What's actually happening at the CFPB?

Welcome to a special issue of Keeping Up with Compliance, LoanPro’s compliance newsletter. Instead of your regular digest of industry and regulatory news items, today we’re focusing on the Consumer Financial Protection Bureau and all the changes that have taken place over the last six months: A new executive, a new acting director, and a major change in course for the agency’s regulatory priorities.

And as always, you can subscribe to the newsletter on LinkedIn to make sure you don’t miss an issue.

---

The CFPB has been making a lot of headlines recently, at least if you’re reading the same fintech and compliance outlets that we subscribe to. New acting directors, reductions in force, rules being revoked or just deprioritized—it’s a lot to keep track of.

Depending on your political leanings and proclivity to panic, the shakeups at the CFPB is somewhere between a business-as-usual exercise of checks and balances at the federal level, or an unprecedented cataclysm that will leave consumer finance irrevocably altered. The truth is likely somewhere in between: These changes mark a significant cut to a federal agency that will have a noticeable impact on their enforcement efforts, but those efforts are already being taken up by private lawsuits and state regulators. And since these changes are largely being carried out by executive order, there’s nothing stopping the next pro-regulation presidential administration from reversing course.

And much like when the CFPB issued a new rule banning credit reporting on medical debt, there’s a lot of speculation being passed around as fact. Commentators on both sides of the aisle have been lamenting or rejoicing the fall of the CFPB, and then lamenting or rejoicing the lawsuits and injunctions that have slowed deregulation and downsizing at the agency.

Meanwhile, there’s been precious little practical information to help guide day-to-day decisions and long-term compliance strategy. In this article, we’ll dive into both the situation at the CFPB (and how it might evolve going forward) as well as the practical steps that your credit operation can take to keep up.

Who's driving this thing, anyway?

By this point, Russell Vought’s position as acting CFPB director is old news. (Scott Bessent briefly served in the position before Vought, and was the first to implement work halt orders. Jonathan McKernan then was nominated for the position, but the nomination was withdrawn when McKernan was selected to lead the Treasury.)

As of this writing, no one has been appointed as a full, not just ‘acting’ director, but that’s not necessarily unusual for the CFPB: Under the Biden administration, Dave Uejio served as acting director for 265 days, and Mick Mulvaney was acting director for over a year during the first Trump administration.

Rumors briefly circulated around fully dismantling the CFPB, perhaps aided by the image of an empty CFPB booth at Fintech Meetup. While there is a massive reduction in force in the works (more on that below), for the time being, federal law still requires the CFPB to exist and keep doing some core tasks.

Deregulation is the goal

Amid the changes, it's worth remembering that the deregulation shouldn’t be catching anyone by surprise—it was a major pillar of the Trump campaign, with a dedicated page on the White House’s website. Change was keenly anticipated by banks, credit unions, and other financial service providers. In Ron Shevlin’s excellent survey of the financial services landscape, What’s Going On in Banking 2025, we got these quotes from executives around the industry in the period between the election and inauguration:

• The change in administration is huge. Not only the hopeful lessening of regulations, but the attitude of the regulators that goes with that change. —CEO, $1.8 billion bank
• Would love to have a more capable regulatory agency and the CFPB to be eliminated. —CFO, $4.5 billion credit union
• I agree with Elon Musk: The CFPB needs to be deleted. The entire organization is a gross historical mistake. —CTO, $2.5 billion bank
• I’m optimistic that Trump will fire Rohit Chopra and put an end to the CFPB’s burdensome regulations. —CEO, $350 million credit union

But fast forward a few months, and the tenor of the conversation has shifted. We haven’t heard anyone in the industry pining for the good ol’ Chopra days, but there is growing confusion over which rules remain in place, which are being deprioritized, and whether any of these changes will stick beyond the next election cycle. Even as the financial services world contemplates how to win in a CFPB-free world, there’s still keen attention being paid to the risks.

