Jumping Head First into 1033

Season 4 of #CreditEcotoGo begins with an in-depth conversation about “data portability”.  Section 1033 of Dodd-Frank authorized the #CFPB to write rules around personal financial data rights. Former CFPB Assistant Director, Corey Stone, joins the podcast to discuss the goals of 1033 and whether the proposals went far enough. The data landscape has changed since Congress included this “sleeper” section into the Act. Corey believes the last decade shows us that industry has caught up to what Congress had in mind back in 2011 and therefore the CFPB’s proposals may not be such a heavy lift after all. The question remains whether this will promote competition as the CFPB’s narrative suggests, or will it, like most regulations, result in a “too small to succeed” scenario. Tune in…. 

DISCLAIMER – No information contained in this Podcast or on this Website shall constitute financial, investment, legal and/or other professional advice and that no professional relationship of any kind is created between you and podcast host, the guests or Clark Hill PLC. You are urged to speak with your financial, investment, or legal advisors before making any investment or legal decisions.

Transcript

0:07

Hello and welcome to another episode of Clark Hill's Credit Ego to Go, curbside thought leadership for financial services. My name is Joanne Needleman and I'm a partner at Clark Hill, as well as a member of the firm's banking and financial services practice group. Data seems to be dominating every conversation in the consumer finance, financial services world from cyber security, data, privacy, data, sharing and data, brokering data has taken on a very philosophical tone. The right to 1 zone personal financial data is rising to the level of a property, right? Section 1033 of the Dodd Frank Act gave the CFPB the authority to write rules requiring certain entities to make a consumer's personal financial data available to them upon request. In the fall of 2022, the CFPB issued an outline of proposal and alternatives for consideration and convened a small business review panel to elicit feedback on the impacts to the rule. On the impacts of the rule that the CFPB is considering. So, to help us unpack these proposals, my guest today is Corey Stone, who has spent most of his career in the consumer payments industry. First, as a consultant to financial institutions and payment networks. Then as an EVP of a national money transmitter and a bill processor. And then as a startup CEO, he has served on the Federal Reserve's consumer advisory board and as a chair of a DeNovo Community Development Bank in New Haven, Connecticut. In 2011, he joined the newly formed CFPB as assistant director in charge of building a market monitoring function to discover diverse activities overseen by the agency. such as credit reporting, debt collections, deposit accounts, and small dollar liquidity lending. He served on internal steering committees for several of the Bureau's rulemakings and convened its first internal task force on consumer data access rights. Corey currently helps several fintechs as an advisor and investor. He serves as an advisor to the Financial Health Network. The consulting firm, Oliver Wyman, FINRAG, FINRAG Lab, and the Aspen Institute. He is vice chair of Connex, a billion dollar credit union in his home state of Connecticut. Corey also tells me he's semi retired, which I find that hard to believe. Corey, it's so great to see you. I've known you for a long time, and I'm so thrilled that you're on the podcast today. Thanks for joining me. Well, thanks for having me, Joanne. It's great to see you. It's good to see you too. Why was this put into Dodd Frank? I mean, as I read Dodd Frank and I read Title 10, you know, Dodd Frank is about stabilizing the financial services regulatory, regulatory regime, making sure banks are, are well capitalized, making sure there's better oversight. What was the, what's the. What was the thought process, if you know, of why this was put in there? Because this didn't get a lot of attention when it was put in there, initially. Oh, it was a real sleeper. Yeah. I mean, I think you have to start by going back and asking, why was the CFPB included in Dodd Frank? Because nominally, the CFPB wasn't about the safety and soundness of the financial system. It was more about protecting consumers. And in this context, it was really focused on the subprime mortgage meltdown and the fact that there were mortgages being, um, uh, made and sold in securitizations that never should have been made. They were made. To fail, they were made to, uh, with the expectation of continuing housing, uh, price increases and, uh, no risk association associated with default because the, the foreclosure would result in a, uh, at least recovery of all of the principal, if not, uh, even. Okay, so I think that that's, you know, the. It was viewing the crisis as a failure of consumer protection, um, and there was some outright discrimination associated with those, um, mortgages where there was clear targeting. The theory behind 1033 was, I think, came out of, um, the kind of simultaneous publication or, or publication just prior to the crisis of Nudge, which is the behavioral economics manifesto from Cass Sunstein