US FTC Succeeds in First Expanded Use of Gramm-Leach-Bliley Penalty Authority

The upshot, for busy people:

• The US Federal Trade Commission (FTC) has gotten creative since the Supreme Court held that the FTC cannot obtain monetary relief in connection with its principal UDAP statute, Section 5 of the FTC Act. It has announced a number of initiatives designed to revive the agency’s ability to force companies to pay money in enforcement actions, including ambitious rulemakings and reviving old FTC precedents.
• Just into the new year, the FTC notched its first success on a different, potentially much broader, approach. In FTC v. RCG Advances, the FTC settled allegations that a small-business financing firm and its principals violated Section 521(a) of the Gramm-Leach-Bliley Act.¹ Originally understood to prohibit scammers from obtaining financial information under a false pretext, Section 521, as used by the FTC, implicates a much broader theory—that the statute is triggered by any misrepresentation in the course of a transaction where a consumer presents payment information.
• Given that the FTC can punish first-time violations of this statute with civil penalties and restitution, businesses should carefully scrutinize the representations that they make in any transaction where consumers provide financial information such as credit card or bank account numbers.

The statute. Section 521 was passed as part of 1999’s Gramm-Leach-Bliley Act. The relevant provision is titled “Prohibition on Obtaining Customer Information by False Pretenses” and prohibits, in relevant part, “any person to obtain or attempt to obtain, or cause to be disclosed or attempt to cause to be disclosed to any person, customer information of a financial institution relating to another person … by making a false, fictitious, or fraudulent statement or representation to a customer of a financial institution.”² The statutory definitions are commonsensical, the key definition being that of “customer information of a financial institution” as “any information maintained by or for a financial institution which is derived from the relationship between the financial institution and a customer of the financial institution and is identified with the customer.”³ Congress assigned enforcement to the FTC and authorized the agency to obtain civil penalties and restitution for injured consumers.⁴ (The language performed this indirectly by reference to the Fair Debt Collection Practices Act, which allows the FTC to obtain those penalties.)

The “Original Meaning.” Both Congress and the FTC made clear at the time that this statute was intended to punish scammers who trick consumers into revealing their financial information. For example, the Conference Report explained that this provision was intended to prohibit someone from “misrepresenting the identity of the person requesting the information or otherwise misleading an institution or customer into making unwitting disclosures of such information.”⁵ Similarly, the FTC in 2001 launched an enforcement sweep called “Operation Detect Pretext” against companies that posed as account holders to obtain account information from banks.⁶

Fast-forward to 2020; the RCG case. The defendants in RCG offered small business financing known as a merchant-cash-advance, a lending product normally paid off in a matter of months via daily debits from the business’s bank account. The case against the RCG defendants was the first in a pair of enforcement actions involving merchant cash advances—a product that then-Commissioner Rohit Chopra called on staff to view skeptically.

Filed in June 2020, the FTC’s initial complaint alleged a variety of unfair and deceptive practices. The complaint alleged that the defendants: (1) made a number of misrepresentations, including that businesses would receive a specific amount of financing without upfront costs deducted; (2) sued business owners for default using confessions of judgment where businesses had not breached the agreement; and (3) made withdrawals from the businesses’ bank accounts without authorization.⁷

Importantly, the FTC did not allege that the RCG defendants had tricked consumers into giving financial information—the agency did not allege, for example, that the defendants offered sham products or that the small businesses failed to receive funding at all. Equally important, the FTC alleged only violations of Section 5 of the FTC Act and filed the suit in federal court under Section 13(b) of the Act (as opposed to one of the more specific statutes the FTC enforces), which authorizes federal courts to issue only a “permanent injunction.”⁸ But, consistent with decades of practice, the FTC also sought monetary relief necessary to redress injured consumers. Courts had upheld this approach, reasoning that, as a form of equitable relief, the power to grant an injunction also granted implied powers to redress consumer injury.

