Whose Rule Is It Anyway? Unpacking CFPB’s Rule 1033

[00:00] John McKechnie: There’s an old joke in Washington that, “When in doubt, read the rule.” So I actually read the rule, and there’s an outline in it about obligations and limitations on how companies collect data. It also covers how they store data. It requires financial institution to share data in a certain standardized format. All those things are in the rule, and yet when they talk about it in specific, very few answers are coming out of CFPB at this point.

[00:30] Narrator: Welcome to 22 Minutes in Lending, your go-to podcast for insights on all things lending, from lending practices, regulatory updates, how to enhance lending efforts, and more. In each episode, Vince Passione connects with industry leaders to discuss the latest trends and happenings around the lending industry. Let’s dive into the latest in lending.

[00:53] Vince Passione: Welcome everyone to 22 Minutes in Lending. I’m your host, Vince Passione, and our guest today is John McKechnie, a governmental affairs expert and passionate credit union advocate.

[01:02] Vince Passione: With nearly 40 years of experience working with foreign alongside credit unions, John has extensive knowledge in legislative advocacy and financial policy and is currently a principal of his own lobbying firm.

[01:13] Vince Passione: Previously, John worked on the House Banking Committee, led congressional affairs at CUNA, and served as the NCAA’s public and congressional affairs Director. John, thank you for being here today. Let’s get started.

[01:23] John McKechnie: Thank you.

[01:25] Vince Passione: So, John, this podcast is pretty timely. October 22nd. This year was a big day. The Consumer Federal Protection Bureau finalized the long-anticipated personal financial data rights legislation. So talk to us about it. What’s in it? What does it mean to our credit unions?

[01:40] John McKechnie: Well, what’s in it is really a lot of different things that, unfortunately, have engendered a lot of controversy in the financial service world. The rule, as you say, was finalized on October 22nd. It is not effective yet, but once it is effective, it would require depository institutions like credit unions and other non-depository institutions that use financial services, it would require those to make information available to consumers, and it would also… Essentially, all transaction information and all account information would be required to be made available under this new regulation.

[02:26] John McKechnie: Sounds pretty innocuous, but as a lot of things in this business, the devil is in the details, and immediately, there was quite a bit of pushback at CFPB about how the rule was too broad, too expansive, lacked a lot of safeguards in terms of data privacy. In other words, it’s quite a controversial issue in the month plus that it’s been on the books. Not effective yet but I think… and we’ve actually already seen some court challenges, which I’ll talk about later, but the point is this is quite a topic of conversation here in Washington.

[03:06] Vince Passione: So, John, we talked before we got started recording about the history behind this, and I have some history, and clearly, you do. So I go back to 1999. It was sort of the beginning of the internet bubble, and there are a whole bunch of things going on, right. Lots of online shopping and data aggregators came to the field around that same time. [inaudible 00:03:25] we started back then.

[03:27] Vince Passione: I had a startup called OnMoney.com, and we were the first screen scrapers, right. We were the folks out there basically scraping HTML tags and aggregating data on behalf of clients. At that time, there was a company called Paytrust. They were doing it to help people basically pay their bills. They were sued at that time by First Union Bank on the question was, whose data is it really?

[03:49] John McKechnie: Right.

[03:49] Vince Passione: And how these account agreements define whose data it is. So tell us the history behind this, right, the Dodd-Frank Act? But some of the history from your perspective.

[03:57] John McKechnie: Well, that… you just nailed it. There’s been a need, I think, and a recognition for consumers to have some degree of control over their data, personal data, and it really initially had gotten to the point where people wanted to have the data portable. They wanted to be transferable among clients… among providers, rather.

[04:21] John McKechnie: I think that the Dodd-Frank Act, which you referenced, that was the law, passed in 2010, mostly in response to the financial crisis, but that gave CFP… [inaudible 00:04:34] created CFPB, and it gave them some marching orders to come up with this regulation to better govern and better define how consumers use their data. A pretty… Again, a pretty simple concept. It’s been questioned by the way away how much additional government rulemaking was necessary given the fact that consumers already, at least at the time, appeared to have a lot of latitude on accessing their own data.

