CFPB Regulatory Updates

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2026-08-14

The CFPB announced and implemented the cessation of discretionary publication of complaint narratives and associated visualizations in the Consumer Complaint Database; previously published narratives remain subject to proactive FOIA Reading Room disclosure.

Suggested considerations

• Compliance teams may wish to continue treating CFPB complaints as supervisory and potential enforcement inputs, notwithstanding the removal of narratives from the public database.
• Firms should consider maintaining controls that support complete, accurate, and timely responses to CFPB complaints, including documented investigation, escalation, remediation, and quality-assurance procedures.
• Complaint-management owners may wish to monitor whether the removal of public narratives affects internal trend analysis and should preserve their own historical complaint records and supporting evidence.
• Legal and regulatory affairs teams should consider reviewing previously published complaint narratives concerning the firm in the CFPB FOIA Reading Room and assessing whether existing disclosure, litigation, reputation, and remediation processes remain appropriate.
• Firms should consider retaining evidence supporting complaint responses because complaint information may continue to be shared with prudential regulators, the FTC, and federal or state agencies, and may remain accessible through FOIA.
• Management may wish to avoid interpreting the change as a basis for reducing complaint-governance staffing, monitoring, root-cause analysis, or board and senior-management reporting.

What changed

The CFPB will no longer publish consumer-submitted complaint narratives or related data visualizations in the Consumer Complaint Database. The Bureau characterizes publication of these materials as discretionary rather than statutorily required and states that the materials are unverified, potentially misleading, and not necessarily evidence of legal violations.

Key dates

2026-06-25

The joint final rule was issued and published in the Federal Register as 91 FR 38246.

2026-10-01

The joint final rule becomes effective. Its standards become available for consideration in later agency-specific reporting requirements, but existing reporting requirements do not change solely because of this effective date.

Suggested considerations

• Compliance teams may wish to inventory all regulatory data collections submitted to the CFPB, SEC, CFTC, Federal Reserve, OCC, FDIC, NCUA, FHFA, or Treasury and identify the systems, vendors, data owners, and filing processes supporting each collection.
• Firms should consider assessing whether legal entities in their reporting perimeter already have active ISO 17442 LEIs, while recognizing that the joint rule does not presently impose an LEI-obtaining or renewal requirement.
• Data-governance teams may wish to map current entity, product, instrument, location, date, and currency fields to the joint standards and document data lineage, semantic definitions, validation controls, and taxonomy dependencies.
• Technology and regulatory-reporting teams should consider evaluating whether reporting platforms can produce machine-readable data and accommodate future agency-specific identifier, schema, taxonomy, or transmission requirements without duplicative migrations.
• Firms with SEC or MSRB reporting exposure may wish to monitor the SEC's agency-specific implementation and assess the potential effect on municipal securities data, including whether CUSIP remains acceptable.
• Compliance teams may wish to monitor each covered agency's rulemakings and other implementation actions rather than treating October 1, 2026 as a deadline to change all existing regulatory filings.

What changed

The final rule establishes common identifiers and technical conventions for certain regulatory data collections, including ISO 17442 as the common Legal Entity Identifier standard, identifiers for products or financial instruments, dates, geographic locations, states, countries, and currencies. It also establishes a principles-based standard for data transmission and schema and taxonomy formats, requiring data to be machine-readable, semantically defined, consistently identified in accordance with the applicable regulatory requirement, and based on nonproprietary or openly licensed standards...

Key dates

2026-06-24

CFPB published the announcement describing the consumer complaint portal reforms.

