ComplianceMarch 03, 2019

Deregulation and relaxed enforcement? Tell that to the states!

(As published in ABA Bank Compliance magazine)

In late 2017, then Acting Director Mick Mulvaney announced that the Consumer Financial Protection Bureau (CFPB) was unlikely to engage in enforcement actions under his watch to the extent that it had under former Director Richard Cordray.[1] Further, he stated that he would look to the states to fill in that gap to the extent necessary–a direct reference to the concurrent enforcement structure built into the Dodd-Frank Act.

In response, 17 state attorneys general wrote Mulvaney, strenuously requesting that the CFPB not abandon its position as the primary regulator and examiner of financial institutions, and that the CFPB continue to work with the states to hold financial institutions accountable.[2] They also indicated they would step up their own enforcement actions should the CFPB fail to act, expressing fears of a repeat of the lack of federal regulation and enforcement that, in their view, had led to the recession of 2008 and would lead to consumer abuse today, if not another recession. [3]

What do these developments mean for financial institutions who are used to focusing on the CFPB to determine how they should tailor their compliance? Quite simply, compliance officers cannot relax their guard. Even though the CFPB, under first Mulvaney and now Kathy Kraninger, has indicated it will stick closely to the letter of the law in its enforcement, state attorneys general and state regulators are able to both enforce UDAAP, as they interpret it, and to enforce their own regulations as well as federal laws, such as those regarding fair lending. States will likely continue using their pre-and post-Dodd Frank powers to bring actions against financial institutions, whether limited to single-state enforcement actions or larger multi-state actions such as the recent $575 million, 50-state settlement with a national bank on December 28th, 2018. As Pennsylvania Attorney General Josh Shapiro wrote, “[This settlement] sends a message that state attorneys general are on the lookout for harmful conduct by providers of consumer financial services, regardless of whether the provider is a national bank, a state-chartered bank, or a nonbank.” [4] Although the CFPB may have stepped back, the state attorneys general are still vigilant and several states, including Pennsylvania, have established their own mini-CFPBs for this purpose.

I. State enforcement before Dodd-Frank

Prior to Dodd-Frank, federal law frequently preempted state laws designed to discourage or outlaw predatory lending. State attorneys general and state regulators who saw certain problems cropping up in the financial industry were unable to take the corrective actions they desired. The federal prudential regulators also declined to take action, frequently deferring to “the market” to sort out any issues with predatory loan products.[5]

Wishing to protect their constituents, state attorneys general and state regulators used what tools they could. State attorneys general shared information with each other about lending practice trends and potential targets for enforcement actions. By cooperating with other states, attorneys general could (and can today) more effectively identify and target questionable practices.

The National Mortgage Servicing Settlement is a great example of such coordinated enforcement. Starting as a probe into the practice of robo-signing, the investigation quickly ballooned to cover other servicing-related issues, such as dual-tracking. In the end, 49 states, the District of Columbia, and the federal government all worked together to reach a historic settlement with the five largest mortgage servicers, resulting in over $50 billion in fines and restitution to compensate homeowners.[6] More importantly, the settlement also created new mortgage servicing rules that have become industry best practices.

II. State enforcement after Dodd-Frank

The 111th Congress recognized that ineffective federal regulation and federal preemption of state regulations was a substantial cause of the financial crisis. Dodd-Frank targeted this ineffective regulatory structure in two different ways. First, it changed financial services industry regulatory oversight by adding new rules, such as Ability to Repay, and modifying old regulations, such as Unfair and Deceptive Acts and Practices (UDAP) and the TILA-RESPA Integrated Disclosure (TRID) rule. It also consolidated their enforcement into a single federal agency–the CFPB. Second, Dodd-Frank eliminated much of the preemption of state laws found in pre-Dodd-Frank regulation[7] and provided enforcement authority to the states, essentially adding more cops to the regulatory beat. Specifically, Congress authorized state attorneys general and regulators to bring civil actions to enforce Title X of Dodd-Frank and its regulations.[8]

The power provided by Dodd-Frank to the states could be used concurrently with the CFPB or independently. This approach was intentional, as Congress recognized that state attorneys general would likely have better information regarding local lending practices. Through the sharing of state resources and knowledge with federal investigators, the burden on the individual agencies and taxpayers could be shared as well. And, should the CFPB ever be “captured” by the entities it regulated, becoming too closely aligned with their interests, Congress intended that the states be allowed to continue to act independently.[9] It was this independent action that the 17 state attorneys general were pledging to continue.

