MD. HB 1127. Maryland Financial Consumer Protection Commission.

MD. HB 1127. Maryland Financial Consumer Protection Commission.
Short Title
Official Text	MD. HB 1127. Maryland Financial Consumer Protection Commission.
Country/Jurisdiction	United States
State or Province	Maryland
Regulatory Bodies
Date Enacted	2019
Scope of the Law	Financial
Information
Taxonomy	Exclusion, Insecurity, Secondary Use
Strategies

Template:MarylandAd

Template:United StatesAd

Text of the law

Mobile Homes and Mobile Home Retailers

The bill incorporates the federal definition of “dwelling” within the Maryland Mortgage Lender Law (MMLL) to mean a residential structure or “mobile home” that contains one to four family housing units, or individual units of condominiums or cooperatives. The bill defines “mobile home” as a trailer, house trailer, trailer coach, or any other dwelling that is transportable in one or more sections that is (1) used (or can be used) for residential purposes and (2) permanently attached to land or connected to utility, water, or sewage facilities.

The bill also alters the definition of “mortgage loan originator” to exclude an individual who is a retailer of mobile homes (or an employee of the retailer) if the retailer (or employee), as applicable, does not receive (directly or indirectly) compensation or gain for engaging in mortgage loan origination activities as described in § 11-601(q)(1) of the Financial Institutions Article.

Mobile Home Retail Sales Requirements: The bill establishes that a mobile home retailer:

 has a duty of good faith and fair dealing in providing financial information to a prospective consumer borrower, including providing financial information in a manner that is not misleading or deceptive and that discloses all material facts;

 may not steer a consumer borrower to financing products that offer less favorable terms; and

 must provide a written disclosure statement to a consumer borrower.

The written statement required by the bill must include (1) a disclosure that describes any corporate affiliation between the mobile home retailer and a financing source about which the mobile home retailer provides information to the consumer borrower; (2) a disclosure that the consumer borrower may obtain financing from any lender (and is not required to obtain financing from a lender suggested by the retailer); and (3) information regarding the rights of a consumer borrower and the procedure for filing a complaint with the commissioner.

If a mobile home retailer fails to comply with the bill’s requirements, the validity of an otherwise valid financing transaction is not affected. OCFR may enforce these requirements by exercising any of its investigative and enforcement powers pursuant to §§ 2-113 through 2-116 of the Financial Institutions Article.

Repossession of Mobile Homes:

The bill further establishes that, at least 45 days before a lender or credit grantor repossesses a mobile home that is primarily for personal, family, or household use, the lender or credit grantor must serve a written notice on the consumer borrower of the lender or credit grantor’s intention to repossess the mobile home. However, this notice is not required if the mobile home is abandoned or if the consumer borrower voluntarily surrenders the mobile home to the lender or credit grantor. Any notice given less than 45 days before repossession must be accompanied by a certification demonstrating that the mobile home is vacant (or that the mobile home has been surrendered).

Mortgage Lenders

The bill authorizes OCFR to set application, license, and investigation fees for a mortgage lender based on the type and volume of activity conducted by the lender.

Maryland Personal Information Protection Act

The bill expands the definition of “personal information” under MPIPA to include:

 activity-tracking data (when in combination with an individual’s first name or first initial and last name, and when such data is not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable);

 genetic information of an individual, as specified; and

 nonpublic social media information about an individual, including communications, postings, pictures, videos, connections between individuals, connections between accounts, and actions.

Security Procedures: The bill requires a business that maintains (in addition to a business that owns or licenses) personal information of a Maryland resident to implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information maintained and the nature and size of the business and its operations.

Security Breaches: The bill modifies the definition of “breach of the security of a system” to mean the unauthorized acquisition of any data that compromises the security, confidentiality, or integrity of the personal information maintained by a business. ^Insecurity

For a business that owns or licenses personal data, unless the business reasonably determines that a breach does not create a likelihood that personal information has been (or will be) misused, the business must notify the individual of the breach. Generally, the required notification must be given as soon as reasonably practicable. However, the bill requires the notification to be provided within 10 (rather than 45) days after the business discovers (or is notified) of the breach. ^{Secondary Use, Exclusion}

For a business that maintains personal data, generally, the business must notify the owner or licensee of the breach as soon as practicable; however, the bill requires the notification to be provided within 3 (rather than 45) days after the business discovers (or is notified) of the breach.

