CFPB Updates 2025

Key dates

2025-12-15

The CFPB and Federal Reserve announced and issued the final threshold amendments based on the 2.1% CPI-W increase as of June 1, 2025.

2026-01-01

The $73,400 Regulation Z and Regulation M thresholds became effective.

2026-12-31

The stated $73,400 thresholds apply through the end of the 2026 calendar year, subject to the applicable transaction-date rules.

Suggested considerations

• Compliance teams may wish to update underwriting, product-classification, and regulatory-coverage logic so that transactions of $73,400 or less are treated as within the applicable Regulation Z or Regulation M framework for the relevant 2026 transaction date.
• Firms should consider reviewing transaction-value calculations, including the total contractual obligation for consumer leases, to confirm that threshold determinations are made using the applicable regulatory definitions and the amount in effect at consummation.
• Lenders and lessors may wish to test disclosures, notices, document generation, and exception handling for transactions close to $73,400, including boundary cases and rounding controls.
• Compliance teams should consider retaining the prior $71,900 threshold for transactions governed by the 2025 threshold and applying $73,400 only to transactions covered by the 2026 period.
• Mortgage and private education lending teams should consider confirming that their systems do not incorrectly treat the $73,400 threshold as an exemption, because those Regulation Z categories remain covered regardless of loan amount.
• Firms may wish to document the annual CPI-W-based threshold change in regulatory inventories, procedures, monitoring scripts, and quality-assurance testing. Independent commentary from Sheppard Mullin characterized the change as an inflation-driven update to the exemption amount rather than a substantive change to TILA or CLA coverage, which supports focusing implementation on system and classification controls.

What changed

Effective January 1, 2026, the Regulation Z exemption threshold under 12 CFR 1026.3(b) and the Regulation M exemption threshold under 12 CFR 1013.2(e) increased to $73,400 from $71,900. The adjustment is based on the annual percentage increase in CPI-W as of June 1, 2025, reported as 2.1%, and is reflected in Regulation Z comment 3(b)-3.xvii and Regulation M comment 2(e)-11.xvii. Regulation Z and Regulation M generally apply to covered consumer credit transactions and consumer leases at or below $73,400; transactions above that amount are generally outside the relevant coverage.

Key dates

2025-11-21

CFPB announced the Humility in Supervision Pledge and stated that examiners would read it to supervised entities at the beginning of examinations.

2026-01-01

The pledge applies to the CFPB’s 2026 examination cycle, including the announced focus on priority markets, tangible and identifiable consumer harm, and narrower examination scopes.

Suggested considerations

• Compliance teams may wish to map their 2026 CFPB examination readiness materials to clearly identified products, statutory and regulatory requirements, and documented consumer-harm risks, with particular attention to servicemembers, veterans, and their families.
• Firms should consider maintaining a concise examination scoping pack that identifies relevant business lines, applicable federal consumer financial laws, prior findings, consumer-impact metrics, and information that can be produced without unnecessary overcollection.
• Supervised entities may wish to designate personnel to validate the scope and priority areas when advance examination notice is received and to document any requests that appear unrelated to the stated scope.
• Firms should consider preserving written records of discussions concerning supplemental information requests, scope changes, Matters Requiring Attention, and any proposed self-reporting or supervisory remediation.
• Compliance teams may wish to continue preparing for enforcement-quality examinations because the pledge does not limit the CFPB’s statutory authority or eliminate potential liability for violations, consumer harm, disclosure failures, or unfair, deceptive, or abusive acts or practices.
• Entities experiencing examination activity inconsistent with the pledge may consider escalating the matter through CFPB supervisory channels, while avoiding reliance on the pledge as a defense against substantive compliance deficiencies.

What changed

The CFPB stated that 2026 examinations will focus on pressing consumer threats, particularly issues affecting service members, their families, and veterans, and matters within the Bureau’s statutory authority. The Bureau will seek to avoid duplicative supervision where states or other regulators are already performing substantially the same work. Supervised entities are expected to receive advance notice of scheduled examinations, clearer expectations, and requests limited to the defined scope and identified priorities.

Key dates

2016-10-03

Beginning of the period for which the CFPB alleged FirstCash made MLA-covered pawn loans exceeding the 36% cap and used noncompliant agreements and disclosures.

2021-11-12

The CFPB filed its lawsuit against FirstCash, Inc. and 19 subsidiaries alleging Military Lending Act violations.

2025-07-11

The parties filed the stipulated final judgment and proposed order, and the court entered the judgment resolving the lawsuit; the order imposed $5 million in redress, a $4 million civil penalty, and prospective MLA compliance requirements.

2025-07-22

The CFPB terminated the 2013 Cash America consent order after determining that the predecessor had fulfilled its obligations, including paying a $5 million penalty and providing consumer redress.

