US FTC Passes First Expanded Use of Gramm-Leach-Bliley Penalty Authority – Consumer Protection


To print this article, all you need to do is be registered or log in to

The result, for people in a hurry:

  • The U.S. Federal Trade Commission (FTC) has gotten creative since the Supreme Court ruled that the FTC cannot obtain monetary relief in relation to its primary UDAP, Section 5 of the FTC Act. . He announced a number of initiatives designed to revive the agency’s ability to force companies to pay money in enforcement actions, including ambitious regulations and reviving old FTC precedents.
  • At the start of the new year, the FTC scored its first success with a different, potentially much broader approach. In FTC advances against RCGthe FTC has settled allegations that a small business finance company and its executives violated Section 521(a) of the Gramm-Leach-Bliley Act.1 Originally understood to prohibit con artists from obtaining financial information under a false pretense, Section 521, as used by the FTC, implies a much broader theory – that the law is triggered by any misrepresentation during a transaction when a consumer presents payment information.
  • Because the FTC can punish early violations of this law with civil penalties and restitution, companies should carefully review the statements they make in any transaction where consumers provide financial information such as credit card numbers. or bank account.

The statute. Section 521 was enacted as part of the Gramm-Leach-Bliley Act of 1999. The relevant provision is titled “Prohibition of Obtaining Customer Information by False Pretenses” and prohibits, in its relevant part, ” any person to obtain or attempt to obtain, or cause or attempt to cause to be disclosed to any person, customer information of a financial institution relating to another person… by making any statement or representation false, fictitious or fraudulent to a customer of a financial institution.2 The legal definitions are common sense, with the key definition being “financial institution customer information” as “any information maintained by or for a financial institution that arises from the relationship between the financial institution and a customer of the financial institution and who is identified with the customer.3 Congress gave enforcement to the FTC and authorized the agency to seek civil penalties and restitution for aggrieved consumers.4 (The language executed it indirectly by referencing the Fair Debt Collection Practices Act, which allows the FTC to obtain these penalties.)

The “original meaning”. Congress and the FTC made it clear at the time that this law was intended to punish scammers who trick consumers into revealing their financial information. For example, the Conference Report explained that this provision was intended to prohibit anyone from “misrepresenting the identity of the person requesting the information or misleading an institution or client into inadvertently disclosing such information”.5 Similarly, the FTC in 2001 launched an enforcement campaign called “Operation Detect Pretext” against companies that posed as account holders to obtain bank account information.6

Fast forward to 2020; the RCG Case. The defendants in RCG offered small businesses financing known as a merchant cash advance, a loan product normally repaid in a few months via daily withdrawals from the business’s bank account. The case against the RCG defendants was the first of a pair of enforcement actions involving merchant cash advances – a product that then-commissioner Rohit Chopra called on staff to view with skepticism.

Filed in June 2020, the FTC’s original complaint alleged various unfair and deceptive practices. The complaint alleged that the defendants: (1) made a number of misrepresentations, including that the companies would receive a specific amount of funding without deduction of upfront costs; (2) sued the business owners for breach using judgment admissions where the companies had not breached the agreement; and (3) made withdrawals from corporate bank accounts without

Importantly, the FTC did not allege that the RCG the defendants had deceived consumers into giving financial information – the agency did not allege, for example, that the defendants were offering fictitious products or that the small businesses had not received funding at all. Equally important, the FTC only alleged violations of Section 5 of the FTC Act and sued in federal court under Section 13(b) of the Act (as opposed to one of the more specific statutes the FTC enforces), which allows federal courts to issue only a “permanent injunction.”8 But, consistent with decades of practice, the FTC also sought monetary relief needed to repair harmed consumers. The courts had upheld this approach, holding that, as a form of equitable relief, the power to grant an injunction also granted implied powers to redress the harm suffered by the consumer.

The Supreme Court throws a wrench into the FTC’s plans. In April 2021, the Supreme Court rendered a decision in AMG Financial Services v. FTC who reversed this decade-old practice. In a unanimous decision, the Court ruled that the FTC cannot obtain monetary relief in cases brought in federal court under its Section 13(b) powers to punish violations of the UDAP under of item 5.9 The ruling emphasized that the FTC could still get money from the companies through other avenues, but could not do so in federal court for a simple violation of Section 5. RCG the defendants seemed doomed.