Suggested considerations

• Compliance teams may wish to obtain and operationalize the revised CFPB Company Portal Manual, mapping each substantive and administrative response category to documented decision criteria and approval controls.
• Nationwide consumer reporting agencies and other portal participants should consider testing whether complaint response coding is applied consistently across business units, products, and servicing locations, particularly for non-monetary relief and administrative returns.
• Firms should consider retaining evidence of the identity, authority, and relationship of any third party submitting or assisting with a complaint, while ensuring those controls do not improperly prevent authorized representatives from obtaining assistance.
• CRAs should consider enhancing intake and case-management fields to identify the consumer's prior direct FCRA dispute, the relevant dispute date, information disputed, investigation outcome, and supporting documentation.
• Compliance teams may wish to distinguish CFPB portal handling from the underlying duties in FCRA sections 611 and 623, including the reasonable-investigation and reinvestigation obligations that may arise after a consumer dispute is properly received.
• Companies should consider monitoring portal communications and API-related implementation materials for additional CFPB specifications concerning address validation, data exchange, administrative response categories, and apparent abuse.
• Complaint-management governance should consider the CFPB's 30-calendar-day operational backlog definition for internal escalation and management information, while avoiding the assumption that the definition changes a statutory response deadline.
• Credit repair and consumer-assistance businesses should review whether their complaint-submission practices accurately identify third-party involvement and avoid automated, duplicative, or unsupported disputes that could be treated as process abuse.

What changed

The CFPB issued a revised Company Portal Manual clarifying the use of substantive and administrative closure categories, including the category "Closed with non-monetary relief," to improve consistency across companies and CRAs. The portal now requires users creating online accounts to verify both an email address and mobile phone number through two-factor authentication, adds relationship categories and clarifying text requiring third parties to disclose their involvement, and is expected to add address validation at complaint submission.

Key dates

2023-10-12

CFPB and DOJ issued the joint statement concerning fair lending and credit opportunities for noncitizen borrowers; it was published in the Federal Register on October 18, 2023.

2026-01-12

CFPB and DOJ withdrew the October 2023 joint statement. The withdrawal was published at 91 FR 1138 and became effective on this date.

Suggested considerations

• Compliance teams may wish to identify underwriting, eligibility, pricing, servicing, and adverse-action processes that reference immigration, citizenship, visa, residency, or work-authorization status.
• Firms should consider documenting the legitimate credit, repayment-risk, creditor-rights, remedies, or legal-compliance rationale for collecting or using immigration-related information, rather than treating the withdrawal as an unrestricted authorization to use the information for any purpose.
• Firms may wish to reassess policies adopted in response to the 2023 joint statement, while preserving controls designed to prevent intentional discrimination or unjustified disparate treatment based on race, color, religion, national origin, sex, marital status, or age.
• Compliance teams may wish to test whether immigration-related variables or proxies produce inconsistent eligibility, pricing, or servicing outcomes across protected groups and whether decisioning documentation supports the stated legitimate purpose.
• Firms should consider retaining existing fair-lending governance, adverse-action notice, data-quality, model-risk, and complaint-monitoring controls because the withdrawal does not amend ECOA or Regulation B or eliminate consumer rights.
• California creditors and other firms operating under state or local fair-lending laws may wish to separately assess obligations that are not displaced by the federal withdrawal, including potentially broader state civil-rights protections.

What changed

The nonbinding October 2023 joint statement is withdrawn effective January 12, 2026; no new statutory or regulatory obligation, safe harbor, or mandatory underwriting standard is created. The agencies state that creditors may consider immigration or citizenship status, including when assessing creditworthiness, financial risk, creditor rights and remedies regarding repayment, or compliance with other laws.

Key dates

2025-12-15

The CFPB and Federal Reserve announced and issued the final threshold amendments based on the 2.1% CPI-W increase as of June 1, 2025.

2026-01-01

The $73,400 Regulation Z and Regulation M thresholds became effective.

2026-12-31

The stated $73,400 thresholds apply through the end of the 2026 calendar year, subject to the applicable transaction-date rules.

