CFPB Issues Final Rule on Nonbank Registration of Enforcement Orders

On June 3, the Consumer Financial Protection Bureau (CFPB or Bureau) issued its final rule requiring covered nonbanks to register enforcement orders, and it is a doozy. Not only will covered nonbanks be required to register public orders issued by agencies and courts with the CFPB, but they will have to go back to 2017. And not only will the CFPB publish the orders, but a large subgroup will have to certify on a yearly basis their full compliance with the orders or make a self-disclosure to the CFPB of any compliance failures. This rule has obvious major consequences for any covered person caught in its web, making the exact ambit of the rule crucial. Given the final rule clocks in at a whopping 486 pages, this post will attempt to provide a roadmap through the rule, focusing on what is required and who is covered.

Who is Covered

The final rule applies to certain nonbanks that are “covered persons” under the Dodd-Frank Act. Covered persons generally participate in offering or providing consumer financial products or services. However, the rule does not apply to insured depository institutions or insured credit unions, persons who are covered solely due to being a “related person” under the Dodd-Frank Act, states including federally recognized Indian tribes, natural persons, certain motor vehicle dealers, and persons that qualify as a covered person under the Dodd-Frank Act only because of conduct excluded from the CFPB’s rulemaking authority.

What Orders are Covered

An order is covered by the final rule if it is a final, public order issued by an agency or court, identifies a covered nonbank by name as a party subject to the order, was issued at least in part in any action or proceeding brought by any federal agency, state agency, or local agency, contains public provisions that impose obligations on the covered nonbank to take certain actions or to refrain from taking certain actions, imposes obligations on the covered nonbank based on an alleged violation of a covered law, and has an effective date on or after January 1, 2017.

Registration Requirements

The registration requirements apply to covered orders that remain in effect on September 16, 2024, or have an effective date on or after that date. The final rule requires covered nonbanks with covered orders to register and submit information to the CFPB’s Nonbank Registry regarding themselves and the covered order. The CFPB will publish filing instructions detailing the information that must be submitted, including the formats required. Generally, along with providing identifying information about the entity itself, including legal name and place of business, the covered entity will be required to submit a fully executed and complete copy of the covered order.

Written Statements

The final rule imposes additional requirements on covered nonbanks that are subject to CFPB supervision and have at least $5 million in qualifying annual receipts. On an annual basis, CFPB-supervised covered nonbanks must review and submit, as applicable, certain additional information regarding covered orders with an effective date on or after the beginning of their applicable implementation submission period. Specifically, the CFPB-supervised covered nonbank is required to designate an executive to: 1) describe the steps taken to review and oversee the covered nonbank’s activities subject to the order during the preceding calendar year, and 2) attest whether during the preceding calendar year the covered nonbank identified any violations or noncompliance with any applicable obligations imposed in the order’s public provisions.

Optional Alternative Registration Requirements for NMLS-Published Covered Orders

The final rule provides a one-time, alternative registration option for covered orders that are published on the Nationwide Multistate Licensing System (NMLS) Consumer Access website.

Submission Periods

The final rule requires CFPB-supervised covered nonbanks to submit the required information annually on or before March 31 of each year. For larger participant CFPB-supervised covered nonbanks that register by December 31, 2024, the first written statement submission is required by March 31, 2025, and will cover all applicable covered orders registered with an effective date from October 16, 2024 to December 31, 2024. For other CFPB-supervised covered nonbanks, the first written statement submission is required on March 31, 2026, and will cover all applicable covered orders registered with an effective date on or after the beginning of their implementation submission period, January 14, 2025 to December 31, 2025.

Registration Requirements Termination

Ongoing registration requirements apply until the covered order is deemed to expire or all relevant provisions are fully terminated. A covered order may be terminated by an agency or court or may terminate under its own terms. A covered order that does not expressly provide for a termination date and is not terminated earlier is deemed to expire 10 years after its effective date. The final rule requires the covered nonbank to file a notice with the CFPB within 90 days of any modification, termination, or abrogation of the order.

Troutman's Take

The CFPB’s final rule represents a significant regulatory development for nonbank entities. It is crucial for these entities to understand the requirements of the rule and ensure compliance. The CFPB may publish certain information about registered covered nonbanks and covered orders on its website, and noncompliance could lead to significant reputational and regulatory risks. Significantly, according to the press release announcing the issuance of the final rule, the CFPB has established a Repeat Offender Unit responsible for oversight of supervised entities subject to CFPB law enforcement orders. According to the Bureau, the “Repeat Offenders Unit is actively ensuring that a company, its senior management, and its board of directors are not treating any orders as suggestions.”