Consumer Information Requests to Large Banks and Credit Unions, 71279-71283 [2023-22774]
Download as PDF
<![CDATA[
Federal Register / Vol. 88, No. 198 / Monday, October 16, 2023 / Rules and Regulations
CONSUMER FINANCIAL PROTECTION
BUREAU
12 CFR Chapter X
Consumer Information Requests to
Large Banks and Credit Unions
Consumer Financial Protection
Bureau.
ACTION: Advisory Opinion.
AGENCY:
The Consumer Financial
Protection Bureau (CFPB) is issuing this
Advisory Opinion regarding section
1034(c) of the Consumer Financial
Protection Act (CFPA), which requires
large banks and credit unions to comply
in a timely manner with consumer
requests for information concerning
their accounts for consumer financial
products and services, subject to limited
exceptions.
DATES: This Advisory Opinion is
applicable as of October 16, 2023.
FOR FURTHER INFORMATION CONTACT:
Colin Reardon or Yan Cao, Senior
Counsels, Legal Division, at 202–435–
7700. If you require this document in an
alternative electronic format, please
contact CFPB_Accessibility@cfpb.gov.
SUPPLEMENTARY INFORMATION: The CFPB
is issuing this Advisory Opinion
through the procedures for its Advisory
Opinions Policy.1 Refer to those
procedures for more information.
SUMMARY:
I. Background
Section 1034(c) of the CFPA requires
large financial institutions to comply
with consumer requests for information
concerning their accounts in a timely
manner.2 This Advisory Opinion
interprets this provision for the purpose
of highlighting the obligations it
imposes upon large financial
institutions. The CFPB has not
previously issued supervisory findings
or pursued an enforcement action under
this provision. This Advisory Opinion is
the CFPB’s first guidance regarding
section 1034(c).3
Section 1034(c) applies to insured
depository institutions and credit
unions that offer or provide consumer
financial products or services and that
have total assets of more than $10
billion, as well as their affiliates.4 The
1 85
FR 77987 (Dec. 3, 2020).
U.S.C. 5534(c).
3 As a matter of prosecutorial discretion, the
CFPB does not intend to seek monetary relief for
violations of section 1034(c) that occur prior to
February 1, 2024.
4 12 U.S.C. 5534(c)(1) (provision applies to ‘‘a
covered person subject to supervision and primary
enforcement by the Bureau pursuant to section
1025’’); see also id. sec. 5481(1), (6) (defining
‘‘affiliate’’ and ‘‘covered person’’); id. sec. 5515(a)–
(c) (CFPA section 1025 providing CFPB with
ddrumheller on DSK120RN23PROD with RULES1
2 12
VerDate Sep<11>2014
15:48 Oct 13, 2023
Jkt 262001
provision states that, subject to certain
exceptions, banks and credit unions
with over $10 billion in assets must ‘‘in
a timely manner, comply with a
consumer request for information in the
control or possession of such covered
person concerning the consumer
financial product or service that the
consumer obtained from such covered
person, including supporting written
documentation, concerning the account
of the consumer.’’ 5 Section 1034(c) is a
current legal obligation that became
effective on July 21, 2011.6
Congress placed section 1034(c)
alongside provisions of the CFPA that
establish a process for addressing
consumer complaints submitted to the
CFPB. Under sections 1034(a) and
1034(b), when a consumer submits a
complaint or inquiry about a large bank
or credit union, that entity ‘‘shall
provide a timely response’’ to the CFPB,
and the CFPB then provides a timely
response to the consumer, including
‘‘any responses received’’ from the
financial institution.7 Through section
1034(c), Congress established an
additional, direct channel for consumers
to request information from large banks
and credit unions without routing their
inquiry through the CFPB or another
government entity. And like a complaint
submitted to the CFPB, a request for
information under section 1034(c) can
lead to the identification and resolution
of errors by a large bank or credit union
involving a consumer’s account.
Responding to consumer requests for
information is critical for ensuring high
levels of customer service and enabling
consumers to resolve issues with their
accounts when they encounter
problems. Large banks and credit unions
possess information that is vital to meet
these customer needs. Too often,
however, it can be difficult and time
consuming for individual consumers to
obtain a clear answer to questions or
resolve an account issue. The CFPB has
observed that some larger financial
supervisory and primary enforcement authority
over insured depository institutions and insured
credit unions with total assets of more than $10
billion and over their affiliates). For convenience,
this Bulletin generally refers to institutions subject
to section 1034(c) as ‘‘large banks and credit
unions.’’
5 12 U.S.C. 5534(c).
6 Subtitle C of the CFPA, which includes section
1034, became effective on ‘‘the designated transfer
date.’’ Public Law 111–203, title X, sec. 1037. The
designated transfer date was July 21, 2011. See
Designated Transfer Date, 75 FR 57252, 57253
(Sept. 20, 2010); see also 12 U.S.C. 5582.
7 12 U.S.C. 5534(a), (b); see also CFPB, Consumer
Response Annual Report at 16–17 (Mar. 2023),
https://files.consumerfinance.gov/f/documents/
cfpb_2022-consumer-response-annual-report_202303.pdf (describing the consumer complaint
process).
PO 00000
Frm 00007
Fmt 4700
Sfmt 4700
71279
institutions have moved away from a
traditional relationship banking model
with an emphasis on providing
customized help to individuals.8 Such
individualized service is now generally
reserved for high net-worth individuals,
and is difficult for other households to
find. For most consumers, larger banks
and credit unions frequently rely on
highly standardized processes rather
than high-quality human interactions or
digital channels that actually facilitate
self-help. When a consumer has a
question or problem, they typically
cannot go to an individual at the bank
or credit union who is already familiar
with their account, such as the person
that originally signed them up for the
product. They are more likely to have to
navigate a phone tree in the hope of
speaking to the right person in a call
center, to have to search through largely
irrelevant material on a website to try to
find the information they need, or to
have to attempt to get a clear answer
from a chatbot.9
On June 14, 2022, the CFPB issued a
request for information asking the
public to provide input on customer
service obstacles they face in interacting
with large banks and credit unions.10
Commenters relayed consumers’
frustration and difficulty in obtaining
critical information about their
accounts.11 This includes information
8 See CFPB, Prepared Remarks of CFPB Director
Rohit Chopra in Great Falls, Montana on
Relationship Banking and Customer Service (June
14, 2022), https://www.consumerfinance.gov/aboutus/newsroom/prepared-remarks-of-cfpb-directorrohit-chopra-in-great-falls-montana-onrelationship-banking-and-customer-service/; see
also FDIC, FDIC Community Banking Study at 4–
1 (December 15, 2020), https://www.fdic.gov/
resources/community-banking/report/2020/2020cbi-study-full.pdf (noting that community banks
‘‘tend to focus on loans as relationships, originating
loans that require local knowledge, a greater
personal touch, individual analysis, and continued
administration’’).
9 See CFPB, Chatbots in consumer finance (June
6, 2023), https://www.consumerfinance.gov/dataresearch/research-reports/chatbots-in-consumerfinance/chatbots-in-consumer-finance/ (observing
that ‘‘automated responses can be highly scripted
and simply direct customers to lengthy policy
statements or FAQs, which may contain very little
helpful information, if any’’); see also Ron Shevlin,
The Human + Digital Challenge In Banking:
Consumers Want Both at 2, Cornerstone Advisors
(2021), https://go.backbase.com/rs/987-MGR-655/
images/Backbase_Cornerstone_Human_Digital.pdf
(finding, based on consumer survey, that ‘‘[t]oday’s
consumers—even those at the younger end of the
age spectrum—want and value high-quality human
interactions in their financial lives’’ and that
‘‘[f]inancial institutions must quickly improve the
quality of their digital channel experiences’’).
10 See Request for Information Regarding
Relationship Banking and Customer Service, 87 FR
36828 (June 21, 2022).
11 See, e.g., Comment from Legal Services NYC at
2 (July 13, 2022), https://
downloads.regulations.gov/CFPB-2022-0040-0006/
E:\FR\FM\16OCR1.SGM
Continued
16OCR1
71280
Federal Register / Vol. 88, No. 198 / Monday, October 16, 2023 / Rules and Regulations
that consumers need to stay current and
avoid fees or penalties; to identify and
resolve errors; and to close accounts that
no longer serve their interests.
Through section 1034(c), Congress
ensured that as banks and credit unions
grow larger they must continue to meet
consumers’ need for information
necessary to manage their finances, and
thus must provide timely responses to
consumer requests for information
concerning their accounts. Such
responses help meet consumers’
reasonable expectations for customer
service.
