A FinTech Discussion: An Overview of Select Legal and Regulatory Issues That Arise in the FinTech/Bank Partnership Space Obrea Poindexter Sean Ruff

March, 17, 2016

1 mofo

What is FinTech? • FinTech is a term to describe the intersection between finance

and technology • It often refers to technical innovation being applied to a traditional

financial service, or it may refer to innovative financial services offerings that disrupt the existing financial services market

Why is it important? • It is one of the fastest growing segments of the financial services

marketplace • Global investment in FinTech tripled to an estimated $12.2 billion in

2013, according to a report by Accenture • A number of factors are driving FinTech growth, including:

– The expansion of digital connectivity – The economic downturn and financial institutions turning to technology

as a way of improving their processes while reducing costs – The new regulations and the penalties associated with getting it wrong

creating a demand for managing compliance and reducing risk

What Is FinTech?

2 mofo

• FinTech/Bank partnerships can be a Win/Win – FinTech companies have the opportunity to leverage the strengths of

bank partners • Quick to market strategies for FinTech companies • The bank’s experience with risk and regulations • The bank’s relationship with its customers

– Allows banks the opportunity to leverage the strengths of FinTech partners • Avoidance of old legacy IT/operating structures that inhibit innovation • Pinpointed focus on a narrow band of customer needs • FinTech partners have relationships with customers outside of the

traditional bank footprint

• Strategic Partnership Structures – Bank remains the hub of the consumer or small business financial

relationship • Agent Structures • Partnership Structures

FinTech/Bank Partnerships

3 mofo

• Compliance Responsibilities –A banking partner is generally responsible for ensuring that

products/services offered are compliant with applicable law –A bank must not abdicate its compliance responsibilities

•Shared compliance responsibilities •Completely outsourced compliance responsibilities

–Bank control of products/services

• Recent Developments –FDIC and marketplace lending

–OCC and bank partnerships

–FinCEN and AML/BSA oversight

Bank Oversight of FinTech Partners

4 mofo

• Select Legal/Regulatory Due Diligence Areas of Critical Concern

–Licensing/registration •State and federal money transmission licensing/registration •State and federal virtual/crypto-currency licensing/registration

•State lending licensing –State debt collection/servicing licenses –State broker licenses

–Consumer protection •UDAP or UDAAP •CFPB proposed rule on short-term and other high-cost loans •CFPB proposed rule on prepaid products

–AML/BSA/OFAC

FinTech Partner Due Diligence

Select State Licensing Requirements • Money Transmission • Lending • Virtual/Crypto-Currency

6 mofo

• What is money transmission? – General framework for analyzing business models that may implicate

money transmission regulation

• State money transmission law? • Federal Money Services Business law?

Money Transmission Licensing

Control Funds? YES NO

Financial Intermediary? YES NO

7 mofo

• Scenario 1: – An entity facilitates the transmission of

funds between individuals, between businesses and between individuals and businesses. To do so, the entity acts as a financial intermediary by taking control of funds that are received from senders and intended for a designated recipient.

• Scenario 2: – An entity facilitates the transmission of

funds between individuals, between businesses and between individuals and businesses. To do so, the entity partners with a bank that takes control of the funds and settles those funds directly with the intended recipient.

Money Transmission Licensing

Control Funds? YES NO

Financial Intermediary? YES NO

Control Funds? YES NO

Financial Intermediary? N/A N/A

8 mofo

• State licensing authorities, led by the New York Department of Financial Services (“NYDFS”), have been adapting their money transmission licensing statutes to virtual currency activities

– In June 2015, the NYDFS issued its final rule creating a comprehensive “BitLicense” scheme, which requires a license to engage in “virtual currency activities” in New York or with New York residents

– Other states are considering regulating virtual currency activities via their legacy money transmission statutes

– In September 2015, the NYDFS issued its first BitLicense to Circle Internet Financial

• Separately, in May 2015, the NYDFS granted a charter under the New York Banking Law to itBit Trust Company, LLC, a commercial Bitcoin exchange

