```

[Federal Register Volume 88, Number 198 (Monday, October 16, 2023)]
[Rules and Regulations]
[Pages 71279-71283]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-22774]

[[Page 71279]]

=======================================================================
-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU

12 CFR Chapter X

Consumer Information Requests to Large Banks and Credit Unions

AGENCY: Consumer Financial Protection Bureau.

ACTION: Advisory Opinion.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB) is issuing 
this Advisory Opinion regarding section 1034(c) of the Consumer 
Financial Protection Act (CFPA), which requires large banks and credit 
unions to comply in a timely manner with consumer requests for 
information concerning their accounts for consumer financial products 
and services, subject to limited exceptions.

DATES: This Advisory Opinion is applicable as of October 16, 2023.

FOR FURTHER INFORMATION CONTACT: Colin Reardon or Yan Cao, Senior 
Counsels, Legal Division, at 202-435-7700. If you require this document 
in an alternative electronic format, please contact 
[email protected].

SUPPLEMENTARY INFORMATION: The CFPB is issuing this Advisory Opinion 
through the procedures for its Advisory Opinions Policy.\1\ Refer to 
those procedures for more information.
---------------------------------------------------------------------------

    \1\ 85 FR 77987 (Dec. 3, 2020).
---------------------------------------------------------------------------

I. Background

    Section 1034(c) of the CFPA requires large financial institutions 
to comply with consumer requests for information concerning their 
accounts in a timely manner.\2\ This Advisory Opinion interprets this 
provision for the purpose of highlighting the obligations it imposes 
upon large financial institutions. The CFPB has not previously issued 
supervisory findings or pursued an enforcement action under this 
provision. This Advisory Opinion is the CFPB's first guidance regarding 
section 1034(c).\3\
---------------------------------------------------------------------------

    \2\ 12 U.S.C. 5534(c).
    \3\ As a matter of prosecutorial discretion, the CFPB does not 
intend to seek monetary relief for violations of section 1034(c) 
that occur prior to February 1, 2024.
---------------------------------------------------------------------------

    Section 1034(c) applies to insured depository institutions and 
credit unions that offer or provide consumer financial products or 
services and that have total assets of more than $10 billion, as well 
as their affiliates.\4\ The provision states that, subject to certain 
exceptions, banks and credit unions with over $10 billion in assets 
must ``in a timely manner, comply with a consumer request for 
information in the control or possession of such covered person 
concerning the consumer financial product or service that the consumer 
obtained from such covered person, including supporting written 
documentation, concerning the account of the consumer.'' \5\ Section 
1034(c) is a current legal obligation that became effective on July 21, 
2011.\6\
---------------------------------------------------------------------------

    \4\ 12 U.S.C. 5534(c)(1) (provision applies to ``a covered 
person subject to supervision and primary enforcement by the Bureau 
pursuant to section 1025''); see also id. sec. 5481(1), (6) 
(defining ``affiliate'' and ``covered person''); id. sec. 5515(a)-
(c) (CFPA section 1025 providing CFPB with supervisory and primary 
enforcement authority over insured depository institutions and 
insured credit unions with total assets of more than $10 billion and 
over their affiliates). For convenience, this Bulletin generally 
refers to institutions subject to section 1034(c) as ``large banks 
and credit unions.''
    \5\ 12 U.S.C. 5534(c).
    \6\ Subtitle C of the CFPA, which includes section 1034, became 
effective on ``the designated transfer date.'' Public Law 111-203, 
title X, sec. 1037. The designated transfer date was July 21, 2011. 
See Designated Transfer Date, 75 FR 57252, 57253 (Sept. 20, 2010); 
see also 12 U.S.C. 5582.
---------------------------------------------------------------------------

    Congress placed section 1034(c) alongside provisions of the CFPA 
that establish a process for addressing consumer complaints submitted 
to the CFPB. Under sections 1034(a) and 1034(b), when a consumer 
submits a complaint or inquiry about a large bank or credit union, that 
entity ``shall provide a timely response'' to the CFPB, and the CFPB 
then provides a timely response to the consumer, including ``any 
responses received'' from the financial institution.\7\ Through section 
1034(c), Congress established an additional, direct channel for 
consumers to request information from large banks and credit unions 
without routing their inquiry through the CFPB or another government 
entity. And like a complaint submitted to the CFPB, a request for 
information under section 1034(c) can lead to the identification and 
resolution of errors by a large bank or credit union involving a 
consumer's account.
