Person-To-Person Lending: New Regulatory Challenges Could Emerge as the Industry Grows
Released: 2011-07-07T00:00:00

Letter

Background

Ensuring adequate consumer protections is one of the broad goals of the financial regulatory system in the United States, together with ensuring the integrity and fairness of markets, monitoring the safety and soundness of institutions, and acting to ensure the stability of the financial system. U.S. regulators take steps to address information disadvantages that consumers of and investors in financial products may face, ensure that consumers and investors have sufficient information to make appropriate decisions, and oversee business conduct and sales practices to prevent fraud and abuse.

Responsibilities for helping ensure consumer financial protection and otherwise overseeing the financial services industry, including person-to- person lending, are shared among various federal and state regulatory agencies and numerous self-regulatory organizations. The manner in which these regulators oversee institutions, markets, or products varies depending upon, among other things, the regulatory approach Congress has fashioned for different sectors of the financial industry. For example:  Federal banking regulators subject depository institutions (hereafter, for simplicity, banks) to comprehensive regulation and examination to ensure their safety and soundness. Until July 2011, the banking regulators serve as the primary consumer protection enforcers and supervisors for the banks under their jurisdictions. These regulators include the Office of the Comptroller of the Currency (OCC) for national banks; Board of Governors of the Federal Reserve System (Federal Reserve) for domestic operations of foreign banks and for state-chartered banks that are members of the Federal Reserve System; Federal Deposit Insurance Corporation (FDIC) for insured state-chartered banks that are not members of the Federal Reserve System; National Credit Union Administration (NCUA) for federally insured credit unions; and the Office of Thrift Supervision for federal thrifts. Both FDIC and the Federal Reserve share oversight responsibilities with the state regulatory authority that chartered the bank.  The Federal Trade Commission (FTC) is responsible for enforcing many federal consumer protection laws. Until July 21, 2011, FTC is the primary enforcer of federal consumer financial laws for nonbank financial services providers. After that date, FTC will share responsibility for such enforcement with the Bureau of Consumer Financial Protection (known as the Consumer Financial Protection Bureau or CFPB), as discussed later. In addition, FTC investigates nonbank financial services providers that may be engaged in unfair or deceptive acts or practices and takes enforcement action. Because it is a law enforcement agency, and not a supervisory agency, FTC does not regularly examine nonbank financial services providers or impose reporting requirements on them, but instead focuses on enforcement. State regulators have been the primary supervisors of nonbank financial services providers, and state-level powers and levels of supervision have varied considerably.  SEC is the primary federal agency responsible for investor protection.

Like FTC, it does not comprehensively regulate and examine companies that issue securities. Rather, federal securities regulation is intended to protect investors in specific securities through disclosure requirements and antifraud provisions that can be used to hold companies liable for providing false or misleading information to investors. State securities regulators—represented by the North American Securities Administrators Association (NASAA)—generally are responsible for registering certain securities products and, along with SEC, investigating securities fraud.

As a result of the Dodd-Frank Act, which mandated the creation of CFPB, federal regulation of consumer financial products and services is in the process of consolidation. CFPB will serve as the primary supervisor of federal consumer protection laws over many of the banks and other financial institutions that offer consumer financial products and services and will be one of the enforcers of these laws. Upon assuming its full authorities, CFPB will, among other things  assume rulemaking authority for more than a dozen existing federal consumer financial laws from other federal agencies, as well as new rulemaking authorities created by the Dodd-Frank Act itself; supervise compliance with federal consumer financial laws with respect to certain nondepository financial services providers, including those involved in residential mortgage lending, private student lending, payday lending, and “larger participant of a market for other consumer financial products or services,” to be defined through CFPB rulemaking; supervise compliance with federal consumer financial laws with respect to banks holding more than $10 billion in total assets and their affiliates; and research, monitor, and report on developments in markets for consumer financial products and services to, among other things, identify risks to consumers.

The date for transferring consumer protection functions to CFPB is July 21, 2011. Until a director takes office, the Secretary of the Treasury has the power to perform some of CFPB’s functions, and the Department of the Treasury (Treasury) has formed an implementation team to start up the agency.

The Dodd-Frank Act also established the Financial Stability Oversight Council (FSOC) to convene financial regulatory agencies to identify risks and respond to emerging threats to the financial stability of the United States. Chaired by the Secretary of the Treasury, FSOC is comprised of the heads of CFPB, FDIC, SEC, and other voting and nonvoting members—including a state banking supervisor and a state securities commissioner. Among other duties, FSOC is to  monitor the financial services marketplace in order to identify potential threats to the financial stability of the United States; facilitate information sharing and coordination among federal and state financial regulatory agencies on developing policies and regulatory activities for financial services; identify gaps in regulation that could pose risks to the financial stability of the United States; and  provide a forum for discussion and analysis of emerging market developments and financial regulatory issues.

The Major Person-to- Person Lending Platforms Serve as Intermediaries and Facilitate Loans Generally for Consumer Lending and Microfinance

Two Major For-Profit Platforms Connect Borrowers Seeking Mostly Consumer Loans with Lenders Seeking a Return on Their Investment

Prosper and LendingClub provide two major Internet-based platforms currently operating in the United States that allow lenders to select and fund loans to borrowers for consumer and business purposes. Lenders participate on these two platforms by buying notes that correspond to a specific loan, or share of a loan, with the goal of being repaid principal and receiving interest. As shown in figure 1, according to data provided by the companies, Prosper grew rapidly after launching its platform in November 2005, facilitating about $176 million in loans by September 2008 (about $5 million per month). After suspending its operations in October 2008 to register a securities offering with SEC—as we discuss later—Prosper resumed operation in July 2009 at a lower loan volume than before (about $2 million per month through December 2010) but grew more rapidly beginning in 2011 (about $4 million per month from January 2011 to March 2011). LendingClub facilitated about $15 million in loans between when it issued its first loan in June 2007 and March 2008 (roughly $1.5 million per month). Between April 2008 and October 2008, LendingClub suspended its sales of notes to lenders to register a securities offering, although it continued to make loans to borrowers using its own funds. LendingClub grew rapidly after resuming operations in October 2008, facilitating about $7.6 million in loans per month. As of March 31, 2011, about 60,000 Prosper lenders had funded about $226 million in loans to more than 33,000 borrowers. At the same time, about 20,600 LendingClub lenders had funded about $243 million in loans to about 25,000 borrowers.

According to industry officials, researchers, and online discussion forums, individuals participate as lenders in for-profit, person-to-person lending platforms as an alternative to traditional savings vehicles (e.g., savings accounts, money market accounts, certificates of deposit) that pay low interest rates. As of March 31, 2011, Prosper reported that lenders received average net annualized returns exceeding 11 percent for loans originated since it completed registration with SEC in July 2009, while LendingClub reported net annualized platform returns exceeding 9 percent for all loans since it issued its first loan in June 2007. Around the same time, the annual percentage yields for savings and money market accounts and 3-year certificates of deposit listed on bankrate.com were lower, ranging from 0.1 percent to 1.2 percent and 1.3 percent to 2.2 percent, respectively.

Borrowers use person-to-person lending as an alternative source of credit. Interest rates on these loans may be lower than those on traditional unsecured bank loans or credit cards. As of March 31, 2011, the annual percentage rate for a 3-year loan was as low as 6.3 percent for Prosper and 6.8 percent for LendingClub, depending on the borrower’s credit ratings or loan grades, while the average annual percentage rate for credit cards around that time was 14.7 percent. Nonetheless, the annual percentage rate could be as high as 35.6 percent for Prosper and 25.4 percent for LendingClub. In contrast, one credit card issuer had an annual percentage rate of 49.9 percent for cash advances and purchases made using its credit card. Prosper reported that the average annual percentage rate for all 3-year loans since its inception was 20.6 percent, and LendingClub reported that the same average for its loans was 11.4 percent.

Lenders using these platforms generally provide capital in relatively small amounts for borrowers who are typically seeking fairly small, unsecured loans for consumer purposes—such as consolidating debts, paying for home repairs, or financing personal, household, or family purchases—or, to a lesser extent, for business purposes. Lenders can invest in many loans and may fund an entire loan request or only a fraction of each loan request—as little as $25 per loan. As of March 31, 2011, Prosper lenders invested on average about $3,700, while LendingClub lenders invested on average about $8,640. Both platforms restrict borrowers’ loan request amounts to between $1,000 and $25,000 for Prosper and up to $35,000 for LendingClub, and the average amount borrowed was $5,886 for Prosper and approximately $9,980 for LendingClub. As of March 31, 2011, according to Prosper officials, about 25 percent of its borrowers since the platform’s inception used the loans to consolidate debt or pay off credit cards, 4 percent used the loans for home repairs, 10 percent used the loans for business purposes, and 14 percent used the loans for other purposes. The corresponding percentages for LendingClub were approximately 57 percent to consolidate or pay off debt, 7 percent for home repairs, 10 percent for financing purchases for consumer use, and 5 percent for business purposes.

