CFPB flexes its market monitoring authority in unprecedented ways

April 19, 2022 - Last fall, the Consumer Financial Protection Bureau made headlines for its orders to six "Big Tech" companies to produce information about their business models and practices for their consumer payments systems. That was followed up less than two months later by the issuance of similar orders to five "Buy Now Pay Later," or BNPL, companies.

The orders, which were among the first public actions taken by then-newly confirmed CFPB Director, Rohit Chopra, signal a willingness by the CFPB to use its market monitoring authority to gather the breadth and amount of data and information about consumer financial products and services that might previously have been collected by the agency solely in support of pending non-public supervisory examinations or enforcement investigations.

The CFPB — created by Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act in the aftermath of the Great Recession — is specifically charged with "collecting, researching, monitoring, and publishing information relevant to the functioning of markets for consumer financial products and services to identify risks to consumers and the proper functioning of markets." (12 U.S.C. § 5511(c)(3)). In support of that mission, Congress gave the CFPB the authority "to gather information from time to time regarding the organization, business conduct, markets, and activities of covered persons and service providers," including by requiring "covered persons and service providers participating in consumer financial services markets" (12 U.S.C. § 5512(c)(4)(B)(ii)) to file special reports or written responses to specific questions posed by the CFPB.

The CFPB has used this authority since its inception. In a September 2018 report on its sources and uses of data, the CFPB identified 13 orders issued pursuant to its market-monitoring authority. The orders, which do not appear publicly on the CFPB's website, appear to have focused on gathering information to support certain statutorily required reporting to Congress, rulemakings, or for market analysis. The recipients of those orders are not named.

Why, then, did an information-gathering tool that's been used over the years by the CFPB garner so much attention last fall? The answers may be obvious to the casual observer. A press release identified the recipients of the so-called Big Tech orders to be household names: Amazon, Apple, Facebook, PayPal, Google, and Square. The BNPL orders were issued to Affirm, PayPal, Klarna, Afterpay, and Zip. And these were among the first actions announced by Director Chopra since taking helm of the agency in September 2021, a move guaranteed to attract outsized attention given his background and government career.

Chopra, whose involvement with the CFPB dates back to standing up the agency as a protégé of now-Senator Elizabeth Warren in 2010 and who served as the agency's first Student Loan Ombudsman, established himself as an aggressive consumer advocate when he served as one of two Democratic commissioners with the Federal Trade Commission during the Trump administration. His dissents from FTC decisions were notable for outlining his theories of how regulatory action could protect consumers. Those ideas, in turn, inspired critics to vigorously voice their opposition when President Joe Biden nominated Chopra to be director of the CFPB.

But beyond the publicized use of a little-known authority by a headline-generating Director, it is the purpose of these orders that breaks sharply with the past. A model Big Tech order posted on the CFPB's website (the actual orders themselves were not made public) shows that the agency seeks a breadth of information and documentation about, among other things, how a company's payment products work, the fees it charges to both consumers and commercial users of those products, revenues earned in connection with those products, its disclosures about those products, and perhaps most critically, how consumer data is harvested, used, monetized, and shared with third parties.

The model BNPL orders seek information about the companies' business model, including underwriting criteria, their servicing and collections practices, consumer demographics, and their data harvesting and monetization practices.

This goes well beyond simply collecting information to analyze the effectiveness of a rule or make a report to Congress. Indeed, these orders are notable precisely because they signal a willingness by Director Chopra to use the CFPB's market-monitoring authority to gather information from companies that the agency might otherwise only be able to collect when conducting a supervisory examination or enforcement investigation. Both of those are agency actions that are largely non-public in nature.

In fact, the results of individual supervisory examinations are never made public (the CFPB publishes quarterly its Supervisory Highlights discussing examinations in an aggregate and anonymized fashion). Enforcement investigations, on occasion, may become public if the CFPB petitions a federal district court to enforce a civil investigative demand against an entity or individual. More typically, they culminate in public consent orders or litigation. The agency has developed procedural rules aimed at protecting against disclosure of business information acquired during an examination or investigation.

Moreover, sections 1024 and 1025 of the Consumer Financial Protection Act limit the CFPB's authority to conduct supervisory examinations to certain entities and certain markets specified by statute and to those entities for whom "the Bureau has reasonable cause to determine" are engaged in conduct that poses risks to consumers in connection with their offering or provision of consumer financial products or services. And the CFPB's enforcement authority, though formidable, nonetheless requires its civil investigative demands for information to individuals or entities to "state the nature of the conduct constituting the alleged violation which is under investigation."

No such limitations appear to cabin the CFPB's power to demand information in support of its market-monitoring authority. To be sure, the Big Tech orders provide that they are not being issued pursuant to either the Bureau's supervisory or enforcement authority (interestingly, the BNPL orders replicate the same sentence about not being a supervisory order but omit the disclaimer that they are not enforcement orders). And the statutory provision authorizing the CFPB to monitor markets provides that information produced in response is afforded confidential treatment.

But the lack of express safeguards that prohibit disclosure of sensitive commercial information in the supervisory and enforcement contexts is likely to unsettle recipients of market-monitoring orders that seek proprietary or closely held information such as revenue streams or how a product works.

By repurposing a statutory authority, Director Chopra appears to have harnessed a power to gather information from entities in a manner that allows the CFPB to bypass the internal hurdles, however nominal, it must clear to commence a supervisory exam or open an enforcement investigation.

The public announcement of these market-monitoring orders has the undoubtedly unwelcome result of sparking innuendo, rattling markets, and shining a glaring spotlight on companies that conceive of themselves as leading the charge on innovation in the payments and small dollar lending spaces. And although an entity may choose to disregard an order, leaving the CFPB to apply for judicial process to compel compliance, doing so is not without reputational risk, particularly if a court agrees that the agency is entitled to part or all of the information it seeks.

Indeed, merely receiving a market-monitoring order may lead a company, and other similar innovators in the consumer finance markets, to engage in some internal recalibration of their practices to preempt further scrutiny by the CFPB, without the benefit of the dialogue between the regulator and the regulated entity that occurs in the supervision and enforcement contexts.

And if that happens, the CFPB could effect reform of certain business practices in certain markets without expending any supervisory or enforcement resources. That might be a win for the agency, and possibly for the American consumer, but it could come at the cost of eroding confidence that government institutions will not apply heavy-handed pressure to achieve policy objectives outside of their normal channels.