A spokesperson for the Consumer Financial Protection Bureau has denied reports that the regulator has put a freeze on its probe into a data breach at Equifax Inc.
On Feb. 5, news agency Reuters reported that the CFPB's Equifax investigation was "on ice." Equifax disclosed a cybersecurity breach in September 2017 that could impact roughly 143 million U.S. customers. The Reuters article stated that the agency had not issued any subpoenas and had withdrawn plans to test the credit reporting agency's data protection methods.
But a CFPB spokesperson said in a written statement that the regulator's investigation was continuing. "As noted previously, the Bureau is looking into Equifax's data breach and response. Reports to the contrary are incorrect. The Bureau cannot comment further at this time," the spokesperson wrote in a statement emailed to S&P Global Market Intelligence. The statement also mentioned that the CFPB is authorized to take "supervisory and enforcement action against certain institutions engaged in unfair, deceptive, or abusive acts or practices, or that otherwise violate federal consumer financial laws."
It was not the first time officials disputed a Reuters article saying that the CFPB would lighten an enforcement action in a headline-grabbing scandal. In December 2017, Reuters reported that the CFPB was reviewing fines against Wells Fargo & Co. over its unauthorized accounts scandal. The next day, President Donald Trump tweeted that fines against the bank would not be decreased "as has incorrectly been reported."
A spokesperson for Equifax issued a statement suggesting that the CFPB probe was ongoing: "As previously disclosed, Equifax is cooperating with agencies that are investigating or otherwise seeking information about the cybersecurity incident, including the CFPB."
At the same time, many industry participants are reporting that the CFPB has taken a lighter touch since Trump appointed Mick Mulvaney acting director of the agency. Mulvaney, also director of the Office of Management and Budget, took over as the head of the CFPB after Richard Cordray resigned to run in Ohio's gubernatorial election. Severe enforcement actions declined in the 2017 fourth quarter, and lawyers are saying numerous enforcement matters have been put on hold. Laurence Platt, a partner with Mayer Brown's financial services practice, also said Feb. 5 that he has seen a drop-off in CFPB enforcement activity.
"In the matters we have [seen], there's not a lot happening right now," Platt said in an interview. "We have several matters, and there's not a lot of movement on those right now."
Platt said he suspects that former Director Cordray had pursued all enforcement actions that staff had suggested but that Acting Director Mulvaney is applying a more critical eye to staff recommendations. He said the CFPB is highly unlikely to pursue actions that break new ground, a practice known as "regulation by enforcement," for which industry groups had criticized Cordray. In a Jan. 23 internal memo, Mulvaney instructed staff that the agency had been too aggressive under Cordray's leadership.
"I think the political people are shadowing the enforcement people at every step," Platt said. "And one of the big criticisms of the CFPB was this notion of regulation by enforcement."