A. States have exercised their powers under Dodd-Frank.

Several states have already exercised their ability to enforce federal law under Dodd-Frank. For example:

  1. Illinois sued both a short-term lender[10] and a for-profit college[11], alleging Unfair, Deceptive or Abusive Acts or Practices (UDAAP) violations as well as state law violations. It settled the case against ALTA in 2015 for $15 million, as well as requiring radical changes in the way ALTA advertised its Criminal Justice program, graduation, salary, and tuition rates.[12]
  2. New York’s 2014 suit against Condor Capital Corporation, a sales finance company that acquired and serviced primarily subprime auto loans in over two dozen states, alleged violations of UDAAP under Dodd-Frank, as well as violations of New York state law.[13] Notably, this suit was undertaken by a regulator other than the state attorney general and did not involve a collaboration with the CFPB. The settlement, reached later the same year, affected Condor’s activities not only in New York, but also in other states–as part of the settlement, Condor admitted to violating Dodd-Frank, and agreed to surrender its licenses in all states, sell its remaining loans, and pay a $3 million penalty to make restitution to customers nationwide.[14]
  3. Mississippi’s UDAAP and Fair Credit Reporting Act (FCRA) suits against Experian[15] (and later TransUnion and Equifax) were an example of local state investigations (starting in Ohio) that eventually caught the attention of the CFPB, which then issued a Civil Investigative Demand in September of 2015.[16] The settlement with Mississippi cost the credit reporting agencies $7.1 million and required them to provide free credit reports for three years to Mississippi residents.[17]

While the more recent RD Legal Funding case is a joint enforcement action between the New York state attorney general and the CFPB, states have shown they are quite capable of and willing to carry out their own independent enforcement actions using the new powers provided in Dodd-Frank. The results of these enforcement actions are unlikely to be limited to the borders of a particular state. As shown, several have impacted the way the defendants operated throughout the country, whether through the terms of the settlement or by raising the interest of other states or even the federal government.

III. Disparate impact enforcement

Increasingly, states have been unlikely to limit themselves to UDAAP claims and have instead shown their willingness to step in wherever they believe the CFPB was taking insufficient action. One such area of focus relates to fair lending concerns. [18]

A. Equal Credit Opportunity Act (ECOA), the CFPB, and indirect auto lending

In 2018, the CFPB and state regulators clashed over whether disparate impact is the proper analytical framework to determine compliance with the Equal Credit Opportunity Act (ECOA). Under former Director Richard Cordray, the CFPB was supportive of disparate impact and on March 21, 2013, it published CFPB Bulletin 2013-02 stating that disparate impact is appropriate for analyzing pricing disparities in the indirect auto market.[19] The ensuing Indirect Auto Lending rule reflected the same philosophy.

The financial services industry has long been concerned about the enforcement of fair lending theories that fall outside clear “disparate treatment” parameters.[20] The use of a “disparate impact” analysis for the indirect auto market was concerning for multiple reasons. First, it is unclear that the statutory language of ECOA provides for disparate impact enforcement. Second, the extent of the CFPB’s authority over indirect auto lending is unclear and, further, the CFPB’s proposed approach should be re-thought in light of the recent Supreme Court Inclusive Communities decision, which heightened the requirements for a disparate impact claim under the Fair Housing Act.[21]

On May 21, 2018, in response to industry concerns, Congress used its authority under the Congressional Review Act to overturn the new CFPB Indirect Auto Lending rule via a Joint Resolution.[22] Acting Director Mick Mulvaney issued a press release the same day, thanking Congress “for reaffirming that the Bureau lacks the power to act outside of federal statutes” and asserting that in light of Inclusive Communities, “the Bureau will be reexamining the requirements of the ECOA.”[23] When a rule is overturned by the Congressional Review Act, the administrative agency is prohibited from passing a similar rule unless it was specifically authorized to do so by a subsequent act of Congress. Given that Congress, the White House, and the CFPB have expressed opposition to the indirect auto lending rule’s proposed use of disparate impact analysis, one might assume this could be the end of the story for disparate impact analysis in indirect auto lending. However, it’s not.

B. Reactions to scrapping disparate impact analysis for indirect auto lending

States immediately voiced their concerns with Congress’s decision and the CFPB’s response. “As the federal government stands down on protecting consumers from financial frauds and abuses, [the Department of Financial Services (DFS)] stands up to safeguard New Yorkers from unfair lending practices,” said DFS Superintendent Maria T. Vullo in an August 23rd 2018 press release, indicating that her department would be applying fair lending principles to its review of indirect automobile lending programs, and would “tak[e] any other supervisory or enforcement actions necessary to ensure that lending in New York State is fair and nondiscriminatory.”[24],[25]

In a September 5th, 2018 letter, 14 attorneys general criticized Acting Director Mulvaney’s suggestion that the CFPB will no longer enforce the prohibition against disparate impact discrimination found in statutes modeled on the ECOA. The letter argues that the CFPB would be violating the Administrative Procedures Act if it reinterprets the ECOA as not providing for disparate impact liability, without going through the proper notice and comment rulemaking. It closes with a promise that, “the attorneys general will not hesitate to uphold the law if CFPB acts in manner contrary to law with respect to interpreting ECOA.”[26]

