2023-22774. Consumer Information Requests to Large Banks and Credit Unions

AGENCY:

Consumer Financial Protection Bureau.

ACTION:

Advisory Opinion.

SUMMARY:

The Consumer Financial Protection Bureau (CFPB) is issuing this Advisory Opinion regarding section 1034(c) of the Consumer Financial Protection Act (CFPA), which requires large banks and credit unions to comply in a timely manner with consumer requests for information concerning their accounts for consumer financial products and services, subject to limited exceptions.

DATES:

This Advisory Opinion is applicable as of October 16, 2023.

FOR FURTHER INFORMATION CONTACT:

Colin Reardon or Yan Cao, Senior Counsels, Legal Division, at 202–435–7700. If you require this document in an alternative electronic format, please contact [e-mail].

SUPPLEMENTARY INFORMATION:

The CFPB is issuing this Advisory Opinion through the procedures for its Advisory Opinions Policy.^[1] Refer to those procedures for more information.

I. Background

Section 1034(c) of the CFPA requires large financial institutions to comply with consumer requests for information concerning their accounts in a timely manner.^[2] This Advisory Opinion interprets this provision for the purpose of highlighting the obligations it imposes upon large financial institutions. The CFPB has not previously issued supervisory findings or pursued an enforcement action under this provision. This Advisory Opinion is the CFPB's first guidance regarding section 1034(c).^[3]

Section 1034(c) applies to insured depository institutions and credit unions that offer or provide consumer financial products or services and that have total assets of more than $10 billion, as well as their affiliates.^[4] The provision states that, subject to certain exceptions, banks and credit unions with over $10 billion in assets must “in a timely manner, comply with a consumer request for information in the control or possession of such covered person concerning the consumer financial product or service that the consumer obtained from such covered person, including supporting written documentation, concerning the account of the consumer.” ^[5] Section 1034(c) is a current legal obligation that became effective on July 21, 2011.^[6]

Congress placed section 1034(c) alongside provisions of the CFPA that establish a process for addressing consumer complaints submitted to the CFPB. Under sections 1034(a) and 1034(b), when a consumer submits a complaint or inquiry about a large bank or credit union, that entity “shall provide a timely response” to the CFPB, and the CFPB then provides a timely response to the consumer, including “any responses received” from the financial institution.^[7] Through section 1034(c), Congress established an additional, direct channel for consumers to request information from large banks and credit unions without routing their inquiry through the CFPB or another government entity. And like a complaint submitted to the CFPB, a request for information under section 1034(c) can lead to the identification and resolution of errors by a large bank or credit union involving a consumer's account.

Responding to consumer requests for information is critical for ensuring high levels of customer service and enabling consumers to resolve issues with their accounts when they encounter problems. Large banks and credit unions possess information that is vital to meet these customer needs. Too often, however, it can be difficult and time consuming for individual consumers to obtain a clear answer to questions or resolve an account issue. The CFPB has observed that some larger financial institutions have moved away from a traditional relationship banking model with an emphasis on providing customized help to individuals.^[8] Such individualized service is now generally reserved for high net-worth individuals, and is difficult for other households to find. For most consumers, larger banks and credit unions frequently rely on highly standardized processes rather than high-quality human interactions or digital channels that actually facilitate self-help. When a consumer has a question or problem, they typically cannot go to an individual at the bank or credit union who is already familiar with their account, such as the person that originally signed them up for the product. They are more likely to have to navigate a phone tree in the hope of speaking to the right person in a call center, to have to search through largely irrelevant material on a website to try to find the information they need, or to have to attempt to get a clear answer from a chatbot.^[9]

On June 14, 2022, the CFPB issued a request for information asking the public to provide input on customer service obstacles they face in interacting with large banks and credit unions.^[10] Commenters relayed consumers' frustration and difficulty in obtaining critical information about their accounts.^[11] This includes information that consumers need to stay current and avoid fees or penalties; to identify and resolve errors; and to close accounts that no longer serve their interests.

Through section 1034(c), Congress ensured that as banks and credit unions grow larger they must continue to meet consumers' need for information necessary to manage their finances, and thus must provide timely responses to consumer requests for information concerning their accounts. Such responses help meet consumers' reasonable expectations for customer service.