The Two Major For-Profit Platforms Have Similar Processes for Facilitating Loans

As shown in figure 2, the lending process is similar for Prosper’s and LendingClub’s platforms, with the company acting as an intermediary between borrowers and lenders. To borrow or lend money on one of the platforms, each participant must register as a member on that company’s Web site under a screen name (to maintain anonymity) and provide basic information to determine their eligibility as a borrower or lender. Each borrower must complete a loan application that is reviewed to determine creditworthiness. For example, prospective borrowers must have minimum credit scores to be accepted on either platform—at least 640 for Prosper and 660 for LendingClub. Prosper and LendingClub assign a proprietary letter grade to each loan request—based on credit score, credit history, and other factors (e.g., requested loan amount and past reported delinquencies)—to help lenders gauge borrowers’ creditworthiness. In comparison, prospective lenders are not evaluated for creditworthiness. Beyond demonstrating basic eligibility requirements, including identity verification, lenders may only have to attest that they meet the minimum income or asset requirements imposed by a number of state securities regulators or, in the case of LendingClub, by the company itself (we discuss these requirements later in this report). In aggregate, a Prosper lender can invest up to $5 million, while a LendingClub lender can invest no more than 10 percent of that lender’s total net worth.

The companies post approved loan requests, including loan amounts, interest rates, and assigned letter grades, on their Web sites for lenders to review and choose to fund. Approved loan requests are for unsecured, fixed-rate loans with a 1-, 3-, or 5-year maturity (Prosper) and a 3- or 5- year maturity (LendingClub), with interest rates reflecting the assigned credit rating or loan grade. Lenders may also view information such as borrowers’ income levels, and the purpose of the loans, to the extent borrowers provide such data. Lenders may scroll through approved loan listings manually to select which loans to fund, or they may build a portfolio based on their preferred criteria, such as loan characteristics (e.g., amount, term, interest rate) or borrower characteristics (e.g., location, number and balance of credit lines, length of employment). Lenders may also use automated portfolio building tools, offered by both platforms, that allow lenders to search for loans using criteria defined by the platforms, such as credit quality, average annual interest rate, or a combination of these characteristics.

On both platforms, lenders do not make loans directly to borrowers. Rather, lenders purchase payment-dependent notes that correspond to the selected borrower loans. Once lenders choose which loans to fund, WebBank, an FDIC-insured Utah-chartered industrial bank, approves, originates, funds, and disburses the loan proceeds to the corresponding borrowers. WebBank then sells and assigns the loans to the respective platform in exchange for the principal amount that the platform received from the sale of corresponding notes to the lenders. WebBank officials said that the bank does not have long-term ownership of the loans and does not bear the risk of nonpayment. Rather, they noted that, due to the nature of the platforms, the risk of nonpayment is transferred (through the notes) to the lenders.

Prosper and LendingClub have exclusive rights to service the loans and collect monthly payments from borrowers, generally via electronic fund transfers. After deducting a 1 percent servicing fee and any other fees, such as insufficient fund fees, the platforms credit each lender’s account his or her share of the remaining funds. Also, the platforms can attempt to recover any loans that become delinquent, and they have exclusive rights to determine whether and when to refer the loans to third-party collection agencies. As we discuss later, for both companies, 2 percent or less of the loans in their top three credit grades originated in the first half of 2010 had defaulted as of March 31, 2011.

A Major Platform Allows Lenders to Support Microloans to Entrepreneurs on a Not- for-Profit Basis

Founded in November 2005, Kiva is the major nonprofit platform in the United States that offers lenders opportunities to support economic development and entrepreneurship, mostly in developing countries, through partnerships with local microfinance institutions. As part of its efforts to alleviate poverty by connecting people through lending, Kiva facilitates the collection and transfer of capital for interest-free loans, funded by its lenders, to approximately 130 microfinance institutions around the world to fund interest-bearing loans to entrepreneurs in their communities. Kiva screens, rates, and monitors each microfinance institution on its platform and assigns it a risk rating for lenders to consider in their funding decisions. As of March 31, 2011, about 570,000 Kiva lenders had funded approximately $200 million for 273,000 microloans across 59 countries.

Much like the two major for-profit platforms, Kiva is set up to allow lenders to register for an online account to select and fund loans to borrowers, primarily in developing countries, who are seeking money to support their small business (microenterprise) operations. As shown in figure 3, Kiva’s lending process contains some key differences from the process used by the major for-profit platforms. Rather than transacting directly with individual borrowers, Kiva aggregates funds from lenders and forwards them to microfinance organizations, which make and manage loans to the borrowers and transmit the borrowers’ repayments to Kiva, which in turn distributes the lenders’ shares of the funds received back to the lenders. Individuals are eligible to become lenders on Kiva simply by providing basic information, including their name and e-mail address. Once lenders have registered, Kiva automatically generates a profile page, but lenders may choose to remain anonymous. Through the platform Web site, lenders can look through the loan requests and select the microenterprises that they are interested in funding. Lenders can fund as little as $25 and as much as the entire amount of the loan. Officials said that requested loan amounts vary geographically, ranging from $1,200 to $10,000. Kiva relies on the local microfinance institutions to screen and evaluate borrowers and set loan amounts and terms. Additionally, the local microfinance institutions work with the borrowers to collect their entrepreneurial stories, pictures, and loan details and upload the information to Kiva’s Web site for potential lenders to view.

When lenders select the microenterprises they want to fund on Kiva’s platform, they do not make loans directly to the borrowers. Rather, the loan proceeds typically replenish the microfinance institutions for the loans that they distributed to borrowers when they were needed. Often, the loans are disbursed before the loan details are posted on Kiva’s Web site for lenders to view. Even though Kiva lenders provide loan funds free of interest, the microfinance institutions charge the entrepreneurs interest on their loans to help cover the institutions’ operating costs. As of February 2011, the average portfolio yield among Kiva’s microfinance institution partners was about 37 percent. As the microfinance institutions collect the scheduled repayments from borrowers, they retain the interest payments and any other fees they charge to help finance their operations, and transfer the amount of principal payments to Kiva, which credits lenders’ accounts for their share of the corresponding loans. If a borrower fails to make a scheduled payment, the microfinance institution notifies Kiva and lenders could potentially receive a late or partial payment or receive no payment. According to Kiva, the repayment rate for all of its loans from all partners as of March 31, 2011, was approximately 99 percent.

According to Kiva officials and online discussion forums, many lenders participate on Kiva’s platform because they are motivated to help individuals in developing countries escape poverty and improve their quality of life. Kiva reported that, as of March 31, 2011, each of its lenders had funded an average of about 11 loans for about $380 per borrower. Furthermore, Kiva officials said that, based on its market research, the bulk of its lenders said that they chose to lend to make a difference in someone’s life without spending a lot of money and that they would be likely to use any repayments they received to fund more loans to other entrepreneurs.

Other Domestic and Foreign Companies Demonstrate the Variety of Person-to-Person Lending Platforms

Several U.S. companies have introduced a variety of other person-to- person lending platforms. For example, some companies have offered, and at least one continues to offer, a more direct form of person-to- person lending that formalizes lending among friends and families. Lenders can use such platforms to make loans directly to borrowers they know by arranging a promissory note that outlines explicit conditions, such as the loan amount, terms and rate, and repayment terms. Other companies have offered platforms that, like Prosper and LendingClub, facilitate interest-bearing loans between individuals who do not know one another, but these companies have often targeted a more specific lending market. For example, these platforms may provide financing for small businesses, mortgages, or private student loans for higher education.

Foreign companies have also offered an array of person-to-person lending platforms in a number of other countries. For example, Zopa, a UK company, operates a major for-profit, person-to-person lending platform similar to Prosper and LendingClub in the United Kingdom and has begun to franchise its model in other countries. As of March 2011, Zopa had facilitated more than £125 million (roughly $200 million) in loans since its launch in 2005. Additionally, other foreign companies in countries such as Australia, Canada, China, France, Germany, India, Japan, and Korea have also offered both for-profit, person-to-person lending platforms and nonprofit platforms that offer lenders opportunities to fund microfinance loans.

Although Person-to- Person Lending Offers Potential Benefits to Lenders and Borrowers, It Also Poses Risks Currently Overseen by a Complex Regulatory Structure

Person-to-person lending offers lenders the potential to earn relatively high returns and may provide borrowers with broader access to credit than they would otherwise have. In return, lenders face the risk of losing their principal and the expected interest on their investments on for-profit platforms. While borrowers using the person-to-person lending platforms face risks largely similar to those facing borrowers using traditional banks, including unfair lending and collection practices, borrowers face some privacy issues unique to the person-to-person lending platforms. The current regulatory structure for the oversight of person-to-person lending consists of a complex framework of federal and state laws and the involvement of numerous regulatory agencies. For the major for-profit platforms, SEC and state securities regulators enforce lender protections, mostly through disclosures required under securities laws, and FDIC and state regulators enforce borrower protections. The Internal Revenue Service (IRS) and California attorney general have authority to enforce reporting and other requirements for Kiva as a charitable organization, while Kiva’s microfinance partners are subject to varying consumer financial protection requirements that apply in the jurisdictions where they lend.

Person-to-Person Lending Poses Risks to Lenders That Have Been Subject to Securities Regulation

The major for-profit, person-to-person lending companies (Prosper and LendingClub) offer lenders the potential to earn higher returns than they might through conventional savings vehicles, as the examples of the companies’ Web sites show (figs. 4 and 5). As we have seen, the companies have reported average net annualized returns for lenders that have exceeded recent returns for savings accounts and certificates of deposit. According to Prosper and LendingClub, lenders can also select loans that match their appetite for risk and return, something they cannot do with bank deposits, and diversify their portfolios by investing in consumer and commercial (i.e., small business) loans as an alternative asset class to stocks or mutual funds.