II. Information Requests Under Section
1034(c)
A. Consumer Requests for Information
Regarding Their Accounts
ddrumheller on DSK120RN23PROD with RULES1
Section 1034(c) states that, subject to
certain enumerated exceptions, large
banks and credit unions ‘‘shall, in a
timely manner, comply with a consumer
request for information in the control or
possession of [a large bank or credit
union] concerning the consumer
financial product or service that the
consumer obtained from [the large bank
or credit union], including supporting
written documentation, concerning the
account of the consumer.’’ 12 Thus,
section 1034(c) applies to a consumer’s
request for information to a large bank
or credit union where the information
concerns the consumer’s account for a
consumer financial product or service,
is in the large bank or credit union’s
control or possession, and does not fall
into an enumerated exception.
The CFPA defines ‘‘consumer
financial product or service’’ to include
several types of financial products or
services that consumers may obtain
from a large bank or credit union,
including deposit and savings accounts,
credit products such as mortgage loans
attachment_2.pdf (describing low-income clients
who have difficulty obtaining ‘‘copies of their
statements; records related to restraints placed on
their accounts; copies of cashed checks or money
orders; information on fees and charges placed on
the account’’ among other information); Comment
from Mobilization for Justice (July 22, 2022),
https://downloads.regulations.gov/CFPB-20220040-0051/attachment_2.pdf (describing lowincome consumers without internet access who
cannot afford fees charged to obtain hard copies of
account statements); Comment from Tzedek DC
(Aug. 19, 2022), https://downloads.regulations.gov/
CFPB-2022-0040-0084/attachment_1.pdf
(describing disabled clients who were denied access
to account information because of the presence of
a retained attorney, and who could not obtain
documents a large bank relied upon to close fraud
disputes); see also Nonrulemaking Docket: Request
for Information Regarding Relationship Banking
and Customer Services (CFPB–2022–0040),
comments available at https://www.regulations.gov/
docket/CFPB-2022-0040/comments.
12 12 U.S.C. 5534(c)(1).
VerDate Sep<11>2014
15:48 Oct 13, 2023
Jkt 262001
and credit cards, and loan servicing.13
Under section 1034(c), large banks and
credit unions that offer or provide
consumer financial products or services
must comply with consumer requests
for information regarding their accounts.
That obligation applies even if
consumers do not expressly invoke
section 1034(c).14
Section 1034(c) applies to consumer
requests for information ‘‘concerning’’
an account for a consumer financial
product or service. The term
‘‘concerning’’ means ‘‘relating to’’ or
‘‘regarding’’ and therefore encompasses
a wide range of information about a
consumer’s account.15 Information
concerning an account would include
account information that appears on
periodic statements or on online
account portals, such as the amount of
the balance in a deposit account, the
interest rate on a loan or credit card, and
information regarding transactions or
payments involving an account.16 It
would include information regarding
bill payment and other recurring
transactions involving the account (e.g.,
a list of all recurring payments out of
the account). It would also include the
terms and conditions of the account,
including a schedule of fees that may be
charged on the account. It could also
include information about the status of
a lien on real property that was released
(or should have been released) years
before. Such information can be
necessary for consumers to manage their
accounts and resolve disputes with their
13 12 U.S.C. 5481(5), (15)(A)(i), (iv). It should be
noted that a consumer can receive services from a
loan servicer (and thus ‘‘obtain’’ a consumer
financial product or service from that servicer) even
if the loan servicer is not the original creditor on
the consumer’s loan. See 12 U.S.C. 5481(5),
(15)(A)(i).
14 Nothing in section 1034(c) states or suggests
that a consumer must expressly indicate that they
are making a request under that provision. See 12
U.S.C. 5534.
15 Concerning, Merriam-Webster, https://
www.merriam-webster.com/dictionary/
concerning#dictionary-entry-2 (last visited Oct. 5,
2023); see also Concerning, Oxford English
Dictionary, https://www.oed.com/dictionary/
concerning_prep?tab=meaning_and_use (last
visited Oct. 5, 2023) (defining ‘‘concerning’’ to
mean ‘‘[i]n reference or relation to; regarding,
about’’).
16 With respect to periodic statements, Regulation
DD describes information that must appear on
periodic statements for deposit accounts held by
depository institutions other than credit unions, see
12 CFR 1030.6(a), and NCUA regulations impose
similar disclosure requirements for credit unions,
see 12 CFR 707.6(b). Regulation E describes
information that must appear on periodic
statements for accounts to or from which electronic
fund transfers can be made. See 12 CFR 1005.9.
Regulation Z describes information that must
appear on periodic statements for open-end credit
plans (e.g., credit cards and home-equity lines of
credit), see 12 CFR 1026.7, 1026.8, and for closedend residential mortgage loans, see 12 CFR 1026.41.
PO 00000
Frm 00008
Fmt 4700
Sfmt 4700
bank or credit union, or with merchants
or other third parties. In contrast,
section 1034(c) does not apply to a
consumer’s request for information that
is not specifically related to a
consumer’s account, such as
information regarding a large bank or
credit union’s internal operating
procedures, financial performance,
marketing strategy, or training program
for its employees.
In addition, section 1034(c) requires a
large bank or credit union to comply
with a consumer’s request for
‘‘information . . . including supporting
written documentation.’’ The word
‘‘support’’ means ‘‘to assist,’’ ‘‘help,’’ or
‘‘provide with substantiation.’’ 17
Accordingly, through its reference to
‘‘supporting written documentation,’’
section 1034(c) requires large banks and
credit unions to provide consumers,
upon request, with written documents
that will substantiate information
provided in response to consumer
questions, or that will assist consumers
with understanding or verifying
information regarding their accounts.
For example, under section 1034(c), a
consumer seeking information about
past transactions on their account could
request copies of past periodic
statements or check images. Similarly, a
consumer seeking information regarding
the terms and conditions governing
their account could request a copy of
their account agreement (including a
copy of the original signed agreement).
Section 1034(c) requires large banks
and credit unions to provide account
information and supporting
documentation to the extent it is in their
‘‘control or possession.’’ The concepts of
‘‘control’’ and ‘‘possession’’ are familiar
from other contexts involving requests
for information, such as the discovery
provisions in the Federal Rules of Civil
Procedure and the Freedom of
Information Act.18 In the context of
section 1034(c), a bank or credit union
‘‘possesses’’ information that is known
by its employees or that can be found
17 Support, Merriam-Webster, https://
www.merriam-webster.com/dictionary/support (last
visited Oct. 5, 2023); see also Supporting, Oxford
English Dictionary, https://www.oed.com/
dictionary/supporting_adj?tab=meaning_and_
use#19725899 (last visited Oct. 5, 2023) (defining
‘‘supporting’’ to mean ‘‘[t]hat provides evidence or
authority for something; confirmatory,
corroborative.’’).
18 See, e.g., Fed. R. Civ. P. 34 (concerning requests
for documents in party’s ‘‘possession, custody, or
control’’); U.S. Dept. of Just. v. Tax Analysts, 492
U.S. 136, 145 (1989) (stating that, with respect to
requests under the Freedom of Information Act
(FOIA), ‘‘the agency must be in control of the
requested materials at the time the FOIA request is
made’’ and that ‘‘[b]y control we mean that the
materials have come into the agency’s possession in
the legitimate conduct of its official duties’’).
E:\FR\FM\16OCR1.SGM
16OCR1
Federal Register / Vol. 88, No. 198 / Monday, October 16, 2023 / Rules and Regulations
ddrumheller on DSK120RN23PROD with RULES1
in its records, such as in its electronic
or paper files.19 A bank or credit union
can also ‘‘control’’ information that it
does not physically possess, where it
has the legal right, authority, or
practical ability to obtain the
information.20 For example, a large bank
or credit union would control
information held by an affiliate or
service provider where it has the right
or ability to receive that information
from the affiliate or service provider.
Large banks and credit unions are not
required to provide information that
falls within one of the four enumerated
exceptions in section 1034(c).21
Specifically, those exceptions apply to
(1) confidential commercial
information, including an algorithm
used to derive credit scores or other risk
scores or predictors; (2) information
collected for the purpose of preventing
fraud or money laundering, or detecting
or making any report regarding other
unlawful or potentially unlawful
conduct; (3) information required to be
kept confidential by any other provision
of law; and (4) any nonpublic or
confidential information, including
confidential supervisory information.22
In addition, section 1034(c) does not
require a large bank or credit union to
respond to a consumer information
request in a specific form, such as in
writing, orally, or electronically. In this
regard, section 1034(c) differs from
section 1033 of the CFPA, which
requires that certain information be
made available ‘‘in an electronic
form.’’ 23
19 Cf. Twentieth Century Fox Film Corp. v. Marvel
Enterprises, Inc., 2002 WL 1835439, at *3 (S.D.N.Y.