II. Information Requests Under Section 1034(c)

A. Consumer Requests for Information Regarding Their Accounts

Section 1034(c) states that, subject to certain enumerated exceptions, large banks and credit unions “shall, in a timely manner, comply with a consumer request for information in the control or possession of [a large bank or credit union] concerning the consumer financial product or service that the consumer obtained from [the large bank or credit union], including supporting written documentation, concerning the account of the consumer.” ^[12] Thus, section 1034(c) applies to a consumer's request for information to a large bank or credit union where the information concerns the consumer's account for a consumer financial product or service, is in the large bank or credit union's control or possession, and does not fall into an enumerated exception.

The CFPA defines “consumer financial product or service” to include several types of financial products or services that consumers may obtain from a large bank or credit union, including deposit and savings accounts, credit products such as mortgage loans and credit cards, and loan servicing.^[13] Under section 1034(c), large banks and credit unions that offer or provide consumer financial products or services must comply with consumer requests for information regarding their accounts. That obligation applies even if consumers do not expressly invoke section 1034(c).^[14]

Section 1034(c) applies to consumer requests for information “concerning” an account for a consumer financial product or service. The term “concerning” means “relating to” or “regarding” and therefore encompasses a wide range of information about a consumer's account.^[15] Information concerning an account would include account information that appears on periodic statements or on online account portals, such as the amount of the balance in a deposit account, the interest rate on a loan or credit card, and information regarding transactions or payments involving an account.^[16] It would include information regarding bill payment and other recurring transactions involving the account ( e.g., a list of all recurring payments out of the account). It would also include the terms and conditions of the account, including a schedule of fees that may be charged on the account. It could also include information about the status of a lien on real property that was released (or should have been released) years before. Such information can be necessary for consumers to manage their accounts and resolve disputes with their bank or credit union, or with merchants or other third parties. In contrast, section 1034(c) does not apply to a consumer's request for information that is not specifically related to a consumer's account, such as information regarding a large bank or credit union's internal operating procedures, financial performance, marketing strategy, or training program for its employees.

In addition, section 1034(c) requires a large bank or credit union to comply with a consumer's request for “information . . . including supporting written documentation.” The word “support” means “to assist,” “help,” or “provide with substantiation.” ^[17] Accordingly, through its reference to “supporting written documentation,” section 1034(c) requires large banks and credit unions to provide consumers, upon request, with written documents that will substantiate information provided in response to consumer questions, or that will assist consumers with understanding or verifying information regarding their accounts. For example, under section 1034(c), a consumer seeking information about past transactions on their account could request copies of past periodic statements or check images. Similarly, a consumer seeking information regarding the terms and conditions governing their account could request a copy of their account agreement (including a copy of the original signed agreement).

Section 1034(c) requires large banks and credit unions to provide account information and supporting documentation to the extent it is in their “control or possession.” The concepts of “control” and “possession” are familiar from other contexts involving requests for information, such as the discovery provisions in the Federal Rules of Civil Procedure and the Freedom of Information Act.^[18] In the context of section 1034(c), a bank or credit union “possesses” information that is known by its employees or that can be found in its records, such as in its electronic or paper files.^[19] A bank or credit union can also “control” information that it does not physically possess, where it has the legal right, authority, or practical ability to obtain the information.^[20] For example, a large bank or credit union would control information held by an affiliate or service provider where it has the right or ability to receive that information from the affiliate or service provider.

Large banks and credit unions are not required to provide information that falls within one of the four enumerated exceptions in section 1034(c).^[21] Specifically, those exceptions apply to (1) confidential commercial information, including an algorithm used to derive credit scores or other risk scores or predictors; (2) information collected for the purpose of preventing fraud or money laundering, or detecting or making any report regarding other unlawful or potentially unlawful conduct; (3) information required to be kept confidential by any other provision of law; and (4) any nonpublic or confidential information, including confidential supervisory information.^[22]

In addition, section 1034(c) does not require a large bank or credit union to respond to a consumer information request in a specific form, such as in writing, orally, or electronically. In this regard, section 1034(c) differs from section 1033 of the CFPA, which requires that certain information be made available “in an electronic form.” ^[23]

B. Conditions That Unreasonably Impede Consumer Information Requests

Section 1034(c) provides that large banks and credit unions “shall, in a timely manner, comply” with consumer requests for information regarding their accounts for consumer financial products or services. It is well established that when the term “shall” is used in statutes, it generally means that something “is required.” ^[24] The addition of the word “comply”—which creates the phrase “shall . . . comply”—further indicates that section 1034(c) creates a mandatory obligation to do what the consumer requests.^[25] Section 1034(c) thus grants consumers a right to request and receive account information that falls within the scope of the provision, and imposes a concomitant legal obligation on large banks and credit unions to respond to the consumer's request and to provide such account information.