---------------------------------------------------------------------------

    \7\ 12 U.S.C. 5534(a), (b); see also CFPB, Consumer Response 
Annual Report at 16-17 (Mar. 2023), https://files.consumerfinance.gov/f/documents/cfpb_2022-consumer-response-annual-report_2023-03.pdf (describing the consumer complaint 
process).
---------------------------------------------------------------------------

    Responding to consumer requests for information is critical for 
ensuring high levels of customer service and enabling consumers to 
resolve issues with their accounts when they encounter problems. Large 
banks and credit unions possess information that is vital to meet these 
customer needs. Too often, however, it can be difficult and time 
consuming for individual consumers to obtain a clear answer to 
questions or resolve an account issue. The CFPB has observed that some 
larger financial institutions have moved away from a traditional 
relationship banking model with an emphasis on providing customized 
help to individuals.\8\ Such individualized service is now generally 
reserved for high net-worth individuals, and is difficult for other 
households to find. For most consumers, larger banks and credit unions 
frequently rely on highly standardized processes rather than high-
quality human interactions or digital channels that actually facilitate 
self-help. When a consumer has a question or problem, they typically 
cannot go to an individual at the bank or credit union who is already 
familiar with their account, such as the person that originally signed 
them up for the product. They are more likely to have to navigate a 
phone tree in the hope of speaking to the right person in a call 
center, to have to search through largely irrelevant material on a 
website to try to find the information they need, or to have to attempt 
to get a clear answer from a chatbot.\9\
---------------------------------------------------------------------------

    \8\ See CFPB, Prepared Remarks of CFPB Director Rohit Chopra in 
Great Falls, Montana on Relationship Banking and Customer Service 
(June 14, 2022), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-in-great-falls-montana-on-relationship-banking-and-customer-service/; see also 
FDIC, FDIC Community Banking Study at 4-1 (December 15, 2020), 
https://www.fdic.gov/resources/community-banking/report/2020/2020-cbi-study-full.pdf (noting that community banks ``tend to focus on 
loans as relationships, originating loans that require local 
knowledge, a greater personal touch, individual analysis, and 
continued administration'').
    \9\ See CFPB, Chatbots in consumer finance (June 6, 2023), 
https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/chatbots-in-consumer-finance/ 
(observing that ``automated responses can be highly scripted and 
simply direct customers to lengthy policy statements or FAQs, which 
may contain very little helpful information, if any''); see also Ron 
Shevlin, The Human + Digital Challenge In Banking: Consumers Want 
Both at 2, Cornerstone Advisors (2021), https://go.backbase.com/rs/987-MGR-655/images/Backbase_Cornerstone_Human_Digital.pdf (finding, 
based on consumer survey, that ``[t]oday's consumers--even those at 
the younger end of the age spectrum--want and value high-quality 
human interactions in their financial lives'' and that ``[f]inancial 
institutions must quickly improve the quality of their digital 
channel experiences'').
---------------------------------------------------------------------------

    On June 14, 2022, the CFPB issued a request for information asking 
the public to provide input on customer service obstacles they face in 
interacting with large banks and credit unions.\10\ Commenters relayed 
consumers' frustration and difficulty in obtaining critical information 
about their accounts.\11\ This includes information

[[Page 71280]]

that consumers need to stay current and avoid fees or penalties; to 
identify and resolve errors; and to close accounts that no longer serve 
their interests.
---------------------------------------------------------------------------

    \10\ See Request for Information Regarding Relationship Banking 
and Customer Service, 87 FR 36828 (June 21, 2022).
    \11\ See, e.g., Comment from Legal Services NYC at 2 (July 13, 
2022), https://downloads.regulations.gov/CFPB-2022-0040-0006/attachment_2.pdf (describing low-income clients who have difficulty 
obtaining ``copies of their statements; records related to 
restraints placed on their accounts; copies of cashed checks or 
money orders; information on fees and charges placed on the 
account'' among other information); Comment from Mobilization for 
Justice (July 22, 2022), https://downloads.regulations.gov/CFPB-2022-0040-0051/attachment_2.pdf (describing low-income consumers 
without internet access who cannot afford fees charged to obtain 
hard copies of account statements); Comment from Tzedek DC (Aug. 19, 
2022), https://downloads.regulations.gov/CFPB-2022-0040-0084/attachment_1.pdf (describing disabled clients who were denied access 
to account information because of the presence of a retained 
attorney, and who could not obtain documents a large bank relied 
upon to close fraud disputes); see also Nonrulemaking Docket: 
Request for Information Regarding Relationship Banking and Customer 
Services (CFPB-2022-0040), comments available at https://www.regulations.gov/docket/CFPB-2022-0040/comments.