Lenders participating on the platforms are also exposed to various risks— particularly credit risk (the possibility that borrowers may default on their loans) and operational risks associated with relying on the platforms to screen loan applicants and service and enforce collection of the loans (see table 1). In contrast with traditional savings vehicles, such as FDIC- insured savings accounts or certificates of deposit with fixed rates of return, the notes that lenders purchase from Prosper and LendingClub do not guarantee that they will recover their principal or achieve expected returns. While the companies take steps to confirm loan applicants’ identities and use information from their credit reports to screen loan requests and assign credit ratings, they often do not verify information that borrowers supply, such as their income, debt-to-income ratio, and employment and homeownership status. Lenders face the risk that inaccuracies in the platforms’ assigned credit ratings or borrower-supplied information could result in lower-than-expected returns. Also, lenders have no direct recourse to the borrowers to obtain loan payments, so their returns depend on the success of the platforms and their collection agents in obtaining repayments from borrowers. For all loans originated between January 1, 2010, and June 30, 2010, about 55 percent of Prosper’s and more than 70 percent of LendingClub’s loan volume went to borrowers with the top three credit grades and, of those loans, 1.2 percent (Prosper) and 2 percent (LendingClub) had entered into default or been charged off by March 31, 2011.

To mitigate some of the credit risk that loans might default, lenders on the platforms may choose to diversify their investments by funding a broad portfolio of loans, in the same way that investors might diversify their investments across and within asset classes to minimize the impact of a single asset losing value. However, investing in a diverse portfolio of loans on a given platform does not eliminate other risks, such as those associated with lenders relying on unverified borrower information and the companies’ credit rating systems when selecting which loans to fund.

The risks to lenders of participating on person-to-person lending platforms are currently addressed through securities registration of the notes the companies sell to lenders. Although officials from Prosper and LendingClub said that they had initially questioned the applicability of federal securities registration requirements to person-to-person lending, both companies ultimately registered securities offerings with SEC. Prosper and LendingClub launched their platforms in 2005 and 2007, respectively, without registering securities offerings. Prosper subsequently filed a registration statement in October 2007 for a proposed secondary trading platform that its lenders could use to trade their notes, but it did not seek to register the notes themselves. Prosper continued to sell notes to lenders until October 2008. In November 2008, SEC entered a cease-and-desist order against Prosper, in which SEC found that Prosper violated Section 5 of the Securities Act for engaging in unregistered offerings of securities. Prosper resumed selling notes to lenders when its registration statement became effective in July 2009. LendingClub suspended its sales of notes to lenders from April to October 2008 to register with SEC. This progression of events is illustrated in figure 6.

SEC’s oversight of person-to-person lending, as with its oversight of other companies that issue securities, focuses on reviewing the companies’ required disclosures rather than examining or supervising the companies or their operations, or reviewing the merits of the notes they offer. Specifically, staff from SEC’s Division of Corporation Finance led the agency’s review of Prosper’s and LendingClub’s registration statements and other required filings for compliance with legal requirements for an issuer to disclose all information that may be material to an investor’s decision to buy, sell, or hold a security. For example, Prosper’s and LendingClub’s prospectuses identify, among other things, the general terms of the notes, the risks to lenders of investing in the notes, and details about the operations of the platforms. In addition, both Prosper and LendingClub continually offer new series of notes to investors to fund corresponding loans and thus are required to update their prospectuses with supplements containing information about the new notes and their corresponding loans as they are offered and sold. These supplements include required information on the terms of each note, such as interest rate and maturity. Prosper and LendingClub also include other information concerning the underlying loan that is available to lenders on their Web sites as part of the loan listing, including anonymous information from the borrower’s credit report, and anonymous information supplied by the borrower, such as loan purpose, employment status, and income.

SEC staff explained that the federal securities laws and rules require that certain information—including information in the prospectus supplements—be provided to investors in order to document the final terms of their investments. Including these disclosures in the prospectus also ensures that certain protections of the securities laws are available to investors in the event the information is found to be incorrect or misleading. For example, SEC staff told us that the borrower and loan information included in the prospectus supplements established a permanent record of all material information that the companies provided to their lenders about the notes offered and purchased. Staff from SEC and officials from the companies agreed that lenders were unlikely to consult the prospectus supplements—which are available to the public online on SEC’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR) database—at the time they invest, because the same information is available in real time on the platforms. However, investors who purchase securities and suffer losses have recovery rights, through litigation, if they can prove that material information was omitted or stated untruthfully in the prospectus or prospectus supplements. Information is only deemed part of a prospectus when it is required to be filed with SEC under its rules.

In addition to registering with SEC, Prosper and LendingClub have registered with selected state securities regulators in order to be permitted to offer and sell notes to state residents. The Securities Act of 1933 exempts certain types of securities, such as those of companies listed on national exchanges, from state securities registration requirements. However, because the notes that Prosper and LendingClub offer do not qualify for such an exemption, the companies have sought to register the notes on a state-by-state basis. As of April 2011, 30 states and the District of Columbia had approved the registration statements or applications of one or both companies (fig. 7). Lenders in the remaining 20 states cannot participate on either platform, but officials from both companies said that they were continuing to seek approval in some of the remaining states.

NASAA officials explained that, while some states take a disclosure- based approach similar to SEC’s, other states have a merit-based approach that, in addition to disclosure, also requires the securities regulators to determine whether a securities offering is fair, just, and equitable. These merit-review states may impose financial suitability standards, such as minimum income or asset requirements and caps on the percentage of an investor’s assets that can be invested in a security. Seven merit-review states have required their residents to meet such suitability standards to participate as lenders on Prosper’s or LendingClub’s platforms. The state securities regulators do not examine compliance with these suitability standards, and the companies are not required to verify that lenders meet them. Rather, the companies require lenders to attest that they meet the standards. NASAA officials said that a company could be held liable if it sold notes to a lender without receiving the proper attestation of suitability or when it knew, or should have known, that the lender’s attestation of suitability was false. In either event, the state securities regulator or SEC could bring an enforcement action against the company.

Officials of the securities regulators in the four merit-review states that we contacted (California, Kentucky, Oregon, and Texas) identified risk factors and other considerations that led their agencies to impose financial suitability requirements for lenders or that have prevented them from approving one company’s, or both companies’, registration statements.For example, all four of these states cited the risks lenders face, particularly related to their reliance on the platforms to screen borrowers and service the loans, the companies’ limited verification of information supplied by borrowers, and the novelty and untested nature of person-to- person lending. Officials from Kentucky and Oregon said that, by imposing suitability requirements that restricted lenders’ investments to 10 percent of their net worth, their agencies aimed to protect investors in their states by limiting their exposure to losses on the notes. They also said that their states’ minimum income or net worth requirements helped to ensure that lenders could afford to withstand any losses incurred and increased the likelihood that they would have the sophistication to understand the risks of investing in the notes. Officials from Texas said that the companies’ registration statements had not yet satisfied Texas’ conditions for approving registrations. The officials said that one of the applicable conditions was a cash flow standard for debt securities—which holds that a company issuing debt securities should have sufficient cash flows to service the debt securities being offered—even though Prosper and LendingClub are not obligated to make payments on the notes if the borrowers fail to repay the corresponding loans. In contrast, officials from California said that the financial condition of person-to-person lending companies has little relevance for lenders compared with the financial conditions of the borrowers in the underlying transactions. However, they noted that securities regulators cannot assess borrowers’ financial conditions. These officials said that, in imposing financial suitability requirements for California residents, the agency sought to balance the risks to lenders with the overall benefits that person-to- person lending confers on lenders and borrowers.

Various Regulators Oversee Risks to Borrowers on Person-to- Person Lending Platforms

Person-to-person lending platforms may broaden the supply of unsecured consumer and commercial loans, and borrowers who obtain loans through the platforms may be able to obtain better terms than they could from more conventional lenders. To the extent that lenders invest in consumer and commercial loans, person-to-person platforms may provide borrowers with an alternative to traditional sources of unsecured credit such as credit cards and personal loans from banks. Borrowers may also be able to obtain lower annual percentage rates through Prosper and LendingClub than through more traditional credit sources. As with traditional loans, however, these terms will vary according to the borrower’s credit score and history, as well as the amount and terms of the loan.

As with any source of credit, borrowers on the two major for-profit, person-to-person lending platforms face risks—such as potentially unclear or misleading lending terms, predatory or discriminatory credit decisions, and unfair, deceptive, or abusive servicing or collection acts or practices. The regulators, researchers, and consumer advocacy organizations we interviewed generally characterized these risks as similar to the risks borrowers faced in obtaining consumer loans from banks or other institutions. Borrowers face the risk of unclear or misleading lending terms, but regulators and consumer advocacy organizations generally agreed that the major for-profit, person-to-person lending platforms currently offer loans with fairly straightforward terms (e.g., fixed-rate, fully amortizing loans). Some of these commentators also said that, as they would with other types of credit providers, borrowers could face the risk of predatory or discriminatory credit decisions or other unfair, deceptive, or abusive acts or practices by the major for-profit platforms or the third-party collection agencies they hire.