Large banks and credit unions do not have to provide information in any particular manner, or using particular means. However, a large bank or credit union would not comply with section 1034(c) if it imposed conditions or requirements on consumers' information requests that unreasonably impeded consumers' ability to request and receive account information. Under the plain language of section 1034(c), if a consumer makes a “request for information in the control or possession of such covered person concerning the consumer financial product or service that the consumer obtained from such covered person” that does not fall into one of the specified exceptions, and a large bank or credit union refuses to provide that information unless the consumer satisfies an unreasonable condition, the bank or credit union has failed to “comply” with the request.^[26] Section 1034(c) does not contain any language stating or suggesting that a large bank or credit union may impose conditions that unreasonably impede consumers' information requests. Such conditions, if permitted, would allow large banks and credit unions to frustrate and effectively nullify the right granted in section 1034(c). And there is no reason to believe that Congress intended for section 1034(c) to allow that result.

By contrast, a large bank or credit union would not violate section 1034(c) in the context of reasonable conditions on consumer information requests. For example, large banks or credit unions might require that the person making the request verify their identity, identify their account, and describe the information they are seeking. Similarly, large banks or credit unions might require the consumer to comply with reasonable data security measures. These kinds of conditions, when implemented in a reasonable manner, would not unreasonably impede consumers' ability to obtain information regarding their accounts.^[27]

As a general matter, requiring a consumer to pay a fee or charge to request account information, through whichever channels the bank uses to provide information to consumers, is likely to unreasonably impede consumers' ability to exercise the right granted by section 1034(c), and thus to violate the provision. Some consumers cannot afford to pay even a small fee to obtain information about their accounts. Even for consumers who can afford such fees, the fees can operate as a significant deterrent to making an information request. Thus, a large bank or credit union's practice of charging fees to respond to an information request would generally unreasonably impede consumers' exercise of their rights under section 1034(c). Regardless of how a large bank or credit union labels or categorizes a fee on its fee schedule or other documents, section 1034(c) does not permit unreasonable impediments to a request for information about a consumer's account. That likely includes charging fees (1) to respond to consumer inquiries regarding their deposit account balances; (2) to respond to consumer inquiries seeking the amount necessary to pay a loan balance; (3) to respond to a request for a specific type of supporting document, such as a check image or an original account agreement; and (4) for time spent on consumer inquiries seeking information and supporting documents regarding an account.^[28]

At the same time, it would generally not violate section 1034(c) for a large bank or credit union to impose a fee or charge in certain limited circumstances. For example, a large bank or credit union might charge a fee to a consumer who repeatedly requested and received the same information regarding their account ( e.g., repeatedly asked for a copy of the same document).^[29] In that context, the large bank or credit union would have already met its obligation under section 1034(c) by complying with the consumer's earlier requests.

A large bank or credit union may also violate section 1034(c) by imposing other conditions or obstacles that unreasonably impede consumers' ability to make an information request. Depending on the facts and circumstances, such conditions or obstacles could include forcing consumers to endure excessively long wait times to make a request to a customer service representative, requiring consumers to submit the same request multiple times, requiring consumers to interact with a chatbot that does not understand or adequately respond to consumers' requests, or directing consumers to obtain information that the institution possesses from a third party instead.^[30] Such conditions or obstacles may frustrate consumers' ability to exercise their right to request information under section 1034(c), and thus may violate that provision.

C. Timely Compliance With Consumer Information Requests

Section 1034(c) provides that large banks and credit unions “shall, in a timely manner, comply” with consumer requests for information.^[31] Section 1034(c) thus does not specify a fixed time limit for responding that applies to all information requests. The CFPB will consider the specific circumstances and nature of a particular request to determine compliance. For example, whether a response to a 1034(c) request is timely may depend on the complexity of the request and/or the difficulty of responding. Where a request seeks basic information that is readily available to a large bank or credit union, to comply with section 1034(c) a bank or credit union would generally need to respond more quickly than if the request is more complex or seeks information that is less accessible. At the same time, even though a timely response for a complex response may involve a longer time period, that does not mean that large banks or credit unions can unduly delay their responses to more complicated requests.