Suggested considerations

• Compliance teams may wish to update underwriting, product-classification, and regulatory-coverage logic so that transactions of $73,400 or less are treated as within the applicable Regulation Z or Regulation M framework for the relevant 2026 transaction date.
• Firms should consider reviewing transaction-value calculations, including the total contractual obligation for consumer leases, to confirm that threshold determinations are made using the applicable regulatory definitions and the amount in effect at consummation.
• Lenders and lessors may wish to test disclosures, notices, document generation, and exception handling for transactions close to $73,400, including boundary cases and rounding controls.
• Compliance teams should consider retaining the prior $71,900 threshold for transactions governed by the 2025 threshold and applying $73,400 only to transactions covered by the 2026 period.
• Mortgage and private education lending teams should consider confirming that their systems do not incorrectly treat the $73,400 threshold as an exemption, because those Regulation Z categories remain covered regardless of loan amount.
• Firms may wish to document the annual CPI-W-based threshold change in regulatory inventories, procedures, monitoring scripts, and quality-assurance testing. Independent commentary from Sheppard Mullin characterized the change as an inflation-driven update to the exemption amount rather than a substantive change to TILA or CLA coverage, which supports focusing implementation on system and classification controls.

What changed

Effective January 1, 2026, the Regulation Z exemption threshold under 12 CFR 1026.3(b) and the Regulation M exemption threshold under 12 CFR 1013.2(e) increased to $73,400 from $71,900. The adjustment is based on the annual percentage increase in CPI-W as of June 1, 2025, reported as 2.1%, and is reflected in Regulation Z comment 3(b)-3.xvii and Regulation M comment 2(e)-11.xvii. Regulation Z and Regulation M generally apply to covered consumer credit transactions and consumer leases at or below $73,400; transactions above that amount are generally outside the relevant coverage.

Key dates

2025-11-21

CFPB announced the Humility in Supervision Pledge and stated that examiners would read it to supervised entities at the beginning of examinations.

2026-01-01

The pledge applies to the CFPB’s 2026 examination cycle, including the announced focus on priority markets, tangible and identifiable consumer harm, and narrower examination scopes.

Suggested considerations

• Compliance teams may wish to map their 2026 CFPB examination readiness materials to clearly identified products, statutory and regulatory requirements, and documented consumer-harm risks, with particular attention to servicemembers, veterans, and their families.
• Firms should consider maintaining a concise examination scoping pack that identifies relevant business lines, applicable federal consumer financial laws, prior findings, consumer-impact metrics, and information that can be produced without unnecessary overcollection.
• Supervised entities may wish to designate personnel to validate the scope and priority areas when advance examination notice is received and to document any requests that appear unrelated to the stated scope.
• Firms should consider preserving written records of discussions concerning supplemental information requests, scope changes, Matters Requiring Attention, and any proposed self-reporting or supervisory remediation.
• Compliance teams may wish to continue preparing for enforcement-quality examinations because the pledge does not limit the CFPB’s statutory authority or eliminate potential liability for violations, consumer harm, disclosure failures, or unfair, deceptive, or abusive acts or practices.
• Entities experiencing examination activity inconsistent with the pledge may consider escalating the matter through CFPB supervisory channels, while avoiding reliance on the pledge as a defense against substantive compliance deficiencies.

What changed

The CFPB stated that 2026 examinations will focus on pressing consumer threats, particularly issues affecting service members, their families, and veterans, and matters within the Bureau’s statutory authority. The Bureau will seek to avoid duplicative supervision where states or other regulators are already performing substantially the same work. Supervised entities are expected to receive advance notice of scheduled examinations, clearer expectations, and requests limited to the defined scope and identified priorities.

Key dates

2016-10-03

Beginning of the period for which the CFPB alleged FirstCash made MLA-covered pawn loans exceeding the 36% cap and used noncompliant agreements and disclosures.

2021-11-12

The CFPB filed its lawsuit against FirstCash, Inc. and 19 subsidiaries alleging Military Lending Act violations.

2025-07-11

The parties filed the stipulated final judgment and proposed order, and the court entered the judgment resolving the lawsuit; the order imposed $5 million in redress, a $4 million civil penalty, and prospective MLA compliance requirements.

2025-07-22

The CFPB terminated the 2013 Cash America consent order after determining that the predecessor had fulfilled its obligations, including paying a $5 million penalty and providing consumer redress.