2002) (noting, in context of Federal Rule of Civil
Procedure 33, that a ‘‘corporation responding to
interrogatories must provide . . . the information
contained in its own files and possessed by its own
employees’’).
20 Cf. In re NTL, Inc. Securities Litigation, 244
FRD. 179, 195 (S.D.N.Y. 2007) (construing ‘‘control’’
in Federal Rule of Civil Procedure 34).
21 12 U.S.C. 5534(c)(2).
22 Id.
23 Section 1033(a) requires that covered persons
(not limited to large depository institutions) ‘‘make
available . . . information,’’ including ‘‘in
electronic form,’’ which can be used by third parties
for the provision of products or services to the
consumer. 12 U.S.C. 5533(a). Section 1033 governs
consumer authorized third-party access to data
made available in electronic form in connection
with third-party provision of other products or
services—including for example, the provision of a
potentially competing account offering. This is
why, for example, section 1033 is limited to data
available in the normal course, and why section
1033 requires data to be ‘‘made available . . . in
electronic form.’’ The CFPB is in the process of
writing proposed regulations to implement section
1033 of the CFPA. See CFPB, Required Rulemaking
on Personal Financial Data Rights, https://
www.consumerfinance.gov/personal-financial-datarights/ (last visited Oct. 5, 2023).
VerDate Sep<11>2014
15:48 Oct 13, 2023
Jkt 262001
B. Conditions That Unreasonably
Impede Consumer Information Requests
Section 1034(c) provides that large
banks and credit unions ‘‘shall, in a
timely manner, comply’’ with consumer
requests for information regarding their
accounts for consumer financial
products or services. It is well
established that when the term ‘‘shall’’
is used in statutes, it generally means
that something ‘‘is required.’’ 24 The
addition of the word ‘‘comply’’—which
creates the phrase ‘‘shall . . .
comply’’—further indicates that section
1034(c) creates a mandatory obligation
to do what the consumer requests.25
Section 1034(c) thus grants consumers a
right to request and receive account
information that falls within the scope
of the provision, and imposes a
concomitant legal obligation on large
banks and credit unions to respond to
the consumer’s request and to provide
such account information.
Large banks and credit unions do not
have to provide information in any
particular manner, or using particular
means. However, a large bank or credit
union would not comply with section
1034(c) if it imposed conditions or
requirements on consumers’
information requests that unreasonably
impeded consumers’ ability to request
and receive account information. Under
the plain language of section 1034(c), if
a consumer makes a ‘‘request for
information in the control or possession
of such covered person concerning the
consumer financial product or service
that the consumer obtained from such
covered person’’ that does not fall into
one of the specified exceptions, and a
large bank or credit union refuses to
provide that information unless the
consumer satisfies an unreasonable
condition, the bank or credit union has
failed to ‘‘comply’’ with the request.26
Section 1034(c) does not contain any
language stating or suggesting that a
large bank or credit union may impose
conditions that unreasonably impede
consumers’ information requests. Such
conditions, if permitted, would allow
large banks and credit unions to
frustrate and effectively nullify the right
24 Shall, Black’s Law Dictionary (11th ed. 2019)
(‘‘This [definition] is the mandatory sense that
drafters typically intend and that courts typically
uphold.’’); see Shall, Merriam-Webster Dictionary,
https://www.merriam-webster.com/dictionary/shall
(‘‘shall’’ is ‘‘used in laws, regulations, or directives
to express what is mandatory’’) (last visited Oct. 5,
2023); see also Lexecon Inc. v. Milberg Weiss
Bershad Hynes & Lerach, 523 U.S. 26, 35 (1998)
(recognizing that ‘‘shall’’ is ‘‘mandatory’’).
25 See Reich v. Trinity Industries, Inc., 16 F.3d
1149, 1154 (11th Cir. 1994) (‘‘shall comply’’
language in provision of Occupational Safety and
Health Act was ‘‘mandatory’’).
26 12 U.S.C. 5534(c).
PO 00000
Frm 00009
Fmt 4700
Sfmt 4700
71281
granted in section 1034(c). And there is
no reason to believe that Congress
intended for section 1034(c) to allow
that result.
By contrast, a large bank or credit
union would not violate section 1034(c)
in the context of reasonable conditions
on consumer information requests. For
example, large banks or credit unions
might require that the person making
the request verify their identity, identify
their account, and describe the
information they are seeking. Similarly,
large banks or credit unions might
require the consumer to comply with
reasonable data security measures.
These kinds of conditions, when
implemented in a reasonable manner,
would not unreasonably impede
consumers’ ability to obtain information
regarding their accounts.27
As a general matter, requiring a
consumer to pay a fee or charge to
request account information, through
whichever channels the bank uses to
provide information to consumers, is
likely to unreasonably impede
consumers’ ability to exercise the right
granted by section 1034(c), and thus to
violate the provision. Some consumers
cannot afford to pay even a small fee to
obtain information about their accounts.
Even for consumers who can afford such
fees, the fees can operate as a significant
deterrent to making an information
request. Thus, a large bank or credit
union’s practice of charging fees to
respond to an information request
would generally unreasonably impede
consumers’ exercise of their rights
under section 1034(c). Regardless of
how a large bank or credit union labels
or categorizes a fee on its fee schedule
or other documents, section 1034(c)
does not permit unreasonable
impediments to a request for
information about a consumer’s
account. That likely includes charging
fees (1) to respond to consumer
inquiries regarding their deposit
account balances; (2) to respond to
consumer inquiries seeking the amount
necessary to pay a loan balance; (3) to
respond to a request for a specific type
of supporting document, such as a
check image or an original account
agreement; and (4) for time spent on
consumer inquiries seeking information
27 Relatedly, the CFPB does not interpret section
1034(c) to preempt or otherwise supersede the
requirements of other Federal or state laws and
regulations designed to protect privacy and data
security. This includes, for example, any
restrictions that may be imposed in the CFPB’s
upcoming rule implementing section 1033.
E:\FR\FM\16OCR1.SGM
16OCR1
71282
Federal Register / Vol. 88, No. 198 / Monday, October 16, 2023 / Rules and Regulations
and supporting documents regarding an
account.28
At the same time, it would generally
not violate section 1034(c) for a large
bank or credit union to impose a fee or
charge in certain limited circumstances.
For example, a large bank or credit
union might charge a fee to a consumer
who repeatedly requested and received
the same information regarding their
account (e.g., repeatedly asked for a
copy of the same document).29 In that
context, the large bank or credit union
would have already met its obligation
under section 1034(c) by complying
with the consumer’s earlier requests.
A large bank or credit union may also
violate section 1034(c) by imposing
other conditions or obstacles that
unreasonably impede consumers’ ability
to make an information request.
Depending on the facts and
circumstances, such conditions or
obstacles could include forcing
consumers to endure excessively long
wait times to make a request to a
customer service representative,
requiring consumers to submit the same
request multiple times, requiring
consumers to interact with a chatbot
that does not understand or adequately
respond to consumers’ requests, or
directing consumers to obtain
information that the institution
possesses from a third party instead.30
Such conditions or obstacles may
frustrate consumers’ ability to exercise
their right to request information under
section 1034(c), and thus may violate
that provision.
C. Timely Compliance With Consumer
Information Requests
Section 1034(c) provides that large
banks and credit unions ‘‘shall, in a
timely manner, comply’’ with consumer
requests for information.31 Section
1034(c) thus does not specify a fixed
time limit for responding that applies to
all information requests. The CFPB will
consider the specific circumstances and
nature of a particular request to
determine compliance. For example,
whether a response to a 1034(c) request
ddrumheller on DSK120RN23PROD with RULES1
28 This
is not intended to be an exhaustive list of
the types of fees for consumer information requests
that may be subject to section 1034(c).
29 A consumer would not seek the same
information by asking for information from a
different time period where information can change
over time (e.g., by requesting certain transaction
information for the month of April and then later
seeking the same type of information for the month
of May).
30 The CFPB has recently highlighted the risks
posed by financial institutions’ use of deficient
chatbots. See CFPB, Chatbots in Consumer Finance
(June 6, 2023), https://www.consumerfinance.gov/
data-research/research-reports/chatbots-inconsumer-finance/.
31 12 U.S.C. 5534(c)(1).
