Consumer Financial Protection Bureau Publishes First Risk-Based Supervisory Designation Order in a Contested Matter

On February 23, 2024, the Consumer Financial Protection Bureau (CFPB or Bureau) announced that it was asserting supervisory jurisdiction over World Acceptance Corp., one of the nation’s largest nonbank consumer small-dollar lenders. The CFPB’s decision and order (Order) state that supervision is warranted because the Bureau has reasonable cause to find that World Acceptance’s activities constitute a risk to consumers.¹ This marks the first time the CFPB has publicly invoked its previously dormant risk-based supervision authority, and it offers clues about how the CFPB plans to apply this authority to consumer lenders, financial-technology companies, payment-service providers, and other nonbank consumer-financial-services companies.

Legal Background

The Dodd-Frank Wall Street Reform and Consumer Protection Act authorizes the CFPB as part of its supervision authority to “require reports and conduct examinations” of certain entities in the market for “consumer financial products and services.”² Under the statute, the Bureau may supervise several categories of “covered persons,” including large banks and credit unions, certain lenders, “larger participants” in designated markets, and, relevant here, any entity that “the [CFPB] has reasonable cause to determine … is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”³ 

While the CFPB’s risk-based supervisory authority has been on the books since 2010, the Bureau left that authority unused for more than a decade. Then, in 2022, the Bureau announced plans to begin invoking this authority to “help protect consumers and level the playing field between banks and nonbanks.”⁴ In connection with that announcement, the CFPB issued a procedural rule describing the process by which it would make such designations and, in a drastic shift from supervision practice, gave itself the right to make those designations public.⁵ Since then, the CFPB has issued notices to entities that it believes may be putting consumers at risk — leading several entities to consent to supervision on a confidential basis.⁶ The Order, however, marks the first time that the CFPB has made public a supervisory designation in a contested matter pursuant to the procedural rule. 

The Order

The World Acceptance Order illustrates the process and timeline that an entity may face in responding to a notice of risk designation. Consistent with the CFPB’s 2022 procedural rule, an initiating official — in this case the Assistant Director for Supervision — sent World Acceptance a notice of reasonable cause in March 2023.⁷ After several months of oral and written responses, as well as briefs by both sides, the CFPB issued the Order in November 2023, more than eight months after the designation process began and several months before the Order was published.⁸  

The Order offers four grounds for concluding that World Acceptance may pose a risk to consumers. First, it states that World Acceptance bundled loans and insurance coverage without adequately explaining the relevant terms, thereby burying “expensive and unwanted … products” within the terms of other products. Second, it suggests that World Acceptance has engaged in harassing and embarrassing collection practices. Third, it notes concerns over inaccurate credit reporting and inadequate error resolution. Finally, it cites a high rate of refinance, which has the potential to create debt cycles.⁹ The Order describes these risks in general terms rather than alleging that World Acceptance engaged in unfair, deceptive, or abusive acts or practices or violated the Truth in Lending Act, Fair Debt Collection Practices Act, Fair Credit Reporting Act, or other federal consumer-financial-protection law. 

Consistent with the CFPB’s statutory mandate to make reasonable-cause determinations “based on complaints… or information from other sources,” the Order relies heavily on the CFPB’s Consumer Complaint Database.¹⁰ The Order cites multiple consumer complaints as a basis for each of the concerns described above, along with World Acceptance’s responses to those complaints.¹¹ Significantly, the CFPB takes the position that an entity need not be the subject of a “unique volume of complaints” and that “factual disputes” do not render particular complaints an improper basis for asserting supervision.¹² Per the Order, consumer complaints are “sufficient to establish reasonable cause that [World Acceptance’s] conduct poses risks to consumers.”¹³ Other sources of information cited include public company reporting and World Acceptance’s response to the notice of reasonable cause, although many footnotes that might further describe the CFPB’s approach to information gathering are redacted.