[05:02] John McKechnie: As a matter of fact, some financial institutions advocates at the time said, “Look, consumers have immense amounts of data at their disposal already, can move it around as they see fit. Why do we need to put a regulation on the books?” That’s a fair question. CFPB would say that, Well, it’s not a matter of access. It’s more a matter of protection,” which I’ll interject something, by the way. The day that the regulation was put on a… put out by CFPB, Director Rohit Chopra appeared in a live TV interview on CNBC Squawk Box.

[05:37] John McKechnie: I’m sure listeners pay attention to that show, and he was asked some very specific questions about how the data would be protected once it was transferred from point A to point B and I was surprised at how vague his answers were, and I think the host of the show was also surprised and she kept on quizzing him about it because the truth is Chopra’s answers on that question were more or less, “We’ll get to that. We’ll cross that bridge when we come to it,” and that’s not a really great answer to hear from a federal regulator that’s supposed to be very precise and very exacting about how this data is used and protected.

[06:14] John McKechnie: I think a lot of people in the financial services industry, a lot of credit unions that I’ve heard from are wondering what are the data standards. What are the requirements? How is the data exactly going to be protected in the transfer process? These are important questions that frankly are not dealt with in this regulation. That’s one of the reasons I think a group of banks already have sued CFPB about the vagueness of the regulation.

[06:40] Vince Passione: Yeah. Well, John, I talked about my history. So in ’97, I was the CTO at Citigroup on the other side of those screen scrapers, and the challenge was exactly the challenge that I think the commentator on Squawk Box was quizzing Rohit Chopra about, which is, “Okay, that’s great. I’ll make the data available, but once I make that data available, what’s my responsibility?” Because today, we have the luxury, right. I do banking with Citigroup.

[07:09] Vince Passione: I was there for quite a number of years as an employee, so I stayed loyal to them. When there’s an issue with my credit card, Citi will call me and tell me there’s some strange, suspicious activity, and if I call them up and say to them, “That’s not me,” they do a great job of turning around and shutting down the card and then basically reversing those transactions to the extent that they can. But there’s no impact to me personally, which costs a great deal of money-

[07:31] John McKechnie: Correct.

[07:33] Vince Passione: … too. And-

[07:33] John McKechnie: The cost is a significant point. I’m glad you brought that up because that’s another thing that I’ve heard overwhelmingly from credit unions is what’s the price tag on this? And it’s very, very poorly defined or understood at this point, and that kind of needed to be defined and understood before the rule was put on the books, I think. There’s an old joke in Washington that, “When in doubt, read the rule.” So I actually read the rule, and there’s an outline in it about obligations and limitations on how companies collect data.

[08:03] John McKechnie: It also covers how they store data. It requires financial institution to share data in a certain standardized format. All those things are in the rule, and yet when they talk about it in specific, very few answers are coming out of CFPB at this point, and I think that’s a surprising shortcoming. It also… I think the rule has a noble purpose of trying to seek… it seeks a way to better empower consumers in the way that they use their financial data.

[08:33] John McKechnie: And yet again, there’s not very good definition so far, which has led to a lot of questions that I’ve heard from credit unions and even from people in Capitol Hill about exactly what’s going to be the price tag and what are the real requirements. This is a… We’re in a very, very vague area right now, and it shouldn’t be. It should be… This is the type of that should be very precise and very concise, and yet it’s not. And I mentioned a few minutes ago, there’s a lawsuit.

[09:02] John McKechnie:
The day after this regulation was promulgated in final form, the Kentucky Bankers Association, a Kentucky bank, and one other, I think it was a FinTech, all filed suit in the US federal’s courts in Kentucky, challenging the regulation. It said that CFPB lacked the statutory authority to do this. It said that CFPB had not written a concise enough rule, which we were just talking about in general. I think it signaled that there’s going to be significant pushback. I mean, that was… they were on the steps of the courthouse less than 24 hours after the regulation came out, which I was impressed by.

[09:44] Vince Passione: Now, John. There was a lot of discussion about some of the payment apps and digital law providers, like Apple Pay, PayPal, Venmo, that they were under this remit, and that was a big surprise. How big a surprise was that really?

[09:58] John McKechnie: It was not a surprise to me in the sense that because there’s a general perception that the financial technology landscape is evolving so quickly, I think that this regulation, in that sense, was written to be very, very broadly encompassing, all-encompassing.

[10:18] John McKechnie: Because I think that people realize, correctly, that the financial services provider landscape that exists in 2024 is not going to be the one that exists in 2030, which is, by the way, when smaller providers would have to comply with this regulation.