and Richard Thaler, which was about how you can um, You know, without, um, being, um, uh, paternalistic, um, actually give consumers better tools to make decisions by getting the right information in the right place. And a piece of the, of that, you know, right information would be, there was this concept of dynamic disclosures, which would be. Instead of a disclosure for all consumers about all relevant aspects of a of a product that might be quite complex and have many, many price points and where comparisons would be difficult, it would say, well, if we know enough about you, we can tell you what your cost of using this product is based on your past usage or your current usage of a similar product. Let's say a checking account. Um, so Um, to take, you know, relatively simple product. If you know somebody is, um, you know, it's got big savings balances and they're not getting, uh, good interest payments on those that where there's a competing product that's out there. If you know about the person's balances. Uh, you can you can come back with a disclosure that says this is what having this product is gonna do for you. This is what the benefit is. You could do the same thing for a credit card. You could do the same thing for a mortgage and have a kind of total cost disclosure that would be highly tailored to the individual. So that that was, um Thank you. I think behind the insertion of 1033 into title 10, which created the CFPB. Right? Right. And I mean, do you think I mean, I think it's we don't know. So the theory is, is if this if consumers. I'm going to say we're educated enough to know to ask for this information would the crisis have been avoided. I don't think 1033 related directly to the mortgage crisis. I, you know, the mortgage, the mortgage crisis was, um, um, about the product that people purchase with the least frequency. And with the least knowledge and where the information that's available about the consumer is kind of the least. You only know if they're an existing homeowner and if they have an existing mortgage, you know what that is, what their usage of that product is, whereas with You know, many other products, um, you know, a lot more about their daily transaction lives, like in the case of a checking account or credit card. And, um, so, you know, this 1033 proposal is, um, I think something that's been in the works for a while. Um, I think the idea of, you know, as, as I said in your bio, The Bureau has been focusing a lot on consumer data access rights and the ability of consumers to have more control over their personal financial data. But do you think, you know, let me jump right in. Do you think that the CFPB has achieved its objective in connecting users with their data and the people who are holding their data in particular? So when you say users, you mean the consumer or you mean the third party? Yeah. So I think it's worth kind of thinking about who the stakeholders are in this ecosystem. There are data holders, which are the financial institutions that we all do business with this as individual consumers. They're the consumers themselves who, you know, sometimes you think of as the user of an app. And then there are third parties who are the people in the ecosystem. To whom the consumer is granting permission to access their data and the section 1033 is talking about Um making the data accessible and the the wording is critical in machine readable form So that a third party can access it process it the the the law is silent about What data? Um, it's pretty silent about frequency of access Um, in terms of access, how the permission gets granted. Um, all kinds of things that are actually quite technical and but but the critical component in this is the third party. It's being able to share the data and it's any third party that the consumer designates, which could include a direct competitor to the financial institution from which the data is being obtained. Yeah, I that to me stuck out as well. What do you think? You know, you basically just said to me some of the things that the that the rule doesn't address. Um, what do you think that the rule address as well? Well, I would say I was actually talking about the statute. So this is quite silent on a number of things. And the Yeah, kind of outline of proposal that was presented to the Sabrifa panel kind of laid out some clear guidelines. But, but I think those guidelines need to be viewed in the context of evolution of the data ecosystem since. The Dodd-Frank was passed. It's been 13 years, almost 13 years. Um, and you know, you and I have talked about, well, why did it take the C F B B so long to get to this And, you know, we, we know they were busy with other things and there was no deadline imposed on coming up with this rule. Um, But since 2010, a whole lot has happened in which, um, consumers have been able to permission or give permission to have data access to all kinds of third parties and a whole ecosystem and infrastructure for collecting and distributing that the data has arisen. So. It's very common now and most consumers have had instances where they are either giving their username or password to an app provider or some other, even maybe their own bank to access data. Um, for purposes of preparing taxes or for purposes