What Does the CFPB’s New Public Registry to Detect Repeat Offenders Mean for Your Business?

On June 3, 2024, the Consumer Financial Protection Bureau (CFPB) issued the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders Final Rule (“the Final Rule”).

The Final Rule, effective September 16, 2024, establishes a public registry of nonbank financial companies that have violated consumer protection laws and will require covered entities to report final judgments, settlements, or other enforcement orders to the CFPB.

Citing the efficacy of other registries for law enforcement and consumer purposes, CFPB Director Rohit Chopra noted that the Final Rule will enable the agency, law enforcement, and the general public to conduct due diligence on firms and discover any misconduct.[1] The rule follows the creation of a Repeat Offender Unit and emerges as part of the CFPB’s broad focus on reining in corporate recidivism and ‘rinse-and-repeat’ enforcement.

Who Does the Final Rule Apply to?

The rule applies to certain nonbanks that are “covered persons” under the Consumer Financial Protection Act (CFPA). However, the following are excluded from the rule:

• insured depository institutions,
• insured credit unions,
• related persons,
• states,
• certain motor vehicle dealers,
• natural persons, and
• entities that qualify as “covered persons” solely because of conduct excluded from the CFPB’s rulemaking authority, such as activity related to charitable contributions.

Which Orders Does the Final Rule Apply to?

Covered entities must report all final public orders and judgments, including consent and stipulated orders and judgments obtained or issued by the CFPB or any government agency for violation of consumer protection laws.

An order is covered by the Final Rule if it:

1. identifies a covered entity by name,
2. was issued in part of a proceeding brought by any Federal, State, or local agency based on an alleged violation of a covered law, and
3. contains public provisions imposing obligations on the covered nonbank to take certain actions or refrain from taking certain actions.

Importantly, covered entities must report public orders that took effect on or after January 1, 2017, or that were entered into earlier but whose terms are still effective as of September 2024.

Registration Information

The rule’s registration requirements begin on September 16, 2024. While the CFPB’s filing instructions have yet to be finalized, the following information will be required:

1. identity information, such as the entity’s legal name and address of its principal place of business;
2. administrative information, such as a registered entity’s affiliates that are registered with respect to the same order; and
3. covered order information, such as a PDF of the original order, the court or agency that issued it, the effective and expiration date, the laws found to be violated (or alleged to be violated for consent orders), and a docket, case, or other identifying number.

Annual Written Statement by Attesting Executive

CFPB-supervised covered nonbanks have an additional requirement: an attesting senior executive must annually review and submit written information regarding covered orders. This written statement must bear the name and title of an attesting executive with respect to each of the covered orders registered and confirm compliance with any relevant orders.

Six trade groups sent a letter to the CFPB, arguing that the attestation requirement is arbitrary and capricious and could harm the hiring and retention of senior executives responsible for compliance.

The CFPB countered that most of these entities already have systems and procedures in place to achieve compliance so that the attestation requirement will impose only modest costs. The Bureau further stated that it would not publish the written statements. However, it “does intend to publish the name and title of the attesting executive(s)…” because doing so “will increase the likelihood of compliance.”

What Should Your Business Do Next?

Businesses should take the following steps to ensure they comply with the Final Rule before it takes effect on September 16, 2024:

1. Understand whether your business fits the appropriate definition for a covered entity.
2. Review inventory agreements or orders your business has entered into to determine whether registration is required. This may be particularly tricky for certain state licensing orders.
3. Even if not required by a formal agreement, your business should begin preparing to review and audit the issues that formed the basis of any settlement to ensure you are not at risk of becoming a “repeat offender.”

Law clerk Rebecca Webber contributed to this post. She is not currently admitted to practice law.

[1]Rohit Chopra, Prepared Remarks of CFPB Director Rohit Chopra on the Final Rule to Detect and Deter Repeat Offender, Consumer Fin. Prot. Bureau, https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-on-the-final-rule-to-detect-and-deter-repeat-offenders/ (June 3, 2024).