Unlike with traditional lending, borrowers also face the risk of having their privacy compromised through their participation on the major for-profit platforms because borrowers may reveal enough information online to permit the platforms’ members and members of the public to deduce their identities. Prosper and LendingClub present borrowers’ information anonymously, including credit report data, and take steps to deter borrowers from posting personally identifiable information. Nonetheless, any personally identifiable information borrowers choose to reveal is available to members online and, because it is included in the prospectus supplements filed with SEC, publicly through SEC’s EDGAR database. Our review of selected prospectus supplements filed by Prosper and LendingClub between August 31, 2010, and November 26, 2010, identified cases in which borrowers revealed information that potentially could be pieced together to determine their identities. For example, a few borrowers listed Web site addresses for their small businesses, while others revealed their city of residence, employer, and job title or other specific occupation information. In April 2011, LendingClub implemented additional controls to help address some of the issues we identified. Also, in June 2011, Prosper officials said that they intended to modify their privacy policy to disclose to borrowers that certain information they provide in their loan listings becomes publicly available through SEC filings. Appendix II offers a more detailed discussion of our analysis.

A number of federal and state regulators currently play a role in monitoring and enforcing Prosper and LendingClub’s compliance with laws that address risks related to consumer lending and Internet commerce. As shown in table 2, these laws require creditors to disclose lending terms, prohibit discrimination, and regulate debt collection. The laws also prohibit unfair or deceptive acts or practices and require companies to protect personal financial information, adopt anti-money- laundering procedures, and meet requirements for electronic transactions. Officials from Prosper and LendingClub identified these laws as being applicable to the platforms’ lending activities directly or indirectly through their relationships with WebBank (the FDIC-insured industrial bank in Utah that originates and disburses the platforms’ loans) and third- party debt collection agencies. Prosper, LendingClub, and WebBank officials also described the steps that they have taken to ensure compliance with many of these laws and their regulations. For example, WebBank officials said that loans are originated based on WebBank- approved credit policies, which Prosper and LendingClub implement. The officials said that WebBank reviews and approves all materials and policies related to loan advertising and origination, and also performs transaction-level testing of the platforms’ credit decisions to, among other things, help ensure compliance with antidiscrimination provisions of the Equal Credit Opportunity Act. The officials noted that Prosper and LendingClub were responsible for providing, on behalf of WebBank as the lender, disclosures of loan terms for approved loan requests, as required under the Truth in Lending Act, and of reasons for denying loan applications for consumer credit, as required under the Equal Credit Opportunity Act and the Fair Credit Reporting Act. They added that WebBank’s transaction-level testing validated the companies’ calculations of annual percentage rates and finance charges and ensured that the platforms’ disclosures were generated correctly.

Several federal and state regulators, including FDIC, FTC, and the Utah Department of Financial Institutions (UDFI), either play a role or could play a role in helping ensure Prosper’s and LendingClub’s compliance with applicable laws and regulations. First, WebBank’s primary federal and state regulators—FDIC and UDFI—have the authority to indirectly oversee Prosper’s and LendingClub’s compliance with applicable lending, consumer protection, and financial privacy laws, because the bank originates and disburses the platforms’ loans, and Prosper and LendingClub are the bank’s servicers for this purpose. FDIC and UDFI generally evaluate institutions’ risk management programs, including third-party relationships. These evaluations focus on the institutions’ oversight programs and generally not include direct examination of third- party platforms. Officials from FDIC and UDFI said that they could take enforcement action against a bank or refer the companies operating platforms to law enforcement agencies if they identified problems in a bank’s relationship with the companies, or found evidence that the companies had violated federal or state laws.

Second, FTC has some enforcement responsibilities related to person-to- person lending. FDIC enforces applicable financial privacy provisions of the Gramm-Leach-Bliley Financial Modernization Act (Gramm-Leach- Bliley Act) against WebBank. FTC staff said that, while FTC has not determined whether Prosper or LendingClub are financial institutions as defined by the act, if the companies were engaged in any of the financial activities incorporated by reference into the act, they would be subject to FTC’s jurisdiction if they were not specifically assigned to another regulator’s jurisdiction. FTC also has the authority to enforce Section 5 of the FTC Act—which prohibits unfair or deceptive acts or practices. FTC staff said that, unless Prosper and LendingClub were exempt from the agency’s jurisdiction, FTC could enforce Section 5 against them. FTC also has primary enforcement responsibility under the Fair Debt Collection Practices Act—which prohibits abusive, unfair, or deceptive acts or practices by third-party debt collectors—although banks and certain other entities are exempt from FTC’s authority. FTC staff said that FTC could enforce the act against Prosper and LendingClub if they were not exempt from FTC’s authority and if they were engaged in third-party debt collection.

However, FTC officials noted that FTC was primarily a law enforcement agency and did not have examination authority. To identify targets for law enforcement investigations and prosecutions, FTC staff monitors consumer complaints, among other sources, for trends and for information about problematic practices and companies. As of March 2011, FTC reported that it had received 29 consumer complaints related to person-to-person lending out of more than 6 million complaints it had received overall in the last 5 years.

Third, some states have lending, servicing, and debt collection laws that apply to Prosper and LendingClub. Officials from both companies said that, although WebBank originates and disburses loans on their behalf, some states require them to be licensed or otherwise authorized to perform their roles in marketing and servicing the loans. The officials said that they could be subject to inspection by these states’ licensing authorities but added that state oversight had generally been limited to periodic reporting requirements.

The federal regulatory structure for person-to-person lending as related to borrower protection will be affected as CFPB assumes its new authorities under the Dodd-Frank Act. For example:  CFPB will assume authority to make rules under many existing consumer financial protection laws and will have the authority to prescribe rules defining what acts or practices pertaining to consumer financial products or services constitute unfair, deceptive, or abusive acts or practices. Similarly, CFPB will have the authority to prescribe rules imposing disclosure requirements to help consumers understand the terms, benefits, costs, and risks of consumer financial products and services. CFPB representatives noted that many regulations promulgated by CFPB will generally apply to consumer loans made through person-to-person lending platforms.  CFPB will assume responsibility for supervising compliance with federal consumer financial laws for (1) banks with more than $10 billion in assets and their affiliates and (2) certain categories of nondepository financial services providers including, as discussed earlier, nondepository entities that are “larger participant of a market for other consumer financial products or services,” as defined by CFPB in regulations after consultation with FTC. CFPB will also have substantial authority to examine “service providers” who provide material services to depository or nondepository “covered persons” under the Dodd-Frank Act. CFPB representatives emphasized that determining the scope of CFPB’s supervision authority with regard to particular person-to-person lending platforms would be highly fact- dependent, but that, in general, a nondepository institution operating a person-to-person lending platform could become subject to CFPB’s supervision authority if it was involved in residential mortgage lending, private student education lending, or payday lending; if it met the definition of a “larger participant of a market for other consumer financial products or services;” or under certain circumstances as a service provider.  CFPB is required to establish a unit whose functions shall include establishing a database or utilizing an existing database to facilitate the centralized collection of, monitoring of, and response to consumer complaints about consumer financial products or services. CFPB representatives said that the complaint unit would collect complaints related to borrowers’ experiences with person-to-person lending platforms to the extent the complaints relate to consumer loans or other consumer financial products or services. As a general matter, CFPB is still defining the scope of its complaint handling function, including whether it would collect complaints related to lenders’ experiences with person-to-person lending platforms and how it would coordinate with agencies such as FDIC, FTC, and SEC to route and respond to such complaints.

The Major Nonprofit Platform Is Subject to Regulation as a Charitable Organization

The major U.S. nonprofit person-to-person lending platform, Kiva, offers lenders the opportunity to help alleviate poverty through funding loans and entrepreneur borrowers the opportunity to benefit from these funds. As we have seen, Kiva lenders do not earn interest on the loans they fund. Instead, Kiva emphasizes the potential social and economic benefits that lenders may help achieve through their support of microfinance and entrepreneurship, as shown in figure 8. To the extent that the funds from lenders provide Kiva’s microfinance partners the capital to finance loans that they would not have otherwise made, the platform’s activities may increase the supply of credit for individual entrepreneurs who might not have access to traditional banking services in their home countries.

Lenders on Kiva’s platform face some risks similar to those facing lenders on the for-profit, person-to-person lending platforms, principally credit risk—the possibility that they will lose their principal if borrowers or Kiva’s microfinance partners fail to repay their loans. Kiva and its microfinance partners do not guarantee lenders’ loans, so the lenders assume the risk that borrowers may not repay. In addition, lenders face risks because they rely on Kiva’s microfinance partners to screen borrowers, service their loans, and transmit payments to Kiva. As a result, even if borrowers repay their loans, lenders may not be repaid due to a microfinance partner’s bankruptcy, fraud, or poor operations. Kiva discloses these risks on its Web site. Similarly, lenders face operational risks associated with their reliance on Kiva to screen and monitor its microfinance partners and effectively maintain its platform for servicing the loans and transmitting payments to lenders. Kiva also discloses on its Web site that lenders face potential currency risks and country-specific risks that do not affect lenders on the major for-profit platforms. For example, Kiva’s microfinance partners may choose to pass on to lenders a share of the foreign currency risks associated with their receiving loan payments in local currency and needing to repay loans to Kiva in U.S. dollars. Also, broader risks of economic or political disruption or natural disaster in borrowers’ home countries can affect repayments to lenders.

