By Ray Birch
WASHINGTON—Credit unions with “rickety” mainframe computers and those unable to answer some pointed questions from their regulators when it comes to fintech partnerships might find themselves in the crosshairs of not just the NCUA but now also the CFPB, says one legal expert.
“I think some of the questions NCUA is asking about fintech relationships, tied in with the CFPB hiring these special-tech staff, is an interesting development,” Brandy Bruyere, a partner at Honigman, LLP told CUToday.info. “CUs should expect scrutiny in this area and be able to show they’ve done their due diligence when it comes to partnering with fintechs.”
Drawing Bruyere’s attention most recently is the CFPB’s growing interest in financial institution technology, which she said was made clear in a recent Bureau job posting in which it said it is seeking expertise in data science and product design.
“The CFPB is seeking workers from similar fields or with the skill sets that frankly are sometimes what you see in the job ads for some of the fintechs,” Bruyere said. “According to the post some of these job functions will be looking at how tech companies are harvesting and monetizing consumer data, and how products offered online are designed.”
Digging Deeper
Bruyere said that post made her dig a little deeper.
Brandy Bruyere
“I went a little bit further and found that the Bureau had, around the same time, published a blog post on its website, again calling for applicants, saying they started a pilot program back in February 2022,” Bruyere explained. “The Bureau will place these technologists directly within the Office of Supervision, Enforcement and Fair Lending. The reason given is they want to improve the Bureau’s ability to hold parties accountable.”
Bruyere said the CFPB has attorneys and other skilled staff, but likely not people with the kind of expertise needed to either “look under the hood a little bit more or maybe fully digest some of the information on fintechs that might come out of some of these examinations and enforcement efforts.”
The Black Box
Bruyere said the blog post “flagged” some things the agency may be proving during exams related to fintech relationships and digital product design.
“That tells me a little bit about what they're going to consider,” she said, noting the CFPB post indicated it may look at the steps a consumer takes to enroll in a product or service. “For example, does a consumer have to actively uncheck a box to not have something automatically added on to a financial service? I found that interesting, especially from a UDAAP risk perspective.”
She added the post also reflects the CFPB’s ongoing interest in lending algorithms that are being used to a much greater extent as auto decisioning, often backed by AI, continue to advance.
“The Bureau has said they want to look into what they called the ‘black box,’ and they want to make sure there's no unintentional discrimination happening from these kinds of things,” Bruyere explained.
Attention to Lending Algorithms
Another item in the post caught Bruyere’s eye, she said.
“They flagged what they called ‘rickety mainframes,’” she pointed out.
The reference, Bruyere believes, indicates the CFPB’s are not only cyber security related, but also systems that perform poorly and make the consumer interaction with the FI an issue. “So, this hints at safety and soundness concerns, which really are outside the CFPB’s mandate, but consumer harm issues, as well.”
All of this demands credit unions not only shore up weak data systems, but also understand in detail the working relationship of any fintech partnership, and to be certain the CU can show they performed due diligence when vetting a fintech, she added.
“One thing credit unions can do now is just make sure they look at the data that's being used on those loan decisions and be able to show their examiners—whether it's NCUA or the CFPB—they conducted a Fair Lending risk analysis on that relationship. You want get ahead of that day, if it comes, when the CFPB asks you questions.”
What CUs Must Demonstrate
Credit unions, Bruyere noted, are increasingly leveraging third-party relationships to provide the services and products their members want and need.
“That’s all good, but credit unions just need to be able to show there was an analysis done from a compliance perspective, from a legal and regulatory risk perspective, and then, of course, a safety and soundness perspective regarding their technology and fintech partnerships,” Bruyere explained. “Those are the types of things that can help keep you out of the CFPB’s crosshairs, as the agency begins to focus closely on technology and fintech relationships. So, make sure, too, the credit union clearly understands how it is using its data, how the algorithms work, and just be ready to answer these questions the regulators could begin asking.
“It will be much better for the cooperative if they come across to the Bureau as having a strong handle on these technology matters, to be armed with the right answers and show the CFPB they have done their homework, as opposed to not knowing and then the CFPB begins to dig deeper as a result.”