Virtual/Crypto-Currency Licensing

9 mofo

• In late 2015, the Conference of State Bank Supervisors (“CSBS”) issued its final Model Regulatory Framework on virtual currency activities (“Final Framework”)

– The CSBS issued the Final Framework “to assist those states seeking to develop and implement state regulatory regimes for virtual currency activities”

• The Final Framework includes a definition of “Virtual Currency,” a general policy statement, a statement of covered and excluded activities, and a set of regulatory requirements

• The CSBS takes the position that “activities involving third party control of virtual currency, including for the purposes of transmitting, exchanging, holding, or otherwise controlling virtual currency,” should be subject to state licensure and supervision

• Because the Final Framework is drafted at a high level, state-by-state implementations will undoubtedly create inconsistency

Virtual/Crypto-Currency Licensing

10 mofo

• Non-bank lending activities may be regulated under state lender licensing laws

– Non-bank consumer lenders may be subject to licensing obligations in a majority of states

– Non-bank commercial lenders may be subject to licensing obligations in a minority of states

• State licensing regimes for non-bank lenders require extensive disclosures in the licensing application

– Such disclosures may include financial statements, management/ organizational information and background checks (and fingerprinting) for control persons

• Licensees will be subject to minimum net worth and surety bond requirements, as well as to examination by state licensing authorities and restrictions on owners/control persons

• Non-bank lenders are generally subject to state rate restrictions (i.e., usury laws)

Lending Licensing

11 mofo

• Bank partnerships may avoid state licensing obligations and rate restrictions

– Federal law authorizes federally insured banks to charge interest authorized by the state in which they are located without regard to usury laws of other states (i.e., to “export” rate rules from their home state) The ability of non-banks to rely on a partner bank’s rate exportation has been

called into question in Madden and CashCall – Bank partners that originate consumer loans will have compliance

obligations under consumer protection laws, discussed below

• Platform operators, independently or through their bank partnership, may have BSA/AML obligations

– Such obligations may include customer identification, screening, reporting, and/or recordkeeping

• Other Applicable Licensing – Debt collection/servicing licenses – Broker licenses

Lending Licensing

Select Consumer Protection Frameworks

13 mofo

• Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Act”), the CFPB has extensive authority to enforce against “covered persons”

– Unfairness: • “[C]auses or is likely to cause substantial injury to consumers which

is not reasonably avoidable by consumers themselves and… not outweighed by countervailing benefits to consumers or to competition”

– Deception: • Statement, omission or practice likely to mislead, upon which

consumer reasonably relied, which was material – Abusive: materially interferes with the ability of a consumer to

understand the terms or conditions of a product or service • UDAP

– FTC authority – State attorney general authority

UDAAP/UDAP

14 mofo

• Rulemaking – Enumerated Consumer Laws

• For example, ECOA, TILA, FCRA, EFTA, RESPA and GLBA

– Federal Consumer Financial Law • UDAAP • Covered Persons and Service Providers

• Enforcement – Enumerated Consumer Laws – Federal Consumer Financial Law

• Covered Persons and Service Providers

• Supervision – Certain Covered Persons – Certain Service Providers

Overview of CFPB Authority

15 mofo

CFPB Proposal on Short-Term and Other High-Interest Loans • The CFPB has said that it plans to issue a proposed rule on payday,

auto title, and certain other short-term loans in Q1 2016, but timing is slipping

– The comment period is likely to be 60 days or 90 days

• Issuance of a final rule is anticipated to be in 2017 – With a 6- to 12-month compliance period

• Covered short-term loans would have a duration of 45 days or fewer • Covered longer-term loans would have a duration of longer than

45 days and a total APR of more than 36 percent – Where the lender has access to the consumer’s deposit account or

paycheck, or holds a security interest in the consumer’s vehicle

16 mofo

CFPB Proposal: Covered Short-Term Loan Options

• Covered Short-Term Loans –Option One

•Determine ability to repay •60-day cooling-off period between loans unless improved circumstances

–Option Two •Less than $500

–No more than one finance charge –No vehicle as collateral

•Extended repayment plan •Limitations on re-borrowing

17 mofo

CFPB Proposal: Covered Longer-Term Loan Options

• Covered Longer-Term Loans –Option One: Ability to Repay

•Determine ability to repay •Special rules for balloon payments

–Option Two: NCUA PAL Terms •28% rate cap •Application fee capped at $20 •Loan between $200 and $1,000