If a required notification is delayed because a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security, notification must be given as soon as reasonably practicable, but not later than 1 day (rather than 30 days) after the law enforcement agency makes the required determination.

Methods of Notification: The bill also modifies the methods for providing notification of breaches. Specifically, the bill requires (rather than authorizes) a business that owns or licenses personal data to provide notification of the breach by written notice, electronic mail, or by telephone. (Notification by electronic mail may only be provided if specified conditions are met.) The bill repeals a provision that allows substitute notice to be given if the cost of providing the notice is cost prohibitive or if the business does not have sufficient contact information.

In addition, the notification must be provided by (1) email, if the business has an email address for the individual; (2) conspicuous posting on the website of the business, if the business maintains a website; and (3) notification to statewide media.

Contents of Notice to the Office of the Attorney General: For data breaches involving a business that owns or licenses personal information, the bill expands the information that must be included in a notice provided to OAG. At a minimum, the notice must include:

 the number of affected Maryland residents;

 a description of the breach, including how it occurred and any vulnerabilities that were exploited;

 any steps the business has taken (or plans to take) relating to the breach of the security of a system; and

 a sample of each form of notice that will be sent to consumers as required.

Protection of Account Information and Liability Standards for Breaches: The bill requires an “entity” to implement and maintain reasonable security procedures and practices (as appropriate) to protect account information from unauthorized access, use, modification, or disclosure. An “entity” means: ^Insecurity

 a financial institution;

 a business that (1) provides, offers, or sells goods or services in the State and (2) processes more than 20,000 payment card transactions each year; or

 a business that directly processes (or transmits) account information for (or on behalf of) another person as part of a payment processing service.

The bill prohibits an entity from retaining account information more than 48 hours after authorization of a payment card transaction.

The bill also establishes liability standards related to the reimbursement of reasonable actual costs incurred by a financial institution. Generally, a vendor or entity is liable to a financial institution if the vendor’s or entity’s negligence was the proximate cause of the breach, as specified, and the claim of the financial institution is not otherwise limited by law. Costs for which a financial institution is entitled to reimbursement include costs associated with notifying affected cardholders, canceling or reissuing of payment cards, and the opening/closing of financial accounts. The bill further specifies instances in which an entity or vendor is not liable.

The bill authorizes a financial institution to bring an action to recover any costs (including attorney’s fees) for which an entity or a vendor is liable. However, an entity or vendor that is compliant with specified security standards is not liable to a financial institution for a data breach under the bill.

Automobile Dealers and Indirect Lending

The bill expands the definition of a “credit services business” under the Maryland Credit Services Businesses Act to include a vehicle dealer (as defined in § 15-101 of the Transportation Article) who participates in finance charges associated with a contract for the sale of a vehicle by the dealer.

Prior to the execution of a financing agreement on a contract for the sale of a vehicle to a buyer, a dealer must disclose to the buyer (1) all financing offers for which the buyer was approved, including the “buy rate” and the term in months for each offer and (2) whether or not the dealer is being compensated for increasing the “contract rate” to a higher rate than the “buy rate,” as specified. The dealer must also obtain the buyer’s signature on the required disclosures.

The “buy rate” is the lowest annual percentage rate (APR) that an indirect lender indicates to a dealer would need to be a feature of a contract for the sale of a vehicle in order for the indirect lender to purchase the contract. “Contract rate” means the APR in a (1) contract offered for the sale of a vehicle or (2) final contract for the sale of a vehicle.

The bill prohibits a dealer from participating in finance charges that would result in a difference between the buy rate and the contract rate of more than (1) 2 APR points for a contract that has an original scheduled term of up to 60 monthly payments or (2) 1.5 APR points for a contract that has an original scheduled term of more than 60 monthly payments.

Fiduciary Duty of Financial Professionals

The bill establishes that investment advisers, broker-dealers, broker-dealer agents, insurance producers, and other specified financial professionals are fiduciaries and have a duty to act in the best interest of the customer without regard to the financial or other interest of the person (or firm) providing the advice. OCFR may adopt specified regulations to carry out this requirement. The bill’s requirements do not impose any books and records requirements on a broker-dealer beyond those that are imposed under federal law.

Virtual Currencies and the Maryland Money Transmission Act

The bill expands MMTA to specify that the transmission of “virtual currency” is a form of money transmission subject to the licensing and regulatory requirements of MMTA. “Virtual currency” means a digital representation of value that (1) may be used as a medium of exchange, a unit of account, or a store of value and (2) is not a currency (whether or not denominated in currency).