The Supreme Court throws a wrench in the FTC’s plans. In April 2021, the Supreme Court issued a decision in AMG Financial Services v. FTC that overturned this decade-long practice. In a unanimous decision, the Court held that the FTC cannot obtain monetary relief in cases brought in federal court under its Section 13(b) powers to punish UDAP violations under Section 5.⁹ The decision emphasized that the FTC still could obtain money from companies through other avenues but that it could not do so in federal court for a bare violation of Section 5. The case for monetary relief against the RCG defendants seemed doomed.

The FTC gets creative. In June 2021, the FTC responded with an amended complaint. It added a deception allegation that mirrored the unauthorized withdrawal allegation: that the defendants deceptively represented that they would withdraw a specified amount from consumers’ bank accounts. But the real news was a brand-new count under GLB Section 521(a)—that the defendants made that misrepresentation to obtain the businesses’ bank account information necessary to facilitate the daily withdrawals under the financing agreement.¹⁰

Notably, the FTC did not allege that the product was false or fictitious or that the customers had given their information away “unwittingly” (in Congress’s words). Indeed, the FTC’s complaint makes clear that providing this information is essential for the small businesses to obtain funding in the first place.

None of the defendants moved to dismiss the amended complaint (the court had dismissed an earlier motion to dismiss summarily), so the court did not have an opportunity to pass on this strategy. But on January 5, 2022, one set of defendants agreed to settle the case and pay the FTC $675,000 specifically for the alleged Section 521 violations.¹¹

What does this mean? Since the AMG decision, the FTC has been aggressive in trying to expand the number of ways it can force companies to pay money in its enforcement actions. Having been successfully used here, an expansive Section 521 is now firmly in the FTC toolkit. Its larger effect will depend on how the FTC will choose to deploy this weapon. At its broadest, the FTC could decide to allege this violation any time a company makes a misrepresentation during a transaction—for example, when a consumer purchases something with a credit card. Or its effect could be more limited if the FTC employs this only for the “worst of the worst” offenders or some other limiting principle. Either way, with this expansive Section 521 theory, the FTC now has a potent weapon that it intends to use on businesses in its crosshairs.

What should my business do? As part of their regular disclosure hygiene, businesses should carefully scrutinize their representations to consumers in connection with any transaction where businesses ask customers to disclose financial information. If your business operates differently than the way the disclosures suggest, your company might be on the hook for not only a costly FTC investigation but also civil penalties and restitution. 

¹ FTC, Merchant Cash Advance Providers Banned from Industry, Ordered to Redress Small Businesses (Jan. 5, 2022), https://www.ftc.gov/news-events/press-releases/2022/01/merchant-cash-advance-providers-banned-industry-ordered-redress; Stipulated Order, FTC v. RCG Advances LLC, No. 20-cv-4432-LAK (S.D.N.Y. Jan. 5, 2022).

² 15 U.S.C. § 6821(a)(2).

³ Id. § 6827.

⁴ Id. § 6822.

⁵ H. Conf. Rep. 106-434, at 173 (Nov. 2, 1999).

⁶ FTC, As Part of “Operation Detect Pretext” FTC Sues to Halt “Pretexting” (Apr. 18, 2001), https://www.ftc.gov/news-events/press-releases/2001/04/part-operation-detect-pretext-ftc-sues-halt-pretexting.

⁷ Compl. ¶¶ 33-44, FTC v. RCG Advances, LLC, No. 20-cv-4432 (S.D.N.Y. June 10, 2020), available at https://www.ftc.gov/system/files/documents/cases/192_3252_rcg_advances_-_complaint.pdf.

⁸ 15 U.S.C. § 53(b).

⁹ AMG Cap. Mgmt. v. FTC, 141 S. Ct. 1341 (2021).

¹⁰ FTC, FTC Files Amended Complaint Seeking Civil Penalties Against Small Business Financing Providers (June 14, 2021), https://www.ftc.gov/news-events/press-releases/2021/06/ftc-files-amended-complaint-seeking-civil-penalties-against-small; 1st Am. Compl. ¶¶ 36(d), 48-54, FTC v. RCG Advances, LLC, No. 20-cv-4432 (S.D.N.Y. June 10, 2021).

¹¹ See supra n.3.