New priorities

But what, you may be wondering, is the CFPB even doing if they’re rescinding all these rules and reducing their workforce? Well, their Chief Legal Officer, Mark Paoletta, was kind enough to tell us in a memo titled 2025 Supervision and Enforcement Priorities.

The memo listed five major priorities the bureau will pursue:

• Mortgages. Mortgages were ranked as the highest priority for enforcement, although several redlining cases have already been dismissed (see below).
• FCRA/Regulation V. Accurate credit reporting remains a priority.
• FDCPA/Regulation F. Debt collectors are still bound by the same rules.
• Various fraudulent overcharges, fees, etc. The phrasing here avoids the term ‘junk fees’, popularized during the Biden administration. Although that may be a distinction without a difference, it could also point toward pursuing fees that were not part of a TILA disclosure, and deprioritizing any rulemaking on late fees or overdraft fees.
• Inadequate consumer information protection. They further specified that they would be focused on data security issues that led to “actual loss to consumers”.

It also listed several deprioritized areas:

• Loans or other initiatives for “justice involved” individuals (criminals) [sic]. While the previous administration might have taken special interest in people facing incarceration, the Vought-led CFPB is just going to afford them the same protection as everyone else.
• Medical debt. Vought-CFPB has joined the chorus of industry groups asking federal judges to nullify the rule Chopra-CFPB created earlier this year.
• Peer-to-peer platforms and lending. Cash App and Zelle were both on the receiving end of CFPB enforcement actions last year; Zelle’s has already been dropped.
• Student loans. And just as collections resumed after a five year hiatus.
• Remittances. Remittances and funds transfers are handled under Regulation E, and were subject to some CFPB rulemaking last year.
• Consumer data. No further information is given here, which leads to some natural questions about how “consumer data” can be deprioritized but “inadequate controls to protect consumer information” remains a priority.
• Digital payments. It’s probably still a good idea to keep your payments secure, though.

Alan Kaplinsky, who acts as senior counsel at Ballard Spahr and has been covering the CFPB since its genesis in 2011, recently sat down for a two-part interview with former CFPB officials Eric Halperin and Craig Cowie, discussing the new priorities and other changes at the bureau. For a deeper exploration of the topic, we recommend listening to the interviews in full, but here are a few key quotes that put the new priorities in context.

Asked about priorities under previous directors, Cowie explained the importance of maintaining some enforcement efforts in deprioritized areas:

I will say, generally speaking, every regulator has to deal with the allocation of resources and prioritization. In other words, what are they going to choose to do? But from an academic perspective, it’s very important that regulators cover the entire gamut of their authorities, because otherwise you’re basically telling people that you’re not going to enforce in certain areas, and that encourages bad behavior.

Halperin then noted those efforts in previous administrations:

You can have priorities, but merely because something isn’t a priority doesn’t mean we didn’t bring enforcement actions on it. In fact, we brought quite a few enforcement actions from 2021 to 2025 on areas that would not be considered one of our enforcement priorities. So I think that’s a really important point as we discuss what may or may not be the new CFPB leadership’s enforcement priorities going forward.

All three compliance experts voiced some skepticism toward whether the bureau would be able to adequately pursue their prioritized areas given the roughly 90% reduction in force.

Dismissing enforcement lawsuits

To really hammer home the idea that they’re deprioritizing certain areas, the CFPB has dropped 22 of the 38 pending enforcement lawsuits that were carried over from Chopra and earlier directors. Yet in that same interview, Halperin and Cowie both pointed out examples of cases being dropped despite apparent alignment with the 2025 Supervision and Enforcement Priorities.

A case involving Zelle was dropped, which alleged hundreds of thousands of fraud complaints went unanswered. Other cases involving fraudulent fees were likewise dismissed. A case against Capital One was dropped, only to be immediately picked up by New York’s attorney general.