VerDate Sep<11>2014
15:48 Oct 13, 2023
Jkt 262001
is timely may depend on the complexity
of the request and/or the difficulty of
responding. Where a request seeks basic
information that is readily available to
a large bank or credit union, to comply
with section 1034(c) a bank or credit
union would generally need to respond
more quickly than if the request is more
complex or seeks information that is
less accessible. At the same time, even
though a timely response for a complex
response may involve a longer time
period, that does not mean that large
banks or credit unions can unduly delay
their responses to more complicated
requests.
What constitutes a timely response
under section 1034(c) may also be
informed by the timing requirements of
other Federal laws and regulations with
which large banks and credit unions
must comply. For example, Regulation
X requires mortgage servicers to respond
to certain information requests within
specific time periods depending on the
nature of the requested information.32 A
large bank or credit union that is subject
to Regulation X and that exceeded
Regulation X’s timing requirements for
an information request likely would not
be responding ‘‘in a timely manner’’ for
purposes of section 1034(c) with respect
to that same information request.
Conversely, a bank or credit union
subject to Regulation X would likely
respond ‘‘in a timely manner’’ for
purposes of section 1034(c) if it
provided a response that satisfied the
timing requirements in Regulation X.
Thus, where both section 1034(c) and
another Federal law or regulation
applies to the same consumer
information request, the CFPB does not
view section 1034(c)’s ‘‘timely manner’’
requirement as likely to impose timing
requirements that differ from the
specific timing requirements of the
other applicable Federal law or
regulation. The CFPB expects that large
banks and credit unions will already
have policies and procedures in place to
meet the timing requirements of other
applicable laws and regulations.
D. Accuracy and Completeness of
Responses to Consumer Information
Requests
By providing that large banks and
credit unions ‘‘shall . . . comply’’ with
consumer requests for information,
section 1034(c) contemplates that large
banks and credit unions will in fact
provide consumers with the information
they request to the extent it is in their
control or possession. A large bank or
credit union would violate section
1034(c) if it provided incomplete or
32 See
PO 00000
12 CFR 1024.36(d)(2).
Frm 00010
Fmt 4700
Sfmt 4700
inaccurate information in response to a
consumer’s information request.
With respect to completeness, a large
bank or credit union would not comply
with section 1034(c) if, for example, the
consumer asked for information about
all of the consumer’s transactions with
a given merchant since the account was
opened, and the large bank or credit
union possesses transaction information
going back seven years, but its response
provides only transaction information
going back one year. However, a large
bank or credit union would not violate
section 1034(c) by withholding
information that falls within the scope
of one of the enumerated exceptions in
section 1034(c)(2).
With respect to accuracy, a large bank
or credit union would not comply with
section 1034(c) if it provided inaccurate
information to consumers in response to
their requests. For example, if a
consumer asked the large bank or credit
union the amount of a particular fee it
charges for the consumer’s account (e.g.,
the amount of a monthly maintenance
fee for a deposit account), a large bank
or credit union would not comply with
section 1034(c) if it provided the wrong
amount for that fee. In that
circumstance, the large bank or credit
union would not be providing
responsive information in its control or
possession (i.e., the correct amount of
the fee).
The CFPB has noted in other contexts
that Federal consumer financial laws
generally apply regardless of the
technology used by institutions.33 The
same principle applies to section
1034(c). Chatbots or other automated
responses may serve to expedite
responses in some cases; however, in
the absence of appropriate checks and
quality assurance processes, these tools
can inadvertently misdirect inquiries or
provide inadequate responses.34 Large
banks and credit unions may violate
section 1034(c) if they employ
technologies that do not properly
recognize consumer information
requests or that provide inaccurate or
incomplete information in response to
those requests.
33 See, e.g., Consumer Financial Protection
Circular 2022–03, ‘‘Adverse action notification
requirements in connection with credit decisions
based on complex algorithms’’ (May 2022), https://
www.consumerfinance.gov/compliance/circulars/
circular-2022-03-adverse-action-notificationrequirements-in-connection-with-credit-decisionsbased-on-complex-algorithms/.
34 See CFPB, Chatbots in consumer finance (June
2023), https://www.consumerfinance.gov/dataresearch/research-reports/chatbots-in-consumerfinance/chatbots-in-consumer-finance/.
E:\FR\FM\16OCR1.SGM
16OCR1
ddrumheller on DSK120RN23PROD with RULES1
Federal Register / Vol. 88, No. 198 / Monday, October 16, 2023 / Rules and Regulations
III. Summary of Section 1034(c)
Obligations
The CFPB is providing this summary
section to assist large banks and credit
unions in complying with section
1034(c). This section is intended to
serve as a simplified summary and a
reference tool, and large banks and
credit unions should refer to the legal
analysis above for further detail and
information.
As discussed above, when a bank or
credit union with over $10 billion in
assets receives a request for information
from a consumer relating to the
consumer’s account for a consumer
financial product or service, section
1034(c) requires the bank or credit
union to respond with information in its
possession or control. The large bank or
credit union must respond to the
request in a timely manner; whether a
response is timely may depend on the
complexity of the request or difficulty of
responding. Responses to consumer
information requests must also be
complete and accurate. Large banks and
credit unions may respond to requests
using any means or channels they
choose.
Consumers need information
regarding their accounts to manages
their finances, and the Advisory
Opinion describes examples of account
information that must be provided upon
request. Consumers can request
information such as account balances,
transaction history, interest rates,
scheduled auto-payments, fees, or
balances necessary to pay off a loan, and
may also request supporting written
documents such as copies or images of
checks or original signed contracts. The
obligation to respond does not include
information that does not concern the
individual consumer’s account, such as
internal operating procedures or
policies, or the company’s financial
performance, marketing strategy, or
training program for its employees. The
obligation also does not apply to
information that falls within the four
enumerated exceptions in section
1034(c), including confidential
information or information collected to
prevent fraud or money laundering.
Section 1034(c) does not bar large
banks and credit unions from imposing
reasonable impediments on consumer
information requests, such as reasonable
identity verification and data security
measures. But large banks and credit
unions may not impose conditions that
unreasonably impede consumers’
information requests. The practice of
charging fees to respond to an
information request would generally
unreasonably impede consumers’
VerDate Sep<11>2014
15:48 Oct 13, 2023
Jkt 262001
exercise of their rights under section
1034(c), and thus violate the provision.
Regardless of how a large bank or credit
union labels or categorizes a fee on its
fee schedule or other documents,
section 1034(c) does not permit
unreasonable impediments to a request
for information about a consumer’s
account. That would likely include
charging fees (1) to respond to consumer
inquiries regarding their deposit
account balance; (2) to respond to
consumer inquiries seeking the amount
necessary to pay a loan balance; (3) to
respond to a request for a specific type
of supporting document, such as a
check image or an original account
agreement; and (4) for time spent on
consumer inquiries seeking information
and supporting documents regarding an
account. Depending on the
circumstances, other kinds of conditions
or obstacles may also violate section
1034(c), such as forcing consumers to
endure excessive wait times, requiring
consumers to submit the same request
multiple times, requiring consumers to
interact with a chatbot that does not
adequately respond to requests, or
directing consumers to obtain
information from a third party.
As a matter of prosecutorial
discretion, the CFPB does not intend to
seek monetary relief for potential
violations of section 1034(c) that occur
prior to February 1, 2024.
IV. Regulatory Matters
The CFPB has concluded that the
Advisory Opinion is an interpretive rule
in part and a general statement of policy
in part. Insofar as the Advisory Opinion
constitutes an interpretive rule, it is
issued under the CFPB’s authority to
interpret the Consumer Financial
Protection Act, including under section
1022(b)(1) of the Consumer Financial
Protection Act, which authorizes
guidance as may be necessary or
appropriate to enable the CFPB to
administer and carry out the purposes
and objectives of Federal consumer
financial laws.35
Insofar as the Advisory Opinion
constitutes a general statement of
policy, it provides background
information about applicable law and
articulates considerations relevant to the
CFPB’s exercise of its authorities. It does
not confer any rights of any kind.
Pursuant to the Congressional Review
Act,36 the CFPB will submit a report
containing this Advisory Opinion and
other required information to the United
States Senate, the United States House
of Representatives, and the Comptroller
PO 00000
U.S.C. 5512(b)(1).
U.S.C. 801 et seq.
General of the United States prior to the
rule’s published effective date. The
Office of Information and Regulatory
Affairs has designated this interpretive
rule as not a ‘‘major rule’’ as defined by
5 U.S.C. 804(2).
The CFPB has determined that this
Advisory Opinion also does not impose
any new or revise any existing
recordkeeping, reporting, or disclosure
requirements on covered entities or
members of the public that would be
collections of information requiring
approval by the Office of Management
and Budget under the Paperwork
Reduction Act of 1995.37
Rohit Chopra,
Director, Consumer Financial Protection
Bureau.