Borrowers who receive loans funded by lenders on the Kiva platform also face risks that are similar to those facing borrowers who receive loans through other types of lenders, based on actions of the microfinance institutions that actually disburse the funds and service the loans posted to the Kiva Web site. These risks include the potential for a microfinance institution to provide unclear or misleading lending terms, make predatory or discriminatory credit decisions, and use unfair, deceptive, or abusive servicing or collection acts or practices. For Kiva’s microfinance partners that lend to borrowers in the United States, the legal standards for lending terms and practices would depend in part on whether they extend consumer or commercial credit, but would likely be similar to those for Prosper and LendingClub and other institutions involved in domestic lending of the same type, according to CFPB representatives. For Kiva’s microfinance partners that lend in foreign countries, however, the local lending regulations may vary.

As a 501(c)(3) nonprofit tax-exempt organization, Kiva is subject to federal and state charity regulation and IRS financial reporting requirements. For example, to obtain and maintain its exemptions from federal and state income taxes and its ability to receive tax-deductible donations, Kiva must be organized and operated exclusively for charitable or other exempt purposes and must comply with federal limitations on lobbying activities. Although Kiva is exempt from income taxation, the IRS and California’s Franchise Tax Board require charitable organizations to file annual information returns of their income and expenses. Also, under California law, Kiva must prepare and have audited annual financial statements. While Kiva must disclose its annual returns and financial statements to the public on request, federal and state charities regulations do not require it to disclose information about its platform or the risks involved for lenders. IRS can examine Kiva’s returns for compliance with requirements for federal income tax-exemption, and Kiva could be subject to enforcement action by the IRS or the California Attorney General if it is not in compliance with the relevant requirements. Kiva is not subject to further federal or state supervision or examination of its operations or activities.

Because Kiva does not offer lenders the opportunity to earn interest, it has not been subject to federal securities registration requirements. Staff from SEC’s Division of Corporation Finance said that Kiva had not invited SEC to take a position on whether its arrangement with lenders was subject to securities regulation. However, these staff said that based on Supreme Court precedent, SEC generally considered a security to be present only where the purchaser expects to make a profit or return that is the result of a third party’s efforts. Even if a security were present—if, for example, Kiva or another nonprofit platform offered notes that paid interest—nonprofit organizations issuing securities can potentially obtain an exemption from federal and state registration requirements.

FTC cannot enforce Section 5 of the FTC Act’s prohibition against unfair or deceptive acts or practices against a corporation that does not carry on business for its profit or the profit of its members. FTC staff said that, if Kiva is such an entity, the agency would lack the authority to challenge its conduct under Section 5 of the FTC Act. As of March 2011, FTC reported that the agency had received no complaints related to Kiva in the last 5 years.

Kiva officials said that, because its microfinance partners make loans to individuals, the microfinance partners are responsible for compliance with any applicable consumer financial protection requirements. For example, Kiva’s microfinance partners that lend in the U.S. could be subject to the Truth in Lending Act to the extent that they extend consumer credit and the Fair Debt Collection Practices Act to the extent that they engage in third-party collections of consumer credit, according to CFPB representatives. They also said that, because the Equal Credit Opportunity Act applies to both consumer and commercial credit, it may apply to the microfinance partners regardless of whether the transactions involve consumer or commercial credit. FTC staff also noted that the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act could also apply, and that the debt collection practices of Kiva’s domestic microfinance partners and their third-party debt collectors could be subject to the prohibitions on abusive, unfair, or deceptive acts or practices under the Fair Debt Collection Practices Act and Section 5 of the FTC Act. Kiva’s microfinance partners that lend outside the U.S. are subject to varying national and local borrower protection laws and regulations in the foreign countries where they lend, according to Kiva officials. These officials said that Kiva facilitates its microfinance partners’ compliance with some requirements. For example, for microfinance partners that are subject to prohibitions on publicly identifying borrowers who are delinquent on their loan payments, Kiva offers a feature that informs lenders when loans are delinquent but keeps the identity of the borrowers anonymous to other Kiva members and the public on Kiva’s Web site.

Options for Regulating Person-to- Person Lending Have Advantages and Disadvantages Related to Borrower and Lender Protection, Flexibility, and Efficiency

We identified two primary options for regulating person-to-person lending that differ primarily in their approach to lender protection: (1) continuing with the current bifurcated federal system—that is, protecting lenders through securities regulators and borrowers primarily through financial services regulators, which will include the newly formed CFPB—or (2) consolidating borrower and lender protection under a single federal regulator, such as CFPB. We considered the advantages and disadvantages of these two options primarily in relation to three key elements—consistent consumer and investor protection, regulatory flexibility, and efficiency and effectiveness—from a framework that we had previously developed for evaluating proposals for financial regulatory reform. The current regulatory system offers borrowers and lenders on the major for-profit platforms protections consistent with those for other borrowers and investors, but some industry observers suggested that using securities regulation to protect lenders on person-to-person lending platforms lacked flexibility and imposed burdens on companies that hampered efficiency. Under a consolidated regulatory approach, borrowers on person-to-person lending platforms would likely continue to receive the same kinds of protections as other borrowers, and, depending on how implemented, lender protections could be expanded. Some industry observers, however, were uncertain about the efficiency and effectiveness of shifting to a new regulatory regime under an agency that is still in its formative stages. Finally, new regulatory challenges could emerge if the person-to-person lending industry introduced new products or services or if it grew dramatically, making it difficult to predict which regulatory option would be optimal in the future.

The Two Options for Regulating Person-to- Person Lending Differ Primarily in Their Approach to Lender Protection

The key distinction between the two primary options for regulating person-to-person lending is how they would protect lenders using the for- profit platforms. First, as we have seen, under the current regulatory system, SEC and state securities regulators protect lenders on the major for-profit platforms primarily through disclosure requirements and the antifraud and other liability attending those who offer and sell securities, while, for borrower protection, FDIC and UDFI have authority to oversee banking institutions and their third-party relationships. In addition, CFPB will play a role in borrower protection under the current regulatory system as it assumes rulemaking authority for federal consumer financial laws and as its database for collecting and routing consumer complaints becomes operational. Also, CFPB could have a number of potential bases for conducting direct examinations of person-to-person lending platforms, as discussed earlier, including, but not limited to, nondepository platforms that qualify as “larger participant of a market for other consumer financial products or services,” to be defined by CFPB rulemaking.

Second, a consolidated regulatory approach for person-to-person lending would assign primary federal responsibility for borrower and lender protection to a single regulator, such as CFPB. A consolidated approach would require exempting person-to-person lending platforms from federal securities laws. Under such an approach, CFPB could be assigned responsibility for lender protection, in addition to the roles that it would play with respect to borrower protection under the current regulatory system for person-to-person lending. Depending on how a consolidated regulatory approach was implemented, CFPB might, for example, require disclosures for lenders as well as borrowers, impose requirements or restrictions on person-to-person lending companies’ practices in facilitating loans to borrowers and selling the loans (or corresponding notes) to lenders, and perform supervisory examinations of person-to- person lending companies. Under a consolidated regulatory approach, other federal and state regulatory agencies might still be involved in regulating and overseeing person-to-person lending, unless preempted by law. For example, even if person-to-person lending was exempt from federal securities law, person-to-person lending companies could still be required to register offerings with state securities regulators. Also, bank regulators could continue to examine third-party relationships of banking institutions with companies, and states could continue to require person- to-person lending companies to obtain licenses or other authorizations to perform their role in facilitating loans.

The federal and state regulators, current and former U.S. industry participants, researchers, and consumer advocacy organizations that we contacted took different views of these options for regulating person-to- person lending. The staff of federal and state agencies we contacted cited advantages and disadvantages of each approach but did not take positions on which would be optimal. Officials from NASAA and some of the industry observers we contacted favored the current regulatory system. A few industry observers have supported a consolidated regulatory approach, albeit it with some reservations about the effects on the existing companies of shifting to a new regulatory system. A number of the other industry observers we contacted did not express a preference between the options, in some cases because they were uncertain how a consolidated approach would be implemented.

We assessed the advantages and disadvantages of these two regulatory options in relation to our previously developed framework for evaluating proposals for financial regulatory reform. The framework consists of nine elements that are key to developing a successful financial regulatory system (see table 3). We focused on three of these elements—providing consistent consumer and investor protection, being flexible and adaptable, and being efficient and effective. When we asked regulators, industry participants, consumer advocacy organizations, and researchers that we contacted to comment on the advantages and disadvantages of the two regulatory options, they most frequently cited issues related to these three elements. (For more information on our methodology, see app. I.)

Federal and state regulators, industry participants, researchers, and a consumer advocacy organization we contacted generally regarded all of the elements as somewhat or very important to regulating person-to- person lending. However, they agreed that having a systemwide focus and minimizing taxpayer exposure were less significant considerations at present, but some thought that such considerations could become more significant if the person-to-person lending industry and participating firms were to grow dramatically.

While the Current Regulatory System Generally Protects Borrowers and Lenders, Some Industry Observers Questioned Its Flexibility and Efficiency

As we have seen, the current regulatory system provides borrowers and lenders on for-profit, person-to-person lending platforms with protections consistent with those afforded to conventional bank borrowers and investors in registered securities. The current regulatory regime for person-to-person lending does not have goals and agency responsibilities that are specific to the industry and its activities. Rather, it applies broader consumer financial and securities laws, regulations, and agency oversight and enforcement responsibilities to this new industry.