---------------------------------------------------------------------------

    Through section 1034(c), Congress ensured that as banks and credit 
unions grow larger they must continue to meet consumers' need for 
information necessary to manage their finances, and thus must provide 
timely responses to consumer requests for information concerning their 
accounts. Such responses help meet consumers' reasonable expectations 
for customer service.

II. Information Requests Under Section 1034(c)

A. Consumer Requests for Information Regarding Their Accounts

    Section 1034(c) states that, subject to certain enumerated 
exceptions, large banks and credit unions ``shall, in a timely manner, 
comply with a consumer request for information in the control or 
possession of [a large bank or credit union] concerning the consumer 
financial product or service that the consumer obtained from [the large 
bank or credit union], including supporting written documentation, 
concerning the account of the consumer.'' \12\ Thus, section 1034(c) 
applies to a consumer's request for information to a large bank or 
credit union where the information concerns the consumer's account for 
a consumer financial product or service, is in the large bank or credit 
union's control or possession, and does not fall into an enumerated 
exception.
---------------------------------------------------------------------------

    \12\ 12 U.S.C. 5534(c)(1).
---------------------------------------------------------------------------

    The CFPA defines ``consumer financial product or service'' to 
include several types of financial products or services that consumers 
may obtain from a large bank or credit union, including deposit and 
savings accounts, credit products such as mortgage loans and credit 
cards, and loan servicing.\13\ Under section 1034(c), large banks and 
credit unions that offer or provide consumer financial products or 
services must comply with consumer requests for information regarding 
their accounts. That obligation applies even if consumers do not 
expressly invoke section 1034(c).\14\
---------------------------------------------------------------------------

    \13\ 12 U.S.C. 5481(5), (15)(A)(i), (iv). It should be noted 
that a consumer can receive services from a loan servicer (and thus 
``obtain'' a consumer financial product or service from that 
servicer) even if the loan servicer is not the original creditor on 
the consumer's loan. See 12 U.S.C. 5481(5), (15)(A)(i).
    \14\ Nothing in section 1034(c) states or suggests that a 
consumer must expressly indicate that they are making a request 
under that provision. See 12 U.S.C. 5534.
---------------------------------------------------------------------------

    Section 1034(c) applies to consumer requests for information 
``concerning'' an account for a consumer financial product or service. 
The term ``concerning'' means ``relating to'' or ``regarding'' and 
therefore encompasses a wide range of information about a consumer's 
account.\15\ Information concerning an account would include account 
information that appears on periodic statements or on online account 
portals, such as the amount of the balance in a deposit account, the 
interest rate on a loan or credit card, and information regarding 
transactions or payments involving an account.\16\ It would include 
information regarding bill payment and other recurring transactions 
involving the account (e.g., a list of all recurring payments out of 
the account). It would also include the terms and conditions of the 
account, including a schedule of fees that may be charged on the 
account. It could also include information about the status of a lien 
on real property that was released (or should have been released) years 
before. Such information can be necessary for consumers to manage their 
accounts and resolve disputes with their bank or credit union, or with 
merchants or other third parties. In contrast, section 1034(c) does not 
apply to a consumer's request for information that is not specifically 
related to a consumer's account, such as information regarding a large 
bank or credit union's internal operating procedures, financial 
performance, marketing strategy, or training program for its employees.
---------------------------------------------------------------------------

    \15\ Concerning, Merriam-Webster, https://www.merriam-webster.com/dictionary/concerning#dictionary-entry-2 (last visited 
Oct. 5, 2023); see also Concerning, Oxford English Dictionary, 
https://www.oed.com/dictionary/concerning_prep?tab=meaning_and_use 
(last visited Oct. 5, 2023) (defining ``concerning'' to mean ``[i]n 
reference or relation to; regarding, about'').
