LAS VEGAS–Credit unions and CUSOs here were given an update on the legal and regulatory issues they face across a broad range of issues that are rapidly changing.

A popular feature of NACUSO’s annual meeting, the presentation was made by attorneys Amanda Smith, Jennifer Winston, Mike Heller and Mike Mulvey of the firm Messick, Lauer & Smith, which has a long relationship with the trade group.

Here is a look at what was discussed:

Smith: Uncertainty Likely Through Remainder of Year

“A lot has been happening. There is a lot of uncertainty,” said Smith. “Everything is moving very quickly. The uncertainty is going to last at least through the third quarter, into the fourth quarter of this year. And then it will settle down as much as things are going to settle down for the next four years.”

Smith said there is going to be a shift to the states for regulatory enforcement, and she urged CUs and CUSOs to watch their respective state AGs.

“For now, everything is on pause at the CFPB, which has sent most of its employees home. Staff layoffs have been allowed by the courts, but the courts have also rejected the idea of dismantling the Bureau,” Smith observed. “What all that means for the Bureau remains unknown.”

Smith further noted that when it comes to funding, acting CFPB head Russell Vought has said the Bureau will not be asking for additional funds, and it will just relay on the funds it currently has available. 

Other Agencies

While the CFPB has been sucking up the air in the room, other agencies also are seeing changes, pointed out Smith, such as the FTC and other independent agencies that have also seen layoffs and funding cuts, as well as the removal of board members and commissioners opposed by Trump, meaning there is no quorum. There is litigation surrounding many of those moves.

Credit unions were urged to be aware similar moves could occur at NCUA, where the Trump administration could remove some of its board members. NCUA is also facing DOGE-related budget cuts, which it will discuss at its April 17 board meeting.

Where to From Here?

Many people are happy to see the deregulation, said Smith. “I would agree, but it’s not a time to pullback on policies and compliance. You can’t presume things are going away permanently. You need to continue with the status quo until we have absolute certainty things are going away,” Smith told the meeting.

Winston: The Many Ways to Deregulate

Winson noted the administration can deregulate in three ways:

• Nullify rules through the Congressional Review Act
• Recission through Notice & Comment
• De Facto choice not to enforce

Looking to some of the rules of the last two years that could be affected, Winston cited:

• The Data Broker Rule. “What we think will happen here is it will never be finalized.”
• The Overdraft Rule. The House and Senate have passed joint resolutions to disapprove the OD rule. It will head to the president’s desk for signature and will disappear.
• Rule 1071 on small business loans. The rule is currently in litigation, Winson explained, adding it will likely be rescinded.
• The Medical Debt Rule. It falls under the Congressional Review Act, and House and Senate committees have both passed disapproval votes. Winston said for now it stays, as there hasn’t been much movement.
• Credit Card Late Fee Rule. As the CU Daily has reported, the CFPB agrees the rule is illegal and it will be eliminated by the courts.

As the CU Daily also reported, the CFPB’s acting director has indicated up to 100 rules and regs could be rescinded as the Bureau had used guidance to regulate. Within the next 14 days the CFPB will release what has survived and what has not.

Similarly, there won’t be regulation by enforcement by NCUA under Chairman Kyle Hauptman, said Winston.

Heller: What’s Happening With Open Banking

Mike Heller discussed the CFPB’s Open Banking rule and the new marketplace reality that will soon arrive in the U.S. where consumers will have full ownership of their data. 

Heller said it’s unlikely the rule will be pulled, as it has bipartisan support. But he also noted that on the day the rule was issued, two banking trade groups filed suit against the CFPB. However, in what he called “an interesting twist,” a fintech trade association has filed a motion to support the rule on behalf of the CFPB.

Heller said the CFPB still has the option to amend the final open banking rule, which covers consumer financial services, credit cards, digital wallets and other accounts. 

“The rules are also explicit that there’s certain data that’s not covered by the rule and that is confidential commercial information,” said Heller, who ran through additional details on what data is collected, who can collect it, and more. 

The Compliance Tiers

“One of the big changes is what has happened to the compliance tiers under this rule. There are additional compliance tiers added and the deadlines have been expanded as well,” said Heller. 

The earliest compliance date for the open banking rule is April 1, 2026, although, as Heller noted, that’s subject again to extension as the result of litigation.

“One thing I would note about this second compliance tier, which is April 1, 2027 is that it includes all the remaining nondepository institutions,” said Heller, explaining there is no distinction institutions related to asset size.

“Where credit unions fall under this rule is in these third, fourth and fifth compliance tiers that will be triggered in 2028, 2029 and 2030,” said Heller.

An Exemption, But…

There is an exemption in the open banking rule for depository institutions that are at $850 million in assets and below, “but the rule is very explicit in stating that if you know during this time period that this rule is effective that your institution will exceed that asset threshold, you will be expected to comply with the rules within a reasonable period of time and it’s not to exceed five years.”

What makes the rule so important, according to Heller, is that it “could have a pretty sizable impact as to how consumer data is transferred between financial institutions and other technology service providers. The whole goal of the CFPB in passing this final rule was to facilitate open banking and provide consumers with greater control of their financial data.

“In a nutshell, it requires data providers to make it easier for consumers to gain access to their information,” Heller added. 

For third parties, open banking is going to mean developing developer APIs, Heller pointed out.

Additional Points Raised

Other points made by Heller:

• Data has to be accessible at no charge.
• Data providers are prohibited from passing along costs or fees
• Authorized third parties do have strict requirements to gain access to data. Third parties must get authorization
• Consumers must also have easy access to revocation of rights to data.

Get Ready

Heller urged all CUs that fall under the compliance rules to begin to prepare now for doing so.

“Open banking does present an opportunity for a lot more competition,” said Heller. “Consumers’ ability to switch more easily is going to create competitive pressures. But for credit unions, there are also opportunities to partner with third parties for more personalized experiences.”

Mulvey: Changes in Cryptocurrency

Both sides of Congress have moved legislation related to stablecoins—coins pegged to the dollar—that require issuers to register with financial regulators.

Banks, and even credit unions, may look to get into the business through a subsidiary, would need to obtain the registration to do so and have sufficient assets and reserves to offer stablecoins, Mulvey explained.

Credit unions/CUSOs are going to have to meet regular reporting requirements, including around third parties, and will also have to put together redemption policies “so that the purchasers of these stablecoins would have the ability to have them redeemed by the issuing institution.”

The unanswered questions at this point, said Mulvey: Who will oversee regulation of the market? Will asset size tiers be in place? Will there be state-level regulation?

‘No Clear Line’

“This is where we are. There’s still no clear line as to how we’re going to regulate,” said Mulvey. “They’re not securities but there’s been no clear plan, no clear statement on these as commodities. There’s also debate about whether non-bank entities can be involved in the issuance of stablecoins and that brings up some of these bigger tech conglomerates—Google. X, Facebook, etc.”

Mulvey noted both the OCC and FDIC have issued guidance related to cryptocurrency and stablecoins. NCUA has yet to issue guidance on an issue that also raises questions around vendor oversight authority, said Mulvey.