SEC staff noted that comprehensive protections of the type afforded to investors under federal securities laws are particularly important considering that some lenders compare returns on the notes they purchase from the for-profit platforms to relatively risk-free, federally insured bank products. They explained that the breadth and scope of disclosure and attendant liability for false disclosure under these laws are key to investor protection. However, some industry observers saw drawbacks to protecting lenders by relying primarily on the disclosures required under current securities registration requirements. Specifically:  The disclosure-based approach allows LendingClub and Prosper to report on loan performance and returns on investment differently. Four industry observers said that this approach increases the difficulty to lenders of assessing risk and potential returns and comparing performance across the platforms. Staff from SEC’s Division of Corporation Finance said that SEC could potentially encourage or require Prosper and LendingClub to report in the same way, either through the SEC staff comment process for the companies’ financial disclosures or by proposing a rule that would require them to use consistent reporting methods. However, SEC staff pointed out that there could be trade-offs between the benefit to lenders of standardized reporting and the additional reporting burden on the companies. They also noted that proposing a rule would entail a substantial investment of SEC’s limited staff resources to address an issue that currently affects only two registered companies.  Three industry observers we interviewed noted some concerns about the limited role of securities regulators in helping ensure lender protection if a person-to-person lending company entered bankruptcy. As we have seen, because lenders who hold notes do not have a direct security interest in the corresponding borrower loans, their rights could be uncertain if the platform were to enter bankruptcy. Prosper and LendingClub’s prospectuses disclose this risk and describe their back-up plans for servicing loans. However, staff from SEC’s Division of Corporation Finance said that prescribing steps that a person-to-person lending company should take to protect lenders in case of a bankruptcy would be inconsistent with the role of securities regulation—a role that is intended to ensure adequate disclosures for investors rather than to regulate companies’ operations.

Four industry observers also raised concerns about the flexibility and adaptability of securities regulation as it is applied to person-to-person lending. SEC staff members and three industry observers said that, under the current regulatory system, issuing securities is central to the business of person-to-person lending companies, so the companies’ ability to navigate securities regulation requirements is critical to their success. However, four industry observers questioned the applicability of securities regulations to person-to-person lending, in part because securities regulation treats the platforms as issuers of a debt security, while in actuality borrowers are responsible for fulfilling the debt obligation. Three commentators questioned whether securities requirements that preceded the emergence of the person-to-person lending industry could continue to be applied to the industry without stifling its innovation and growth—that is, they questioned whether the current system was adaptable and flexible enough to respond to this nascent industry. For example, officials from one company said that the company’s ability to quickly adapt to changing market conditions or to experiment with changes to its business model had at times been hampered by the time and cost involved in amending its prospectus to reflect such changes.

To some extent, some of these concerns have been alleviated or will likely be addressed in the future. According to officials from Prosper and LendingClub, SEC staff have developed an understanding of person-to- person lending and have been increasingly receptive to working with the companies involved to enable them to meet registration requirements in a way that fits with their business models. For example, officials from Prosper and LendingClub said that SEC staff were considering the companies’ proposal to streamline how the companies would disclose changes to their credit policies and lending terms to reduce the time and cost involved. Also, SEC staff said that they were willing to continue to work with the companies through the comment process on their ongoing filings. But they also noted that their role was primarily to respond to proposals or analyses of concerns provided by the companies, not to suggest changes themselves.

Industry observers we interviewed raised other concerns about the efficiency of using securities regulation to provide lender protection, noting in particular the burdens that the registration process imposed on existing firms and potential new entrants. For example, because each borrower’s loan corresponds to a series of lenders’ notes that can be for as little as $25, Prosper and LendingClub must register a large volume of notes with relatively small denominations. Officials from LendingClub and Prosper said that it was costly to establish their processes to register these series of notes in their prospectus supplement filings, although they have reduced their ongoing costs by largely automating the filings. SEC staff and officials from both companies agreed that lenders were unlikely to consult these filings, except for litigation purposes. One researcher also questioned the utility of the prospectus supplement filings and suggested that their volume could make it difficult for investors to identify disclosures containing more useful information.

Four industry observers also suggested that new entrants could effectively be barred from entering the market by the cost and other burdens associated with securities registration, which two of them said restricts competition and discourages development of new credit options for consumers. Whereas Prosper and LendingClub launched their platforms and had built a base of borrowers and lenders before they registered with SEC and state securities regulators, new person-to- person lending companies would likely need to register before launching platforms under the current regulatory system. New entrants could potentially begin to sell notes without registering with SEC or could meet reduced registration requirements under existing exemptions—such as those for small offerings or private offerings that are made available only to a limited number of sophisticated investors. However, SEC staff noted that the existing exemptions might not be compatible with the business of person-to-person lending companies, which have generally been widely available online and have sought to attract investment from many lenders. Instead, these staff noted that SEC could use rulemaking to exempt securities issued for person-to-person lending from certain registration requirements but only if its commissioners deemed doing so to be in the public interest.

At least three industry observers also raised concerns about the burdens associated with meeting varying state securities registration requirements. Officials from Prosper and LendingClub said that the registration process at the state level had already been costly and laborious, and 20 states had yet to approve either of their registration applications. One former industry executive said that the burden of state securities requirements, and particularly the states’ ability to impose varying financial suitability requirements, was a key consideration in his company’s decision to exit the market rather than pursue federal and state registration. Officials from the major for-profit platforms suggested that the notes of person-to-person lending companies should be exempt from state registration requirements, as the securities of companies listed on national exchanges are. However, officials from NASAA and selected state securities regulators said that the states play an important role in helping ensure investor protection, and those officials generally favored states’ continued participation in securities regulation of the person-to- person lending industry. Furthermore, to promote greater consistency in how states reviewed the registration statements of person-to-person lending companies, NASAA officials said that it was considering two options: (1) a comprehensive policy statement applicable to person-to- person lending, or (2) particular standards for merit review that states could use in reviewing applications of person-to-person lending companies.

Although a Consolidated Regulatory Approach Could Provide Adequate Protections, Its Flexibility, Efficiency, and Effectiveness Are Uncertain

Depending on how it was implemented, a consolidated approach to borrower and lender protection could continue to provide borrowers on person-to-person lending platforms with the protections they currently receive. But how the protections provided to lenders would compare with those under the current regulatory system is uncertain. As they do under the current system, borrowers would presumably continue to receive the same kinds of protections afforded to borrowers using more traditional sources for consumer or commercial credit. Also, legislation adopting a consolidated regulatory approach could create specifically targeted protections Congress deemed necessary, such as industry-specific authority to perform supervisory examinations of person-to-person lending companies’ compliance with requirements for both borrower and lender protection. While CFPB could also be given the authority to prescribe lender protections under a consolidated regulatory approach, it is uncertain whether CFPB would require disclosures for lenders that are similar in substance to those required under securities regulation, whether any required disclosures would be more or less extensive, and whether any required disclosures of borrower and loan information would be made publicly available. In addition, legislation could authorize liability for false disclosure. Furthermore, legislation adopting a consolidated regulatory approach could authorize CFPB to go beyond the current disclosure requirements by prescribing standardized reporting on loan performance and returns on investment or requiring companies to take steps related to the effect on lenders of a company’s bankruptcy. While such steps could address the concerns about lender protection under the current system that we noted earlier, the benefits to lenders would need to be weighed against the burden that such requirements would impose on the companies involved.

Three of the industry observers we interviewed suggested that a consolidated regulatory approach might be better suited than the current system to resolve tensions between borrower and lender protection. Two of them cited, for example, the tension in person-to-person lending between lenders’ interests in gaining valid information about the credit risk they are assuming and borrowers’ privacy interests. Borrowers have the discretion to determine how much personal information to provide anonymously with their loan requests, and the platforms could address any concerns that borrowers raised about their privacy by limiting the data they request. Nonetheless, these commentators thought that it would be beneficial to have a consolidated regulator that would be charged with balancing the need to disclose to lenders material information about borrowers and loans with borrowers’ concerns about the vulnerability of such information, when made publicly available, to searching activity that could result in borrowers being identified by name. However, staff from SEC cautioned that easing disclosure requirements could reduce lender protections and suggested that, considering the financial risks facing lenders who participate in the platforms, it would be important for a consolidated regulator to seek to ensure at least the same level of lender protection as the current system provides.

Adopting a consolidated regulatory approach would provide an opportunity to examine the appropriate level of oversight for nonprofit platforms, particularly with respect to lender protection. The researchers we interviewed all questioned whether it was appropriate that a nonprofit platform that offered no returns to lenders would not be subject to disclosure requirements, while one that offered minimal returns potentially would be subject to the full burden of securities registration requirements. The researchers all suggested that nonprofit platforms should be subject to financial regulation rather than disclosing risks to lenders only on a voluntary basis, as they do now. A consolidated regulatory approach to person-to-person lending could be designed to encompass nonprofit platforms. However, Kiva officials suggested that the costs of imposing additional regulatory burden on nonprofit platforms might outweigh the benefits of regulation to philanthropically motivated lenders.