Other cases were dropped despite having their origins in Trump’s first administration. One case, nearly ready for trial, was initiated under Director Kathy Kraninger, who was appointed during Trump’s first term. Another against TransUnion was based on Kraninger’s findings and filed under Chopra. Another was filed under Kraninger’s predecessor, Richard Cordray.

The CFPB had also tried to reverse a consent order against Townstone Financial from last November, but was denied in court.

Reduction in force and budget cuts

One of the first changes to come out of the Vought-era CFPB was a massive reduction in force, cutting the total number of employees at the agency from roughly 1750 down to 250. The Office of Enforcement, which previously had over 250 employees, now has only 50. The Officer of Supervision was likewise cut down to 50 employees. The Office of Litigation was not affected as heavily, perhaps in anticipation of the legal challenges their deregulatory efforts are already facing in court.

For now, though, the reduction in force is temporarily on hold thanks to a lawsuit from the union representing the fired employees. That case has been beset at every side with appeals and injunctions, and is still being hashed out as of this writing.

Meanwhile, the CFPB lost one employee it had intended to keep: Cara Petersen, who resigned from her post as leading enforcement in reaction to the reduction in force and case dismissals. Petersen wrote in an open letter to her fellow CFPB employees that “I have served under every director and acting director in the bureau’s history and never before have I seen the ability to perform our core mission so under attack.”

How will changes at the CFPB affect your compliance strategy?

If you were hoping that this deregulatory momentum would mean taking it easy and giving your compliance officer a much needed vacation, think again.

There are two major areas to look out for: immediate policy reactions from state-level regulators, and long-term changes at the CFPB and other federal agencies.

State-level reactions

If you only ever had to worry about the CFPB, that would be one thing. But as the acting director directs the agency to back up, state agencies want to pick up the mantle and create new consumer protections within their borders. So far, this has mostly been carried out by left-leaning states; their rightward counterparts largely agree with the Trump administration’s assessment that financial services were overregulated in the first place.

• New York created new licensing requirements for BNPL providers, and several other consumer protections, and the comptroller directly cited the reduction in force at the CFPB as a cause for more aggressive state-level consumer protections.
• Maryland enacted new regulations on Earned Wage Access (EWA) products.
• Florida, meanwhile, has kept up the deregulatory momentum, passing a bill that allows debt collectors to send emails around the clock, reasoning that they’re less disruptive than a phone call and quite easy to mute.

This isn’t new, strictly speaking. California and other states have privacy laws on the books creating unique obligations for handling data, and Iowa has enough additional rules on the books that many credit providers just avoid the state entirely. State-level consumer protections aren’t new per se, but a sudden surge in state-level regulation would present a compliance challenge for any national credit providers.

What will future election cycles bring?

The 2028 election is too far out to speculate on, but ultimately, whether the next president is a Republican, Democrat, or Ross Perot reincarnate, what matters for the CPFB is that president’s stance on two questions:

1. Is the CFPB necessary to protect consumers?
2. If so, what should their regulatory priorities be, and what resources are necessary to meet them?

Regardless of how you feel about the CFPB, you can probably still imagine a world without them, as the agency only came into being in 2011. Before that, their regulatory niche was filled by several other agencies—the Federal Trade Commission, the Securities and Exchanges Commission, the Department of Housing and Urban Development (and its child agency, the Federal Housing Administration), the Federal Reserve, and the Department of Justice.

And while the CFPB did take over some responsibilities that these agencies previously managed, they didn’t consolidate that jurisdiction so much as create a new, overlapping one. One of the chief complaints levied against the CFPB in its fourteen years of rulemaking and enforcement has been that this shared authority is redundant at best, and at worst creates confusion or outright contradictions. Still, the CFPB’s actions have stopped fraudulent and deceptive practices, often returning money to affected consumers. It’s possible to imagine the CFPB’s responsibilities returned to other organizations or handled by private lawsuits, but it’s also possible to imagine a CFPB with clearer jurisdictional boundaries and better coordination with other state and federal agencies.

