A settlement has been announced in the lawsuit filed by Benjamin Lawsky, the Superintendent of the New York Department of Financial Services, using his Dodd-Frank Section 1042 authority.  Section 1042 allows state attorneys general and regulators to bring civil actions for violations of Dodd-Frank’s prohibition of unfair, deceptive, or abusive acts or practices.  Mr. Lawsky’s lawsuit represented the first lawsuit by a state regulator using his Section 1042 authority. (We have also been following several lawsuits filed by state AGs using their Section 1042 authority.)

In his lawsuit, which was filed in a New York federal court against a large subprime auto lender and its CEO, Mr. Lawsky alleged that the lender had systematically concealed from its customers the fact that they had refundable positive credit balances and failed to make refunds except when expressly requested by a customer.  In addition, the complaint alleged that the lender submitted false unclaimed property reports to the New York State Comptroller’s Office denying that certain customers had positive credit balances. It also alleged that the lender lacked basic information security measures, thereby endangering the security of its customers’ personally identifiable information. The complaint also included the allegation that the lender had violated TILA by calculating interest based on a 360-day year and applying the resulting daily interest rate to its customers’ loan accounts each of the 365 days during the year. According to the complaint, this practice resulted in customers paying interest in excess of the disclosed APR.

In the consent judgment submitted to the court for approval, the defendants admit to violations of Dodd-Frank, TILA and New York law.  The consent judgment requires the defendants to pay a $3 million civil penalty, refund all positive credit balances and interest charged in excess of the disclosed APR, plus nine percent interest on such amounts.  Following the sale of the lender’s remaining loan portfolio by the receiver appointed by the district court, the consent judgment requires the lender to surrender its licenses in all states.  If a customer is found by the DFS to have suffered identity theft within two years of the consent judgment that is traceable to the lender’s conduct, the consent judgment requires the individual defendant to pay such customer any damages resulting from the identity theft and provide free credit reporting to such customer for two years.