As part of a money transmission (including before or after the transmission), if a licensee has control of virtual currency for one or more customers, the licensee must maintain in its control an amount of each type of virtual currency sufficient to satisfy the aggregate entitlements of the customers to the type of virtual currency.

A licensee is prohibited from providing money transmission services to a customer unless the licensee is in full compliance with (1) federal anti-money-laundering laws, as specified and (2) federal customer due diligence requirements, as specified. During the conduct of money transmission, the bill prohibits a licensee or person from engaging in:

 an unsafe or unsound act or practice;

 an unfair or deceptive act or practice;

 fraud or intentional misrepresentation;

 another dishonest act; or

 misappropriation of currency, virtual currency, or other value held by a fiduciary.

The bill requires a licensee to maintain a record of policies and procedures for specified compliance programs.

Currency Exchanges

The bill establishes new requirements related to entities providing “currency exchange services” and requires such entities to be licensed by OCFR. “Currency exchange services” refers to:

 receipt of revenues from the exchange of currency of one government for currency of another government; or

 the assumed control of virtual currency from (or on behalf) of a person, at least momentarily, to sell, trade, or convert (1) virtual currency for currency, bank credit, or one or more forms of virtual currency or (2) currency or bank credit for one or more forms of virtual currency.

The bill exempts specified entities, such as banks, savings and loans, and credit unions, from obtaining licensure as a currency exchange service and authorizes OCFR to adopt regulations related to currency exchanges. Licensing revenues (as well as any other fee or revenue received by OCFR under the new currency exchanges subtitle) must be deposited into the Nondepository Special Fund and used for related purposes. However, OCFR must pay all fines and penalties into the general fund.

Licensing and Recordkeeping Requirements:

The bill prohibits a person from providing currency exchange services unless the person is properly licensed (or exempt from licensing). In addition, the bill establishes licensing procedures, requirements, and qualifications as well as provisions related to the confidentiality of information for licensees. An application for an initial license is $1,000; applicants must also pay a $1,000 investigation fee. A license may be renewed annually; the renewal fee is also $1,000.

The bill establishes recordkeeping requirements for licensees; a licensee must retain the appropriate records for at least two years (unless a longer period is expressly required by State or federal law). At any time (and as often as considered appropriate), OCFR may investigate the records and business operations of a licensee (or a person who acts on behalf of a licensee).

The bill requires a licensee to comply with all federal and State laws concerning money laundering.

Disclosure Requirements: The bill requires a licensee to conspicuously post at each place of business at which the licensee provides currency exchange services a notice of the rate of exchange and fees for providing the services. If a licensee provides currency exchange services on the licensee’s website, the website must conspicuously show the same information.

In addition, a licensee must provide each customer with a written receipt sufficient to identify:

 the transaction;

 the licensee;

 the exchange rate;

 the amount and type of currency (or virtual currency) exchanged; and

 the fees charged.

Required Reserves and Prohibited Activities: As part of a currency exchange service (including before or after the transmission), if a licensee has control of virtual currency for one or more customers, the licensee must maintain in its control an amount of each type of virtual currency sufficient to satisfy the aggregate entitlements of the customers to the type of virtual currency.

A licensee is prohibited from providing currency exchange services to a customer unless the licensee is in full compliance with (1) federal anti-money-laundering laws, as specified and (2) federal customer due diligence requirements, as specified. In addition, the customer must present a form of customarily acceptable identification. The bill prohibits a licensee or person from engaging in specified unlawful activities during the conduct of virtual currency exchange services.

Enforcement: OCFR may enforce the bill’s currency exchange requirements by issuing an order (1) to cease and desist and to take affirmative action from the violation and any further similar violations and (2) requiring the violator to take affirmative action to correct the violation (including restitution of money or property to any aggrieved person).

OCFR may suspend or revoke the license of any licensee who engages in illegal or otherwise dishonest activities or violates the provisions of the Currency Exchange Subtitle, as specified. However, prior to taking any enforcement actions, OCFR must give the licensee an opportunity for a hearing in accordance with State law. OCFR must report to the appropriate State’s Attorney (or the Attorney General) any alleged criminal violation. OCFR may also impose a civil penalty in an amount of up to (1) $10,000 for a first offense and (2) $25,000 for each subsequent offense.