That brings us to the second question: If you do think the CFPB itself is vital for protecting consumers, what should their regulatory priorities be, and what resources are necessary to meet them? It’s a far more nuanced question, and one that a single article can’t answer; a series of congressional hearings might be the more appropriate venue.

Where will long-term clarity come from?

While the CFPB might continue this course for the duration of the Trump presidency and any like-minded successors, we can reasonably expect the next pro-regulatory administration to swing back in the other direction. There is a chance that the regulatory pendulum eventually settles at a happy medium, but it’s also possible that this pro-regulatory administration would strike back with a vengeance.

That’s part of the difficulty with this style of executive-led deregulation—the changes are only guaranteed as long as people with the same ideas are in office. Another president and CFPB director could reverse course just as easily, reprioritizing the areas the Vought-led CFPB isn’t focused on.

If you’re a credit provider, this puts you in a bit of a pickle. On the one hand, keeping up with rules that are explicitly not a priority sounds like an excellent way to waste your team’s time and fall behind your competitors. But on the other hand, ignoring those unenforced rules might leave you unprepared when they suddenly become the priority again under a new administration.

Congress could resolve this back and forth

Ultimately, the commerce clause vests financial regulations with Congress. Regulators like the CFPB only have rulemaking authority because Congress delegated it to them when they passed the CFPA.

The Supreme Court's decision in Loper Bright Enterprises v. Raimondo has only made this clearer. With the end of Chevron deference, regulators are no longer the judges in their own cases, and courts can't simply defer to an agency's interpretation just because a law is ambiguous. The onus is now on Congress to write clear laws—clear enough for consumers to understand their protections, for credit and financial services providers to understand their obligations, and for regulatory agencies to understand their mandate for enforcement.

Congressional action could provide clarity. For instance, Congress could pass laws on any number of contentious points that the Vought and Chopra CFPBs disagree on:

• They could pass an amendment to the CFPA that either reins in rulemaking scope or enumerates specific requirements more clearly.
• They could amend ECOA to clarify disparate impact requirements or carve out safe harbor rules.
• They could amend TILA to require more clarity on fee structures, and then clearly define what kind of fees are allowed and which are illegal.

Of course, passing federal legislation is difficult by constitutional design, requiring majorities in both houses and an amenable president to get anything through. It’s possible that lawmakers will see a need and reach across the aisle to pass those amendments, or that an electoral sweep gives one party control over Congress and the presidency. But barring those possibilities, federal legislation won’t happen.

State-by-state rulemakings solidify

While it might be a pain for any credit provider who operates across all fifty states, it’s very possible that the CFPB and other regulators stay the course while states adopt their own policies and consumer protections. The 2025 Supervision and Enforcement Priorities memo mentioned above includes several points on respecting Federalism, aiming to minimize overlap with state regulators and only participate where required by statute.

This policy is in line with the 10th amendment, allowing states to retain control over areas where the federal government lacks constitutional authority. And perhaps that’s just as well: the rapid back and forth between administrations might indicate that financial services are a controversial enough topic that we won’t get to a national consensus in the next election cycle.

If the direction at the CFPB continues, this is the path we’re heading towards. States like New York and Maryland don’t want to wait around for the CFPB to return to the Chopra era (as discussed above); they’re stepping up regulation and enforcement now.

In the long run, this could lead to states collaborating and developing a shared set of standards (similar to what we see in other areas regulated by state governments, like licensure requirements), easing the regulatory burden for credit providers. PCI compliance, for example, isn’t required by federal law, but a number of state laws reference or require it. Even then, it’s likely that we would still have a few states imposing additional protections that make it difficult for nationwide operations; many credit providers just don’t offer their products in Iowa because of the regulatory burden.

Your compliance strategy needs to be adaptive

If these changes have you rethinking your approach to compliance, reach out to us. We’d love to hear what concerns you have and where you’re looking to bolster your strategy, and offer insights into what’s working for other credit providers in your industry.