Suggested considerations

• Compliance teams at creditors offering potentially MLA-covered consumer credit should consider mapping every product, including pawn loans, against the definition of consumer credit and testing whether fees and charges are included in the 36% Military Annual Percentage Rate calculation under 32 C.F.R. § 232.3(i).
• Firms should consider implementing documented procedures to determine covered-borrower status before or at account opening, using the Department of Defense database or another permitted method under the safe harbor in 32 C.F.R. § 232.5(b), and retaining the required evidence and timing records.
• Legal and product teams may wish to review loan agreements, disclosures, and servicing scripts for mandatory arbitration provisions and for all MLA disclosures required by 32 C.F.R. § 232.6, including the applicable payment-obligation and covered-borrower notices.
• Affected lenders should consider identifying loans made to servicemembers and covered dependents from October 3, 2016 onward, assessing potential MAPR, disclosure, and arbitration exposure, and evaluating remediation where historical controls were inadequate.
• Governance functions may wish to assign ownership for MLA compliance across underwriting, point-of-sale systems, branch operations, vendor management, complaint handling, and internal testing, with escalation for products that cannot reliably screen covered borrowers.
• Firms should consider reviewing the judgment and any applicable CFPB redress procedures before calculating restitution, and should avoid treating the termination of the predecessor’s 2013 consent order as relief from the separate FirstCash obligations.

What changed

The July 11, 2025 stipulated final judgment, entered by the court the same day, requires FirstCash and its subsidiaries to set aside $5 million to provide full redress in connection with thousands of unlawful pawn loans and pay $4 million to the CFPB victims relief fund. Going forward, the defendants must comply with the Military Lending Act, 10 U.S.C. § 987, and its implementing regulation, 32 C.F.R. part 232, including the 36% MAPR limit, the prohibition on mandatory arbitration, and required disclosures.

Key dates

2025-01-30

The CFPB issued the original Wise consent order, requiring approximately $450,000 in consumer redress and a $2.025 million civil money penalty.

2025-04-17

The CFPB published the rescission of Consumer Financial Protection Circular 2024-02 at 89 FR 27357; the rescission was later identified as relevant to the revised Wise penalty.

2025-05-15

The CFPB and Wise entered the Amended Consent Order, which superseded the January order and reduced the civil money penalty to $44,955.

2025-05-25 Deadline

Wise was required to reserve or deposit $449,550.99 in a segregated account within 10 days of the Amended Consent Order’s effective date, assuming the order became effective on May 15, 2025.

2025-07-14 Deadline

Wise was required to create and implement its comprehensive compliance plan within 60 days of the Amended Consent Order’s effective date, assuming an effective date of May 15, 2025.

Suggested considerations

• Firms should consider mapping each remittance-transfer customer journey to the applicable Regulation E disclosure, receipt, cancellation, refund, error-notice and error-resolution requirements, including transfers funded from prepaid accounts or foreign bank accounts.
• Compliance teams may wish to test whether advertisements and product interfaces accurately state ATM fees, transfer fees, exchange rates, recipient amounts and other costs for the relevant U.S. customer population, rather than relying on global or non-U.S. customer data.
• Firms should consider validating that exchange rates are disclosed using the required Exchange Rate terminology, rounded consistently to no fewer than two and no more than four decimal places, and accompanied by the required date-of-availability information.
• Compliance teams may wish to review controls for delayed or unavailable transfers to ensure remittance fees are refunded within the applicable Regulation E timeframe and that notices of error are investigated, resolved and documented appropriately.
• Firms should consider reviewing change-in-terms notices, foreign-language receipts, combined disclosures, record-retention controls and written policies and procedures for prepaid accounts and remittance transfers.
• Boards and senior management of covered payment providers may wish to receive documented reporting on material Regulation E deficiencies, consumer-redress calculations, remediation progress and testing results.
• Firms should distinguish the rescinded Circular 2024-02 from the underlying binding requirements of the EFTA, Regulation E, the Prepaid Rule and the CFPA, and should avoid treating the penalty reduction as a relaxation of disclosure or refund obligations.