What constitutes a timely response under section 1034(c) may also be informed by the timing requirements of other Federal laws and regulations with which large banks and credit unions must comply. For example, Regulation X requires mortgage servicers to respond to certain information requests within specific time periods depending on the nature of the requested information.^[32] A large bank or credit union that is subject to Regulation X and that exceeded Regulation X's timing requirements for an information request likely would not be responding “in a timely manner” for purposes of section 1034(c) with respect to that same information request. Conversely, a bank or credit union subject to Regulation X would likely respond “in a timely manner” for purposes of section 1034(c) if it provided a response that satisfied the timing requirements in Regulation X. Thus, where both section 1034(c) and another Federal law or regulation applies to the same consumer information request, the CFPB does not view section 1034(c)'s “timely manner” requirement as likely to impose timing requirements that differ from the specific timing requirements of the other applicable Federal law or regulation. The CFPB expects that large banks and credit unions will already have policies and procedures in place to meet the timing requirements of other applicable laws and regulations.

D. Accuracy and Completeness of Responses to Consumer Information Requests

By providing that large banks and credit unions “shall . . . comply” with consumer requests for information, section 1034(c) contemplates that large banks and credit unions will in fact provide consumers with the information they request to the extent it is in their control or possession. A large bank or credit union would violate section 1034(c) if it provided incomplete or inaccurate information in response to a consumer's information request.

With respect to completeness, a large bank or credit union would not comply with section 1034(c) if, for example, the consumer asked for information about all of the consumer's transactions with a given merchant since the account was opened, and the large bank or credit union possesses transaction information going back seven years, but its response provides only transaction information going back one year. However, a large bank or credit union would not violate section 1034(c) by withholding information that falls within the scope of one of the enumerated exceptions in section 1034(c)(2).

With respect to accuracy, a large bank or credit union would not comply with section 1034(c) if it provided inaccurate information to consumers in response to their requests. For example, if a consumer asked the large bank or credit union the amount of a particular fee it charges for the consumer's account ( e.g., the amount of a monthly maintenance fee for a deposit account), a large bank or credit union would not comply with section 1034(c) if it provided the wrong amount for that fee. In that circumstance, the large bank or credit union would not be providing responsive information in its control or possession ( i.e., the correct amount of the fee).

The CFPB has noted in other contexts that Federal consumer financial laws generally apply regardless of the technology used by institutions.^[33] The same principle applies to section 1034(c). Chatbots or other automated responses may serve to expedite responses in some cases; however, in the absence of appropriate checks and quality assurance processes, these tools can inadvertently misdirect inquiries or provide inadequate responses.^[34] Large banks and credit unions may violate section 1034(c) if they employ technologies that do not properly recognize consumer information requests or that provide inaccurate or incomplete information in response to those requests.

III. Summary of Section 1034(c) Obligations

The CFPB is providing this summary section to assist large banks and credit unions in complying with section 1034(c). This section is intended to serve as a simplified summary and a reference tool, and large banks and credit unions should refer to the legal analysis above for further detail and information.

As discussed above, when a bank or credit union with over $10 billion in assets receives a request for information from a consumer relating to the consumer's account for a consumer financial product or service, section 1034(c) requires the bank or credit union to respond with information in its possession or control. The large bank or credit union must respond to the request in a timely manner; whether a response is timely may depend on the complexity of the request or difficulty of responding. Responses to consumer information requests must also be complete and accurate. Large banks and credit unions may respond to requests using any means or channels they choose.

Consumers need information regarding their accounts to manages their finances, and the Advisory Opinion describes examples of account information that must be provided upon request. Consumers can request information such as account balances, transaction history, interest rates, scheduled auto-payments, fees, or balances necessary to pay off a loan, and may also request supporting written documents such as copies or images of checks or original signed contracts. The obligation to respond does not include information that does not concern the individual consumer's account, such as internal operating procedures or policies, or the company's financial performance, marketing strategy, or training program for its employees. The obligation also does not apply to information that falls within the four enumerated exceptions in section 1034(c), including confidential information or information collected to prevent fraud or money laundering.