of just providing shopping, a consolidated view of your finances. And, you know, fidelity, uh, is a great example. They are one of the biggest providers of data. To third parties because they house so many people's assets. Mm-hmm., and they're one of the biggest collectors of data from third parties because many people use the Fidelity app to give a consolidated view of, of their finances. Right. That didn't, that didn't exist. That infrastructure was just nascent in 2010. Yeah. And it. Made possible by a whole layer of, uh, what are called, um, we call them data aggregators. Uh, and I want to differentiate them from data brokers. They are the aggregators of the people who essentially build the plumbing. Right. Oh, I love that plumbing. The plumbing historically has consisted of what is referred to with slight slang as screen scraping, which mean you give the aggregator your username and password and they go log in to your bank's website or your financial institution's website and look at your Uh, banking pages, um, and pull the data out literally from the screens that are being presented. That obviously has security, uh, vulnerabilities written all over it. And part of the challenge that that industry has faced, um, is well, how do we make this Sharing ecosystem work in a more secure way. So people aren't giving up their credentials to third parties and become vulnerable to fishing and all kinds of ways in which bad actors could get the same access as I look at 10 33. It was pretty visionary, right? I mean, who was thinking about? I mean, we were we, as you say, it was so nascent. I mean, you think about what's happened in the last two years. I mean, this, this idea of data was not in, you know, we were all thinking about mortgages. We were thinking about bank liquidity. We were thinking we were never thinking about data in the financial services. Ecosystem, as you say, so, I mean, I. Maybe, you know, dare I say, I hate to give Congress credit for doing something out of the box, and it, but it was in some ways out of the box. Well, I mean, Dodd Frank was thousands of pages long. I don't know how, I don't know how long it was, but you know, these, these bills are written by staff. Right. It happened to be, um, Uh, young, recent law school graduate who was working at Treasury and who was a protege of, um, I think the authors of Nudge, uh, Richard Thaler and Cass Sunstein, who said we, we can create an opportunity, uh, for, uh, this ecosystem to blossom. And so. You know, it's, it's only a few paragraphs long. Yeah. And she snuck it in. Yeah. And nobody was I remember being on the Hill when Dodd Frank, uh, uh, doing lobbying for various associations, you know, all I remember is talking to staff saying I've got 3000 pages I have to read by Monday. So that section obviously didn't get highlighted. So, but good for them. Good for them. Um, So, I mean, in just keeping in that vein, do you think that the proposals are keeping up with what is going on today? I mean, we talk about, you know, screen scraping, we talk about, um, data aggregators, we talk about consumers, you know, wanting to access their data when they want to access. Do these proposals help or hinder the ability of what consumers are doing right now? Um, I think they help. Um, and I think, um, they also point to how complex the environment is. Yes, yes. Um, and the complex environment has a lot to do with the technology. Um, and it has a lot to do with the fragmented authorities that, that regulators have. So the C F B B covers some financial institutions, but not all. And, um, Has, uh, proposed that the rule would cover certain types of financial services products, but not others, right? And it would cover certain kinds of, um, data providers, but not others. And, uh, certain types of data, but not. Yeah. Yeah. Do you think it would be broader? Um, there were ways in which I think it should be broader in their ways that that, uh, I think it should be narrower. Um, I helped the financial health network, um, write its comment letter, and, uh, I think it came down in a in a reasonable place. For example. Um, there's no good reason in my mind why, um, the rule shouldn't have included traditional lenders like mortgage lenders, uh, or mortgage servicers or, uh, auto loans and auto lends, which are, you know, those are the two and student loans. So those are the three most important sources of credit that people have, but it only includes credit cards. Right, right. Um, now credit cards, a much more complicated, uh, set of transactional data because people are spending on all the time. And yes, you can go to, uh, the, um, a consumer's credit report if you're a third party and get kind of the basic balance information, but you can't get. All of the terms and all of the detailed payment history that you can from from, uh, you know, either lenders themselves. Right. This has both a kind of clear and direct limitation on the kinds of services that third parties can provide, which would be helped by that kind of data. And it has inclusion impacts because What's available on the credit report doesn't tell the full story about a consumer's behavior. Um, so I might give, uh, an example, which would be. It's easier to give with credit cards, which are covered under