Notably, although the Order details the practices that support the Bureau’s decision that World Acceptance constitutes a risk to consumers, it also explains that it “does not constitute a finding that the entity has engaged in wrongdoing.”¹⁴ In fact, the Order comes after the CFPB “previously investigated … but later closed its investigation” of World Acceptance.¹⁵ Instead, the Order simply states that the CFPB has “reasonable cause” to believe that an entity poses risks, which the CFPB asserts need not be “unique or specific” to the targeted entity.¹⁶

Supervision

As a result of the Order, World Acceptance now needs to prepare for CFPB supervision. For those entities that have not been subject to federal financial supervision, supervision can be a costly and resource-intensive process. Once an entity is subject to CFPB supervision, the Bureau takes the position that it may examine any consumer financial product or service offered by a supervised entity — not just the products or services that triggered supervision.¹⁷ To that end, Bureau examiners engaged in the supervision process may ask the entity for any information that they deem relevant. The CFPB’s 1,800-page examination manual lists a vast array of such data — from internal audit reports to informal training documents.¹⁸ Examiners may also visit the entity to interview personnel, make observations, conduct transaction testing, and oversee other processes.¹⁹ While there, examiners may inspect corporate offices and client-facing sites and demand meetings with the supervised entity’s board of directors or principals.²⁰

At the end of the examination, the CFPB issues a report or letter listing the entity’s compliance rating as well as other findings, matters requiring attention, and supervisory recommendations.²¹ The CFPB will then meet with the supervised entity’s board of directors or principals to discuss the findings.²²

When there are negative examination findings, the CFPB may request informal supervisory measures, such as a commitment by the supervised entity to change its business practices or to pay restitution to affected consumers. When examiners identify potential violations of consumer-financial-protection law, they may issue a potential action and request-for-response (also known as a PARR letter) that describes such violations and provides the entity an opportunity to respond. Findings of potential legal violations may also be referred to the CFPB Office of Enforcement, which can then conduct an investigation that leads to a public enforcement action. While the examination report, documents and materials collected pursuant to supervision, and communications between the CFPB and the supervised entity are confidential,²³ the CFPB may refer matters to other regulators²⁴ and make those materials available to the Office of Enforcement. The CFPB may also use collected materials on an anonymized basis when it periodically publishes its Supervisory Highlights.

CFPB supervision is an involved process that requires careful navigation and thorough preparation. The World Acceptance Order is the CFPB’s first public risk-supervision decision, but it is not likely to be the last.  

¹ World Corp., Decision and Order (Public Version) (Consumer Financial Protection Bureau, 2023), available here.

² 12 U.S.C. § 5514(b)(1); id. § 5515(b)(1).

³ Id. § 5514(a)(1).

⁴ Consumer Financial Protection Bureau, “CFPB Invokes Dormant Authority to Examine Nonbank Companies Posing Risks to Consumers” (Apr. 25, 2022), available here.  

⁵ 87 Fed. Reg. 25,397.

⁶ See Consumer Financial Protection Bureau, Supervisory Highlights, Issue 30 (Summer 2023) at 31, available here. 

⁷ Order at 6. 

⁸ Id.

⁹ The Order notes that in 2023 over 70% of World Acceptance’s loan originations were refinancings of existing loans. Id.

¹⁰ 12 U.S.C. § 5514(a)(1)(C).

¹¹ See Order at 7–17.

¹² Id. at 18.

¹³ Id

¹⁴ Consumer Financial Protection Bureau, “CFPB Orders Federal Supervision for Installment Lender Following Contested Designation” (Feb. 23, 2024), available here.

¹⁵ Order at 20.

¹⁶ Id. at 19.

¹⁷ See generally CFPB, CFPB Supervision and Examination Manual (June 2023), available here.

¹⁸ Id., Credit Card Account Mgmt. at 91–93.

¹⁹ Id., Examinations and Targeted Revs. at 5.

²⁰ Id., Examinations and Targeted Revs. at 5, 10.

²¹ Id. Examinations and Targeted Revs. at 16–17 (capitalization omitted).

²² Id. at 17.

²³ 12 C.F.R. § 1070.2(i).

²⁴ CFPB Supervision and Examination Manual, Overview at 6–9.