A person who knowingly violates the provisions related to the licensure and regulation of currency exchanges is guilty of a misdemeanor and, upon conviction, is subject to a fine of up to $5,000 and/or imprisonment for up to three years.

A person who is injured by a violation of the bill’s currency exchange requirements may file an action to recover damages or for injunctive relief. A court may award a prevailing plaintiff (1) up to three times the amount of actual damages and (2) an amount at least equal to the amount paid by the plaintiff to the defendant, reasonable attorney’s fees, and costs.

The bill’s currency exchange requirements may not be construed to affect the jurisdiction of the Securities Commissioner under Title 11 of the Corporations and Association Article.

Arbitration

The bill requires OAG and OCFR to (1) review Title I of the National Consumer Law Center’s Model State Consumer and Employee Justice Enforcement Act and (2) report by October 1, 2019, to the Senate Finance Committee and the House Economic Matters Committee on the potential impact on consumers and businesses of the General Assembly’s adoption of Title I in legislation.

Extension of the Maryland Financial Consumer Protection Commission The bill extends MFCPC, by two years, through June 30, 2021. The commission is required to assess the impact of new developments in financial services that have revealed new risk to consumers. MFCPC must report on these developments to the Governor and General Assembly by December 31, 2019, and again by December 31, 2020.

Current Law/Background:

Maryland Financial Consumer Protection Commission

Pursuant to Chapters 18 and 781 of 2017, MFCPC is responsible for (1) assessing the impact of potential changes to federal financial industry laws and regulations, budgets, and policies and (2) issuing recommendations for federal and State actions that are intended to protect residents of the State when conducting financial transactions and receiving financial services.

Mobile Homes and Mobile Home Retailers

Under MMLL, a “dwelling” has the meaning stated in 15 U.S.C. § 1602(w), which defines “dwelling” as a residential structure or mobile home which contains one to four family housing units, or individual units of condominiums or cooperatives. However, a “dwelling” does not include a residential structure or mobile home unless the residential structure or mobile home (or at least one unit contained within) is owner-occupied.

At least 10 days before a lender repossesses any goods, the lender may serve a written notice on the borrower of the lender’s intention to repossess the goods. Similarly, at least 10 days before a credit grantor repossesses any tangible personal property, the credit grantor may serve a written notice on the consumer borrower of the intention to repossess the tangible personal property.

According to the 2018 MFCPC report, the U.S. Congress included a provision in the Economic Growth, Regulatory Relief, and Consumer Protection Act (which was enacted May 24, 2018) specifying that retailers of manufactured houses meeting certain requirements are not considered mortgage loan originators for purposes of the Truth in Lending Act (TILA).

TILA, enacted in 1968, is a federal law promoting transparency and protecting consumers taking out consumer loans. Its regulation is implemented through Regulation Z, which in part prohibits a loan originator from steering a consumer toward a loan that provides the loan originator with greater compensation than other transactions the loan originator offered or could have offered to the consumer.

MFCPC made several recommendations related to manufactured housing in its 2018 report.

 First, the commission recommended that, if a retailer of a manufactured home provides information regarding financing the purchase of the home, the retailer (1) must do so in a fair and honest manner in compliance with the Maryland Consumer Protection Act and (2) may not otherwise steer a consumer to product offerings with less favorable terms. In addition, the commission recommended that the retailer provide a statement, in plain English, describing any financial relationship or affiliation between the retailer and the lender about whose products the retailer provides information.

 Second, the commission recommended amending the definition of “dwelling” under Maryland law to ensure that manufactured home brokers, lenders, and originators are subject to the mortgage lending laws in the State.

 Third, the commission recommended that retailers of manufactured homes who provide information to consumers regarding financing options must provide a written disclosure to consumers on a form prescribed by OCFR at the time the retailer provides financing information. The commission recommended that the disclosure include information regarding borrower rights and the procedure for filing a complaint with OCFR if a consumer is harmed or has been steered to an inappropriate product.

 Fourth, the commission recommended increasing the notice requirement for an action of replevin or an action to repossess a manufactured home that is not vacant or has not been surrendered to 30 days (consistent with federal law) or to 45 days from 10 days.

Mortgage Lenders

OCFR is required to set fees under MMLL by regulation. The fees must be reasonable and set in a manner that will produce funds sufficient to cover the actual direct (and indirect) costs of regulating licensees.