What changed

The May 15, 2025 Amended Consent Order supersedes the January order. Wise must reserve or deposit $449,550.99 in a segregated account for affected-consumer redress, subject to the order’s treatment of qualifying prior payments, and must pay a $44,955 civil money penalty under 12 U.S.C. § 5565(c)(4), rather than the prior $2.025 million penalty. Wise must create and implement a comprehensive compliance plan within 60 days of the order’s effective date, covering its remittance-transfer and prepaid-account services, applicable federal consumer financial law, and the order’s requirements.

Key dates

2024-05-31

The CFPB published Use of Digital User Accounts to Access Buy Now, Pay Later Loans at 89 Fed. Reg. 47,068, treating covered BNPL lenders as card issuers under Regulation Z.

2025-05-06

The CFPB announced that it would not prioritize enforcement actions based on the BNPL interpretive rule and was contemplating rescission.

2025-05-12

The CFPB subsequently withdrew the 2024 BNPL interpretive rule as part of its withdrawal of guidance documents.

Suggested considerations

• Compliance teams may wish to document the distinction between the CFPB's enforcement-priority statement and a formal repeal, noting that the announcement itself did not provide a safe harbor from the Truth in Lending Act, Regulation Z, UDAAP, Fair Credit Reporting Act, or applicable state law.
• BNPL providers should consider preserving existing Regulation Z implementation records, including disclosures, account statements, dispute and error-resolution procedures, refund processes, complaint files, and change-management documentation, because the CFPB's announcement did not authorize retrospective noncompliance and future policy could change.
• Firms may wish to verify the current status of the 2024 interpretive rule and monitor CFPB Federal Register notices, supervisory publications, litigation developments, and any replacement rule or guidance.
• Product and legal teams should consider reassessing whether each BNPL product is subject to Regulation Z based on its structure and applicable statutory provisions, rather than relying solely on the withdrawn interpretive rule.
• Compliance teams may wish to continue testing disclosures, payment schedules, fees, refund handling, billing-error response, complaint management, and marketing for compliance with remaining federal and state requirements.
• Multi-state providers should consider separately reviewing state licensing, rate, fee, disclosure, dispute-resolution, privacy, and unfair-practices requirements; independent commentary specifically identified New York legislation imposing BNPL licensing and supervision requirements, a 16 percent interest cap, fee restrictions, and additional consumer safeguards.
• Firms may wish to maintain contingency plans that allow rapid restoration or modification of credit-card-style Regulation Z controls if federal enforcement priorities or the legal status of BNPL products changes.

What changed

The CFPB stated that enforcement actions based on Use of Digital User Accounts to Access Buy Now, Pay Later Loans, 89 Fed. Reg. 47,068 (May 31, 2024), would not be a priority. The Bureau said it would redirect enforcement and supervision resources toward pressing consumer threats, particularly those involving servicemembers, veterans, taxpayers, and small businesses. The Bureau also said it was contemplating appropriate action to rescind the interpretive rule; subsequent CFPB materials identified the rule as withdrawn on 2025-05-12.

Key dates

2025-02-07

The Fifth Circuit stayed the Section 1071 rule pending appeal in Texas Bankers Association v. CFPB and tolled compliance deadlines only for the case’s plaintiffs and intervenors, subject to further court modification.

2025-04-30

The CFPB published the policy statement announcing that it would not prioritize enforcement or supervision against entities outside the Fifth Circuit stay.

2025-05-12

The CFPB withdrew the policy statement as part of its broader withdrawal of policy statements, interpretive rules, advisory opinions, and other guidance.

2025-06-18

The CFPB issued an interim final rule extending Section 1071 compliance dates for all regulated entities by approximately one year; the earliest revised date for the highest-volume tier was July 1, 2026.

2026-05-01

The CFPB issued a final reconsideration rule revising Regulation B subpart B and extending the revised framework’s general compliance date to January 1, 2028.