[10:33] John McKechnie: April 30th… I’m sorry, April 1st, 2030, is when smaller providers have to comply. So there’s a sense that things are moving fast, and they wanted to cover as much as possible. That part I commend them on.

[10:46] Vince Passione: Now, John, you talked about the timeline. There is a rollout based on asset size, right?

[10:53] John McKechnie: Right.

[10:55] Vince Passione: Someone like Navy, the largest credit union in the industry, it looks like, from what I could see looking at the rule, it’s not probably until 2027 that they get impacted.

[11:04] John McKechnie: Right.

[11:05] Vince Passione: But are there some milestones that our listeners should be thinking about?

[11:08] John McKechnie: Well, April 1st seems to be the date that each of these standards are met. April 1st, 2026 is larger providers, middle providers in 2027, and smaller in 2030.

[11:21] Vince Passione: Got it.

[11:22] John McKechnie: I say if I were writing a rule, by the way, I wouldn’t make it effective April Fool’s Day, which is what they [inaudible 00:11:27].

[11:29] Vince Passione: I didn’t catch that. You’re right. So lots of pushback from the banks, pushback from the credit unions. Is this an opportunity where you see credit unions and banks getting on the same page and aligning forces, or is this just by happenstance?

[11:47] John McKechnie: Well, I hope they do. I mean, there are ways in which credit unions and banks stand shoulder to shoulder in certain issues. A big issue now that I’m dealing with on Capitol Hill, of course, is the Credit Card Competition Act, which is something that Senator Durbin, Senator Marshall have attempted to pass that would restrict the way credit interchange fees are levied.

[12:08] John McKechnie: That’s a place where credit unions and banks have common cause, and they’ve done a good job of working together. I’ve been involved in the credit union advocacy world for a long time. Generally, there’s a lot of tension, I would say, between us and the banking industry, but I see no reason why we can’t work together on something like this. This is pretty obviously something that impacts both types of institutions, and I think we have common concerns about it. Let’s just put it that way.

[12:36] Vince Passione: So thinking about… we talked about the impact to credit unions and banks, but the rule itself and the ability for consumers to own their data, as someone who’s on the other side of it as part of my career, makes a lot of sense, and I think it makes sense to most consumers, but it is their data.

[12:53] Vince Passione: The challenge is keeping it secure, I think, right, and the cost of doing that and who’s responsible. But do you see some kind of sort of trickle-down effect to the broader credit union system? For example, do you see this being a new standard of care, and every credit union now will have to adhere to it because consumers expect that functionality?

[13:12] John McKechnie: That’s an excellent way to put it. I think that credit unions always ought to put their members first. I hope… I mean, that’s been my experience. I’m happy to say over my nearly 40 years around the industry, credit unions do a great job of keeping the member first in mind. So I think that should be easy for us to do.

[13:29] Vince Passione: Mm-hmm.

[13:29] John McKechnie: The standards you’re talking about, the costs, and frankly, the liability that we have no control over. Once the data is shared outside of the four walls of a credit union, that’s worrisome for a lot of credit unions who figure that there was… they’re liable in the eyes of their members to get this data available and make it available and get it out the door if they need to get it out the door. And yet, what happens to it after that is beyond the credit union control.

[13:55] John McKechnie: That’s another thing. I mean, we’re in a brave new world of technology. I agree with that, but I think credit unions are wise to be wary about the lack of definition and, frankly, the lack of legal liability and how that’s limited. Because I talked to a credit union CFO… I’m sorry, CTO, credit chief technology officer last week, and she was just very worried about the actual process of transferring consumer data.

[14:21] John McKechnie: It’s not as simple as it’s just pressing a button. And she said, “Look, there’s untold liability that waits out there for us if something goes wrong, and in a lot of cases, the members are going to come to the credit union and maybe blame them for a breach that doesn’t occur under our control.” So I don’t want to be overly critical of CFPB and say they opened a can of worms, but they kind of did.

[14:48] Vince Passione: No, they did. And I think in some ways for good reason because when you listen to that interview on Squawk, Chopra went to the logical part of it, and the one that’s the consumer-facing piece is the ease at which consumers can switch accounts if they want to, right. You see in situations, where consumers turn around and switch a bank account, but they don’t move their payment instructions and they miss a payment on a loan. As someone that services loans, it happens.