Maryland Personal Information Protection Act

When a business is destroying a customer’s, employee’s, or former employee’s records containing personal information, the business must take reasonable steps to protect against unauthorized access to or use of the personal information, taking specified considerations into account.

To protect personal information from unauthorized access, use, modification, or disclosure, a business that owns or licenses personal information of a Maryland resident must implement and maintain reasonable and appropriate security procedures and practices. A business that uses a nonaffiliated third party as a service provider and discloses personal information about a Maryland resident under a written contract with the third party must require, by contract, that the third party implement and maintain reasonable security procedures and practices that are (1) appropriate to the nature of the disclosed information and (2) reasonably designed to help protect the information from unauthorized access, use, modification, disclosure, or destruction. This provision applies to a written contract that is entered into on or after January 1, 2009. ^Insecurity

A business that owns or licenses computerized data that includes personal information of a Maryland resident, upon the discovery or notification of a breach of the security of a system, must conduct, in good faith, a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused as a result of the breach. If, after the investigation, the business reasonably believes that the breach has resulted or will result in the misuse of personal information of a Maryland resident, the business must notify the individual of the breach. Generally, the notice must be given as soon as reasonably practicable (but not later than 45 days after the business conducts the required investigation). If the business determines that notification is not required, the business must maintain the records related to the determination for three years.

A business that maintains computerized data that includes personal information that it does not own or license must notify the owner or licensee of the personal information of a breach and share information relevant to the breach as soon as reasonably practicable (but not later than 45 days) after the business discovers or is notified of the breach.

The notification may be delayed (1) if a law enforcement agency determines that it will impede a criminal investigation or jeopardize homeland or national security or (2) to determine the scope of the breach, identify the individuals affected, or restore the system’s integrity.

Consumer notification must include a description of categories of information acquired by the unauthorized user, the business’ contact information, and contact information for the major consumer reporting agencies and specified government agencies. The notification may be given by mail or telephone; electronic mail or other forms of notice may be used if specified conditions are met. Prior to consumer notification, a business must notify OAG of the breach after it discovers or is notified of the breach.

In the case of a breach of a security system involving an individual’s email account – but no other specified personal information – the business may comply with the required notification in electronic or other form. The notification must direct the individual whose personal information has been breached to promptly (1) change the individual’s password and security question or answer, as applicable, or (2) take other appropriate steps to protect the email account, as well as all other online accounts for which the individual uses the same user name or email and password (or security question or answer).

Generally, the required notification may be given to the individual by any method described in § 14-3504 of the Commercial Law Article. However, the required notification may not be given by sending notification by email to the affected account. The notification may, however, be given by a clear and conspicuous notice delivered to the individual online while the individual is connected to the affected email account from an Internet protocol address or online location from which the business knows the individual customarily accesses the account.

A waiver of the notification requirements is void and unenforceable. Compliance with the notification requirements does not relieve a business from a duty to comply with any federal legal requirements relating to the protection and privacy of personal information.

In its 2018 report, MFCPC noted that changing technology has created new types of personal information, as well as changes in the prevalence and availability of certain types of personal information. To address the evolution of personal information, the commission recommended expanding the definition of “personal information” under MPIPA to include genetic information of an individual and activity-tracking data collected on an individual.

As data breaches have increased in frequency and size, more Maryland consumers have been subject to the negative consequences of breaches. Some of these consequences, such as identity or credit card fraud, may be mitigated using tools like security freezes. Consumers, however, are not able to take actions to protect themselves if they are not aware that they have been the subject of a data breach. Thus, the commission recommended strengthening the notice requirements in MPIPA. Businesses subject to a data breach should provide notification of the breach to a consumer directly and through substitute means. Businesses should not be able to choose the way they provide notification. In addition, the required notice should (1) specify the number of affected Marylanders; (2) describe the breach, including how it occurred and any vulnerabilities that were exploited; (3) include any steps the business has taken or plans to take in response to the breach; and (4) include a sample form notice that the business will send to consumers. ^{Insecurity, Exclusion}

The report went on to recommend updating MPIPA to require business entities to implement and maintain reasonable security procedures and practices that are appropriate to protect account information from unauthorized access, use, modification, or disclosure, including requiring businesses to destroy certain account information after 48 hours.