Accordingly, in October 2018, the CFPB published its Fall 2018 rulemaking agenda and noted in the preamble that the Bureau would be reexamining the requirements of ECOA concerning disparate impact.[27] Speculation ensued as to what this meant.[28] Would the CFPB decide “disparate impact” was not included in ECOA at all (a position Mulvaney has previously taken and that his successor, Kathy Kraninger, may take)? Would the CFPB decide to adopt the definitions used by other federal agencies? Or would the CFPB decide that adherence to the new heightened standard in Inclusive Communities is most appropriate?

With the increase in the use of opaque technology, it seems unlikely that the CFPB can ignore disparate impact and simply revert to a disparate treatment approach. In a December 2018 call with its joint advisory committee, the CFPB discussed the rise of Artificial Intelligence and the problems associated with “black box” technology where the algorithms used for underwriting or other purposes were unexplained.[29] The Bureau’s representatives, along with the advisory council members, noted the possibility that data showing the impact of the algorithms would be the only indication that discrimination was taking place. And, while an algorithm itself could not discriminate, evidence of that disparate impact would and should lead to a review of what parameters the algorithm had set up and whether those should be adjusted to lessen the impact.

Regardless of the direction the CFPB chooses to go in its rulemaking, increased reliance on technology coupled with society’s current focus on systemic bias, as well as the ready availability of data and its analysis, seem likely to allow groups other than federal agencies to use that data to construct a disparate impact case.

C. State disparate impact enforcement

State attorneys general and agencies are already demonstrating that they will continue to investigate and enforce redlining cases. In August 2018, the New York Department of Financial Services pointedly reminded auto finance lenders of the existing New York state fair lending laws.[30] Massachusetts and Delaware attorneys general had previously reviewed Santander’s auto lending practices for disparate impact and other predatory policies.[31] And, in October 2018, Pennsylvania’s Attorney General Josh Shapiro issued a press release requesting that all Philadelphia area mortgage borrowers and home loan applicants file complaints with his office if they believed they had been victims of redlining.[32]

Interestingly, the Pennsylvania attorney general’s action does not seem to have been instigated by an internal report, but rather by the publication of an article in the newsletter “Reveal.” [33] “Kept Out,” written by two reporters for the nonprofit investigative journalism group The Center for Investigative Reporting, used the Center’s analysis of publicly available Home Mortgage Disclosure Act (HMDA) records to identify patterns of potential redlining in several cities across the U.S., highlighting Philadelphia as the biggest metropolitan area with redlining practices. The Pennsylvania attorney general’s subsequent investigation suggests that not only state attorneys general will be stepping in to carry out any investigations the CFPB feels disinclined to conduct, but local community or independent nonprofit research organizations can use publicly available HMDA or other data to put together cogent redlining cases.[34] Other states have also initiated investigations in response to the Reveal article,[35] and additional states have stepped up to conduct redlining investigations on their own.[36]

IV. Takeaways

The banking industry has experienced rapid change over the last 10 years. Dodd-Frank created new federal rules and a new federal agency. While initially a lot of attention focused on the powerful CFPB’s regulatory oversight activities, we cannot afford to overlook the changing roles and growing authority of the states as meaningful participants in regulatory oversight and supervision. We do not know what direction Director Kraninger will take the Bureau. However, many states have clearly indicated that they will continue to enforce the existing regulations aggressively, regardless of the CFPB. We must listen and take them seriously.

To learn more, please complete the form below and we'll be in touch.


[3]States’ concerns about the Bureau’s direction were perhaps best captured by the remarks of New York Department of Financial Services (DFS) Superintendent Maria T. Vullo: “I am disappointed by the new administration’s sudden policy shift, which is clearly intended to undermine necessary national financial services regulation and enforcement. DFS remains committed to its mission to safeguard the financial services industry and protect New York consumers, and will continue to lead and take action to fill the increasing number of regulatory voids created by the federal government." Statement by DFS Superintendent Maria T. Vullo, Regarding CFPB ’s Troublesome Policy Shift Away from Consumer Protection. January 25, 2018

[4]Attorney General Shapiro Announces $575 Million 50-State Settlement with Wells Fargo Bank for Opening Unauthorized Accounts and Charging Consumers for Unnecessary Auto Insurance, Mortgage Fees, December 28, 2018, , (accessed on January 16, 2018).