[15:14] Vince Passione: And that’s unfortunate, especially younger consumers who tend to do that more frequently. They damage their credit scores as a result. So I think there’s a huge positive side for the consumer, and it overcomes friction in the system. That makes sense. People should have choice, but at the end of the day, as you point out, there’s a lot of liability here and understanding the chain of custody.

[15:41] John McKechnie: That’s right.

[15:42] Vince Passione: [inaudible 00:15:42] point that I hand it to you and you’re responsible for it versus me, I don’t think the consumer’s going to know that they’re not really seeing what’s happening behind the scenes.

[15:50] John McKechnie: Well, I looked at the lawsuit that was filed. I mentioned it was filed by the… actually, it was the Bank Policy Institute, which is the National Bank Association, as well as the Kentucky Bankers. But what they’ve specifically talked about and what they honed in on that I agree with is that there’s no oversight of third parties required in this regulation.

[16:10] John McKechnie: So if a third party gets consumer data from a credit union or a bank, I mean, we’re almost responsible for ensuring that it’s protected, and yet we have no ability to do that from a practical standpoint. That’s a huge legal sticking point that I hope the courts look at and push back on.

[16:29] John McKechnie: They also, the thing that concerned me was the likelihood of fraud and scams that are underneath the weak safeguarding processes. It’s a scary environment out there, and credit unions are going to be putting member data into that environment without much in the way of reassurance.

[16:48] Vince Passione: Yeah, I agree. I see it today with packages like Venmo. Anybody that’s using it today, right, you’ll see all these disclosures come from your financial institution, credit union, or banks saying, “Be aware what you’re doing. Make sure that this is the right number you’re transferring to,” because if it goes badly, even if it’s the consumer’s fault, consumers usually turn around and go to the financial institution and say, “Please fix it.”

[17:12] John McKechnie: Mm-hmm.

[17:12] Vince Passione: So this should be a good day for FinTechs. I remember when last… the year before last, Rohit Chopra was at Money 2020 talking about open banking, and there were a bunch of FinTechs in the audience standing and applauding. Right. Access to data, it’s the fuel that drives many of their platforms. So how do you view that and how do you view… we touched on a little bit, today, should… is the CFPB going to, you believe, start to focus more on FinTechs now it’s giving them the data and say, “Now you need to be responsible for it?”

[17:47] John McKechnie: Well, that’s a question that’s difficult to answer, and I’m trying to be, again, fair to CFPB, but you’d think that there would be some kind of third-party accountability in this regulation. I don’t see it. It’s not there. There’s no accountability. I think CFPB is gradually recognizing the importance of FinTechs, but there they’re not… I think they realize that it’s very difficult to get their arms around it right now. This rule may have been a half step in the right direction, but again, the liability and lack of accountability and third parties should concern every credit union in the country, and I’m sure it does.

[18:28] John McKechnie:
I think one thing that comes to mind, and I’d be remiss if I didn’t mention it pretty early in this discussion, or well, it’s not that early in the discussion, but on Capitol Hill, because of the change in the election, you now have Republican majorities in both the House and the Senate. I think there’s a very strong likelihood that, in the House of Representatives, there’s going to be something called the Congressional Review Act, which is a resolution passed that can actually rescind a regulation, take it off the books within 60 business days of it being promulgated.

[19:06] John McKechnie: I think the Republican House and Senate are going to repeal this regulation and force CFPB to go back to the drawing board. It’s required by… The regulation’s required in law. So I think we’re going to get a regulation. I think this one’s not going to stand the test of time, though. I think, in the first few months of next year, you could see this thing rescinded.

[19:27] Ron Draper: This is Ron Draper, CEO of Somerville Credit Union. So, in 2014, we were looking for a turnkey student lending solution, one that was simple and efficient for our members to access. And eventually, we chose LendKey because it just integrated seamlessly for quick member mobile access and was easy to remotely review and approve from a loan officer point of view. And I should know, because I’m that loan officer. I still recommend LendKey to people whenever I get the chance because, after almost a decade, it can continues to offer consistent product and service delivery both to our membership and to our staff.

[20:05] Vince Passione: Yeah. And Trump’s moving pretty quickly in his appointments as well. So, with that, what are the other big potential legislative shifts that credit unions should be preparing for with this new administration?