Finally, MFCPC noted that addressing the financial liability after a data breach occurs is also critical to managing the impact of data breaches. To that end, MFCPC noted the General Assembly may also wish to consider establishing liability standards after a data breach has occurred such that the business that experienced the breach is required to reimburse financial institutions for the costs associated with reissuance of a payment card, notification of a consumer, and opening and closing financial accounts. Depending on the circumstances of the breach, the reimbursement could be required from the business or a vendor that supplied the business with software or equipment designed to process, store, or transmit stored account information for the business. However, MFCPC recommended that any such liability should be limited to situations in which the negligence of the vendor or a failure of a business to maintain reasonable security was the proximate cause of the breach.

Automobile Dealers and Indirect Lending

According to MFCPC’s 2018 report, the majority of all car purchases are financed. The Center for Responsible Lending (CRL) states that 80% of cars are financed through dealers and just under 80% of automobile loan volume is through indirect lending, which often includes hidden interest rates and markups. Maryland has the second highest percentage of delinquent automobile loan balances more than 30 days past due, second only to Mississippi.

An automobile dealer may provide financing directly or it may facilitate indirect financing by a third party (i.e., a bank, a nonbank affiliate of a bank, an independent nonbank, or a “captive” nonbank). In indirect automobile financing, the dealer collects basic information about an applicant and provides that information to prospective indirect automobile lenders. When an indirect automobile lender is interested in purchasing a retail installment sales contract executed by the consumer with the dealer, the lender provides the dealer with a risk-based “buy rate” that establishes a minimum interest rate.

The indirect automobile lender often allows the dealer to mark up the interest rate above the “buy rate.” For instance, a “buy rate” may be 4.0% and a dealer marks up the rate by 2.0%, making the real rate 6.0%. This markup is not mentioned in any documents signed by the consumer. Dealers claim the practice is justified to cover the cost of arranging customers’ financing. Manufacturers’ captive finance companies seemed to have settled on a limit of up to 2.5% markup, according to testimony at the commission’s November 16, 2018 meeting. The National Automobile Dealers Association explained to the commission that it is customary for lenders to cap the spread. Based on information available to OAG, it appears that major lenders are capping spreads at 2% or less.

In its 2011 study of automobile loan markups, CRL found that buyers with weaker credit scores may be targeted for markups because they have fewer alternative financing options. Consumers are often unaware that the available rate and terms communicated to them by the dealer may be higher than the “buy rate” set by a given lender because the dealer has an incentive to generate higher compensation by increasing the rate that is offered to the borrower. In certain cases, the dealer “markup” may be several percentage points higher than the interest rate available to a consumer, resulting in substantial dealer compensation to the detriment of the Maryland consumer.

MFCPC recommended legislation bringing greater transparency in this process and imposing reasonable limitations on the means by which automobile dealerships are compensated for their role in the indirect automobile lending process by lenders. The commission recommended licensing and oversight of the dealerships offering credit to Maryland consumers, capping back-end compensation in order to restrain abusive automobile financing practices, and providing additional disclosures to consumers relating to the financing charge.

Fiduciary Duty

According to MFCPC’s 2018 report, although Maryland law provides some protections for consumers who rely on the advice of securities professionals, it does not explicitly extend the fiduciary duty to broker-dealers or their agents.

Under Maryland regulations (COMAR 02.02.05.03), an investment adviser is a fiduciary and has a duty to act primarily for the benefit of its clients. An investment adviser includes a person that holds out as an investment adviser in any way, including indicating by advertisement, card, or letterhead, or in any other manner indicates that the person is a financial or investment “planner,” “counselor,” “consultant,” or any other similar type of adviser or consultant. In addition, under § 11-306 of the Corporations and Associations Article, a person who engages in the business of effecting transactions in securities for the account of others or for the person’s own account, or who acts as a broker-dealer or agent, may not engage in dishonest or unethical practices in the securities or investment advisory business.

MCFPC advises, however, that the existing Maryland standards taken together may provide less investor protection than the standard set forth in § 913(g) of the Dodd-Frank Wall Street Reform and Consumer Protection Act and by the U.S. Department of Labor in its 2016 rule.

Consequently, MFCPC recommended that the General Assembly pass legislation that specifies that a broker-dealer, broker-dealer agent, insurance producer, investment adviser, or investment adviser representative who offers advisory services or holds themselves out as an advisor, consultant, or as providing advice, should be held to a fiduciary duty to act in the best interest of the customer without regard to the financial or other interest of the person or firm providing the advice.