the rule, but you can't tell from looking at a credit card on most credit card accounts, whether a consumer is a revolver or not, uh, and how much debt they're actually carrying versus how much. Of their balance just represents spending that they're just paying off, uh, before the end of the grace period. Right. Uh, and that has a huge impact on what the consumer's, uh, borrowing is and, and, and what their likely future behavior is going to be. The, the logic and the reasoning of putting this together, obviously, and then the bureau is very focused on this as they feel in some ways, this will promote competition in looking at this. Initially, to me, I think this is going to be hard to be competitive, especially for smaller entities to kind of build up this infrastructure. Um. But to your point, a lot of them already have it, but it, you know, some have it better than others. I think 1 of the recommendations from the subpoena panel was that the Bureau needs to look at this. This aspect a little bit more critically, um, what are your thoughts on that? Um, as far as, you know, we'll we'll and I, you know, my feelings about that Frank is sometimes too small to succeed, um, with what is the expectations are. I'm curious about your thoughts. Yeah, when you and I've talked about the fact that the most small, uh, financial institutions are already complying with, uh, the. The basic requirements of the law in that their data is being screen scraped today. They may not even know it. Uh, they may be paying for that, uh, if their core processor or, uh, digital banking, um, provider charges per login, because some of those logins may be the aggregators coming to, to pull out the data, which can happen with, with, um, it can be a one time poll, or it can be a recurring poll that happens Uh, as frequency is every frequently is every day, depending on the kind of third party, um, user, um, that, um, as long as screen scraping is permitted to exist for some period of time. Um, I think that the core processors who serve the smaller institutions will be required under the rule to come up with To serve their members compliance needs or their users compliance needs with the APIs that allow the aggregators to pull directly in a secure way without using that, you know, consumer access key to unlock the data. Um, the, the, the so called API automated program interface environment. Comes with security protections, uh, and encryption that doesn't currently exist in the screen scraping world. So there's a, there's a time, uh, focus. The reality, unfortunately, of the, I'll call it core processor oligopoly is Anytime they have to do something new, they get to charge more. Well, that's right. That's right. And ultimately, as the whipping boys for right now, and won't that ultimately fall upon the consumer? I think it ultimately Uh, in in more in the form of reduced, uh, number of alternatives because, uh, it just increases the, uh, the scale economies that that Small businesses, small financial institutions have to live under, um, less so in terms of costs, because I don't think this is going to be, uh, a meaningful cost driver for the bigger institutions who set price for everybody else. Right? Right. I mean, I think it's, it will be interesting, but I also think it could foster, as with anything, I Innovation. I mean, someone could be out there figuring out a better or easier way to do this, right? Can I mean, you raised the question of competition and I think it's pretty clear that competition was an important original. Um, intent underline section 10 33. Yeah, but I don't know that it's actually the most important benefit. I don't know if it is either. I don't know if it is either, but it always I don't know if this is important. It is important, but I also don't believe. The, the narrative that it will increase competition. I'm a little I'm very skeptical about that. That's just me. I certainly don't think it's going to reduce competition. I, I think the, because the intent was to drive competition, um, I think there will be some marginal impact on competition, but I think the, the much bigger benefit potentially has to do with the ability that, um, Applications and innovators have to assemble a fuller picture of a consumer's finances, knowing their income, knowing their credit status, knowing where they have debt, knowing information that the consumer provides about their family, about their age, about, you know, everything that impinges on their finances to help them make better choices. And but better choices, both in the kind of global sense of it's a time for me to buy a house or not down to the minuscule sense of what's what should be my grocery budget for this week and how much. Have I already spent against that, but yeah, there's a potential for, uh, there, um, being the gatekeeper for the consumer to access the system or the ecosystem, uh, because ultimately the onus for, uh, authenticating the consumer, uh, may fall on them. Particularly when it's a smaller institution. Um. That is either requesting the data or supplying the data. So, um, I think that's an area where, uh, the rule didn't go as far as most people expected. Um, but that doesn't mean that the Bureau isn't thinking about these issues. So the rule is one of the