    \16\ With respect to periodic statements, Regulation DD 
describes information that must appear on periodic statements for 
deposit accounts held by depository institutions other than credit 
unions, see 12 CFR 1030.6(a), and NCUA regulations impose similar 
disclosure requirements for credit unions, see 12 CFR 707.6(b). 
Regulation E describes information that must appear on periodic 
statements for accounts to or from which electronic fund transfers 
can be made. See 12 CFR 1005.9. Regulation Z describes information 
that must appear on periodic statements for open-end credit plans 
(e.g., credit cards and home-equity lines of credit), see 12 CFR 
1026.7, 1026.8, and for closed-end residential mortgage loans, see 
12 CFR 1026.41.
---------------------------------------------------------------------------

    In addition, section 1034(c) requires a large bank or credit union 
to comply with a consumer's request for ``information . . . including 
supporting written documentation.'' The word ``support'' means ``to 
assist,'' ``help,'' or ``provide with substantiation.'' \17\ 
Accordingly, through its reference to ``supporting written 
documentation,'' section 1034(c) requires large banks and credit unions 
to provide consumers, upon request, with written documents that will 
substantiate information provided in response to consumer questions, or 
that will assist consumers with understanding or verifying information 
regarding their accounts. For example, under section 1034(c), a 
consumer seeking information about past transactions on their account 
could request copies of past periodic statements or check images. 
Similarly, a consumer seeking information regarding the terms and 
conditions governing their account could request a copy of their 
account agreement (including a copy of the original signed agreement).
---------------------------------------------------------------------------

    \17\ Support, Merriam-Webster, https://www.merriam-webster.com/dictionary/support (last visited Oct. 5, 2023); see also Supporting, 
Oxford English Dictionary, https://www.oed.com/dictionary/supporting_adj?tab=meaning_and_use#19725899 (last visited Oct. 5, 
2023) (defining ``supporting'' to mean ``[t]hat provides evidence or 
authority for something; confirmatory, corroborative.'').
---------------------------------------------------------------------------

    Section 1034(c) requires large banks and credit unions to provide 
account information and supporting documentation to the extent it is in 
their ``control or possession.'' The concepts of ``control'' and 
``possession'' are familiar from other contexts involving requests for 
information, such as the discovery provisions in the Federal Rules of 
Civil Procedure and the Freedom of Information Act.\18\ In the context 
of section 1034(c), a bank or credit union ``possesses'' information 
that is known by its employees or that can be found

[[Page 71281]]

in its records, such as in its electronic or paper files.\19\ A bank or 
credit union can also ``control'' information that it does not 
physically possess, where it has the legal right, authority, or 
practical ability to obtain the information.\20\ For example, a large 
bank or credit union would control information held by an affiliate or 
service provider where it has the right or ability to receive that 
information from the affiliate or service provider.
---------------------------------------------------------------------------

    \18\ See, e.g., Fed. R. Civ. P. 34 (concerning requests for 
documents in party's ``possession, custody, or control''); U.S. 
Dept. of Just. v. Tax Analysts, 492 U.S. 136, 145 (1989) (stating 
that, with respect to requests under the Freedom of Information Act 
(FOIA), ``the agency must be in control of the requested materials 
at the time the FOIA request is made'' and that ``[b]y control we 
mean that the materials have come into the agency's possession in 
the legitimate conduct of its official duties'').
    \19\ Cf. Twentieth Century Fox Film Corp. v. Marvel Enterprises, 
Inc., 2002 WL 1835439, at *3 (S.D.N.Y. 2002) (noting, in context of 
Federal Rule of Civil Procedure 33, that a ``corporation responding 
to interrogatories must provide . . . the information contained in 
its own files and possessed by its own employees'').
    \20\ Cf. In re NTL, Inc. Securities Litigation, 244 FRD. 179, 
195 (S.D.N.Y. 2007) (construing ``control'' in Federal Rule of Civil 
Procedure 34).
---------------------------------------------------------------------------

    Large banks and credit unions are not required to provide 
information that falls within one of the four enumerated exceptions in 
section 1034(c).\21\ Specifically, those exceptions apply to (1) 
confidential commercial information, including an algorithm used to 
derive credit scores or other risk scores or predictors; (2) 
information collected for the purpose of preventing fraud or money 
laundering, or detecting or making any report regarding other unlawful 
or potentially unlawful conduct; (3) information required to be kept 
confidential by any other provision of law; and (4) any nonpublic or 
confidential information, including confidential supervisory 
information.\22\
---------------------------------------------------------------------------

    \21\ 12 U.S.C. 5534(c)(2).
