Bank Regulatory News and Trends

This regular publication from DLA Piper focuses on helping banking and financial services clients navigate the ever-changing regulatory landscape.

In this edition:

• CFPB issues final rule on personal financial data rights causing mixed reactions from trade groups.
• FDIC approves guidance on bank mergers as Justice Department withdraws from 1995 Bank Merger Guidelines; major industry group expresses opposition to FDIC policy statement.
• FDIC opens comment period for proposed rule on recordkeeping for third-party deposits.
• OCC seeks research on AI in banking and financial services.
• Comment period extended for FDIC’s brokered deposit rule.
• FDIC extends compliance deadline on signage and advertising rule.
• FDIC deadline extension on deposit data information request.

CFPB issues final rule on personal financial data rights causing mixed reactions from trade groups. In furtherance of what the industry refers to as “open banking,” the Consumer Financial Protection Bureau (CFPB) issued a final rule interpreting the personal financial data rights established by the Consumer Financial Protection Act of 2010 (included as Title X of the Dodd-Frank Act Wall Street Reform and Consumer Protection Act). The rule requires banks, credit unions, and other financial service providers to make consumers’ data available upon request to consumers and authorized third parties in “a secure and reliable manner” and at no cost to the consumer; defines obligations for third parties accessing consumers’ data including privacy protections; and promotes industry standards that the agency described as “fair, open, and inclusive.” Provisions intended to safeguard consumer data protection include banning “bait-and-switch” data harvesting by allowing third parties to collect, use, or retain only the data necessary to deliver the product the consumer requested. The rule would also establish revocation and deletion rights, requiring that data access end immediately through a “simple and straightforward” process intended to prevent “dark patterns” from emerging.

• Key Congressional Republicans reacted positively to the rule. House Financial Services Chairman Patrick McHenry (R-NC) called it “a promising step forward to protect Americans’ financial data privacy” and said it was similar to Committee Republicans’ Data Privacy Act.


• The rule was hailed by the Consumer Federation of America and the Financial Technology Association.


• The rule was panned by the American Fintech Council, which cited concerns over regulatory provisions prohibiting secondary use of consumers’ data for the cross-selling of financial products and conducting targeted advertising.


• On October 22, 2024, the same day the CFPB rule was announced, the Bank Policy Institute and the Kentucky Bankers Association filed a lawsuit challenging aspects of the bureau’s rulemaking under Section 1033 of Dodd-Frank. The suit, filed in the US District Court in Lexington, Kentucky, asserts that the CFPB overstepped its statutory authority and finalized a rule that jeopardizes consumers’ privacy, financial data, and account security, and asks the court to halt the rule from taking effect.


• Barring judicial intervention, the rule takes effect 60 days after its publication in the Federal Register. However, compliance with the rule will be implemented in phases. The largest institutions will have to comply by April 1, 2026, while the smallest covered institutions will have until April 1, 2030. Certain small banks and credit unions are not subject to this rule.

FDIC approves guidance on bank mergers as Justice Department withdraws from 1995 Bank Merger Guidelines; major industry group expresses opposition to FDIC policy statement. In response to continuing pressure on expansion of large banks and proposed mergers that would further consolidate market share of those banks, the Federal Deposit Insurance Corporation (FDIC) approved a final Statement of Policy (SOP) on Bank Merger Transactions addressing the scope of transactions subject to FDIC approval, the agency’s process for evaluating merger applications, and the principles that guide its consideration of the applicable statutory factors as set forth in the Bank Merger Act. The vote at the FDIC’s Board of Directors meeting on September 17, 2024 was along party lines, with the two Republican appointees on the board expressing their objections. As reported in the April 2024 edition of Bank Regulatory News and Trends when the new guidance was proposed, mergers resulting in banks with more than $100 billion in combined assets would be subject to a heightened level of evaluation. Under the final SOP, which does not significantly differ from the April proposal, mergers subject to FDIC approval under the Bank Merger Act would have to undergo a more rigorous assessment regarding effects on competition and consolidation within the industry, how the needs of the community would be served, and consequences for the stability of the financial system.

• In a related development, on September 17, 2024, the US Department of Justice announced its withdrawal from the 1995 Bank Merger Guidelines and stated that the 2023 Merger Guidelines will remain its sole and authoritative statement across all industries. The department also released commentary explaining the application of the merger guidelines, identifying competition issues that may commonly occur in bank mergers and outlining which guidelines best inform analysis of those issues.