–Option Three: 5% PTI Terms •Monthly payments no more than 5% GMI •No prepayment fee •No more than two such loans within 12-month period

18 mofo

CFPB Proposal: Ability to Repay (Longer-Term Loans) • The Lender must make a reasonable determination whether the

consumer “will have enough remaining income” to – Repay the loan – Fulfill “major financial obligations” and – Meet living expenses – Without re-borrowing during the “underwriting period” (loan term

+60 days for short-term or longer-term with a balloon payment) – The lender must consider and verify

• Amount and timing of income • Major financial obligations • Consumer’s borrowing history

– Use of at least one credit bureau, and furnishing to credit bureaus would be required

– According to the CFPB, a lender’s “ability to repay” determination may not be reasonable if borrowers consistently re-borrow or default

19 mofo

CFPB Proposal: Requirements Applicable to All Covered Loans • Verify borrowing history, as well as amount and timing of income • Report loan to all CFPB-approved credit bureaus • Maintain records documenting actions until 36 months after

last entry –Ability to repay determination, verification of borrowing history,

history of payment presentments, etc. • Payment reminder three business days before attempt to collect • Obtain new authorization if two consecutive attempts to collect

from consumers’ accounts are unsuccessful • Establish and maintain written policies and procedures that meet

the rule’s requirements (e.g., for determining ability to repay)

20 mofo

• In late 2014, the CFPB issued a proposed rule to regulate prepaid accounts (the “Proposed Rule”)

• The Proposed Rule would dramatically broaden the scope of the CFPB’s prepaid regulation

• The Proposed Rule would cover a broad range of prepaid products, including

–Payroll cards –Certain federal, state and local government benefit cards –Student financial aid disbursement cards –Tax refund cards –Certain peer-to-peer payment products

• A final rule is expected in Spring 2016

Proposed Prepaid Rule

21 mofo

• The definition of a prepaid account under the Proposed Rule would not be limited to physical cards

– The Proposed Rule would cover mobile and other electronic prepaid accounts that can store funds However, a payment product that is only capable of storing a

consumer’s payment credentials, such as a digital wallet, would not be covered, provided the digital wallet is incapable of storing funds

– From the CFPB’s commentary: “If a product allows a consumer to transfer funds, which can be stored before the consumer designates a destination for the funds, the product [may be viewed as a ‘prepaid account’]” Watch out for peer-to-peer (“P2P”), bill pay and other

functionality not related to purchases because this functionality could be in scope of the Proposed Rule

Proposed Prepaid Rule

Select AML/BSA/OFAC Issues

23 mofo

• Federal Bank Secrecy Act requirements

– AML program, as applicable

– Customer identification program, as applicable

– Recordkeeping and reporting, as applicable

• Office of Foreign Assets Control – OFAC administers and enforces economic and trade sanctions based on

U.S. foreign policy and national security goals – Under OFAC guidelines, although a sanctions compliance program is not

required, the existence of a risk-based OFAC compliance program is used by that agency in determining whether to seek civil penalties and/or criminal penalties for even inadvertent violations

• The statutes administered by OFAC generally impose strict liability; that is, even without specific intent to violate the law

– U.S. companies (both banks and non-banks) typically screen customers against the OFAC Specially Designated Nationals list to comply with OFAC regulations

BSA/AML/OFAC

Select Data Security/Privacy Issues

25 mofo

• Assessment of compliance and operational implementation of applicable federal and state data security/privacy laws

• In light of the very real threat of a partner experiencing a security incident, contracting parties should take steps to ensure that their information will be secured

– Select partners with appropriate security – Require partners by contract to maintain sufficient information safeguards – Periodically assess whether those partners are actually safeguarding the

company’s information

• There is no one-size-fits-all solution – Risk-based approach

• Based on the sensitivity of the information that the partner will have access to and the quantity of that information

• Based on the risks associated with how the partner will handle the information

Data Security/Privacy