The flexibility, efficiency, and effectiveness of creating a new regulatory regime under a new agency are uncertain. Depending on how it was implemented, a consolidated regulatory approach that vested responsibility for borrower and lender protections in a single agency could potentially be more efficient than the current system, and it could potentially be designed to adapt to changes in the industry. However, seven of the federal and state regulators and industry observers we interviewed cited uncertainties about how a consolidated regulatory approach would be defined in statute and regulation or how CFPB would carry out its responsibilities, making it difficult to predict how flexible, adaptable, and efficient CFPB would be were it to become the consolidated supervisor for person-to-person lending. Three commentators were uncertain how effective CFPB would be in protecting lenders on person-to-person lending platforms, in part because the Dodd- Frank Act generally focuses the agency’s mission and jurisdiction on protection of consumers of financial products and services rather than on protection of investors. Furthermore, officials from both of the major for- profit platforms raised concerns about the costs of transitioning to a new regulatory regime, especially considering that they had already invested substantial costs and time adapting to the current one. Also, officials from one of the firms raised concerns that, under a consolidated regulatory approach, lenders who were already familiar with and reliant on the protections afforded by securities regulation might be less willing to invest in notes on the platforms and thus could set back the industry’s growth at least temporarily. Company officials also raised a concern that losing the precedent set by SEC and the courts in securities-related rulings would create uncertainty for the industry.

Furthermore, reductions in the regulatory burden on person-to-person lending companies under a consolidated regulatory approach would likely be limited if state securities regulations continued to apply. Officials from NASAA and the state securities regulators we interviewed said that even if person-to-person lending was exempt from federal securities law, the notes the companies sold could still be treated as securities under state law. In that case, person-to-person lending companies might still be required to register with state securities regulators to allow lenders in those states to participate.

Further Changes and Growth in Person-to- Person Lending Could Pose New Regulatory Challenges

The continuing evolution and growth of person-to-person lending could give rise to new regulatory concerns or challenges, making it difficult to predict what the optimal regulatory structure will be. For example, while the major for-profit platforms have focused on providing relatively straightforward unsecured consumer loans, they and other platforms have explored or could explore more complex loan products, other forms of lending—such as auto loans or mortgages—or variants on the concept of person-to-person lending that could affect regulatory concerns, such as ensuring the fairness and transparency of lending terms and practices. Also, the major for-profit platforms have increasingly been attracting sophisticated individual and institutional investors, and the potential exists for these and other platforms to offer advisory services to these investors that could introduce new regulatory issues. For example, LC Advisors, LLC, a wholly owned subsidiary of LendingClub, has registered with SEC and state securities regulators as an investment adviser firm that will offer and manage separately managed accounts and other services for high net worth and institutional clients to invest through the LendingClub platform. Furthermore, platforms could develop different features or products for lenders—such as allowing companies to select loans on a lender’s behalf or allowing lenders to invest in pools of loans assembled by the company—that have generally been subject to regulation by SEC. Such activities could raise new questions about protecting the interests of lenders and, if a consolidated regulatory approach were adopted, could introduce challenges in defining and coordinating CFPB’s and SEC’s regulatory jurisdictions.

In addition, the regulators and industry observers we contacted did not raise having a systemwide focus and minimizing taxpayer risk as significant regulatory considerations because of the small size of the market and the firms involved in person-to-person lending. Further, two industry observers suggested that, from a systemwide perspective, one of the potential benefits of person-to-person lending is that it shifts credit risk from banks and nondepository lenders to individual lenders. Five of the regulators and industry observers we contacted suggested that systemwide concerns could increase only if the industry grew dramatically and were to focus more on attracting large institutional investors.

Regardless of whether the current regulatory system is retained or a consolidated approach is adopted, mechanisms currently exist for monitoring the person-to-person lending industry for emerging risks and regulatory challenges. Staff from SEC’s Divisions of Corporation Finance, Trading and Markets, and Investment Management said that they routinely monitor changes in Prosper’s and LendingClub’s business models through their review of the companies’ securities registration filings, and they noted that the companies’ growth would be evident through their required disclosures. Also, as previously discussed, CFPB’s duties include researching, monitoring, and reporting on developments in markets for consumer financial products and services to, among other things, identify risks to consumers. However, CFPB representatives said that the agency is still in the process of developing this function and that they had not determined the methods by which the agency would monitor the industry. Finally, FSOC could come to play a role in monitoring the industry if person-to-person lending were to grow dramatically.

Agency Comments and Our Evaluation

We provided a draft of this report for review and comment to FDIC, the Federal Reserve, FTC, NASAA, NCUA, SEC, and Treasury (including the CFPB implementation team). We also provided relevant excerpts from the draft report to UDFI, the four state securities regulators we interviewed, Kiva, LendingClub, Prosper, WebBank, and Zopa for review and technical comment. These agencies and companies provided technical comments, which we incorporated as appropriate. In addition, we received written comments from the Deputy Associate Director of Research, Markets & Regulations, CFPB; the Director of the Division of Depositor and Consumer Protection, FDIC; and the Chairman of SEC, which are summarized below and reprinted in appendixes III to V.

In its written comments, CFPB said that the person-to-person lending industry could have significant implications for consumers seeking alternative sources of credit. CFPB agreed and stated that monitoring the industry as it evolves would be important and, as the draft report noted, CFPB will collect and analyze complaints about consumer financial products and services over time. Additionally, CFPB noted that it expects to keep abreast of consumers’ experiences with providers of person-to- person lending and developments in the industry.

FDIC in its written comments stated that it agreed with our description of the types of risks identified related to person-to-person lending as well as the federal consumer protection laws and regulations that may be applicable. FDIC said that, as the draft report noted, there is one FDIC- supervised institution currently involved in person-to-person lending. FDIC noted that its supervisory program examines for these products from both a risk-management and a consumer-protection perspective, including a review of third parties involved in the offering of the product as appropriate. FDIC said that it will continue to monitor this evolving industry and adjust its supervisory program as warranted.

In its written response, SEC said that the draft report provided a comprehensive overview of the person-to-person lending industry and an important contribution to the overall understanding of the regulatory structure of the industry. SEC stated that for several years, its staff have been actively involved in working with the two for-profit platform operators, Prosper and LendingClub, to facilitate ways for them to conduct their offerings in a manner that realizes their business objectives and is consistent with the federal securities laws. SEC said that, because Prosper and LendingClub conduct registered offerings of securities, investors in these securities are being provided with the information they need to make informed investment decisions and have the protections of the liability and antifraud provisions of the Securities Act of 1933 and the Securities Exchange Act of 1934. SEC also said that Prosper and LendingClub file prospectus supplements containing the information that borrowers voluntarily disclose on the companies’ Web sites because that information—particularly credit report data—is the basis on which investment decisions are being made. SEC said that, while it remains concerned about any violation of borrowers’ privacy rights in this information, it believes that these rights should be addressed within a framework where investors continue to receive appropriate disclosures and protections to which they are entitled under the federal securities laws. SEC stated that, as indicated in the draft report, the person-to- person lending industry is relatively new and that future innovations could pose new regulatory challenges. SEC said that the Commission and its staff seek to be vigilant in this regard and that they look forward to helping address concerns about the adequacy and effectiveness of the current regulatory structure.

We are sending copies of this report to interested congressional committees, the Chairman of FDIC, the Chairman of the Federal Reserve, the Chairman of the FTC, the Executive Director of NASAA, the Chairman of NCUA, the Chairman of SEC, and the Secretary of the Treasury. This report will also be available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions about this report, please contact me at (202) 512-8678 or sciremj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

Our report objectives were to address (1) how the major person-to-person lending platforms operate and how consumers use them; (2) the key benefits, risks, and concerns that person-to-person lending poses for consumers and how the risks are currently regulated; and (3) advantages and disadvantages of the current and alternative approaches to regulating person-to-person lending.

To describe how the major person-to-person lending platforms operate and how consumers use them, we reviewed existing studies and reports related to the operation of major person-to-person lending platforms and the regulatory challenges for both the for-profit and the nonprofit platforms. We interviewed executives from the three major U.S. firms operating person-to-person lending platforms—two for-profit companies (Prosper Marketplace, Inc. (Prosper) and LendingClub Corporation (LendingClub) and one nonprofit organization (Kiva Microfunds (Kiva))— and the bank (WebBank) that partners with Prosper and LendingClub to disburse loans made through their platforms. We reviewed materials on the companies’ Web sites and documents on their operations, in particular information on how the platforms work for both lenders and borrowers. For the for-profit companies, we further reviewed offering documents (i.e., prospectus and prospectus supplements) and quarterly and annual reports. Additionally, we obtained data from the companies and their Web sites regarding loan performance and consumer characteristics. We did not independently verify the data the companies provided. We assessed the reliability of these data by reviewing relevant documents, including the for-profit companies’ audited financial statements filed with the Securities and Exchange Commission (SEC), and interviewing company officials. We concluded that the data were sufficiently reliable for our purposes. We also interviewed representatives of three companies that previously operated platforms in the United States, and two foreign person-to-person lending companies operating abroad. Furthermore, we reviewed online discussion forums where borrowers and lenders on the platforms post their views, to obtain more direct information on the purposes for which consumers use both the for- profit and nonprofit person-to-person lending platforms.