• On October 29, 2024, in a blog post, the Bank Policy Institute (BPI), an advocacy group representing the nation’s leading banks, took issue with key elements of the FDIC’s final SOP. BPI said the policy statement would exacerbate an already uncertain regulatory environment for merger approval. “A lack of interagency coordination in this critical policy area furthers the uncertainty for industry participants and has a chilling effect on bank merger transactions,” wrote Sarah Flowers, BPI’s senior vice president and senior associate general counsel for regulatory affairs.

FDIC opens comment period for proposed rule on recordkeeping for third-party deposits. On October 2, 2024, the FDIC published a notice of proposed rulemaking intended to enhance recordkeeping for bank deposits received from fintech and other third-party, non-bank companies. Under the proposed rule and absent an enumerated exception, FDIC-insured banks holding certain custodial accounts would be required to ensure accurate account records are maintained in order to determine the individual owner of the funds, including a requirement to reconcile the account for each individual owner on a daily basis. These and other requirements apply if the bank uses a third party to maintain records. The FDIC stated that “the proposed requirements also are expected to result in depositor and consumer protection benefits, such as promoting timely access by consumers to their funds, even in the absence of the failure of an [FDIC-insured depository institution].”

• Among the exceptions are accounts holding only trust deposits, sweep accounts established by broker-dealers and investment advisers, and account arrangements that allocate deposits among insured depository institutions in a network for purposes other than payment transactions.


• The FDIC is accepting public comments on the proposal until December 2, 2024.

OCC seeks research on AI in banking and financial services. Recognizing the need to identify and potentially direct the impact of artificial intelligence (AI) in the banking sector, the Office of the Comptroller of the Currency (OCC) is asking authors of academic research papers on the use of AI in banking and finance to submit their papers for review and consideration by the agency by December 15, 2024. Presumably, the submissions will help to educate and inform the regulator on how best to manage associated risks for banks.

• The OCC plans to invite selected authors to present to OCC staff and invited academic and government researchers at a symposium to be held on June 6, 2025.

Comment period extended for the FDIC’s brokered deposit rule. Responding to concerns voiced by trade organizations representing banks and fintech companies, the FDIC extended the public comment period on its proposal to broaden the definition of “deposit broker.” In July 2024, the FDIC Board of Directors approved – by a 3-2 party-line vote – a notice of proposed rulemaking that would amend the regulatory framework used to determine whether deposits qualify as brokered deposits under the FDIC’s regulations. The proposed rule would also eliminate the “exclusive deposit placement arrangement” exception and revise the interpretation of the primary purpose exception (PPE) to consider the third party’s intent in placing funds at a particular institution. It would allow only banks to file notices and applications for PPEs and it would revise the “25 percent test” designated business exception for a PPE, making it available only to broker-dealers and investment advisers provided that less than ten percent of the total assets that the broker-dealer or investment adviser has under management for its customers is placed at one or more banks.

• In an August 23, 2024 letter to the FDIC, a coalition of trade groups representing various sectors of the financial services industry called on the agency to withdraw the proposed rule, or at least extend the public comment period. “We are concerned that the brokered deposits proposal would significantly alter the FDIC's brokered deposit framework, and reverse statutory interpretations without sufficient or transparent data or robust policy rationale,” the joint letter stated.


• The FDIC said it will now accept feedback on the rulemaking through November 21, 2024.

FDIC extends compliance deadline on signage and advertising rule. The FDIC provided more time for banks to comply with the agency’s new signage and advertising requirements. Institutions will now have until May 1, 2025 to implement new processes and systems. The final rule – intended to modernize the rules governing the use of the official FDIC signs and advertising statements, and to clarify the FDIC’s regulations regarding false advertising, misrepresentations of deposit insurance coverage, and misuse of the FDIC’s name or logo – was published at the end of 2023. The original compliance deadline of April 1, 2024 was first extended to January 1, 2025, and it has now been extended to May 1, 2025.

• The final rule mandates a new black and navy blue FDIC official digital sign that banks will be required to display near the bank’s name on all websites and mobile applications and on certain automated teller machines.

FDIC deadline extension on deposit data information request. The FDIC extended its comment period until December 6, 2024 regarding the agency’s request for information (RFI) on deposit data that is not currently reported in the Call Report or other regulatory reports, including for uninsured deposits. The FDIC said the purpose of the RFI is to seek information on the characteristics that affect the stability and franchise value of different types of deposits and whether more detailed or more frequent reporting on these characteristics or types of deposits could enhance offsite risk and liquidity monitoring; inform analysis of the benefits and costs associated with additional deposit insurance coverage for certain types of deposits; improve risk sensitivity of deposit insurance pricing; and provide analysts and the general public with accurate and transparent data. Notice of the extension was published on October 4, 2024. The original RFI on deposits was published on August 6, 2024.