many tools that the Bureau has. Uh, I think people were expecting and hoping for a larger participant rulemaking to be, uh, a part of this rulemaking. And, um, I think the Bureau. Maybe thinking, uh, aggregators are already covered because they are in, you know, all of them are are vendors to large institutions that are already covered and therefore under service provider extension of your circus supervisory powers. They can already examine. Yeah, the aggregators. That's a good point. I think it's a stay tuned on that 1. I don't think we know where that's going to ultimately land. Um, all right, but final point. I mean, I have to ask, we talked a little bit about servicers. Um, but how will this impact. Credit reporting and servicers who are 3rd parties who are using or otherwise using a lot of this data. I mean, are they, are they going to, are they going to have responsibilities under this rule? I mean, they're not covered entities under the rule, but, you know, they're all. Have lots and lots of data, especially credit reporting , right. CRAs . Right. And I think, I mean there are a number of layers here. I mean, one really interesting thing is the fact that the, that the consumer's data to which consumers are being given rights under 10 33 and under the rulemaking exclude consumer report data. As it currently exists in the viewers. One of the questions the Bureau asked was, should it include credit reports that are now that have been obtained by the consumers financial services providers, right? Um, but that's a, you know, that's a one time snapshot. It's about the The the data that the consumer could already get, and it's not in a particularly useful form because the Credit Bureau dated that user sees meaning an institution doesn't include information about who the furnishers are. Right. It just says it's a credit. Uh, card company. It doesn't say credit card company, right? So it's a limited value to the consumer. Um, I think more interestingly, um, is some of the use to which, uh, the bureaus, uh, are putting this data. So you've got a boost, for example, at Experian, which uses finicity An aggregator to obtain information about the consumer's bill payments outside of, you know, traditional credit products like rental and utilities to augment their credit reports. And you can actually have that factored into the fight. Go score. And it's a voluntary service. For which a consumer can sign up to augment their credit report, uh, and potentially give them a score when they didn't have a score or change their score for the better. Um, if they have a thin file, I think thinking a little bit farther, uh, into the future, you can imagine an environment in which all of the data. That exists in a credit report and much data that doesn't exist in a credit report because of the limited kinds of information that the credit bureaus currently collect that data becoming available through the aggregators through this data sharing ecosystem to give a much richer picture of the consumer's credit picture. Right. So we talked about the credit card. Right. Example, um, the bureaus have the ability to collect payment amount and therefore determine who's revolving. The issuers don't have a formal obligation to report it because it's a voluntary system. Right. Because the consumer can say You, my credit card company, I want you to send this data to my credit evaluation service over here, and they are going to vouch that they got it, that I am me, and that, um, I am making full payment each month, and therefore I'm not a revolver. They can tell, um, this other company to whom I'm applying for a loan. Suddenly the aggregator is more in the role of providing the data that's being used in underwriting. Right. So the question is how do we get to a place where all of the data that's available to a consumer Uh, or about a consumer stuff that the consumer wants to share, but also stuff that the consumer may not want to share the share is available through this ecosystem. Now it's a permission based ecosystem, so you could say the consumer wouldn't share it and wouldn't have to share it. But so the, so then the users in the position of saying, well, how do I know I'm getting the consumers sharing all the stuff about that? Right? Well, it's going to be critical for under, I mean, super critical for underwriting could create an interesting scenario again for consumers for consumers to self advocate if they have the knowledge and the understanding of how to do that. That's it. That's it. Huge left huge, huge left. Well, Corey, thank you so much. This was a great last this a great tutorial. I really appreciate it. Really appreciate your insight on this. And I hope that we can follow up on this. Uh, you know, I'm sure the NPR will come out and, you know, a year or so, whatever that may be. Um, it'll be interesting to see where, where the Bureau lands with this. Um, I really appreciate your kind of going down all these different, uh, rabbit holes. It's oh, good. That's what I do. That's what I do to explore. I love the conversation. I'm glad you're playing along. Um, so before I let you go, uh, what I've done in all my podcasts and believe it or not, it'll be three years in June since I started this little exercise of talking to all my friends.