Section 1034(c) does not bar large banks and credit unions from imposing reasonable impediments on consumer information requests, such as reasonable identity verification and data security measures. But large banks and credit unions may not impose conditions that unreasonably impede consumers' information requests. The practice of charging fees to respond to an information request would generally unreasonably impede consumers' exercise of their rights under section 1034(c), and thus violate the provision. Regardless of how a large bank or credit union labels or categorizes a fee on its fee schedule or other documents, section 1034(c) does not permit unreasonable impediments to a request for information about a consumer's account. That would likely include charging fees (1) to respond to consumer inquiries regarding their deposit account balance; (2) to respond to consumer inquiries seeking the amount necessary to pay a loan balance; (3) to respond to a request for a specific type of supporting document, such as a check image or an original account agreement; and (4) for time spent on consumer inquiries seeking information and supporting documents regarding an account. Depending on the circumstances, other kinds of conditions or obstacles may also violate section 1034(c), such as forcing consumers to endure excessive wait times, requiring consumers to submit the same request multiple times, requiring consumers to interact with a chatbot that does not adequately respond to requests, or directing consumers to obtain information from a third party.

As a matter of prosecutorial discretion, the CFPB does not intend to seek monetary relief for potential violations of section 1034(c) that occur prior to February 1, 2024.

IV. Regulatory Matters

The CFPB has concluded that the Advisory Opinion is an interpretive rule in part and a general statement of policy in part. Insofar as the Advisory Opinion constitutes an interpretive rule, it is issued under the CFPB's authority to interpret the Consumer Financial Protection Act, including under section 1022(b)(1) of the Consumer Financial Protection Act, which authorizes guidance as may be necessary or appropriate to enable the CFPB to administer and carry out the purposes and objectives of Federal consumer financial laws.^[35]

Insofar as the Advisory Opinion constitutes a general statement of policy, it provides background information about applicable law and articulates considerations relevant to the CFPB's exercise of its authorities. It does not confer any rights of any kind.

Pursuant to the Congressional Review Act,^[36] the CFPB will submit a report containing this Advisory Opinion and other required information to the United States Senate, the United States House of Representatives, and the Comptroller General of the United States prior to the rule's published effective date. The Office of Information and Regulatory Affairs has designated this interpretive rule as not a “major rule” as defined by 5 U.S.C. 804(2).

The CFPB has determined that this Advisory Opinion also does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring approval by the Office of Management and Budget under the Paperwork Reduction Act of 1995.^[37]

Rohit Chopra,

Director, Consumer Financial Protection Bureau.

Footnotes

1.  85 FR 77987 (Dec. 3, 2020).

2.  12 U.S.C. 5534(c).

3.  As a matter of prosecutorial discretion, the CFPB does not intend to seek monetary relief for violations of section 1034(c) that occur prior to February 1, 2024.

4.  12 U.S.C. 5534(c)(1) (provision applies to “a covered person subject to supervision and primary enforcement by the Bureau pursuant to section 1025”); see also id. sec. 5481(1), (6) (defining “affiliate” and “covered person”); id. sec. 5515(a)–(c) (CFPA section 1025 providing CFPB with supervisory and primary enforcement authority over insured depository institutions and insured credit unions with total assets of more than $10 billion and over their affiliates). For convenience, this Bulletin generally refers to institutions subject to section 1034(c) as “large banks and credit unions.”

5.  12 U.S.C. 5534(c).

6.  Subtitle C of the CFPA, which includes section 1034, became effective on “the designated transfer date.” Public Law 111–203, title X, sec. 1037. The designated transfer date was July 21, 2011. See Designated Transfer Date, 75 FR 57252, 57253 (Sept. 20, 2010); see also12 U.S.C. 5582.

7.  12 U.S.C. 5534(a), (b); see also CFPB, Consumer Response Annual Report at 16–17 (Mar. 2023), https://files.consumerfinance.gov/​f/​documents/​cfpb_​2022-consumer-response-annual-report_​2023-03.pdf (describing the consumer complaint process).