    \22\ Id.
---------------------------------------------------------------------------

    In addition, section 1034(c) does not require a large bank or 
credit union to respond to a consumer information request in a specific 
form, such as in writing, orally, or electronically. In this regard, 
section 1034(c) differs from section 1033 of the CFPA, which requires 
that certain information be made available ``in an electronic form.'' 
\23\
---------------------------------------------------------------------------

    \23\ Section 1033(a) requires that covered persons (not limited 
to large depository institutions) ``make available . . . 
information,'' including ``in electronic form,'' which can be used 
by third parties for the provision of products or services to the 
consumer. 12 U.S.C. 5533(a). Section 1033 governs consumer 
authorized third-party access to data made available in electronic 
form in connection with third-party provision of other products or 
services--including for example, the provision of a potentially 
competing account offering. This is why, for example, section 1033 
is limited to data available in the normal course, and why section 
1033 requires data to be ``made available . . . in electronic 
form.'' The CFPB is in the process of writing proposed regulations 
to implement section 1033 of the CFPA. See CFPB, Required Rulemaking 
on Personal Financial Data Rights, https://www.consumerfinance.gov/personal-financial-data-rights/ (last visited Oct. 5, 2023).
---------------------------------------------------------------------------

B. Conditions That Unreasonably Impede Consumer Information Requests

    Section 1034(c) provides that large banks and credit unions 
``shall, in a timely manner, comply'' with consumer requests for 
information regarding their accounts for consumer financial products or 
services. It is well established that when the term ``shall'' is used 
in statutes, it generally means that something ``is required.'' \24\ 
The addition of the word ``comply''--which creates the phrase ``shall . 
. . comply''--further indicates that section 1034(c) creates a 
mandatory obligation to do what the consumer requests.\25\ Section 
1034(c) thus grants consumers a right to request and receive account 
information that falls within the scope of the provision, and imposes a 
concomitant legal obligation on large banks and credit unions to 
respond to the consumer's request and to provide such account 
information.
---------------------------------------------------------------------------

    \24\ Shall, Black's Law Dictionary (11th ed. 2019) (``This 
[definition] is the mandatory sense that drafters typically intend 
and that courts typically uphold.''); see Shall, Merriam-Webster 
Dictionary, https://www.merriam-webster.com/dictionary/shall 
(``shall'' is ``used in laws, regulations, or directives to express 
what is mandatory'') (last visited Oct. 5, 2023); see also Lexecon 
Inc. v. Milberg Weiss Bershad Hynes & Lerach, 523 U.S. 26, 35 (1998) 
(recognizing that ``shall'' is ``mandatory'').
    \25\ See Reich v. Trinity Industries, Inc., 16 F.3d 1149, 1154 
(11th Cir. 1994) (``shall comply'' language in provision of 
Occupational Safety and Health Act was ``mandatory'').
---------------------------------------------------------------------------

    Large banks and credit unions do not have to provide information in 
any particular manner, or using particular means. However, a large bank 
or credit union would not comply with section 1034(c) if it imposed 
conditions or requirements on consumers' information requests that 
unreasonably impeded consumers' ability to request and receive account 
information. Under the plain language of section 1034(c), if a consumer 
makes a ``request for information in the control or possession of such 
covered person concerning the consumer financial product or service 
that the consumer obtained from such covered person'' that does not 
fall into one of the specified exceptions, and a large bank or credit 
union refuses to provide that information unless the consumer satisfies 
an unreasonable condition, the bank or credit union has failed to 
``comply'' with the request.\26\ Section 1034(c) does not contain any 
language stating or suggesting that a large bank or credit union may 
impose conditions that unreasonably impede consumers' information 
requests. Such conditions, if permitted, would allow large banks and 
credit unions to frustrate and effectively nullify the right granted in 
section 1034(c). And there is no reason to believe that Congress 
intended for section 1034(c) to allow that result.
---------------------------------------------------------------------------

    \26\ 12 U.S.C. 5534(c).
