DOJ/DHS Issue Interim Guidance on Implementation of Cybersecurity Information Sharing Act

The Department of Homeland Security (DHS) and the Department of Justice (DOJ) have released Interim Guidance Documents (Guidance Documents) to implement the Cybersecurity Information Sharing Act of 2015 (CISA). The Act requires DHS and DOJ to establish a voluntary cybersecurity information sharing process that encourages public and private sector entities to share cyberthreat indicators and defensive measures. Companies that choose to share such information must comply with the Guidance Documents to take advantage of the liability protections conferred by CISA.

The Guidance Documents include:

The Guidance Documents describe the requirements and mechanisms for sharing information with DHS's National Cybersecurity and Communications Integration Center (NCCIC), which serves as ''a national nexus of cyber and communications integration for the Federal Government, intelligence community, and law enforcement.''

Companies that share cyberthreat indicators and defensive measures may also include personally identifiable information with any other entity permissible under the Guidance Documents as long as the information is directly related to a ''cybersecurity purpose,'' even though such information would otherwise be protected from such sharing under other applicable privacy laws. CISA broadly defines a ''cybersecurity purpose'' as any purpose related to protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability.

Companies will have a number of options for sharing relevant information, including through a form on the NCCIC website, via e-mail to DHS, or by utilizing DHS's Automated Indicator Sharing (AIS) initiative, which allows for machine-to-machine real-time communication of information between federal agencies and the private sector.

- Alan S. Kaplinsky, Edward J. McAndrew, Daniel JT McKenna, Roshni Patel, Kim Phan, and Philip N. Yannella

Maryland District Court Without Jurisdiction to Consider Borrower’s Collateral Attack on State Foreclosure Action

Federal courts lack jurisdiction to consider borrowers' claims that arise out of a state court foreclosure proceeding, the U.S. District Court for the District of Maryland recently ruled. 

Parker v. Investire involved claims by a borrower related to a mortgage foreclosure action that was litigated in Maryland state court and was initially uncontested. The property was sold at foreclosure sale, and the final order ratifying the sale was entered by the state court. Thereafter, judgment of possession was entered in favor of the purchaser. The borrower filed an unsuccessful appeal, and the state court ordered the borrowers to vacate the property.

Thereafter, the borrowers filed a complaint in the U.S. District Court, asserting a claim for quiet title, asking the Court to enter a temporary injunction, and set aside the sale.

The Court summarily rejected the borrower’s effort to forestall enforcement of the possession order, and sua sponte dismissed the complaint. The Court held that the Anti-Injunction Act, 28 U.S.C. § 2283 precluded the Court from enjoining the state court proceedings, or granting declaratory relief regarding his rights to the property. The Court also ruled that it  lacked federal question jurisdiction, noting that "foreclosure actions brought under state law do not give rise to federal question subject matter jurisdiction […] nothing in simple foreclosure action of real property suggests the presence of a federal question."

As this opinion illustrates, the Anti-Injunction Act can prevent borrowers from collaterally attacking state court foreclosure proceedings. While not all claims are handled as expeditiously as those asserted in Parker, most cases can be disposed of through a motion to dismiss.

- Daniel C. Fanaselle and Robert A. Scott

CFPB finalizes no-action policy for innovative financial products

Ballard Spahr to conduct webinar on March 24, 2016 entitled ''CFPB Regulatory Certainty or Uncertainty? Consent Orders, Informal Guidance, and the New No-Action Letter Policy'' Register here

The Consumer Financial Protection Bureau (CFPB) has issued a final policy statement on issuing ''no-action'' letters (NAL) for innovative financial products or services. The CFPB's statement that the final policy was released on its website on February 18, 2016, presumably means that the final policy became effective immediately. The policy is part of ''Project Catalyst,'' the CFPB's initiative launched in November 2012 for facilitating innovation in consumer-friendly financial products and services. Under Project Catalyst, the CFPB finalized a trial disclosure policy in October 2013 for exempting individual companies, on a case-by-case basis, from applicable federal disclosure requirements to allow those companies to test trial disclosures.

NALs are intended for ''innovative financial products or services that promise substantial consumer benefit where there is substantial uncertainty about whether or how specific provisions of certain statutes implemented or regulations issued would be applied.'' NALs would include a statement that the CFPB staff ''has no present intention to recommend initiation of an enforcement or supervisory action against the requester in respect to the particular aspects of its products under the specific identified provisions and applications of statutes or regulations that are the subject of the [NAL].'' The final policy states that NALs ''will not be routinely available'' and that the CFPB anticipates NALs ''will be provided rarely and on the basis of exceptional circumstances and a thorough and persuasive demonstration of the appropriateness of such treatment.'' The CFPB estimates that, on average, it will receive one to three actionable requests annually for NALs.

