On July 12, the CFPB issued a consent order against a FinTech company for facilitating point of sale financing activities without authorization from consumers.  The consent order requires the company to pay up to approximately $9 million in redress to impacted consumers and a $2.5 million civil money penalty.

The company uses merchants to market and intake loan applications from consumers at the point of sale.  The CFPB alleges, among other things, that merchants applied for loans without a consumer’s knowledge and entered their own email addresses as the consumer’s address on the loan application resulting in the company sending loan documents to merchants instead of the consumer.

In addition to the civil money penalty and consumer redress, the consent order requires the FinTech company to (i) verify consumers’ identities; (ii) confirm consumer authorizations prior to activating loans or disbursing loan proceeds; (iii) implement an effective consumer complaint management program; (iv) exercise effective oversight of third-party merchant partners; and (v) implement consistent standards to govern the write-off of illegal loans.

Putting it Into Practice:  This latest enforcement action carries a number of important reminders for FinTech companies.  Two of the more subtle implications included in the consent order are:

• The action harkens back to Obama-era CFPB scrutiny of companies for the actions of their vendors and merchant partners, and signals a renewed regulatory expectation that companies should dedicate sufficient resources and personnel to vendor management and compliance activities especially with respect to reviewing merchant operations to ensure that legal requirements are being met and carried out in line with CFPB guidance (See CFPB Bulletin 2016-02).

As investment in FinTech continues at its frenetic pace in 2021, private equity and venture capital funds with multiple options to partner with FinTechs have placed increased importance on regulatory due diligence.  As competition among FinTechs for investors increases, companies embarking on new funding rounds will want to evaluate their processes for vetting and monitoring third-party relationships to the satisfaction of potential investors.