---------------------------------------------------------------------------

    By contrast, a large bank or credit union would not violate section 
1034(c) in the context of reasonable conditions on consumer information 
requests. For example, large banks or credit unions might require that 
the person making the request verify their identity, identify their 
account, and describe the information they are seeking. Similarly, 
large banks or credit unions might require the consumer to comply with 
reasonable data security measures. These kinds of conditions, when 
implemented in a reasonable manner, would not unreasonably impede 
consumers' ability to obtain information regarding their accounts.\27\
---------------------------------------------------------------------------

    \27\ Relatedly, the CFPB does not interpret section 1034(c) to 
preempt or otherwise supersede the requirements of other Federal or 
state laws and regulations designed to protect privacy and data 
security. This includes, for example, any restrictions that may be 
imposed in the CFPB's upcoming rule implementing section 1033.
---------------------------------------------------------------------------

    As a general matter, requiring a consumer to pay a fee or charge to 
request account information, through whichever channels the bank uses 
to provide information to consumers, is likely to unreasonably impede 
consumers' ability to exercise the right granted by section 1034(c), 
and thus to violate the provision. Some consumers cannot afford to pay 
even a small fee to obtain information about their accounts. Even for 
consumers who can afford such fees, the fees can operate as a 
significant deterrent to making an information request. Thus, a large 
bank or credit union's practice of charging fees to respond to an 
information request would generally unreasonably impede consumers' 
exercise of their rights under section 1034(c). Regardless of how a 
large bank or credit union labels or categorizes a fee on its fee 
schedule or other documents, section 1034(c) does not permit 
unreasonable impediments to a request for information about a 
consumer's account. That likely includes charging fees (1) to respond 
to consumer inquiries regarding their deposit account balances; (2) to 
respond to consumer inquiries seeking the amount necessary to pay a 
loan balance; (3) to respond to a request for a specific type of 
supporting document, such as a check image or an original account 
agreement; and (4) for time spent on consumer inquiries seeking 
information

[[Page 71282]]

and supporting documents regarding an account.\28\
---------------------------------------------------------------------------

    \28\ This is not intended to be an exhaustive list of the types 
of fees for consumer information requests that may be subject to 
section 1034(c).
---------------------------------------------------------------------------

    At the same time, it would generally not violate section 1034(c) 
for a large bank or credit union to impose a fee or charge in certain 
limited circumstances. For example, a large bank or credit union might 
charge a fee to a consumer who repeatedly requested and received the 
same information regarding their account (e.g., repeatedly asked for a 
copy of the same document).\29\ In that context, the large bank or 
credit union would have already met its obligation under section 
1034(c) by complying with the consumer's earlier requests.
---------------------------------------------------------------------------

    \29\ A consumer would not seek the same information by asking 
for information from a different time period where information can 
change over time (e.g., by requesting certain transaction 
information for the month of April and then later seeking the same 
type of information for the month of May).
---------------------------------------------------------------------------

    A large bank or credit union may also violate section 1034(c) by 
imposing other conditions or obstacles that unreasonably impede 
consumers' ability to make an information request. Depending on the 
facts and circumstances, such conditions or obstacles could include 
forcing consumers to endure excessively long wait times to make a 
request to a customer service representative, requiring consumers to 
submit the same request multiple times, requiring consumers to interact 
with a chatbot that does not understand or adequately respond to 
consumers' requests, or directing consumers to obtain information that 
the institution possesses from a third party instead.\30\ Such 
conditions or obstacles may frustrate consumers' ability to exercise 
their right to request information under section 1034(c), and thus may 
violate that provision.
---------------------------------------------------------------------------

    \30\ The CFPB has recently highlighted the risks posed by 
financial institutions' use of deficient chatbots. See CFPB, 
Chatbots in Consumer Finance (June 6, 2023), https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/.
---------------------------------------------------------------------------

C. Timely Compliance With Consumer Information Requests

    Section 1034(c) provides that large banks and credit unions 
``shall, in a timely manner, comply'' with consumer requests for 
information.\31\ Section 1034(c) thus does not specify a fixed time 
limit for responding that applies to all information requests. The CFPB 
will consider the specific circumstances and nature of a particular 
request to determine compliance. For example, whether a response to a 
1034(c) request is timely may depend on the complexity of the request 
and/or the difficulty of responding. Where a request seeks basic 
information that is readily available to a large bank or credit union, 
to comply with section 1034(c) a bank or credit union would generally 
need to respond more quickly than if the request is more complex or 
seeks information that is less accessible. At the same time, even 
though a timely response for a complex response may involve a longer 
time period, that does not mean that large banks or credit unions can 
unduly delay their responses to more complicated requests.