[FR Doc. 2023–22774 Filed 10–13–23; 8:45 am]
BILLING CODE 4810–AM–P
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 39
[Docket No. FAA–2023–1998; Project
Identifier MCAI–2023–01045–R; Amendment
39–22572; AD 2023–20–51]
RIN 2120–AA64
Airworthiness Directives; Airbus
Helicopters
Federal Aviation
Administration (FAA), DOT.
ACTION: Final rule; request for
comments.
AGENCY:
The FAA is adopting a new
airworthiness directive (AD) for Airbus
Helicopters Model AS332C, AS332C1,
AS332L, AS332L1, AS332L2, and
SA330J helicopters. This AD was
prompted by a report of three newly
supplied main rotor swashplate bushing
retaining plates with oversized internal
diameters. This AD requires
accomplishing a one-time inspection to
measure the internal diameter of
affected bushing retaining plates and
depending on the results, accomplishing
an additional inspection, replacing nonconforming bushing retaining plates, or
accomplishing additional corrective
action, as specified in a European Union
Aviation Safety Agency (EASA) AD,
which is incorporated by reference. The
FAA previously sent this AD as an
emergency AD to all known U.S. owners
and operators of these helicopters. The
FAA is issuing this AD to address the
unsafe condition on these products.
SUMMARY:
35 12
36 5
Frm 00011
Fmt 4700
37 44
Sfmt 4700
71283
E:\FR\FM\16OCR1.SGM
U.S.C. 3501–3521.
16OCR1
]]>Agencies
- CONSUMER FINANCIAL PROTECTION BUREAU
[Federal Register Volume 88, Number 198 (Monday, October 16, 2023)]
[Rules and Regulations]
[Pages 71279-71283]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-22774]
[[Page 71279]]
=======================================================================
-----------------------------------------------------------------------
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Chapter X
Consumer Information Requests to Large Banks and Credit Unions
AGENCY: Consumer Financial Protection Bureau.
ACTION: Advisory Opinion.
-----------------------------------------------------------------------
SUMMARY: The Consumer Financial Protection Bureau (CFPB) is issuing
this Advisory Opinion regarding section 1034(c) of the Consumer
Financial Protection Act (CFPA), which requires large banks and credit
unions to comply in a timely manner with consumer requests for
information concerning their accounts for consumer financial products
and services, subject to limited exceptions.
DATES: This Advisory Opinion is applicable as of October 16, 2023.
FOR FURTHER INFORMATION CONTACT: Colin Reardon or Yan Cao, Senior
Counsels, Legal Division, at 202-435-7700. If you require this document
in an alternative electronic format, please contact
[email protected].
SUPPLEMENTARY INFORMATION: The CFPB is issuing this Advisory Opinion
through the procedures for its Advisory Opinions Policy.\1\ Refer to
those procedures for more information.
---------------------------------------------------------------------------
\1\ 85 FR 77987 (Dec. 3, 2020).
---------------------------------------------------------------------------
I. Background
Section 1034(c) of the CFPA requires large financial institutions
to comply with consumer requests for information concerning their
accounts in a timely manner.\2\ This Advisory Opinion interprets this
provision for the purpose of highlighting the obligations it imposes
upon large financial institutions. The CFPB has not previously issued
supervisory findings or pursued an enforcement action under this
provision. This Advisory Opinion is the CFPB's first guidance regarding
section 1034(c).\3\
---------------------------------------------------------------------------
\2\ 12 U.S.C. 5534(c).
\3\ As a matter of prosecutorial discretion, the CFPB does not
intend to seek monetary relief for violations of section 1034(c)
that occur prior to February 1, 2024.
---------------------------------------------------------------------------
Section 1034(c) applies to insured depository institutions and
credit unions that offer or provide consumer financial products or
services and that have total assets of more than $10 billion, as well
as their affiliates.\4\ The provision states that, subject to certain
exceptions, banks and credit unions with over $10 billion in assets
must ``in a timely manner, comply with a consumer request for
information in the control or possession of such covered person
concerning the consumer financial product or service that the consumer
obtained from such covered person, including supporting written
documentation, concerning the account of the consumer.'' \5\ Section
1034(c) is a current legal obligation that became effective on July 21,
2011.\6\
---------------------------------------------------------------------------
\4\ 12 U.S.C. 5534(c)(1) (provision applies to ``a covered
person subject to supervision and primary enforcement by the Bureau
pursuant to section 1025''); see also id. sec. 5481(1), (6)
(defining ``affiliate'' and ``covered person''); id. sec. 5515(a)-
(c) (CFPA section 1025 providing CFPB with supervisory and primary
enforcement authority over insured depository institutions and
insured credit unions with total assets of more than $10 billion and
over their affiliates). For convenience, this Bulletin generally
refers to institutions subject to section 1034(c) as ``large banks
and credit unions.''
\5\ 12 U.S.C. 5534(c).
\6\ Subtitle C of the CFPA, which includes section 1034, became
effective on ``the designated transfer date.'' Public Law 111-203,
title X, sec. 1037. The designated transfer date was July 21, 2011.
See Designated Transfer Date, 75 FR 57252, 57253 (Sept. 20, 2010);
see also 12 U.S.C. 5582.
---------------------------------------------------------------------------
Congress placed section 1034(c) alongside provisions of the CFPA
that establish a process for addressing consumer complaints submitted
to the CFPB. Under sections 1034(a) and 1034(b), when a consumer
submits a complaint or inquiry about a large bank or credit union, that
entity ``shall provide a timely response'' to the CFPB, and the CFPB
then provides a timely response to the consumer, including ``any
responses received'' from the financial institution.\7\ Through section
1034(c), Congress established an additional, direct channel for
consumers to request information from large banks and credit unions
without routing their inquiry through the CFPB or another government
entity. And like a complaint submitted to the CFPB, a request for
information under section 1034(c) can lead to the identification and
resolution of errors by a large bank or credit union involving a
consumer's account.
---------------------------------------------------------------------------
\7\ 12 U.S.C. 5534(a), (b); see also CFPB, Consumer Response
Annual Report at 16-17 (Mar. 2023), https://files.consumerfinance.gov/f/documents/cfpb_2022-consumer-response-annual-report_2023-03.pdf (describing the consumer complaint
process).
---------------------------------------------------------------------------
Responding to consumer requests for information is critical for
ensuring high levels of customer service and enabling consumers to
resolve issues with their accounts when they encounter problems. Large
banks and credit unions possess information that is vital to meet these
customer needs. Too often, however, it can be difficult and time
consuming for individual consumers to obtain a clear answer to
questions or resolve an account issue. The CFPB has observed that some
larger financial institutions have moved away from a traditional
relationship banking model with an emphasis on providing customized
help to individuals.\8\ Such individualized service is now generally
reserved for high net-worth individuals, and is difficult for other
households to find. For most consumers, larger banks and credit unions
frequently rely on highly standardized processes rather than high-
quality human interactions or digital channels that actually facilitate
self-help. When a consumer has a question or problem, they typically
cannot go to an individual at the bank or credit union who is already
familiar with their account, such as the person that originally signed
them up for the product. They are more likely to have to navigate a
phone tree in the hope of speaking to the right person in a call
center, to have to search through largely irrelevant material on a
website to try to find the information they need, or to have to attempt
to get a clear answer from a chatbot.\9\
---------------------------------------------------------------------------
\8\ See CFPB, Prepared Remarks of CFPB Director Rohit Chopra in
Great Falls, Montana on Relationship Banking and Customer Service
(June 14, 2022), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-in-great-falls-montana-on-relationship-banking-and-customer-service/; see also
FDIC, FDIC Community Banking Study at 4-1 (December 15, 2020),
https://www.fdic.gov/resources/community-banking/report/2020/2020-cbi-study-full.pdf (noting that community banks ``tend to focus on
loans as relationships, originating loans that require local
knowledge, a greater personal touch, individual analysis, and
continued administration'').
\9\ See CFPB, Chatbots in consumer finance (June 6, 2023),
https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/chatbots-in-consumer-finance/
(observing that ``automated responses can be highly scripted and
simply direct customers to lengthy policy statements or FAQs, which
may contain very little helpful information, if any''); see also Ron
Shevlin, The Human + Digital Challenge In Banking: Consumers Want
Both at 2, Cornerstone Advisors (2021), https://go.backbase.com/rs/987-MGR-655/images/Backbase_Cornerstone_Human_Digital.pdf (finding,
based on consumer survey, that ``[t]oday's consumers--even those at
the younger end of the age spectrum--want and value high-quality
human interactions in their financial lives'' and that ``[f]inancial
institutions must quickly improve the quality of their digital
channel experiences'').