The FTC is getting creative. In June 2021, the FTC responded with an amended complaint. He added an allegation of deception that mirrored the unauthorized withdrawal allegation: that the defendants misrepresented that they would withdraw a specified amount from consumers’ bank accounts. But the real news was an all-new count under GLB Section 521(a) — that defendants made this misrepresentation to obtain the companies’ bank account information needed to facilitate daily withdrawals under the GLB. funding agreement.ten

In particular, the FTC does not have alleging that the product was fake or fictitious or that customers had given their information “unknowingly” (in the words of Congress). Indeed, the FTC complaint makes it clear that providing this information is essential for small businesses to obtain financing in the first place.

None of the defendants moved to dismiss the amended complaint (the court had denied an earlier motion for summary dismissal), so the court did not have the opportunity to convey this strategy. But on January 5, 2022, a group of defendants agreed to settle the case and pay the FTC $675,000 specifically for alleged violations of Section 521.11

What does it mean? Since AMG decision, the FTC has been aggressive in trying to expand the number of ways it can force companies to pay money in its enforcement actions. After being successfully used here, an expansive 521 section is now firmly in the FTC’s toolbox. Its greater effect will depend on how the FTC chooses to deploy this weapon. In its broadest form, the FTC could decide to allege this violation whenever a company makes a false statement during a transaction, for example, when a consumer buys something with a credit card. Or its effect might be more limited if the FTC only employs it for the “worst of the worst” offenders or some other limiting principle. Either way, with this sweeping Section 521 theory, the FTC now has a potent weapon it intends to use against the companies in its crosshairs.

What should my business do? As part of their regular disclosure hygiene, companies should carefully review their statements to consumers in connection with any transaction where companies ask customers to disclose financial information. If your business operates differently than the disclosures suggest, your business could be liable not only for a costly FTC investigation, but also for civil penalties and restitution.

1 FTC, Merchant Cash Advance Providers Banned from Industry, Ordered to Redress Small Businesses (January 5, 2022), ordered by industry prohibited by advance providers; stipulated order, FTC vs. RCG Advances LLCno. 20-cv-4432-LAK (SDNY 5 January 2022).

2 15 USC § 6821(a)(2).

3 ID. § 6827.

4 ID. § 6822.

5H. Conf. Rep. 106-434, at 173 (2 November 1999).

6 FTC, As part of “Operation Detect Pretext” FTC Sues to Halt “Pretexting” (April 18, 2001), operation -detect-pretext-ftc-sues-halt-pretexting.

7 Compl. ¶¶ 33-44, FTC vs. RCG Advances, LLCno. 20-cv-4432 (SDNY 10 June 2020), available at

8 15 USC § 53(b).

9 AMG cap. Management. against FTC, 141 S.Ct. 1341 (2021).

10 FTC, FTC Files Amended Complaint Seeking Civil Sanalties Against Small Business Financing Providers (June 14, 2021), -of-complaint-civil-sanctions-against-small; 1st morning. Compl. ¶¶ 36(d), 48-54, FTC vs. RCG Advances, LLCno. 20-cv-4432 (SDNY 10 June 2021).

11 See above n.3.

Visit us at

Mayer Brown is a global provider of legal services comprised of law firms that are separate entities (the “Mayer Brown Firms”). The Mayer Brown firms are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, two limited liability companies established in Illinois in the United States; Mayer Brown International LLP, a limited company incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales under number OC 303359); Mayer Brown, a SELAS based in France; Mayer Brown JSM, a partnership of Hong Kong and its associated entities in Asia; and Tauil & Checker Advogados, a Brazilian legal partnership with which Mayer Brown is associated. “Mayer Brown” and the Mayer Brown logo are registered trademarks of Mayer Brown law firms in their respective jurisdictions.

© Copyright 2020. Mayer Brown Practices. All rights reserved.

This article by Mayer Brown provides information and commentary on interesting legal issues and developments. The foregoing is not a complete treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action regarding the matters discussed here.


About Author

Comments are closed.