To identify the key benefits, risks, and concerns that person-to-person lending poses for consumers and how the risks are currently regulated, we interviewed executives from the three major U.S. person-to-person lending platforms and reviewed regulatory filings and relevant documents. We also reviewed laws that may be applicable to the platforms and their third-party relationships, including the Securities Act of 1933, the Truth in Lending Act, Section 5 of the Federal Trade Commission Act, and the Gramm-Leach-Bliley Financial Modernization Act. Furthermore, we reviewed relevant regulations and guidance and interviewed officials at the Bureau of Consumer Financial Protection (known as the Consumer Financial Protection Bureau or CFPB) implementation team at the Department of the Treasury (Treasury), Federal Deposit Insurance Corporation (FDIC), Board of Governors of the Federal Reserve System (Federal Reserve), Federal Trade Commission (FTC), National Credit Union Administration (NCUA), SEC, and Treasury officials involved with the Financial Stability Oversight Council, as well as the Utah Department of Financial Institutions (UDFI), and the North American Securities Administrators Association (NASAA). Because state securities regulators approach person-to-person lending differently, we interviewed four state securities regulators—California, Kentucky, Oregon, and Texas—to understand the risks and concerns they have identified. Specifically, we selected states with merit-review standards (as opposed to less complex disclosure-review standards similar to the federal securities regulation system) that had approved both, one, or neither of the securities registration statements of the two major for-profit U.S. platforms. In addition, we conducted interviews with three consumer advocacy organizations—the Center for Financial Services Innovation, Consumer Federation of America, and Consumers Union. Three organizations that we contacted declined to participate because the person-to-person lending industry is beyond the scope of their work. To assess the potential risk of disclosure of personally identifiable information, we randomly selected a small sample of prospectus supplements which the two major for-profit platforms are required to file with SEC, from the period from August 31, 2010, through November 26, 2010, and systematically reviewed a sample of the loan listings to identify any examples of where the borrowers disclosed enough information with their loan requests to allow them to be potentially identified by name. (See app. II for more details on this analysis.)

To identify the advantages and disadvantages of the current and alternative approaches to regulating person-to-person lending, we reviewed previously proposed legislation and discussed other regulatory options with relevant federal and state officials, executives and representatives from person-to-person lending companies, researchers, and consumer advocacy organizations listed earlier. While other options may exist for a consolidated regulatory approach including assigning responsibility to a different federal regulator, such as SEC or one of the federal banking regulators, we focused on two options most frequently identified by the entities we interviewed and that were considered in legislation. First, we considered the current regulatory structure. Second, we focused on the possibility for a consolidated regulatory approach under CFPB because it is assuming a role in supervising nondepository lenders and because the version of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) passed by the House of Representatives included a provision that would have exempted person- to-person lending from federal securities regulatory requirements and vested primary jurisdiction for regulating person-to-person lending platforms and their lending activities in the new consumer financial protection agency, now known as CFPB. The provision would have created an exemption from federal securities requirements for person-to- person lending in section 3(a) of the Securities Act of 1933 (15 U.S.C. § 77c(a)) and would instead have given CFPB the authority to prescribe regulations or issue orders pertaining to person-to-person lending, including disclosure requirements with respect to the sale of loans, or notes representing an interest in loans, to individuals. However, the provision was not included in the Senate or enacted versions of the Dodd- Frank Act. We assessed the advantages and disadvantages of these two primary options we identified using our previously developed framework for evaluating proposals for financial regulatory reform, which consists of nine elements that are key to developing a successful financial regulatory system. We contacted 20 of the entities we interviewed to obtain their views on the importance of the elements of this framework and received 11 responses, from CFPB representatives, FDIC, SEC, one state securities regulator, the two major U.S. for-profit platforms and the bank that they work with to disburse loans, three researchers, and one consumer advocacy organization. On the basis of their ratings and the information we obtained through our interviews and other research, we chose to focus our discussion of the advantages and disadvantages of the two regulatory options for person-to-person lending on three of the nine elements from our framework—consistent consumer and investor protection, regulatory flexibility and adaptability, and efficiency and effectiveness.

We conducted this performance audit from August 2010 to July 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Analysis of Prosper and LendingClub’s Prospectus Supplement Filings

Prosper and LendingClub, the two major U.S. for-profit, person-to-person lending platforms, have registered as securities the series of notes that they continually offer to investors to fund corresponding loans. The companies thus are required to update their prospectuses, filed with the SEC, with supplements containing information about the notes and their corresponding loans as they are offered and sold. Because certain terms of the notes sold to lenders—such as maturity date, interest rate, and amount—depend on the terms of the corresponding loans, Prosper and LendingClub submit prospectus supplements to disclose information about the notes they offer and sell. Specifically, the companies submit prospectus supplements to disclose information about the notes they offer one or more times per business day, before they post the corresponding loan requests to their Web sites. They also submit prospectus supplements on a daily or weekly basis to disclose information about the notes they have sold. The prospectus supplements include required information on the terms of each note, such as interest rate and maturity. Prosper and LendingClub also include other information concerning the underlying loan that is available to lenders on their Web sites as part of the loan listing, including anonymous information from the borrower’s credit report, anonymous information supplied by the borrower, such as loan purpose, employment status, and income, and (in the case of notes sold) the borrower’s online responses to questions posted by lenders. These prospectus supplements are publicly available through SEC’s online Electronic Data Gathering, Analysis, and Retrieval System (EDGAR).

Borrowers face the risk that they may reveal enough information as part of their loan requests to permit the platforms’ members and members of the public (through EDGAR) to deduce their identities. Lenders could attempt to identify borrowers by name and contact them (for example, regarding loan repayment) but such an action would violate the terms of a lender’s agreement with either platform. Officials from Prosper said that they were not aware of any incidents of lenders identifying and attempting to contact borrowers but that they would expel lenders from the platform if that did occur. Also, some current and former industry participants raised a concern that EDGAR users could attempt to search LendingClub’s and Prosper’s prospectus supplements to obtain identifiable information about borrowers.

To assess the potential for disclosure of information in prospectus supplements that could be used to identify borrowers by name, we reviewed selected prospectus supplements describing notes that LendingClub and Prosper sold, and their corresponding loans. Specifically, we randomly selected 4 weeks from the period August 31, 2010, through November 26, 2010, and obtained from EDGAR all prospectus supplements that both companies filed, listing notes sold, during those weeks. Within the selected prospectus supplements, we reviewed every fifth loan listing to identify examples of information that could potentially be pieced together to infer someone’s identity using additional Internet research or telephone calls.

Of the 275 loan listings that we reviewed in the selected prospectus supplements, we identified 47 instances where we thought that borrowers potentially revealed information that could be used to determine their identities. In nearly all of these cases, borrowers revealed information about their location, employer, and job title or occupation, often in combination with personal information—such as their first or last names or initials, or details about marriages, divorces, bankruptcies, or their children—that we thought could potentially be used to identify them by name. However, in many of these cases, substantial effort might be needed to identify borrowers, such as contacting employers directly to match a job title with a name or searching for marriage announcements. In a few remaining cases, borrowers voluntarily provided a business name or Web site address to support a loan request for small business purposes. We shared the results of our analysis with officials from Prosper and LendingClub, who confirmed our assessment that the information we identified could be used to identify some borrowers.

On April 15, 2011, after the time period covered by our analysis, LendingClub adopted changes to its question-and-answer process that company officials said were intended to reduce the likelihood that borrowers would reveal personally identifiable information. LendingClub’s loan listings have fields for borrowers to enter their current city and state of residence and employer name, information that company officials said its lenders considered important in evaluating borrowers and their creditworthiness. In addition, prior to April 15, 2011, LendingClub’s borrowers could voluntarily reveal their job title or occupation in their loan descriptions or in their optional responses to lenders’ online questions. LendingClub officials said that, on that date, the company modified its question-and-answer process to only permit lenders to select from a set of “pre-screened” questions approved by LendingClub and WebBank. The officials said that LendingClub also screens each borrower’s answers and loan descriptions for personally identifiable information or information that could be reasonably combined to identify the borrower, including the borrower’s job title or occupation.

We did not assess the extent to which borrowers on the platforms are aware that the anonymous information they disclose with their loan requests can be accessed by the general public. LendingClub’s privacy policy discloses to borrowers that their personal, but not personally identifiable, and financial information contained in loan listings are filed with SEC and, as such, are made publicly available. In addition, LendingClub officials said that, during the loan application process, the company labels certain information fields that are completed by the borrower as being publicly available. During the time period covered by our analysis, Prosper’s privacy policy did not contain a similar disclosure, nor did its terms of use statement or borrower agreement. However, in June 2011, Prosper officials said that the company intended to modify its privacy policy to provide such a disclosure.

While the Gramm-Leach-Bliley Financial Modernization Act restricts the sharing of nonpublic personal information by financial institutions with unaffiliated third parties, the act exempts disclosures that are necessary to effect, administer, or enforce a transaction that the consumer has requested. Staff at the CFPB, FDIC, and the Federal Reserve indicated that a detailed legal analysis would be necessary to evaluate any potential legal concerns related to privacy protection for borrowers on the platforms.

Appendix III: Comments from the Consumer Financial Protection Bureau

Appendix IV: Comments from the Federal Deposit Insurance Corporation

Appendix V: Comments from the Securities and Exchange Commission

Appendix VI: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Harry Medina, Assistant Director; Emily Chalmers; William Chatlos; Rachel DeMarcus; Julianne Dieterich; Chir-Jen Huang; Matthew McDonald; Marc Molino; and Patricia Moye made key contributions to this report.