---------------------------------------------------------------------------
On June 14, 2022, the CFPB issued a request for information asking
the public to provide input on customer service obstacles they face in
interacting with large banks and credit unions.\10\ Commenters relayed
consumers' frustration and difficulty in obtaining critical information
about their accounts.\11\ This includes information
[[Page 71280]]
that consumers need to stay current and avoid fees or penalties; to
identify and resolve errors; and to close accounts that no longer serve
their interests.
---------------------------------------------------------------------------
\10\ See Request for Information Regarding Relationship Banking
and Customer Service, 87 FR 36828 (June 21, 2022).
\11\ See, e.g., Comment from Legal Services NYC at 2 (July 13,
2022), https://downloads.regulations.gov/CFPB-2022-0040-0006/attachment_2.pdf (describing low-income clients who have difficulty
obtaining ``copies of their statements; records related to
restraints placed on their accounts; copies of cashed checks or
money orders; information on fees and charges placed on the
account'' among other information); Comment from Mobilization for
Justice (July 22, 2022), https://downloads.regulations.gov/CFPB-2022-0040-0051/attachment_2.pdf (describing low-income consumers
without internet access who cannot afford fees charged to obtain
hard copies of account statements); Comment from Tzedek DC (Aug. 19,
2022), https://downloads.regulations.gov/CFPB-2022-0040-0084/attachment_1.pdf (describing disabled clients who were denied access
to account information because of the presence of a retained
attorney, and who could not obtain documents a large bank relied
upon to close fraud disputes); see also Nonrulemaking Docket:
Request for Information Regarding Relationship Banking and Customer
Services (CFPB-2022-0040), comments available at https://www.regulations.gov/docket/CFPB-2022-0040/comments.
---------------------------------------------------------------------------
Through section 1034(c), Congress ensured that as banks and credit
unions grow larger they must continue to meet consumers' need for
information necessary to manage their finances, and thus must provide
timely responses to consumer requests for information concerning their
accounts. Such responses help meet consumers' reasonable expectations
for customer service.
II. Information Requests Under Section 1034(c)
A. Consumer Requests for Information Regarding Their Accounts
Section 1034(c) states that, subject to certain enumerated
exceptions, large banks and credit unions ``shall, in a timely manner,
comply with a consumer request for information in the control or
possession of [a large bank or credit union] concerning the consumer
financial product or service that the consumer obtained from [the large
bank or credit union], including supporting written documentation,
concerning the account of the consumer.'' \12\ Thus, section 1034(c)
applies to a consumer's request for information to a large bank or
credit union where the information concerns the consumer's account for
a consumer financial product or service, is in the large bank or credit
union's control or possession, and does not fall into an enumerated
exception.
---------------------------------------------------------------------------
\12\ 12 U.S.C. 5534(c)(1).
---------------------------------------------------------------------------
The CFPA defines ``consumer financial product or service'' to
include several types of financial products or services that consumers
may obtain from a large bank or credit union, including deposit and
savings accounts, credit products such as mortgage loans and credit
cards, and loan servicing.\13\ Under section 1034(c), large banks and
credit unions that offer or provide consumer financial products or
services must comply with consumer requests for information regarding
their accounts. That obligation applies even if consumers do not
expressly invoke section 1034(c).\14\
---------------------------------------------------------------------------
\13\ 12 U.S.C. 5481(5), (15)(A)(i), (iv). It should be noted
that a consumer can receive services from a loan servicer (and thus
``obtain'' a consumer financial product or service from that
servicer) even if the loan servicer is not the original creditor on
the consumer's loan. See 12 U.S.C. 5481(5), (15)(A)(i).
\14\ Nothing in section 1034(c) states or suggests that a
consumer must expressly indicate that they are making a request
under that provision. See 12 U.S.C. 5534.
---------------------------------------------------------------------------
Section 1034(c) applies to consumer requests for information
``concerning'' an account for a consumer financial product or service.
The term ``concerning'' means ``relating to'' or ``regarding'' and
therefore encompasses a wide range of information about a consumer's
account.\15\ Information concerning an account would include account
information that appears on periodic statements or on online account
portals, such as the amount of the balance in a deposit account, the
interest rate on a loan or credit card, and information regarding
transactions or payments involving an account.\16\ It would include
information regarding bill payment and other recurring transactions
involving the account (e.g., a list of all recurring payments out of
the account). It would also include the terms and conditions of the
account, including a schedule of fees that may be charged on the
account. It could also include information about the status of a lien
on real property that was released (or should have been released) years
before. Such information can be necessary for consumers to manage their
accounts and resolve disputes with their bank or credit union, or with
merchants or other third parties. In contrast, section 1034(c) does not
apply to a consumer's request for information that is not specifically
related to a consumer's account, such as information regarding a large
bank or credit union's internal operating procedures, financial
performance, marketing strategy, or training program for its employees.
---------------------------------------------------------------------------
\15\ Concerning, Merriam-Webster, https://www.merriam-webster.com/dictionary/concerning#dictionary-entry-2 (last visited
Oct. 5, 2023); see also Concerning, Oxford English Dictionary,
https://www.oed.com/dictionary/concerning_prep?tab=meaning_and_use
(last visited Oct. 5, 2023) (defining ``concerning'' to mean ``[i]n
reference or relation to; regarding, about'').
\16\ With respect to periodic statements, Regulation DD
describes information that must appear on periodic statements for
deposit accounts held by depository institutions other than credit
unions, see 12 CFR 1030.6(a), and NCUA regulations impose similar
disclosure requirements for credit unions, see 12 CFR 707.6(b).
Regulation E describes information that must appear on periodic
statements for accounts to or from which electronic fund transfers
can be made. See 12 CFR 1005.9. Regulation Z describes information
that must appear on periodic statements for open-end credit plans
(e.g., credit cards and home-equity lines of credit), see 12 CFR
1026.7, 1026.8, and for closed-end residential mortgage loans, see
12 CFR 1026.41.
---------------------------------------------------------------------------
In addition, section 1034(c) requires a large bank or credit union
to comply with a consumer's request for ``information . . . including
supporting written documentation.'' The word ``support'' means ``to
assist,'' ``help,'' or ``provide with substantiation.'' \17\
Accordingly, through its reference to ``supporting written
documentation,'' section 1034(c) requires large banks and credit unions
to provide consumers, upon request, with written documents that will
substantiate information provided in response to consumer questions, or
that will assist consumers with understanding or verifying information
regarding their accounts. For example, under section 1034(c), a
consumer seeking information about past transactions on their account
could request copies of past periodic statements or check images.
Similarly, a consumer seeking information regarding the terms and
conditions governing their account could request a copy of their
account agreement (including a copy of the original signed agreement).
---------------------------------------------------------------------------
\17\ Support, Merriam-Webster, https://www.merriam-webster.com/dictionary/support (last visited Oct. 5, 2023); see also Supporting,
Oxford English Dictionary, https://www.oed.com/dictionary/supporting_adj?tab=meaning_and_use#19725899 (last visited Oct. 5,
2023) (defining ``supporting'' to mean ``[t]hat provides evidence or
authority for something; confirmatory, corroborative.'').
---------------------------------------------------------------------------
Section 1034(c) requires large banks and credit unions to provide
account information and supporting documentation to the extent it is in
their ``control or possession.'' The concepts of ``control'' and
``possession'' are familiar from other contexts involving requests for
information, such as the discovery provisions in the Federal Rules of
Civil Procedure and the Freedom of Information Act.\18\ In the context
of section 1034(c), a bank or credit union ``possesses'' information
that is known by its employees or that can be found
[[Page 71281]]
in its records, such as in its electronic or paper files.\19\ A bank or
credit union can also ``control'' information that it does not
physically possess, where it has the legal right, authority, or
practical ability to obtain the information.\20\ For example, a large
bank or credit union would control information held by an affiliate or
service provider where it has the right or ability to receive that
information from the affiliate or service provider.
---------------------------------------------------------------------------
\18\ See, e.g., Fed. R. Civ. P. 34 (concerning requests for
documents in party's ``possession, custody, or control''); U.S.
Dept. of Just. v. Tax Analysts, 492 U.S. 136, 145 (1989) (stating
that, with respect to requests under the Freedom of Information Act
(FOIA), ``the agency must be in control of the requested materials
at the time the FOIA request is made'' and that ``[b]y control we
mean that the materials have come into the agency's possession in
the legitimate conduct of its official duties'').
