True Lender Repeal Moves Forward. What's Next?

Argyle Buying Users' Passwords, Big Banks Share Data, Binance Faces DOJ & IRS Probes

May 16, 2021

Hey all, Jason here.

I’ve been back in the US for a week now and honestly, it’s been a bit jarring.

From a small European city (Utrecht) to a large American one (Chicago); from a country still struggling to get access to vaccines to one where many are saying “no, thanks” to the jab; from barely leaving my house to seeing friends and family and dining in restaurants. It’s a nice change of pace but really throws into stark relief how strange the past year+ has been.

Don’t forget that the COMPLY Summit (online) is later this week. I’ll be moderating a panel on “Buy now, pay later & Point of Sale Lending: Protecting Consumers and the Industry” with panelists from Affirm, West Creek Financial, and Four. See the full agenda and register for free.

New here? Subscribe to get Fintech Business Weekly each Sunday:

Event: Flourish Ventures on Embedded Finance

Sponsored Content: Flourish Ventures’ three-part event series on embedded finance brings together global fintech founders at the forefront of this important technology trend to explore what embedded finance means for core businesses and their customers.

Join us for the first event in the series this Wednesday, May 19, when entrepreneurs from NYC-based Propel, Cairo-based MaxAB, and Dhaka-based ShopUp share insights and learnings about the platforms powering embedded finance.

Senate Passes “True Lender” Repeal with Republican Support — What’s Next?

Frequent readers of this newsletter are probably familiar with the idea of “true lender” and the lynchpin role it plays for many non-bank fintech lenders across the APR spectrum, including names like Affirm, Prosper, Avant, and OppLoans.

For those who are less familiar, the basic idea is that a bank can be considered the legal lender of a given loan, even if that loan or a portion of it is later sold.

In combination with the “valid when made” principle and federal preemption of state law, this means that some types of banks are able to ‘export’ the interest rate of their home state, even when it exceeds the usury rate of a borrower’s state of residence.

It’s worth noting that this practice isn’t exclusive to fintech-bank parnterships.

As the banking and lending value chain has been disaggregated, it has become increasingly common for different companies with different licensing requirements to serve different parts of the customer borrowing journey, from customer acquisition to origination/funding, servicing, and collections — and this is true across product types, including mortgages, credit cards, auto loans, as well as the unsecured personal loans favored by many fintech lenders.

In the fintech-bank partnership context, a bank will originate the loan and then the fintech lender will purchase some or all of the loan while the bank collects a fee.

Banks also use secondary market sales or purchases to adjust their loan books in line with their risk tolerance and to meet regulatory capital and liquidity requirements. A true lender repeal isn’t specific to fintech-bank partnerships nor to high APR loans, but adds uncertainty to the wider secondary market for buying and selling loan receivables.

The true lender doctrine is facing uncertainty on multiple fronts. Last week, the US Senate used the Congressional Review Act, a mechanism that allows Congress to reverse executive branch rulemaking, to move forward with invalidating the Trump-era OCC rule codifying “true lender.”

The measure passed the Senate 52-47, with Republican Senators Marco Rubio (FL), Cynthia Lummis (WY), and Susan Collins (ME) crossing the aisle to join Democrats in voting to invalidate the rule.

The measure now goes to the House, where it is expected to pass. The White House has indicated it supports passing the repeal resolution. A successful repeal, which looks like a near-certainty at this point, will generate immense uncertainty and invite more of the types of legal challenges that proliferated prior to the OCC rule.

The move to repeal the rulemaking via the CRA has the interesting side effect of prohibiting the recently appointed acting head of the OCC, Michael Hsu, from developing a new rule that is “substantially similar” to the one Congress repealed — meaning, barring Congressional action to clarify true lender via legislation (unlikely), these battles are likely to play out in the courts, perpetuating uncertainty about these types of fintech-bank partnerships.

This move, spurred in large part by consumer advocates’ distaste for loans over 36% APR, is an indirect attack on high APR lending.

While it may make it harder (or impossible) for a non-bank fintech to partner with a bank to offer loans above a state’s usury cap, it does nothing to prevent banks themselves from making those loans — it only prevents re-selling them.

Payroll API Startup Argyle Allegedly Setup Network of Shell Sites to Capture Users’ Payroll Credentials

Early last week, Brian Krebs, a security researcher, published this analysis of websites that appear to be linked to Argyle, a payroll API startup (“the Plaid of payroll,” if you will).

Kreb’s writeup of the story is a bit difficult to follow, but the key allegation is that Argyle setup a network of sites under names like “Unite At Work,” “Workplace Unite,” and “Common Grounds,” which offered to pay users up to $500 for sharing their payroll login credentials for employers like JPMorgan Chase, Starbucks, Uber, Amazon — and even federal government agencies like the Department of Justice.