Virtual Currencies

MFCPC’s 2018 report noted that, under MMTA, a person may not engage in the business of money transmission if that person (or the person with whom that person engages in the business of money transmission) is located in the State, unless that person is licensed by OCFR. While it may be implicit, MMTA does not explicitly address the supervision of virtual currencies, the exchange of virtual currencies, or other new technologically advanced money service businesses. Further, based on a comparison of the Uniform Model Act with State law, there may be gaps in consumer protection provisions that are in the Uniform Model Act but not in State law.

OCFR considers virtual currencies to be covered by MMTA. However, to be proactive as the cryptocurrency markets continue to develop, MFCPC recommended the General Assembly pass legislation that makes explicit what is implicit in the applicability of MMTA. Further, the commission recommended explicitly stating the licensing requirement for fiat currency and virtual currency exchanges. To further modernize State law, the commission recommended that the General Assembly consider adopting consumer protections that are included in the Uniform Model Act but not in State law.

Arbitration

According to the National Consumer Law Center (NCLC), “forced arbitration” clauses are terms included in contracts of adhesion that, as a condition of purchase or employment, require consumers or employees to give up their constitutional right to assert claims against a merchant or employer in court. The clauses appear in a variety of types of contracts, including credit agreements, cell phone contracts, nonunion employment agreements, and automobile loans.

Although business advocates represent that arbitration clauses provide consumers with direct access to a private forum, in practice, many consumers are unable to use arbitration to resolve complaints for three reasons: (1) many clauses require consumers to pursue what are often small dollar claims individually, without the benefit of a class or group; (2) arbitration can be very expensive due to mandatory fees or requirements to use arbitration in another geographic location; and (3) businesses’ greater familiarity with the process may allow them to prolong the duration of arbitration.

In 2015, the New York Times conducted an investigation about forced arbitration clauses and class actions as no government agency tracks class actions. According to the article, of 1,179 class actions between 2010 and 2014 that companies sought to push into arbitration, judges ruled in the companies’ favor in four out of every five cases. Further, the New York Times found that, between 2010 and 2014, only 505 consumers went to arbitration over a dispute of $2,500 or less. Overall, consumers were not likely to go to arbitration if they were not able to participate in a class action or the amount of alleged damages was nominal.

Acknowledging the harm of forced arbitration clauses that prohibit class action suits, the federal Consumer Financial Protection Bureau issued the Arbitration Agreements Rule, which allowed consumers to bring class actions challenging abuses in the financial services sector. On November 1, 2017, however, President Trump signed a joint resolution passed by the U.S. Congress disapproving the Arbitration Agreements Rule under the Congressional Review Act. In response, a Model State Consumer and Employee Justice Enforcement Act has been developed.

The 2018 MFCPC report noted that the commission discussed whether to recommend that the State adopt NCLC’s Model State Act and in particular, Title I, allowing whistleblowers to bring qui tam actions on behalf of the State. In light of the broad array of consumer contracts that it might affect, however, the commission recommended that OAG and OCFR advise the General Assembly on the ramifications of adopting Title I of NCLC’s Model State Act.

State Revenues: The bill is expected to result in a significant influx of licensees required to register with OCFR. The impact of each provision of the bill affecting licensing revenues is discussed below. Exhibit 1 summarizes the revenue impact of the bill, with $3.1 million in new special fund revenues in fiscal 2020 and $1.4 million annually thereafter.

Maryland Credit Services Businesses Act Licensees

OCFR advises that it expects the number of credit services business licensees to increase by about 1,591 under the bill, based on data from the Motor Vehicle Administration (MVA). These businesses must obtain licensure on the bill’s October 1, 2019 effective date and renew the license prior to December 31, 2019. The licensing fee for a credit services business is $850; however, a portion of that fee – $100 – is paid to the Nationwide Multistate Licensing System and Registry. Therefore, Nondepository Special Fund licensing revenues increase by $2,386,500 in fiscal 2020. Licensees must also pay a $100 investigation fee, resulting in an additional $159,100 in fiscal 2020 only.

In total, special fund revenues increase by $2,545,600 in fiscal 2020 and by $1,193,250 annually thereafter, assuming the number of renewals remains constant in future years.