---------------------------------------------------------------------------

    \31\ 12 U.S.C. 5534(c)(1).
---------------------------------------------------------------------------

    What constitutes a timely response under section 1034(c) may also 
be informed by the timing requirements of other Federal laws and 
regulations with which large banks and credit unions must comply. For 
example, Regulation X requires mortgage servicers to respond to certain 
information requests within specific time periods depending on the 
nature of the requested information.\32\ A large bank or credit union 
that is subject to Regulation X and that exceeded Regulation X's timing 
requirements for an information request likely would not be responding 
``in a timely manner'' for purposes of section 1034(c) with respect to 
that same information request. Conversely, a bank or credit union 
subject to Regulation X would likely respond ``in a timely manner'' for 
purposes of section 1034(c) if it provided a response that satisfied 
the timing requirements in Regulation X. Thus, where both section 
1034(c) and another Federal law or regulation applies to the same 
consumer information request, the CFPB does not view section 1034(c)'s 
``timely manner'' requirement as likely to impose timing requirements 
that differ from the specific timing requirements of the other 
applicable Federal law or regulation. The CFPB expects that large banks 
and credit unions will already have policies and procedures in place to 
meet the timing requirements of other applicable laws and regulations.
---------------------------------------------------------------------------

    \32\ See 12 CFR 1024.36(d)(2).
---------------------------------------------------------------------------

D. Accuracy and Completeness of Responses to Consumer Information 
Requests

    By providing that large banks and credit unions ``shall . . . 
comply'' with consumer requests for information, section 1034(c) 
contemplates that large banks and credit unions will in fact provide 
consumers with the information they request to the extent it is in 
their control or possession. A large bank or credit union would violate 
section 1034(c) if it provided incomplete or inaccurate information in 
response to a consumer's information request.
    With respect to completeness, a large bank or credit union would 
not comply with section 1034(c) if, for example, the consumer asked for 
information about all of the consumer's transactions with a given 
merchant since the account was opened, and the large bank or credit 
union possesses transaction information going back seven years, but its 
response provides only transaction information going back one year. 
However, a large bank or credit union would not violate section 1034(c) 
by withholding information that falls within the scope of one of the 
enumerated exceptions in section 1034(c)(2).
    With respect to accuracy, a large bank or credit union would not 
comply with section 1034(c) if it provided inaccurate information to 
consumers in response to their requests. For example, if a consumer 
asked the large bank or credit union the amount of a particular fee it 
charges for the consumer's account (e.g., the amount of a monthly 
maintenance fee for a deposit account), a large bank or credit union 
would not comply with section 1034(c) if it provided the wrong amount 
for that fee. In that circumstance, the large bank or credit union 
would not be providing responsive information in its control or 
possession (i.e., the correct amount of the fee).
    The CFPB has noted in other contexts that Federal consumer 
financial laws generally apply regardless of the technology used by 
institutions.\33\ The same principle applies to section 1034(c). 
Chatbots or other automated responses may serve to expedite responses 
in some cases; however, in the absence of appropriate checks and 
quality assurance processes, these tools can inadvertently misdirect 
inquiries or provide inadequate responses.\34\ Large banks and credit 
unions may violate section 1034(c) if they employ technologies that do 
not properly recognize consumer information requests or that provide 
inaccurate or incomplete information in response to those requests.
---------------------------------------------------------------------------

    \33\ See, e.g., Consumer Financial Protection Circular 2022-03, 
``Adverse action notification requirements in connection with credit 
decisions based on complex algorithms'' (May 2022), https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/.
    \34\ See CFPB, Chatbots in consumer finance (June 2023), https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/chatbots-in-consumer-finance/.

---------------------------------------------------------------------------

[[Page 71283]]

III. Summary of Section 1034(c) Obligations

    The CFPB is providing this summary section to assist large banks 
and credit unions in complying with section 1034(c). This section is 
intended to serve as a simplified summary and a reference tool, and 
large banks and credit unions should refer to the legal analysis above 
for further detail and information.