The final policy states that the CFPB plans to publish NALs, along with a version or summary of the request, on its website. The policy describes the process for requesting a NAL and information that must be included in a request, the types of responses the CFPB may provide to a request (including when a grant or denial might be published on the CFPB's website), the factors the CFPB will consider in deciding whether to provide a NAL, the expected contents of a NAL (including any conditions or limitations attending the NAL), and rules governing the CFPB's disclosure of a version or summary of the request and any data received from the requester in connection with the NAL. NALs can be modified or revoked at any time at the CFPB's discretion for any reason.

The final policy statement substantially follows the CFPB's proposal. In the supplementary information accompanying the final policy, the CFPB addresses comments that it received on the proposal and its rationale for various aspects of the policy. Highlights include the following:

  • The CFPB reported that it had received comments calling on it to adopt a policy for providing definitive regulatory guidance to industry such as interpretative letters and advisory opinions. While not directly rejecting such comments, the CFPB gave no indication that it was giving serious consideration to such a policy. Instead, the CFPB noted its commitment to ''devoting substantial efforts to improving regulatory clarity and transparency to consumers, industry and other stakeholders'' and pointed to its official interpretations that accompany many CFPB regulations, efforts to support industry implementation of CFPB regulations and provide guidance through the publication of resources and other efforts, provision of unofficial oral staff guidance in response to e-mail inquiries, regular meetings with industry, and publication of bulletins.
  • The CFPB states that NALs are non-binding on the CFPB and would not bind courts or others who might challenge a product or service offered by the recipient of a NAL, such as regulators or other parties in litigation. Like the proposal, the final policy provides that a NAL will include a statement disclaiming any intention that the NAL ''constitutes a determination by the Bureau or its staff about, or is an interpretation of, or grants any exception, waiver, safe harbor or similar treatment respecting the status and rules identified in the request, or their application to the product’s aspects in question, or otherwise constitutes an official expression of the Bureau's views.'' The CFPB specifically rejected requests from commenters to make NALs binding on other regulators while noting that requesters should be aware that CFPB staff may consult with other agencies that have enforcement, supervisory or licensing authority over the requester.
  • The proposal indicated that the CFPB would presumptively not issue a NAL where the request concerns a legal or product environment that the CFPB considers to be inappropriate for no-action treatment, and as an example, stated that the staff did not anticipate no-action treatment of UDAAP matters. The CFPB received comments stating that an NAL would have little utility if it did not provide some assurance that the CFPB would not pursue a UDAAP claim against the requester for offering the product addressed in the request. In response, the CFPB stated that because of the factors the CFPB will consider before issuing a NAL ''it is highly unlikely that staff would first provide a NAL…and then recommend initiation of [a UDAAP supervisory or enforcement] action…in the absence of new facts or circumstances.'' However, the CFPB cautions that the grant of a NAL regarding a particular aspect of a product ''should not be understood to excuse potential UDAAP violations that might arise from other aspects of the product, such as marketing or operation that were not addressed in the NAL letter or stem from subsequent changes in the product.'' In response to comments that UDAAP matters should not be categorically ruled out for no-action treatment, the CFPB noted the complexity of UDAAP determinations and its limited resources to devote to NALs. Nevertheless, it removed the UDAAP example from the final policy, stating that the CFPB ''need not make a categorical determination at this time'' but also cautioning that ''this change should not be interpreted as portending the issuance of a significant volume of such UDAAP-focused NALs.''
  • The CFPB rejected calls by commenters to make NALs subject to a 30-day notice and comment period, stating that such a requirement would ''unnecessarily discourage NAL applications and delay the NAL process.''
  • In response to concerns about proprietary information that may be compromised by the publication of NALs, the CFPB stated that it plans to confer with a potential requester that has concerns about the public release of particular information in advance of submission or later to discuss how such concerns might be addressed.
  • The CFPB rejected commenters' requests for the CFPB to provide specific reasons for declining to issue a NAL.