Maryland Money Transmission Act Licensees

OCFR expects about 18 additional money transmitter licensees based on similar changes to New York State law. Assuming these businesses obtain a license on the bill’s effective date and renew the license prior to December 31, 2019, Nondepository Special Fund licensing revenues increase by $72,000 in fiscal 2020. In addition, licensees pay a $1,000 investigation fee, resulting in an additional revenue increase of $18,000 in fiscal 2020.

In total, special fund revenues increase by $90,000 in fiscal 2020 and by $36,000 annually thereafter, assuming the number of renewals remains constant in future years.

Currency Exchange Licensees

OCFR notes that there are 146 fiat currency exchange entities operating in Maryland that are registered with the federal government. The number of virtual currency exchanges providing services to Maryland residents is unknown, however. Accordingly, OCFR expects at least 146 licensees to register under the bill’s currency exchange provisions. Licensees must register on the bill’s effective date and renew again prior to December 31. Therefore, in fiscal 2020, Nondepository Special Fund licensing revenues increase by $292,000. Licensees are also required to pay a $1,000 investigation fee, resulting in an additional $146,000 in fiscal 2020 only.

In total, special fund revenues increase by $438,000 in fiscal 2020 and by $146,000 annually thereafter, assuming the number of renewals remains constant in future years.

Mortgage Lender License Fees

While the bill authorizes OCFR to set application, license, and investigation fees for mortgage lenders based on the type and volume of activity conducted by the lender, OCFR advises that it is unable to estimate the potential impact of this provision on revenues, as it would likely need to engage stakeholders in order to understand whether a fee change is warranted and, if so, what type of change would be appropriate. The Department of Legislative Services advises that no material impact is expected from this provision of the bill, as OCFR would likely set fees in a manner that is revenue neutral.

Penalty Provisions

The bill’s penalty provisions – and the expansion of existing penalty provisions – are also expected to result in an increase in general fund revenues. However, any increase in general fund revenues is expected to be minimal.

State Expenditures: Because of the significant increase of licensees under the bill and the related licensing and enforcement activities, additional personnel are necessary to implement the bill’s requirements.

Special fund expenditures increase by $386,801 in fiscal 2020, which accounts for the bill’s October 1, 2019 effective date. This estimate reflects the cost of hiring four examiners and three licensing analysts. It includes salaries, fringe benefits, one-time start-up costs, and ongoing operating expenses.

Future year expenditures reflect full salaries with annual increases and employee turnover and ongoing operating expenses.

OAG advises that it can handle the bill’s requirements with existing resources, assuming a minimal number of additional complaints resulting from the bill.

Small Business Effect: Many of the business entities required to be licensed under the bill are likely small businesses. Such small businesses are subject to licensing and investigation fees as well as other regulatory requirements. The majority of additional licensees (about 1,591) expected to register with OCFR as a result of the bill are automobile dealers. These entities are currently required to be licensed by MVA pursuant to Title 15, Subtitle 3 of the Transportation Article. Therefore, to the extent any of those dealers are small businesses, the bill subjects those entities to licensing and regulatory requirements beyond those already required.

Other provisions of the bill also likely affect small businesses. Specifically, the bill’s requirements related to mobile home retailers establish prohibited activities and impose additional disclosure requirements. The bill’s expansion of MPIPA likely results in additional costs for small businesses that own, license, or maintain the personal information of Maryland residents. Such businesses may incur additional costs to comply with the bill’s requirements, particularly those relating to notifying consumers regarding data breaches.

Small business currency exchanges that do not comply with regulations are subject to lawsuits from aggrieved consumers, and small business entities that do not comply with data security requirements are exposed to lawsuits from aggrieved financial institutions under the bill.

Additional Information

Prior Introductions: None.

Cross File: SB 786 (Senator Rosapepe, et al.) - Finance.

Information Source(s): Office of the Attorney General (Consumer Protection Division); Judiciary (Administrative Office of the Courts); Department of Labor, Licensing, and Regulation; Maryland Department of Transportation; Maryland Insurance Administration; Maryland Financial Consumer Protection Commission; Center for Responsible Lending; Congress.gov; Consumer Financial Protection Bureau; Experian; National Automobile Dealers Association; National Consumer Law Center; New York Times; Uniform Law Commission; Department of Legislative Services

Fiscal Note History: First Reader - March 12, 2019 md/kdm

Disclaimer: The text of this law may not be the most recent version. We make no warranties or representations about the accuracy, completeness, or adequacy of the information contained on this site. Please check official sources.