Um, Transcribed by https: 34:14

otter. ai Uh, through zoom, um, and doing these podcasts that I really I have enjoyed it. I really have. This is actually the 1st 1. I'm doing this year because it's been where the world has been so busy. But when I started back in June of 2020, it was just a great way to. See everybody because everybody was kind of home and we were dealing with this pandemic and you know, we didn't know what the world was going to be. So my question when I was doing this podcast at that time was, you know, so what are you doing? What's going on now that you haven't left the house in six months? Uh, but now that we're, you know, somewhat back to normal, I would say for the most part. Um, I always ask my guests, so what are you doing now? That you would have done, but for COVID. Um, I will tell you, I know one person who got married. I'm already, uh, happily married and have been for more than 35 years, but, um, my, my wife and I had a, a small vacation place that we'd bought and that we rented out for much of the summer. But. Um, that's where we retreated. Um, and it's a single room. It's, you know, it's a, it's a glorified cabin. Um, and found that we really liked being there and we've stopped renting it out. We are there for most of the summer. Um, so that was a piece. And then I, it's the other piece also relates to my marriage, which is we. Started undertaking a kind of structured, um, self examination process where you always teamed up with a partner. It happens to be our spouse where we're kind of spending a week on traits that we want to be able to develop in ourselves and kind of sharing, uh, how the weeks are going as we focus on these different traits and, um, It's, uh, it's a, um, it's an interesting process to, um, kind of formally, uh, share your inner thoughts on a schedule with your spouse, as opposed to like, in the odd moments in the day. So, um. With this external world losing structure, we've added, uh, structure to our internal world, and, uh, it's just one of those things that stuck. I love it. I just love it. And is your cabin in Maine? Our cabin is in Maine, uh, in Rockport, which is a coastal town. We can walk to the harbor. We can So lovely. We have deer, deer and wild turkeys run, wandering across the, the lawn and That's great. That's awesome. We love it. Love it. And finally, in consideration of your time and coming onto the podcast, um, what I've done since the beginning, um, was to always ask my guests to, at the time, identify, uh, food banks or shelters or anything that were helping people during COVID, because there was all of a sudden such a food crisis, which really was so weird to me, um, thankfully we're beyond that, but I still do love the charity element and, and learning about food Organizations that people have certain affinities for and so we've kept that going on the podcast and I'm hoping there's an organization that you can identify and we're happy to make a donation on your behalf. Thank you, do you want me to share what I'm sure? Absolutely. Yes. No, our credit union, which is the biggest credit union in our county, New Haven, Connecticut. Um, it has a 501 C3 foundation where the staff of the credit union, um, allocate the, the proceeds. And I just want to kind of both support the community, but also, you know, indicate my support for the staff of the credit union by, by having the donation directed to Connex Cares is the name of the entity. I love it. And what do they do in the community? What are some of the activities? Um, there's, uh, I mean, you would think you wouldn't be surprised of food banks and diaper banks and things like that, that the organization supports. But we also have, um, a lending initiative to make sure that, um, we are devoting 3 percent of our assets to, uh, households Uh, of, uh, primarily of color who wouldn't meet our current mortgage underwriting standards to advance home ownership and and kind of compensate for decades of structural racism, which have affected the composition and complexion of our, um, homeownership market here in New Haven County. Awesome. Well, we are more than happy to do it and it sounds like a wonderful organization. Um, so Corey again, thank you so much for coming on to the podcast today. And many thanks to all of our credit eco to go loyal listeners. For tuning in and logging on all episodes of credit to go to go can be found on bus about, uh. Apple and iTunes, excuse me and Spotify information on our podcast can also be found on my car kill dot com bio page. as well as on my LinkedIn page. If you'd like to be a guest on the show or have ideas for future show topics, please email us at crediteedgotogoatclarkhill. com. Thank you. Be well and stay safe. This podcast is intended for general education and informational purposes only, and should not be regarded as either legal advice. or a legal opinion. You should not act upon or use this publication or any of its contents for any specific situation. Recipients are cautioned to obtain legal advice from their legal counsel with respect to any decision or course of action contemplated in a specific situation. Clark Hill PLC and its attorneys provide legal advice only after establishing an attorney client relationship through a written attorney client engagement agreement. This recording does not establish an attorney client relationship with any recipient.