CFPB Withdraws Proposed Rule on Data Broker Practices

On May 15, the Consumer Financial Protection Bureau (CFPB) withdrew its proposed rule, Protecting Americans from Harmful Data Broker Practices (Regulation V), via notice in the Federal Register. The proposed rule aimed to rein in data brokers that sell Americans’ sensitive personal and financial information by, among other things, treating data brokers as “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA) and requiring them to comply with accuracy requirements, provide consumers access to their information, and maintain safeguards against misuse. The CFPB’s stated rationale for withdrawing the proposed rule included that the CFPB found legislative rulemaking “not necessary or appropriate at this time to address the subject matter” of the proposed rule, concerns raised by commenters, and misalignment of the proposed rule with the CFPB’s current interpretation of the FCRA, which the CFPB noted is being revised, and the CFPB’s changed policy objectives. The CFPB advised that it will issue a rule implementing the relevant definitions and provisions of the FCRA only when and if the CFPB determines it necessary to do so.

On May 12, the CFPB rescinded over 60 pieces of regulatory guidance it had issued since 2011, including bulletins, policy statements, final rules, advisory opinions, and nearly all consumer financial protection circulars.  Among the rescinded guidance is the CFPB’s 2024 interpretive rule on “Buy Now, Pay Later” (BNPL) loans, clarifying that issuers of BNPL products qualify as card issuers under Regulation Z. This rule was subject to an ongoing lawsuit in the US District Court for the District of Columbia, and the CFPB previously announced on May 6 that it would no longer prioritize enforcement actions taken based on that interpretive rule and that it planned to rescind it. Participants in the financial services industry should review the full list of rescissions to understand the full scope of how the CFPB’s announcement may impact their business operations and compliance program.

On May 7, the Office of the Comptroller of the Currency (OCC) issued Interpretive Letter 1184, which confirms that national banks and federal savings associations may provide crypto-asset custody and execution services, including buying and selling assets at a customer’s direction. This aligns with prior OCC guidance in Interpretive Letter 1170, affirming the permissibility of crypto-asset custody services. The OCC also clarified that banks may outsource crypto-asset custody and execution services to third parties, provided banks implement appropriate third-party risk management practices. Banks must also conduct these activities in a safe and sound manner and in compliance with applicable laws and regulations.

On May 8, the OCC adopted an interim final rule rescinding the OCC’s 2024 policy statement on its review of applications under the Bank Merger Act and restoring a streamlined application and expedited review to the OCC’s procedures for evaluating applications under the Bank Merger Act. Acting Comptroller of the Currency Rodney E. Hood stated that the goal of the interim final rule is to reduce burden and uncertainty for banks, support an effective regulatory framework that streamlines the merger process for well-managed and well-capitalized banks, and promote the OCC’s goal of encouraging competition and facilitating economic growth and innovation.

On May 5, the OCC released a request for information (RFI) on community banks’ engagement with digitalization. The OCC is seeking input from community banks and relevant stakeholders regarding (1) the key challenges and barriers that community banks are facing in adopting and implementing digitization strategies or initiatives; (2) how community banks’ board of directors are engaged in overseeing and supporting digitization strategies and initiatives; (3) how potential budget constraints are impacting community banks’ ability to adopt or maintain digitalization strategies; (4) to what extent community banks are sharing data with third-party providers as part of a digitalization strategy or initiative; (5) how community banks are managing the ongoing risks of digitalization that may result in material financial risks; and (6) how regulatory and compliance requirements are impacting community banks’ decisions to undertake digitalization strategies or initiatives. Comments must be received by June 26.