The Affinity Hub

In the latest round of now months of intense regulatory enforcement of the fintech industry, the FDIC has been sending out letters to fintechs who claim to offer “FDIC deposit insurance” on their websites for the deposit products they offer.

The issue of course is that only banks can offer FDIC insurance on deposits, and fintechs are not banks (at least not the vast majority of them).

The FDIC’s claim is that even if the deposits themselves are FDIC insured by the bank partner sitting behind the fintech, a fintech can’t imply that it is the one offering the FDIC insurance.

Seem like semantics?

Well, regulators have a long history of playing “gotcha” with the words that fintechs use on their website.

Colorado — Or when a couple of fintechs forget that they are the “tech” and not just the “fin”

In a long and somewhat historic lawsuit that took place in the heyday of the fintech-bank partnership model (circa 2017–2019 — heyday because there was otherwise little federal policing happening those days), Colorado sued two prominent fintechs — Avant and Marlette — for unlicensed lending activity.

The State of Colorado claimed that neither had a license to lend in the state above the state usury cap.

But each fintech had a bank partner behind it, and as we know from the rate exportation rule covered in our post “In a bank-fintech partnership, who is in charge?”, state chartered banks have the right to export the rate of their home state to all fifty states, a nifty little privilege that allows banks — and not non-banks — to charge interest rates above state usury caps.

When Colorado came knocking on the door, each of Avant and Marlette pointed the finger to their bank partners, WebBank and Cross River Bank, respectively, as the lenders.

But Colorado pointed back to say that it was the fintechs, and not the banks, who claimed to be doing the financial activity. In the claim, they pointed to these statements on Avant’s website:

“Over 100,000 people have experienced the convenience of our personal loans”

“At Avant, we offer personal installment loans”

“Our rates and terms”

The implication, of course, was that Avant, using the first person, was doing the lending. If Avant had said, instead, “Through Avant, you can obtain a personal installment loan,” the conclusion might have been different* ** ***

*I would always remind my colleagues at Bread (a BNPL) that the passive voice is our friend. We don’t make loans. Loans are made, and we just happen to be there, just hanging out in the area.

**For the sake of thoroughness, the Colorado claim didn’t just rest on the website wording but included other issues such as whether the banks had the predominant economic interest in the loans it was offering and whether it had real third party oversight over the program, the latter of which is the essence of almost any consent order being issued these days against sponsor banks.

***The case was eventually settled with a mixed outcome. Banks could continue to lend through fintechs in Colorado but only if they had more skin in the game (more ownership of the loans they issued). But the bank-fintech model survived in the state, thanks to many of the lawyers who represented Avant/Marlette and their bank sponsors.‍

Feel free to market — just don’t embellish

Words aren't just important when describing the bank-fintech partnerships.

In one of the first actions by the CFPB against a fintech, the agency fined Dwolla (a payment processor) $100,000 back in 2016, mere months before the CFPB went into a change-of-presidential-administration induced hibernation for a few years (Nov 2016–2020). They pointed to the following claims made by Dwolla on its website:

Dwolla “empowers anyone with an internet connection to safely send money to friends or businesses”

Dwolla ’s data-security practices “exceed industry standards,” and “surpass industry security standards”;

Dwolla “sets a new precedent for the industry for safety and security”

At first glance, you might say this might seem a bit much— maybe just a marketing person having had an extra shot of espresso writing the website copy one morning — but it’s not that crazy.

After all, don’t all fintechs consider their customer transactions to be safe and secure. And while they may not boast of “setting a new precedent for the industry” (sheesh, ok, maybe *two* extra shots of espresso taken that morning by that copywriter), tech companies often and rightfully believe that they do a better job of protecting customer data than many of the larger non-tech companies.

The CFPB, though, showed up with one simple directive.

Prove It.

Prove, with tangible data, that you “exceed industry standards” and that you’ve “set a new precedent” for industry standards.

And so when you begin to try to substantiate your claims, you know fully well that it only takes one exception to disprove the claim— one example of a transaction that deviated from you standard security practices, one example of where you didn’t exceed the industry standard, etc. and before you know it, you are going down a rabbit hole of parsing through the Merriam Webster dictionary definition of “safe” and “secure”.

Superlatives are for high school yearbooks

While the CFPB/Dwolla lawsuit was probably a bit extreme (if the CFPB was trying to scare fintech legal and compliance operators at the time, I distinctly remember how well it worked), start-ups should take the lesson.

Words you use matter. And they matter most of all on public facing marketing and your website where a regulator can spend hours on a slow Friday afternoon sipping coffee and parsing through every word.

Some of the best practices are obvious:

Don’t use superlatives like “the best”, “always”, “never,” “guaranteed.” You will always have an exception.

Examples of vague hyperboles:

“We have the most secure app”

“We have saved customers more money than our competitors”

“We have the most satisfied customers on the planet”

These can all be disproven with one exception.

But some best practices are less obvious.

In late March 2024, the CFPB issued a circular warning remittance providers about how they market the speed of sending a remittance transfer.

It took issue with the wording of “instant transfers”. It also issued a warning about other marketing claims, and it seems by their broadly worded guidance that they intend the warning to extend beyond the remittance industry.

Some of the takeaways from the CFPB Circular:

Don’t say something is “instant” or “immediate”. Your credit approval is never going to be instant, the payment transfer is never going to be immediate. You might be able to say “in seconds” (because, well, it could be 1 or 1,000 seconds) but be careful about saying “a few seconds”

Don’t say “no fees” if you have any fees whatsoever even if they are baked into the retail price of your product.

Don’t say your product is “free” when it is not, in fact, free (i.e., no such thing as a free lunch, etc. — there is a string attached somewhere)

Marketing and Legal — Best Frenemies

How does this all work in practice?

If you’re a scaled start-up and you have both a dedicated marketing person or team and a dedicated legal person or team, congratulations.

You should empower them equally, leave them in a room, close the door, and let them debate every single marketing copy and word that you push out into the world.

If you are a scrappy start-up, you might have to adopt dual personalities, one as the care-free creative, and the other as cynical tactician, when writing your marketing copy.

Or spend the few extra bucks to hire someone to scrape through your website. When your marketing is out there for the world to see, it’s worth the money to have peace of mind that you can back up what you’ve put out there.

And then if you don’t want keep paying a person for every social media post, make sure, before you publish, to spend a few minutes reading every word from the perspective of those pesky regulators.

How could my well-intentioned phrase or word advertising my start-up’s hard earned accomplishments be read in a way that suggests that I’m just making stuff up?

************************
While we hope you found this post helpful, please note that the information in this post is not intended to be legal or regulatory advice.

Fintech Law and Compliance 101 is affiliated with https://www.itsaffinity.com/ a compliance learning management platform built specifically for banks, bank sponsors, and fintechs

‍