\19\ Cf. Twentieth Century Fox Film Corp. v. Marvel Enterprises,
Inc., 2002 WL 1835439, at *3 (S.D.N.Y. 2002) (noting, in context of
Federal Rule of Civil Procedure 33, that a ``corporation responding
to interrogatories must provide . . . the information contained in
its own files and possessed by its own employees'').
\20\ Cf. In re NTL, Inc. Securities Litigation, 244 FRD. 179,
195 (S.D.N.Y. 2007) (construing ``control'' in Federal Rule of Civil
Procedure 34).
---------------------------------------------------------------------------
Large banks and credit unions are not required to provide
information that falls within one of the four enumerated exceptions in
section 1034(c).\21\ Specifically, those exceptions apply to (1)
confidential commercial information, including an algorithm used to
derive credit scores or other risk scores or predictors; (2)
information collected for the purpose of preventing fraud or money
laundering, or detecting or making any report regarding other unlawful
or potentially unlawful conduct; (3) information required to be kept
confidential by any other provision of law; and (4) any nonpublic or
confidential information, including confidential supervisory
information.\22\
---------------------------------------------------------------------------
\21\ 12 U.S.C. 5534(c)(2).
\22\ Id.
---------------------------------------------------------------------------
In addition, section 1034(c) does not require a large bank or
credit union to respond to a consumer information request in a specific
form, such as in writing, orally, or electronically. In this regard,
section 1034(c) differs from section 1033 of the CFPA, which requires
that certain information be made available ``in an electronic form.''
\23\
---------------------------------------------------------------------------
\23\ Section 1033(a) requires that covered persons (not limited
to large depository institutions) ``make available . . .
information,'' including ``in electronic form,'' which can be used
by third parties for the provision of products or services to the
consumer. 12 U.S.C. 5533(a). Section 1033 governs consumer
authorized third-party access to data made available in electronic
form in connection with third-party provision of other products or
services--including for example, the provision of a potentially
competing account offering. This is why, for example, section 1033
is limited to data available in the normal course, and why section
1033 requires data to be ``made available . . . in electronic
form.'' The CFPB is in the process of writing proposed regulations
to implement section 1033 of the CFPA. See CFPB, Required Rulemaking
on Personal Financial Data Rights, https://www.consumerfinance.gov/personal-financial-data-rights/ (last visited Oct. 5, 2023).
---------------------------------------------------------------------------
B. Conditions That Unreasonably Impede Consumer Information Requests
Section 1034(c) provides that large banks and credit unions
``shall, in a timely manner, comply'' with consumer requests for
information regarding their accounts for consumer financial products or
services. It is well established that when the term ``shall'' is used
in statutes, it generally means that something ``is required.'' \24\
The addition of the word ``comply''--which creates the phrase ``shall .
. . comply''--further indicates that section 1034(c) creates a
mandatory obligation to do what the consumer requests.\25\ Section
1034(c) thus grants consumers a right to request and receive account
information that falls within the scope of the provision, and imposes a
concomitant legal obligation on large banks and credit unions to
respond to the consumer's request and to provide such account
information.
---------------------------------------------------------------------------
\24\ Shall, Black's Law Dictionary (11th ed. 2019) (``This
[definition] is the mandatory sense that drafters typically intend
and that courts typically uphold.''); see Shall, Merriam-Webster
Dictionary, https://www.merriam-webster.com/dictionary/shall
(``shall'' is ``used in laws, regulations, or directives to express
what is mandatory'') (last visited Oct. 5, 2023); see also Lexecon
Inc. v. Milberg Weiss Bershad Hynes & Lerach, 523 U.S. 26, 35 (1998)
(recognizing that ``shall'' is ``mandatory'').
\25\ See Reich v. Trinity Industries, Inc., 16 F.3d 1149, 1154
(11th Cir. 1994) (``shall comply'' language in provision of
Occupational Safety and Health Act was ``mandatory'').
---------------------------------------------------------------------------
Large banks and credit unions do not have to provide information in
any particular manner, or using particular means. However, a large bank
or credit union would not comply with section 1034(c) if it imposed
conditions or requirements on consumers' information requests that
unreasonably impeded consumers' ability to request and receive account
information. Under the plain language of section 1034(c), if a consumer
makes a ``request for information in the control or possession of such
covered person concerning the consumer financial product or service
that the consumer obtained from such covered person'' that does not
fall into one of the specified exceptions, and a large bank or credit
union refuses to provide that information unless the consumer satisfies
an unreasonable condition, the bank or credit union has failed to
``comply'' with the request.\26\ Section 1034(c) does not contain any
language stating or suggesting that a large bank or credit union may
impose conditions that unreasonably impede consumers' information
requests. Such conditions, if permitted, would allow large banks and
credit unions to frustrate and effectively nullify the right granted in
section 1034(c). And there is no reason to believe that Congress
intended for section 1034(c) to allow that result.
---------------------------------------------------------------------------
\26\ 12 U.S.C. 5534(c).
---------------------------------------------------------------------------
By contrast, a large bank or credit union would not violate section
1034(c) in the context of reasonable conditions on consumer information
requests. For example, large banks or credit unions might require that
the person making the request verify their identity, identify their
account, and describe the information they are seeking. Similarly,
large banks or credit unions might require the consumer to comply with
reasonable data security measures. These kinds of conditions, when
implemented in a reasonable manner, would not unreasonably impede
consumers' ability to obtain information regarding their accounts.\27\
---------------------------------------------------------------------------
\27\ Relatedly, the CFPB does not interpret section 1034(c) to
preempt or otherwise supersede the requirements of other Federal or
state laws and regulations designed to protect privacy and data
security. This includes, for example, any restrictions that may be
imposed in the CFPB's upcoming rule implementing section 1033.
---------------------------------------------------------------------------
As a general matter, requiring a consumer to pay a fee or charge to
request account information, through whichever channels the bank uses
to provide information to consumers, is likely to unreasonably impede
consumers' ability to exercise the right granted by section 1034(c),
and thus to violate the provision. Some consumers cannot afford to pay
even a small fee to obtain information about their accounts. Even for
consumers who can afford such fees, the fees can operate as a
significant deterrent to making an information request. Thus, a large
bank or credit union's practice of charging fees to respond to an
information request would generally unreasonably impede consumers'
exercise of their rights under section 1034(c). Regardless of how a
large bank or credit union labels or categorizes a fee on its fee
schedule or other documents, section 1034(c) does not permit
unreasonable impediments to a request for information about a
consumer's account. That likely includes charging fees (1) to respond
to consumer inquiries regarding their deposit account balances; (2) to
respond to consumer inquiries seeking the amount necessary to pay a
loan balance; (3) to respond to a request for a specific type of
supporting document, such as a check image or an original account
agreement; and (4) for time spent on consumer inquiries seeking
information
[[Page 71282]]
and supporting documents regarding an account.\28\
---------------------------------------------------------------------------
\28\ This is not intended to be an exhaustive list of the types
of fees for consumer information requests that may be subject to
section 1034(c).
---------------------------------------------------------------------------
At the same time, it would generally not violate section 1034(c)
for a large bank or credit union to impose a fee or charge in certain
limited circumstances. For example, a large bank or credit union might
charge a fee to a consumer who repeatedly requested and received the
same information regarding their account (e.g., repeatedly asked for a
copy of the same document).\29\ In that context, the large bank or
credit union would have already met its obligation under section
1034(c) by complying with the consumer's earlier requests.
---------------------------------------------------------------------------
\29\ A consumer would not seek the same information by asking
for information from a different time period where information can
change over time (e.g., by requesting certain transaction
information for the month of April and then later seeking the same
type of information for the month of May).
---------------------------------------------------------------------------
A large bank or credit union may also violate section 1034(c) by
imposing other conditions or obstacles that unreasonably impede
consumers' ability to make an information request. Depending on the
facts and circumstances, such conditions or obstacles could include
forcing consumers to endure excessively long wait times to make a
request to a customer service representative, requiring consumers to
submit the same request multiple times, requiring consumers to interact
with a chatbot that does not understand or adequately respond to
consumers' requests, or directing consumers to obtain information that
the institution possesses from a third party instead.\30\ Such
conditions or obstacles may frustrate consumers' ability to exercise
their right to request information under section 1034(c), and thus may
violate that provision.
---------------------------------------------------------------------------
\30\ The CFPB has recently highlighted the risks posed by
financial institutions' use of deficient chatbots. See CFPB,
Chatbots in Consumer Finance (June 6, 2023), https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/.