8.   See CFPB, Prepared Remarks of CFPB Director Rohit Chopra in Great Falls, Montana on Relationship Banking and Customer Service (June 14, 2022), https://www.consumerfinance.gov/​about-us/​newsroom/​prepared-remarks-of-cfpb-director-rohit-chopra-in-great-falls-montana-on-relationship-banking-and-customer-service/​; see also FDIC, FDIC Community Banking Study at 4–1 (December 15, 2020), https://www.fdic.gov/​resources/​community-banking/​report/​2020/​2020-cbi-study-full.pdf (noting that community banks “tend to focus on loans as relationships, originating loans that require local knowledge, a greater personal touch, individual analysis, and continued administration”).

9.   See CFPB, Chatbots in consumer finance (June 6, 2023), https://www.consumerfinance.gov/​data-research/​research-reports/​chatbots-in-consumer-finance/​chatbots-in-consumer-finance/​ (observing that “automated responses can be highly scripted and simply direct customers to lengthy policy statements or FAQs, which may contain very little helpful information, if any”); see also Ron Shevlin, The Human + Digital Challenge In Banking: Consumers Want Both at 2, Cornerstone Advisors (2021), https://go.backbase.com/​rs/​987-MGR-655/​images/​Backbase_​Cornerstone_​Human_​Digital.pdf (finding, based on consumer survey, that “[t]oday's consumers—even those at the younger end of the age spectrum—want and value high-quality human interactions in their financial lives” and that “[f]inancial institutions must quickly improve the quality of their digital channel experiences”).

10.   See Request for Information Regarding Relationship Banking and Customer Service, 87 FR 36828 (June 21, 2022).

11.   See, e.g., Comment from Legal Services NYC at 2 (July 13, 2022), https://downloads.regulations.gov/​CFPB-2022-0040-0006/​ attachment_2.pdf (describing low-income clients who have difficulty obtaining “copies of their statements; records related to restraints placed on their accounts; copies of cashed checks or money orders; information on fees and charges placed on the account” among other information); Comment from Mobilization for Justice (July 22, 2022), https://downloads.regulations.gov/​CFPB-2022-0040-0051/​attachment_​2.pdf (describing low-income consumers without internet access who cannot afford fees charged to obtain hard copies of account statements); Comment from Tzedek DC (Aug. 19, 2022), https://downloads.regulations.gov/​CFPB-2022-0040-0084/​attachment_​1.pdf (describing disabled clients who were denied access to account information because of the presence of a retained attorney, and who could not obtain documents a large bank relied upon to close fraud disputes); see also Nonrulemaking Docket: Request for Information Regarding Relationship Banking and Customer Services (CFPB–2022–0040), comments available at https://www.regulations.gov/​docket/​CFPB-2022-0040/​comments.

12.  12 U.S.C. 5534(c)(1).

13.  12 U.S.C. 5481(5), (15)(A)(i), (iv). It should be noted that a consumer can receive services from a loan servicer (and thus “obtain” a consumer financial product or service from that servicer) even if the loan servicer is not the original creditor on the consumer's loan. See12 U.S.C. 5481(5), (15)(A)(i).

14.  Nothing in section 1034(c) states or suggests that a consumer must expressly indicate that they are making a request under that provision. See12 U.S.C. 5534.

15.   Concerning, Merriam-Webster, https://www.merriam-webster.com/​dictionary/​concerning#dictionary-entry-2 (last visited Oct. 5, 2023); see also Concerning, Oxford English Dictionary, https://www.oed.com/​dictionary/​concerning_​prep?​tab=​meaning_​and_​use (last visited Oct. 5, 2023) (defining “concerning” to mean “[i]n reference or relation to; regarding, about”).

16.  With respect to periodic statements, Regulation DD describes information that must appear on periodic statements for deposit accounts held by depository institutions other than credit unions, see12 CFR 1030.6(a), and NCUA regulations impose similar disclosure requirements for credit unions, see12 CFR 707.6(b). Regulation E describes information that must appear on periodic statements for accounts to or from which electronic fund transfers can be made. See12 CFR 1005.9. Regulation Z describes information that must appear on periodic statements for open-end credit plans ( e.g., credit cards and home-equity lines of credit), see12 CFR 1026.7, 1026.8, and for closed-end residential mortgage loans, see12 CFR 1026.41.

17.   Support, Merriam-Webster, https://www.merriam-webster.com/​dictionary/​support (last visited Oct. 5, 2023); see also Supporting, Oxford English Dictionary, https://www.oed.com/​dictionary/​supporting_​adj?​tab=​meaning_​and_​use#19725899 (last visited Oct. 5, 2023) (defining “supporting” to mean “[t]hat provides evidence or authority for something; confirmatory, corroborative.”).