[20:17] John McKechnie: Well, I mean, I think one of the things that we’re going to see is a pretty significant Tax Reform Bill put on… put in front of Congress and credit unions, as long as I’ve been around, that’s been kind of the central issue that credit unions try to protect on Capitol Hill.

[20:34] John McKechnie: I feel pretty good about the arguments the credit unions might bring to that debate if it does happen, but I also think that the need for revenue on Capitol Hill, plus the fact that they seem to be ready to put the entire tax code on the table, I think that means there’s potential for some pretty nervous days for credit unions on Capitol Hill come 2025, and I think it’s going to happen quickly in the early half of 2025.

[21:03] John McKechnie: The Congress seems to be anxious to move on tax reform. There’s a lot of expiring tax provisions from the 2017 law that they want to tackle. So that would be one thing I think that’s going to be a big issue for credit unions to pay attention to.

[21:20] Vince Passione: So taxation, do you think [inaudible 00:21:22]-

[21:22] John McKechnie: Yes. Yes. I do, but again, I feel good about our chances. I like our team, I like our arguments, but a lot of our friends on Capitol Hill are saying, “We’re with you, but you’re going to need to polish up your arguments and be ready to engage,” and that’s good… I think that’s good advice anyway. I like the idea of credit unions being involved in the process.

[21:47] Vince Passione: So [inaudible 00:21:47] anything other than taxation right now on the consumer side? I mean, what’s good for the consumer that you see in the way of some regulatory changes?

[21:55] John McKechnie: Well, there’s probably going to be some regulatory relief legislation that… That’s kind of standard, that’s kind of red meat for Republicans generally. They like to pare back the size and scope of government, so they’re going to probably put out some regulatory relief legislation. I think also, we haven’t talked much about NCUA, the National Credit Union Administration, but I think there may be some personnel changes there too.[22:19):
The president possibly could replace the current chairman, Todd Harper with Kyle Hauptman who is the single Republican on the board. Chairman Harper could… would still remain on the board, but not in the capacity of chairman. The president can make the change of chairman with the stroke of a pen.

[22:40] John McKechnie: I think you may see things… you may see a reevaluation of how consumer regulations are put forth. NCUA has had, I think, a strong emphasis on fair lending activities and on things like overdraft that Chairman Hauptman may want to later touch on. That’s going to be some changes.

[23:03] Vince Passione: Any focus on just things like liquidity, and when we think about regulatory capital? I mean, credit unions struggled so much in the last sort of two years around regulatory capital requirements and liquidity. Do you see any sort of new and interesting ideas about how to manage that, giving credit unions more access to potentially other sources of capital?

[23:24] John McKechnie: Well, that’s… I’m glad you brought liquidity up because that’s been something that has sort of, pardon the pun, ebbed and flowed in terms of the importance of it. Credit unions about two years ago, shortly after the pandemic, there was some real concern about liquidity, and it was not a uniform picture nationally. There was regional liquidity strains. Other parts of the country didn’t experience that.

[23:48] John McKechnie: I think credit unions continue to… I think they’re doing a great job of managing liquidity, but they could also use more sources. So NCUA has a central liquidity facility, which is an important backstop. I’d like to see that get modernized on Capitol Hill. That’s not a major issue on a day-to-day basis, but it’s something that Congress really ought to look at assessing. I think the corporate credit union system has done a very good job staying on top of issues like that.

[24:20] John McKechnie: But again, more is better, more choices, more alternatives. The regulatory capital regime has been something that’s evolving. I suspect that the Fed may try to pare back some of the Basel III required capital requirements, but the point is, I think credit unions do well when they’re agile, when they stay on their toes, and when they look at the whole playing field. I expect good things because I think credit unions generally do a very good job of managing their balance sheets.

[24:55] Vince Passione: No, agreed. Agreed. Well, everyone, that’s all the time we had for today. John, thank you so much for joining me. I appreciate your time and your insights, and thank you to all of our listeners for tuning in. Don’t forget to subscribe so you can enjoy future episodes, and I’ll meet you back here at our next 22 Minutes in Lending.

[25:11] Narrator: Thank you for listening to the 22 Minutes in Lending podcast. We hope you enjoyed today’s episode. You’ll find links to any resources mentioned in the show notes. If you’re enjoying our show, be sure to subscribe and leave us a five-star review.