The sites offered to pay the users for sharing their credentials, with the promise of upfront cash and ongoing payments if they continued sharing access, under the premise that the site was using this access to develop products to “maximize the personal value of every worker’s data.”

According to Krebs, it’s not illegal to give someone your password (or to induce someone to do so willingly), but I suspect the companies having their payroll/HCM systems accessed by a 3rd party under arguably misleading circumstances wouldn’t look too favorably on the practice.

The security and data risk is heightened for employers that use payroll credentials to facilitate single sign on access to other services, like employees’ insurance or 401(k) providers.

Why would Argyle allegedly go to the effort to setup this elaborate network of sites?

Network of shell sites and their connections to Argyle. Image via krebsonsecurity / Virustotal

According to Steve Friedl, an IT consultant in the payroll industry quoted in Krebs article (emphasis added):

“They are not paying this money just to be able to sell people services, they are doing so to maintain their screen-scraping software API,” Friedl said.
“This is essentially paying employees to help Argyle hack their payroll provider.”

Big Banks Plan to Share Account Data to Underwrite “Credit Invisibles”

Big banks, including JPMorgan Chase, Wells Fargo, and US Bancorp, plan to begin sharing account data to help underwrite credit cards for applicants who lack traditional credit scores, according to the Wall Street Journal last week. The pilot program is expected to launch later this year.

While it generated big headlines, using account data / cash flow-based underwriting is nothing new. Alternative lenders and upstart credit card offerings like Petal have been doing this for years, using services like Plaid to access users’ bank account data to analyze their cash flow to determine creditworthiness. Neobanks like Chime and Varo effectively do this with their first party data to allow users to access up to $100 of overdraft / credit line.

According to the article, Chase itself has been using its first party account data since at least 2016. The big step forward here is sharing — using deposit account data from other institutions.

About 10 banks are discussing exchanging data and are evaluating doing so via the traditional big three credit bureaus (Experian, Equifax, Transunion) or through bank-owned Early Warning Services, which also operates Venmo/Cash App competitor service Zelle.

The WSJ article mentions banks are also considering using account aggregators like Plaid or Finicity to facilitate sharing users’ bank account data. While the battles over screenscraping have gradually given way to something like a detente and the rise of more secure and scalable APIs, I’m somewhat skeptical 10 of the biggest banks want to cede this territory to Plaid or Finicity.

My bet is that we see something akin to a replay of Zelle — while it’s less well known as a consumer brand, it has grown to process $307 billion across 1.2 billion transactions in 2020.

Using Early Warning to share deposit account data would allow banks to avoid Plaid’s fees and, potentially, build a bank-owned competitor to the ubiquitous data sharing service.

While big banks, let alone groups of them together, aren’t known for moving quickly nor collaborating, they recognize the threats from emerging fintechs who use data to serve customers they can’t and from the fintechs that build the infrastructure that makes that data access possible.

The question is, in an effort to avoid being disintermediated, can legacy banks collaborate in order to compete?

Binance, World’s Largest Crypto Exchange, Faces Probes from US DOJ, IRS

Forget Swiss bank accounts, the US Department of Justice and IRS have set their sights on Binance, the world’s largest crypto exchange. While the exchange hasn’t been accused of wrongdoing, US officials are seeking information from individuals with knowledge of Binance’s business operations.

Binance is incorporated in the Cayman Islands, and, according to its executives, closely follows US rules and bar Americans from using its services. According to Bloomberg (emphasis added):

“The inquiries follow a Chainalysis report on criminal transactions involving digital tokens. The firm tracked Bitcoin worth $2.8 billion that it suspects crooks moved on to trading platforms in 2019. Chainalysis determined that roughly 27%, or $756 million, wound up on Binance.
Binance responded by saying it adheres to all anti-money laundering regulations in the jurisdictions in which it operates and works with partners like Chainalysis to improve its systems.”

The inquiry is all the more notable given the well-connected Washington names that have recently joined the firm.

Former Senator Max Baucus (D-MT) joined in March to advise on policy and government relations. Brian Brooks, the acting Comptroller of the Currency under Trump, joined the business unit set up to serve American clients, Binance.US, as CEO just last month.

Fintech Spring Meetup

Sponsored content: If you’re looking to meet and network with others in fintech, this is the event for you. Rather than focusing on keynotes or fireside chats, cut straight to the most valuable part: building connections with other knowledgeable, influential industry professionals.

Learn More & Register

Fintech Business Weekly Resources

Early stage startup looking for equity investment or first debt facility?
I may be able to help: jason@fintechbusinessweekly.com

Interested in advertising in Fintech Business Weekly?
Email me: jason@fintechbusinessweekly.com

Anonymous tip or story suggestions?
Reach me on Signal or Telegram: ‪+1 (316) 512-1571‬

Fintech Business Weekly