While the CFPB has often asserted that it does not want to stifle innovation, its actions (including the issuance of the NAL policy) speak louder than words. The NAL policy provides no immunity against private litigation or enforcement actions by other federal and state government agencies. (Indeed, even the CFPB states that it is not even binding on it and that it can be revoked or modified at any time.) The NAL may only cover one or more of the ''enumerated consumer laws'' and not UDAAP which, of course, is often of the greatest concern to banks and companies because of the lack of clarity as to what constitutes an ''unfair,'' ''deceptive'' or ''abusive'' act or practice. The NAL will receive no deference by the courts. And, to make matters worse, the CFPB will publish the NAL (and, possibly, even decisions to not act on or decline the request for a NAL) on its website, thus alerting plaintiffs' lawyers and other government agencies to consider lawsuits against the requestor. The publication might result in competitors gaining access to important confidential strategic information. Even if a company decides to request a NAL despite these drawbacks, the CFPB has made it clear that it expects to receive only one to three actionable applications per year. In light of all of this, one may reasonably question how the CFPB could conclude as it did in the supplementary information to the NAL policy ''The Bureau believes that there may be significant opportunities to facilitate innovation and access, and otherwise enhance consumer benefits, through the Policy.''

On March 24, 2016, we will conduct a webinar in which we will consider not only the new NAL policy but also other avenues for banks and companies to lawfully offer new products and services without subjecting themselves to inordinate risk. Register here for our webinar entitled: ''CFPB Regulatory Certainty or Uncertainty? Consent Orders, Informal Guidance and the New No-Action Letter Policy.''

- Alan S. Kaplinsky

CFPB invites comments on ''Application Process for Designation of Rural Area under Federal Consumer Financial Law''

As we previously addressed, the CFPB issued a final rule to expand the definition of ''rural areas'' under Regulation Z with regard to the authority of small creditors to make certain qualified mortgage loans under the ability to repay rule and avoid the escrow account requirement for certain higher priced mortgage loans. In order to facilitate the designation of additional areas as being ''rural,'' Congress passed the Helping Expand Lending Practices in Rural Communities Act of 2015 (HELP Rural Communities Act) on December 4, 2015.

The Act requires that within 90 days of the Act's passage, the CFPB establish an application process for persons or businesses who would like to have a geographic area designated as ''rural.'' The Act requires that the CFPB take into consideration the following factors which will be used to evaluate applications:

  • Criteria used by the Director of the Bureau of the Census for classifying geographical areas as rural or urban
  • Criteria used by the Director of the Office of Management and Budget (OMB) to designate counties as metropolitan or micropolitan or neither
  • Criteria used by the Secretary of Agriculture to determine property eligibility for rural development programs
  • The Department of Agriculture rural-urban commuting area codes
  • A written opinion provided by the State’s bank supervisor, as defined under section 3(r) of the Federal Deposit Insurance Act (12 U.S.C. 1813(r))
  • Population density

In its evaluation, the CFPB is not required to consider a designation of ''nonrural'' of the area subject to review that was previously made by any federal agency identified in these factors and based on any of the criteria set forth in the factors.

Before the CFPB renders its final decision on an application, the public will be given at least 90 days to comment. Within 90 days after the end of the public comment period, the CFPB must grant or deny the application, in whole or in part, and publish its determination in the Federal Register.

To meet the 90-day deadline to establish the application process, the CFPB issued an enabling procedural rule by March 3, 2016. The CFPB also requested from the OMB by February 29, 2016, emergency processing and approval of a new information collection titled, ''Application Process for Designation of Rural Area under Federal Consumer Financial Law.''

The CFPB invites comments on the following:

  • Whether the collection of information is necessary for the proper performance of the functions of the CFPB, including whether the information will have practical utility
  • The accuracy of the CFPB’s estimate of the burden of the collection of information, including the validity of the methods and the assumptions used
  • Ways to enhance the quality, utility, and clarity of the information to be collected
  • Ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or other forms of information technology

Comments are due by April 18, 2016.

- Wendy Tran and Richard J. Andreano, Jr.

NMLS Reinstatement Period Ended

The NMLS period for renewing or reinstating licenses ended on Monday, February 29.  For licenses not reinstated, the state agencies must be contacted regarding next steps.

- Wendy Tran

Did you know?

NMLS Reinstatement Period Ended

by Wendy Tran

The NMLS period for renewing or reinstating licenses ended on Monday, February 29. For licenses not reinstated, the state agencies must be contacted regarding next steps.

Copyright © 2016 by Ballard Spahr LLP.
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.