule.

Annual requirement to submit written statements to the Bureau for each covered order: On or before March 31 each year, the supervised registered entity must, in the form and manner specified by the Bureau, submit to the nonbank registry a written statement with respect to each covered order, and such statement must be signed by the attesting executive on behalf of the supervised registered entity. In the written statement, the attesting executive must: (1) generally describe the steps that the attesting executive has undertaken to review and oversee the supervised registered entity’s activities subject to the applicable covered order for the preceding calendar year; and (2) attest whether, to the attesting executive’s knowledge, the supervised registered entity during the preceding calendar year identified any violations or other instances of noncompliance with any obligations that were imposed in a public provision of the covered order by the applicable agency or court based on a violation of a covered law.

Requirements to maintain and make available related records: A supervised registered entity must maintain documents and other records sufficient to provide reasonable support for its written statement and to otherwise demonstrate compliance with the requirements of this section with respect to any submission under this section, for five years after such submission is required. The supervised registered entity shall make such documents and other records available to the Bureau upon request.

Notification of entity’s good-faith belief that requirements do not apply: A person may submit a notice to the Registry stating that it is neither designating an attesting executive nor submitting a written statement because it has a good-faith basis to believe that it is not a supervised registered entity or that an order in question is not a covered order. Such person must promptly comply with this section upon becoming aware of facts or circumstances that would not permit it to continue representing that it has a good-faith basis to believe that it is not a supervised registered entity or that an order in question is not a covered order.

Publication (§ 1092.205)

Internet publication of registration information: The Bureau may make available to the public the information submitted to the Registry, including the registration information and the one-time registration of NMLS-published covered orders, by means that include publishing such information on the Bureau’s website within a timeframe determined by the Bureau in its discretion. The Bureau will not include the annual written statement (that will be treated as Bureau confidential supervisory information) and will not publish administrative information.

Other publications of information: In addition, the Bureau may, at its discretion, compile and aggregate information submitted and make such publicly available, as the Bureau deems appropriate.

Correction of submissions to the Registry: If any information submitted to the Registry was inaccurate when submitted and remains inaccurate, the covered nonbank shall file a corrected report within 30 days after the date on which such covered nonbank becomes aware or has reason to know of the inaccuracy. In addition, the Bureau may direct a covered nonbank to correct errors or other non-compliant submissions to the Registry.

Implementation Dates (§ 1092.206)

Larger Participants: For a covered nonbank that is a larger participant of a market for consumer financial products or services as defined by one or more rules issued by the Bureau, the applicable Registry implementation date is 30 days after this Rule takes effect (October 16, 2024).

Other Supervised Covered Persons: For a covered nonbank supervised by the Bureau under any other provision of 12 U.S.C. 5514(a)(1) (i.e., mortgage originators and servicers, student lenders, payday lenders, and any entity the Bureau designated for supervision on a risk basis), the applicable Registry implementation date is 120 days after the Rule takes effect (January 14, 2025).

Other covered nonbank: For any other covered nonbank, the applicable Registry implementation date is 210 days after the Rule takes effect (April 14, 2025).