    As discussed above, when a bank or credit union with over $10 
billion in assets receives a request for information from a consumer 
relating to the consumer's account for a consumer financial product or 
service, section 1034(c) requires the bank or credit union to respond 
with information in its possession or control. The large bank or credit 
union must respond to the request in a timely manner; whether a 
response is timely may depend on the complexity of the request or 
difficulty of responding. Responses to consumer information requests 
must also be complete and accurate. Large banks and credit unions may 
respond to requests using any means or channels they choose.
    Consumers need information regarding their accounts to manages 
their finances, and the Advisory Opinion describes examples of account 
information that must be provided upon request. Consumers can request 
information such as account balances, transaction history, interest 
rates, scheduled auto-payments, fees, or balances necessary to pay off 
a loan, and may also request supporting written documents such as 
copies or images of checks or original signed contracts. The obligation 
to respond does not include information that does not concern the 
individual consumer's account, such as internal operating procedures or 
policies, or the company's financial performance, marketing strategy, 
or training program for its employees. The obligation also does not 
apply to information that falls within the four enumerated exceptions 
in section 1034(c), including confidential information or information 
collected to prevent fraud or money laundering.
    Section 1034(c) does not bar large banks and credit unions from 
imposing reasonable impediments on consumer information requests, such 
as reasonable identity verification and data security measures. But 
large banks and credit unions may not impose conditions that 
unreasonably impede consumers' information requests. The practice of 
charging fees to respond to an information request would generally 
unreasonably impede consumers' exercise of their rights under section 
1034(c), and thus violate the provision. Regardless of how a large bank 
or credit union labels or categorizes a fee on its fee schedule or 
other documents, section 1034(c) does not permit unreasonable 
impediments to a request for information about a consumer's account. 
That would likely include charging fees (1) to respond to consumer 
inquiries regarding their deposit account balance; (2) to respond to 
consumer inquiries seeking the amount necessary to pay a loan balance; 
(3) to respond to a request for a specific type of supporting document, 
such as a check image or an original account agreement; and (4) for 
time spent on consumer inquiries seeking information and supporting 
documents regarding an account. Depending on the circumstances, other 
kinds of conditions or obstacles may also violate section 1034(c), such 
as forcing consumers to endure excessive wait times, requiring 
consumers to submit the same request multiple times, requiring 
consumers to interact with a chatbot that does not adequately respond 
to requests, or directing consumers to obtain information from a third 
party.
    As a matter of prosecutorial discretion, the CFPB does not intend 
to seek monetary relief for potential violations of section 1034(c) 
that occur prior to February 1, 2024.

IV. Regulatory Matters

    The CFPB has concluded that the Advisory Opinion is an interpretive 
rule in part and a general statement of policy in part. Insofar as the 
Advisory Opinion constitutes an interpretive rule, it is issued under 
the CFPB's authority to interpret the Consumer Financial Protection 
Act, including under section 1022(b)(1) of the Consumer Financial 
Protection Act, which authorizes guidance as may be necessary or 
appropriate to enable the CFPB to administer and carry out the purposes 
and objectives of Federal consumer financial laws.\35\
---------------------------------------------------------------------------

    \35\ 12 U.S.C. 5512(b)(1).
---------------------------------------------------------------------------

    Insofar as the Advisory Opinion constitutes a general statement of 
policy, it provides background information about applicable law and 
articulates considerations relevant to the CFPB's exercise of its 
authorities. It does not confer any rights of any kind.
    Pursuant to the Congressional Review Act,\36\ the CFPB will submit 
a report containing this Advisory Opinion and other required 
information to the United States Senate, the United States House of 
Representatives, and the Comptroller General of the United States prior 
to the rule's published effective date. The Office of Information and 
Regulatory Affairs has designated this interpretive rule as not a 
``major rule'' as defined by 5 U.S.C. 804(2).
---------------------------------------------------------------------------

    \36\ 5 U.S.C. 801 et seq.
---------------------------------------------------------------------------

    The CFPB has determined that this Advisory Opinion also does not 
impose any new or revise any existing recordkeeping, reporting, or 
disclosure requirements on covered entities or members of the public 
that would be collections of information requiring approval by the 
Office of Management and Budget under the Paperwork Reduction Act of 
1995.\37\
---------------------------------------------------------------------------

    \37\ 44 U.S.C. 3501-3521.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2023-22774 Filed 10-13-23; 8:45 am]
BILLING CODE 4810-AM-P
```