18.   See, e.g., Fed. R. Civ. P. 34 (concerning requests for documents in party's “possession, custody, or control”); U.S. Dept. of Just. v. Tax Analysts, 492 U.S. 136, 145 (1989) (stating that, with respect to requests under the Freedom of Information Act (FOIA), “the agency must be in control of the requested materials at the time the FOIA request is made” and that “[b]y control we mean that the materials have come into the agency's possession in the legitimate conduct of its official duties”).

19.   Cf. Twentieth Century Fox Film Corp. v. Marvel Enterprises, Inc., 2002 WL 1835439, at *3 (S.D.N.Y. 2002) (noting, in context of Federal Rule of Civil Procedure 33, that a “corporation responding to interrogatories must provide . . . the information contained in its own files and possessed by its own employees”).

20.   Cf. In re NTL, Inc. Securities Litigation, 244 FRD. 179, 195 (S.D.N.Y. 2007) (construing “control” in Federal Rule of Civil Procedure 34).

21.  12 U.S.C. 5534(c)(2).

22.   Id.

23.  Section 1033(a) requires that covered persons (not limited to large depository institutions) “make available . . . information,” including “in electronic form,” which can be used by third parties for the provision of products or services to the consumer. 12 U.S.C. 5533(a). Section 1033 governs consumer authorized third-party access to data made available in electronic form in connection with third-party provision of other products or services—including for example, the provision of a potentially competing account offering. This is why, for example, section 1033 is limited to data available in the normal course, and why section 1033 requires data to be “made available . . . in electronic form.” The CFPB is in the process of writing proposed regulations to implement section 1033 of the CFPA. See CFPB, Required Rulemaking on Personal Financial Data Rights, https://www.consumerfinance.gov/​personal-financial-data-rights/​ (last visited Oct. 5, 2023).

24.   Shall, Black's Law Dictionary (11th ed. 2019) (“This [definition] is the mandatory sense that drafters typically intend and that courts typically uphold.”); see Shall, Merriam-Webster Dictionary, https://www.merriam-webster.com/​dictionary/​shall (“shall” is “used in laws, regulations, or directives to express what is mandatory”) (last visited Oct. 5, 2023); see also Lexecon Inc. v. Milberg Weiss Bershad Hynes & Lerach, 523 U.S. 26, 35 (1998) (recognizing that “shall” is “mandatory”).

25.   See Reich v. Trinity Industries, Inc., 16 F.3d 1149, 1154 (11th Cir. 1994) (“shall comply” language in provision of Occupational Safety and Health Act was “mandatory”).

26.  12 U.S.C. 5534(c).

27.  Relatedly, the CFPB does not interpret section 1034(c) to preempt or otherwise supersede the requirements of other Federal or state laws and regulations designed to protect privacy and data security. This includes, for example, any restrictions that may be imposed in the CFPB's upcoming rule implementing section 1033.

28.  This is not intended to be an exhaustive list of the types of fees for consumer information requests that may be subject to section 1034(c).

29.  A consumer would not seek the same information by asking for information from a different time period where information can change over time ( e.g., by requesting certain transaction information for the month of April and then later seeking the same type of information for the month of May).

30.  The CFPB has recently highlighted the risks posed by financial institutions' use of deficient chatbots. See CFPB, Chatbots in Consumer Finance (June 6, 2023), https://www.consumerfinance.gov/​data-research/​research-reports/​chatbots-in-consumer-finance/​.

31.  12 U.S.C. 5534(c)(1).

32.   See12 CFR 1024.36(d)(2).

33.   See, e.g., Consumer Financial Protection Circular 2022–03, “Adverse action notification requirements in connection with credit decisions based on complex algorithms” (May 2022), https://www.consumerfinance.gov/​compliance/​circulars/​circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/​.

34.   See CFPB, Chatbots in consumer finance (June 2023), https://www.consumerfinance.gov/​data-research/​research-reports/​chatbots-in-consumer-finance/​chatbots-in-consumer-finance/​.

35.  12 U.S.C. 5512(b)(1).

36.  5 U.S.C. 801 et seq.

37.  44 U.S.C. 3501–3521.