---------------------------------------------------------------------------
C. Timely Compliance With Consumer Information Requests
Section 1034(c) provides that large banks and credit unions
``shall, in a timely manner, comply'' with consumer requests for
information.\31\ Section 1034(c) thus does not specify a fixed time
limit for responding that applies to all information requests. The CFPB
will consider the specific circumstances and nature of a particular
request to determine compliance. For example, whether a response to a
1034(c) request is timely may depend on the complexity of the request
and/or the difficulty of responding. Where a request seeks basic
information that is readily available to a large bank or credit union,
to comply with section 1034(c) a bank or credit union would generally
need to respond more quickly than if the request is more complex or
seeks information that is less accessible. At the same time, even
though a timely response for a complex response may involve a longer
time period, that does not mean that large banks or credit unions can
unduly delay their responses to more complicated requests.
---------------------------------------------------------------------------
\31\ 12 U.S.C. 5534(c)(1).
---------------------------------------------------------------------------
What constitutes a timely response under section 1034(c) may also
be informed by the timing requirements of other Federal laws and
regulations with which large banks and credit unions must comply. For
example, Regulation X requires mortgage servicers to respond to certain
information requests within specific time periods depending on the
nature of the requested information.\32\ A large bank or credit union
that is subject to Regulation X and that exceeded Regulation X's timing
requirements for an information request likely would not be responding
``in a timely manner'' for purposes of section 1034(c) with respect to
that same information request. Conversely, a bank or credit union
subject to Regulation X would likely respond ``in a timely manner'' for
purposes of section 1034(c) if it provided a response that satisfied
the timing requirements in Regulation X. Thus, where both section
1034(c) and another Federal law or regulation applies to the same
consumer information request, the CFPB does not view section 1034(c)'s
``timely manner'' requirement as likely to impose timing requirements
that differ from the specific timing requirements of the other
applicable Federal law or regulation. The CFPB expects that large banks
and credit unions will already have policies and procedures in place to
meet the timing requirements of other applicable laws and regulations.
---------------------------------------------------------------------------
\32\ See 12 CFR 1024.36(d)(2).
---------------------------------------------------------------------------
D. Accuracy and Completeness of Responses to Consumer Information
Requests
By providing that large banks and credit unions ``shall . . .
comply'' with consumer requests for information, section 1034(c)
contemplates that large banks and credit unions will in fact provide
consumers with the information they request to the extent it is in
their control or possession. A large bank or credit union would violate
section 1034(c) if it provided incomplete or inaccurate information in
response to a consumer's information request.
With respect to completeness, a large bank or credit union would
not comply with section 1034(c) if, for example, the consumer asked for
information about all of the consumer's transactions with a given
merchant since the account was opened, and the large bank or credit
union possesses transaction information going back seven years, but its
response provides only transaction information going back one year.
However, a large bank or credit union would not violate section 1034(c)
by withholding information that falls within the scope of one of the
enumerated exceptions in section 1034(c)(2).
With respect to accuracy, a large bank or credit union would not
comply with section 1034(c) if it provided inaccurate information to
consumers in response to their requests. For example, if a consumer
asked the large bank or credit union the amount of a particular fee it
charges for the consumer's account (e.g., the amount of a monthly
maintenance fee for a deposit account), a large bank or credit union
would not comply with section 1034(c) if it provided the wrong amount
for that fee. In that circumstance, the large bank or credit union
would not be providing responsive information in its control or
possession (i.e., the correct amount of the fee).
The CFPB has noted in other contexts that Federal consumer
financial laws generally apply regardless of the technology used by
institutions.\33\ The same principle applies to section 1034(c).
Chatbots or other automated responses may serve to expedite responses
in some cases; however, in the absence of appropriate checks and
quality assurance processes, these tools can inadvertently misdirect
inquiries or provide inadequate responses.\34\ Large banks and credit
unions may violate section 1034(c) if they employ technologies that do
not properly recognize consumer information requests or that provide
inaccurate or incomplete information in response to those requests.
---------------------------------------------------------------------------
\33\ See, e.g., Consumer Financial Protection Circular 2022-03,
``Adverse action notification requirements in connection with credit
decisions based on complex algorithms'' (May 2022), https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/.
\34\ See CFPB, Chatbots in consumer finance (June 2023), https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/chatbots-in-consumer-finance/.
---------------------------------------------------------------------------
[[Page 71283]]
III. Summary of Section 1034(c) Obligations
The CFPB is providing this summary section to assist large banks
and credit unions in complying with section 1034(c). This section is
intended to serve as a simplified summary and a reference tool, and
large banks and credit unions should refer to the legal analysis above
for further detail and information.
As discussed above, when a bank or credit union with over $10
billion in assets receives a request for information from a consumer
relating to the consumer's account for a consumer financial product or
service, section 1034(c) requires the bank or credit union to respond
with information in its possession or control. The large bank or credit
union must respond to the request in a timely manner; whether a
response is timely may depend on the complexity of the request or
difficulty of responding. Responses to consumer information requests
must also be complete and accurate. Large banks and credit unions may
respond to requests using any means or channels they choose.
Consumers need information regarding their accounts to manages
their finances, and the Advisory Opinion describes examples of account
information that must be provided upon request. Consumers can request
information such as account balances, transaction history, interest
rates, scheduled auto-payments, fees, or balances necessary to pay off
a loan, and may also request supporting written documents such as
copies or images of checks or original signed contracts. The obligation
to respond does not include information that does not concern the
individual consumer's account, such as internal operating procedures or
policies, or the company's financial performance, marketing strategy,
or training program for its employees. The obligation also does not
apply to information that falls within the four enumerated exceptions
in section 1034(c), including confidential information or information
collected to prevent fraud or money laundering.
Section 1034(c) does not bar large banks and credit unions from
imposing reasonable impediments on consumer information requests, such
as reasonable identity verification and data security measures. But
large banks and credit unions may not impose conditions that
unreasonably impede consumers' information requests. The practice of
charging fees to respond to an information request would generally
unreasonably impede consumers' exercise of their rights under section
1034(c), and thus violate the provision. Regardless of how a large bank
or credit union labels or categorizes a fee on its fee schedule or
other documents, section 1034(c) does not permit unreasonable
impediments to a request for information about a consumer's account.
That would likely include charging fees (1) to respond to consumer
inquiries regarding their deposit account balance; (2) to respond to
consumer inquiries seeking the amount necessary to pay a loan balance;
(3) to respond to a request for a specific type of supporting document,
such as a check image or an original account agreement; and (4) for
time spent on consumer inquiries seeking information and supporting
documents regarding an account. Depending on the circumstances, other
kinds of conditions or obstacles may also violate section 1034(c), such
as forcing consumers to endure excessive wait times, requiring
consumers to submit the same request multiple times, requiring
consumers to interact with a chatbot that does not adequately respond
to requests, or directing consumers to obtain information from a third
party.
As a matter of prosecutorial discretion, the CFPB does not intend
to seek monetary relief for potential violations of section 1034(c)
that occur prior to February 1, 2024.
IV. Regulatory Matters
The CFPB has concluded that the Advisory Opinion is an interpretive
rule in part and a general statement of policy in part. Insofar as the
Advisory Opinion constitutes an interpretive rule, it is issued under
the CFPB's authority to interpret the Consumer Financial Protection
Act, including under section 1022(b)(1) of the Consumer Financial
Protection Act, which authorizes guidance as may be necessary or
appropriate to enable the CFPB to administer and carry out the purposes
and objectives of Federal consumer financial laws.\35\
---------------------------------------------------------------------------
\35\ 12 U.S.C. 5512(b)(1).
---------------------------------------------------------------------------
Insofar as the Advisory Opinion constitutes a general statement of
policy, it provides background information about applicable law and
articulates considerations relevant to the CFPB's exercise of its
authorities. It does not confer any rights of any kind.
Pursuant to the Congressional Review Act,\36\ the CFPB will submit
a report containing this Advisory Opinion and other required
information to the United States Senate, the United States House of
Representatives, and the Comptroller General of the United States prior
to the rule's published effective date. The Office of Information and
Regulatory Affairs has designated this interpretive rule as not a
``major rule'' as defined by 5 U.S.C. 804(2).
---------------------------------------------------------------------------
\36\ 5 U.S.C. 801 et seq.
---------------------------------------------------------------------------
The CFPB has determined that this Advisory Opinion also does not
impose any new or revise any existing recordkeeping, reporting, or
disclosure requirements on covered entities or members of the public
that would be collections of information requiring approval by the
Office of Management and Budget under the Paperwork Reduction Act of
1995.\37\
---------------------------------------------------------------------------
\37\ 44 U.S.C. 3501-3521.
Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2023-22774 Filed 10-13-23; 8:45 am]
BILLING CODE 4810-AM-P