[5] See, for example, Alan Greenspan’s address to the Council of Foreign Relations (Nov. 19, 2001), available at

[7] Senate Committee Report, p. 16, citing Comptroller Hawke’s acknowledgment to Congress that the OCC’s preemption of state predatory lending laws was due, in part, to the desire of the OCC “to attract additional [federal] charters, which helps to bolster the budget of the OCC.” S. REP. NO. 111-176, 14-16 (2010).

[8] Section 1042 of the Dodd-Frank Act, codified at 12 U.S.C. 5552.

[9]U.S. Senate committee report noted the difficulty of a single agency acting as both prudential regulator (ensuring the safety and soundness of the financial institution) and consumer protection enforcement. Senate Committee Report, S. REP. No. 111-176, 10 (2010).

[10] Illinois v. CMK Investments, No. 2014-ch-04694 (Ill. Cir Ct. 2014)� (Complaint found at:

[11]State of Illinois v. Alta Colleges, No. 12-CH-01587 (Ill. Cir. Ct. 2012), UDAAP charges added in 2014.

[13]Benjamin Lawsky v Condor Capital Corp, et al, U.S. District Court, Southern District of New York, No.14-cv-02863.

[14] “Subprime auto lender Condor Capital settles with New York,” Karen Freifeld, December 19, 2014, Reuters, (accessed November, 19, 2018).

[15]State of Miss. ex rel. Jim Hood v. Experian Information Solutions, Inc., No.1:14-cv-00243-LG-JMR (S.D. Miss.).

[18] The Senate committee on Dodd-Frank noted that minorities were disproportionately affected by the predatory lending practices of the banks leading up to the recession, with 54% of African-Americans and 47% of Hispanics receiving high cost loans in 2007. By contrast, 18% of non-Hispanic whites were sold high cost loans in the same year. S. REP. NO. 111-176, 14-16 (2010).

[19] “Indirect Auto Lending and Compliance with the Equal Credit Opportunity Act” (CFPB Bulletin 2013-02).

[23]Statement of the Bureau of Consumer Financial Protection on enactment of S.J. Res. 57, May 21, 2018

[25]“DFS Takes Action to Protect New Yorkers from Unfair Auto Lending Practices as Federal Government Rolls Back Consumer Protections,” August 23, 2018, (accessed November 14, 2018).

[26]ECOA Disparate Impact Letter to the CFPB, September 5, 2018, (accessed December 16, 2018).


[29]Bureau of Consumer Financial Protection December 6 Advisory Committee Call, discussing Tom Oscherwitz’s presentation on “Overview of Artificial Intelligence in Financial Services,” particularly slides 20-22, addressing transparency and bias in AI.

[30] “DFS Takes Action to Protect New Yorkers from Unfair Auto Lending Practices as Federal Government Rolls Back Consumer Protections,” August 23, 2018, (accessed November 14, 2018).

[31] “Mass. AG probes Santander for auto lending practices,” Deirdre Fernandes, Boston Globe, December 25, 2014, (accessed November 14, 2018), leading to a $25.9 million settlement in March of 2017: “Santander pays $25.9 million to settle subprime auto loan probes,” Nate Raymond, Automotive News, March 29, 2017, (accessed November 24, 2018).

[32] “Press Release: Attorney General Shapiro Puts Spotlight on Redlining”, October 22, 2018, (accessed November 14, 2018).

[33] “KEPT OUT: For people of color, banks are shutting the door to homeownership.” Aaron Glantz and Emmanuel Martinez, February 15, 2018, (accessed November 14, 2018).

[34] See, for example, the Connecticut Fair Housing Center’s suit against Liberty Bank, filed in October 2018 (“Center & NCLC File Federal Lawsuit Accusing Liberty Bank of Redlining,” Shannon Houston, October 4, 2018, (accessed November 14, 2018)), or the city of Miami’s suit against Bank of America and Wells Fargo (“Supreme Court Rules Miami Can Sue for Predatory Lending,” Adam Liptak, May 1, 2017 (accessed November 14, 2018)).

[35] These states include Washington state, Illinois, Iowa, Delaware, District of Columbia, and Iowa. “State attorneys general probe lending disparities,” Aaron Glantz and Emmanuel Martinez, March 13, 2018 (updated October 23, 2018), (accessed November 14, 2018).

[36]E.g., in New York, “A.G. Schneiderman Secures Agreement With Evans Bank Ending Discriminatory Mortgage Redlining in Buffalo,” September 10, 2015, (accessed November 14, 2018).

Samuel Holle
Senior Compliance Consulting Analyst, Compliance Center of Excellence

Samuel Holle is a senior compliance consulting analyst for Wolters Kluwer, where he assists financial institutions in the business and compliance implementation of new software solutions. Holle’s current role focuses on customer relationship management, leading the compliance efforts in the creation and delivery of custom content, and providing mortgage compliance expertise throughout the product implementation.