Suggested considerations

• Compliance teams may wish to avoid treating the 2025-04-30 announcement as a formal repeal, exemption, or safe harbor, and should document the distinction between enforcement prioritization and continuing statutory or regulatory obligations.
• Covered lenders should consider preserving existing Section 1071 governance, data mapping, recordkeeping, and implementation work where proportionate, while assessing whether the 2026 final reconsideration rule changes the applicable scope, data points, procedures, or implementation timetable.
• Firms should consider identifying whether they are plaintiffs, intervenors, or members of an association covered by the Texas Bankers Association stay, because the original court order did not apply uniformly to all covered institutions.
• Compliance teams may wish to monitor the CFPB’s Section 1071 rulemaking, the status of Texas Bankers Association v. CFPB, and subsequent Federal Register amendments rather than relying on the withdrawn policy statement as current guidance.
• Lenders should consider retaining an audit trail for any decision to pause, scale, or continue implementation, including legal analysis of the applicable rule version, court orders, CFPB amendments, and operational or fair-lending risks.
• Covered institutions may wish to assess whether existing small-business application and demographic-data processes could support future reporting, because the CFPB’s enforcement posture did not eliminate potential litigation, examination, state-law, fair-lending, or reputational exposure.

What changed

The CFPB stated that it would deprioritize enforcement and supervision of the Small Business Lending Rule against entities not covered by the court-ordered stay, citing limited resources and the perceived unfairness of treating similarly situated institutions differently. The statement did not create a formal exemption, alter Regulation B, remove Section 1071 data-collection and reporting obligations, or expand the Fifth Circuit’s stay, which initially tolled compliance dates only for the plaintiffs and intervenors in Texas Bankers Association v. CFPB.

Key dates

2024-07-08

The final rule was published at 89 Fed. Reg. 56028.

2024-09-16

The final rule became effective.

2025-01-14 Deadline

Initial implementation deadline for larger participant CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(1).

2025-04-11

The CFPB announced its policy of not prioritizing enforcement or supervision actions for failures to meet future registration deadlines under 12 CFR part 1092.

2025-04-14 Deadline

Implementation registration deadline for other CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(2).

2025-07-14 Deadline

Implementation registration deadline for all other covered nonbanks under 12 CFR 1092.206(a)(3).

Suggested considerations

• Compliance teams may wish to document whether the entity is a covered nonbank and whether any agency or court order meets the covered-order criteria in 12 CFR 1092.201, including the requirement that the order be a final public order identifying the entity and imposing obligations based in whole or in part on specified consumer-law or UDAAP violations.
• Firms should consider preserving an inventory of potentially covered orders, registration data, and supporting legal analyses even if they elect not to file while the CFPB's prioritization policy remains in effect.
• Covered entities may wish to assess whether filing by the applicable date remains preferable for licensing, supervisory, litigation, diligence, or reputational reasons, rather than treating the announcement as a definitive exemption.
• Compliance teams should monitor for a proposed rulemaking, final rule, formal withdrawal, or further CFPB communication that changes the status or scope of 12 CFR part 1092.
• CFPB-supervised registered entities should continue evaluating the separate annual written-statement requirements in 12 CFR 1092.204 and should not assume that the announcement eliminates obligations other than the future registration-deadline enforcement priority described.
• Firms may wish to record the policy statement as an enforcement-risk and resource-allocation development, not as a statutory safe harbor against other CFPB, state, or private-party consequences for underlying consumer-law violations.

What changed

The CFPB stated that it will not prioritize enforcement or supervision actions concerning failures to submit registration information by future deadlines under the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders, codified at 12 CFR part 1092. The stated policy covers, among other entities, nonbanks subject to the implementation deadlines in 12 CFR 1092.206(a)(2) and 12 CFR 1092.206(a)(3). The CFPB will instead focus enforcement and supervision resources on pressing threats to consumers.

Key dates

2025-03-28

The CFPB announced that it would not prioritize supervision or enforcement involving penalties or fines under the Payment Withdrawal and Payment Disclosure provisions and said it was considering a rulemaking to narrow the rule's scope.

2025-03-30

The Payment Withdrawal and Payment Disclosure provisions of the Payday, Vehicle Title, and Certain High-Cost Installment Loans Regulation became operative after litigation-related delays.

Suggested considerations

• Firms should continue treating 12 C.F.R. §§ 1041.7 and 1041.9 as operative unless and until a legally effective amendment changes them.
• Compliance teams may wish to preserve controls that prevent additional payment-transfer attempts after two consecutive failed transfers for insufficient funds unless a new authorization satisfying the rule is obtained.
• Firms should review pre-withdrawal, post-failure, and other payment-related notices for compliance with the applicable content, timing, and delivery requirements in 12 C.F.R. § 1041.9.
• Lenders may wish to document the CFPB announcement separately from their formal compliance risk assessment, because the announcement describes enforcement priorities rather than a legal exemption or limitation on private, state, or other applicable enforcement exposure.
• Firms should assess state attorney general and state regulator exposure, including the possibility of enforcement under the Consumer Financial Protection Act and applicable state consumer-protection laws.
• Compliance teams may wish to monitor any CFPB notice of proposed rulemaking, Federal Register publication, litigation, and subsequent effective-date activity before changing production controls.
• Covered lenders should retain evidence of payment-attempt logic, consumer authorizations, notices, exceptions, and records required by the rule so that supervisory or state inquiries can be addressed.

What changed

The CFPB stated that it would deprioritize enforcement and supervision actions concerning penalties or fines associated with the rule's Payment Withdrawal and Payment Disclosure provisions. The operative rule continues to restrict a covered lender from attempting additional payment withdrawals after two consecutive failed attempts caused by insufficient funds unless the consumer provides a new authorization, and it requires specified payment-related notices, including notices before certain withdrawals and after two consecutive failed attempts.

Key dates

2020-07-15

The CFPB filed its enforcement action against Townstone Financial and Barry Sturner alleging unlawful redlining-related conduct.

2024-11-07

The Northern District of Illinois entered the stipulated final judgment and order, including a $105,000 civil money penalty and restrictions concerning Equal Credit Opportunity Act compliance.

2025-03-26

The CFPB and Townstone jointly filed a Rule 60(b)(6) motion seeking relief from and vacatur of the stipulated final judgment and order.

2025-03-28

The CFPB publicly announced its request to vacate the Townstone judgment, dismiss the case, and return the penalty.

2025-06-12

The Northern District of Illinois denied the joint motion, finding that the parties had not shown the extraordinary circumstances required for Rule 60(b)(6) relief; the judgment therefore remained in effect.

Suggested considerations

• Compliance teams at mortgage lenders may wish to treat the Townstone stipulated final judgment entered on November 7, 2024 as remaining operative unless and until a court orders otherwise; the June 12, 2025 denial means the announced vacatur did not change the firm's obligations.
• Firms may wish to continue monitoring fair-lending risk using application, approval, origination, pricing, geography, marketing, and servicing data, while documenting legitimate business explanations for geographic or demographic disparities.
• Mortgage lenders and brokers may wish to review marketing, community outreach, loan-officer activity, branch and office locations, underwriting practices, and public-facing statements for potential discouragement or differential treatment under the Equal Credit Opportunity Act and Regulation B.
• Firms with CFPB consent orders may wish to avoid assuming that a change in CFPB leadership or enforcement priorities permits unilateral suspension, modification, or refund of settlement obligations; any such relief generally requires the relevant court or other legally authorized process.
• Legal and compliance teams may wish to preserve records supporting fair-lending analyses and governance decisions, including data definitions, screening methodology, model limitations, qualitative review, escalation decisions, and communications concerning public statements or marketing content.
• Industry participants may wish to distinguish the CFPB's litigation position in Townstone from a binding change to redlining standards: the publication did not repeal, amend, or narrow the Equal Credit Opportunity Act, Regulation B, the Fair Housing Act, or applicable supervisory expectations.

What changed

The CFPB publication announced a proposed litigation step, not a new regulation, supervisory requirement, or generally applicable enforcement policy. The joint motion alleged that the prior redlining investigation and settlement were materially flawed, including alleged reliance on mortgage application and origination disparities, analysis of Townstone's public statements, and infringement of First Amendment rights. The motion sought to vacate the stipulated final judgment and order, dismiss the case, and return the $105,000 penalty.