Suggested considerations

• Compliance teams at creditors offering potentially MLA-covered consumer credit should consider mapping every product, including pawn loans, against the definition of consumer credit and testing whether fees and charges are included in the 36% Military Annual Percentage Rate calculation under 32 C.F.R. § 232.3(i).
• Firms should consider implementing documented procedures to determine covered-borrower status before or at account opening, using the Department of Defense database or another permitted method under the safe harbor in 32 C.F.R. § 232.5(b), and retaining the required evidence and timing records.
• Legal and product teams may wish to review loan agreements, disclosures, and servicing scripts for mandatory arbitration provisions and for all MLA disclosures required by 32 C.F.R. § 232.6, including the applicable payment-obligation and covered-borrower notices.
• Affected lenders should consider identifying loans made to servicemembers and covered dependents from October 3, 2016 onward, assessing potential MAPR, disclosure, and arbitration exposure, and evaluating remediation where historical controls were inadequate.
• Governance functions may wish to assign ownership for MLA compliance across underwriting, point-of-sale systems, branch operations, vendor management, complaint handling, and internal testing, with escalation for products that cannot reliably screen covered borrowers.
• Firms should consider reviewing the judgment and any applicable CFPB redress procedures before calculating restitution, and should avoid treating the termination of the predecessor’s 2013 consent order as relief from the separate FirstCash obligations.

What changed

The July 11, 2025 stipulated final judgment, entered by the court the same day, requires FirstCash and its subsidiaries to set aside $5 million to provide full redress in connection with thousands of unlawful pawn loans and pay $4 million to the CFPB victims relief fund. Going forward, the defendants must comply with the Military Lending Act, 10 U.S.C. § 987, and its implementing regulation, 32 C.F.R. part 232, including the 36% MAPR limit, the prohibition on mandatory arbitration, and required disclosures.

Key dates

2025-01-30

The CFPB issued the original Wise consent order, requiring approximately $450,000 in consumer redress and a $2.025 million civil money penalty.

2025-04-17

The CFPB published the rescission of Consumer Financial Protection Circular 2024-02 at 89 FR 27357; the rescission was later identified as relevant to the revised Wise penalty.

2025-05-15

The CFPB and Wise entered the Amended Consent Order, which superseded the January order and reduced the civil money penalty to $44,955.

2025-05-25 Deadline

Wise was required to reserve or deposit $449,550.99 in a segregated account within 10 days of the Amended Consent Order’s effective date, assuming the order became effective on May 15, 2025.

2025-07-14 Deadline

Wise was required to create and implement its comprehensive compliance plan within 60 days of the Amended Consent Order’s effective date, assuming an effective date of May 15, 2025.

Suggested considerations

• Firms should consider mapping each remittance-transfer customer journey to the applicable Regulation E disclosure, receipt, cancellation, refund, error-notice and error-resolution requirements, including transfers funded from prepaid accounts or foreign bank accounts.
• Compliance teams may wish to test whether advertisements and product interfaces accurately state ATM fees, transfer fees, exchange rates, recipient amounts and other costs for the relevant U.S. customer population, rather than relying on global or non-U.S. customer data.
• Firms should consider validating that exchange rates are disclosed using the required Exchange Rate terminology, rounded consistently to no fewer than two and no more than four decimal places, and accompanied by the required date-of-availability information.
• Compliance teams may wish to review controls for delayed or unavailable transfers to ensure remittance fees are refunded within the applicable Regulation E timeframe and that notices of error are investigated, resolved and documented appropriately.
• Firms should consider reviewing change-in-terms notices, foreign-language receipts, combined disclosures, record-retention controls and written policies and procedures for prepaid accounts and remittance transfers.
• Boards and senior management of covered payment providers may wish to receive documented reporting on material Regulation E deficiencies, consumer-redress calculations, remediation progress and testing results.
• Firms should distinguish the rescinded Circular 2024-02 from the underlying binding requirements of the EFTA, Regulation E, the Prepaid Rule and the CFPA, and should avoid treating the penalty reduction as a relaxation of disclosure or refund obligations.

What changed

The May 15, 2025 Amended Consent Order supersedes the January order. Wise must reserve or deposit $449,550.99 in a segregated account for affected-consumer redress, subject to the order’s treatment of qualifying prior payments, and must pay a $44,955 civil money penalty under 12 U.S.C. § 5565(c)(4), rather than the prior $2.025 million penalty. Wise must create and implement a comprehensive compliance plan within 60 days of the order’s effective date, covering its remittance-transfer and prepaid-account services, applicable federal consumer financial law, and the order’s requirements.

Key dates

2024-05-31

The CFPB published Use of Digital User Accounts to Access Buy Now, Pay Later Loans at 89 Fed. Reg. 47,068, treating covered BNPL lenders as card issuers under Regulation Z.

2025-05-06

The CFPB announced that it would not prioritize enforcement actions based on the BNPL interpretive rule and was contemplating rescission.

2025-05-12

The CFPB subsequently withdrew the 2024 BNPL interpretive rule as part of its withdrawal of guidance documents.

Suggested considerations

• Compliance teams may wish to document the distinction between the CFPB's enforcement-priority statement and a formal repeal, noting that the announcement itself did not provide a safe harbor from the Truth in Lending Act, Regulation Z, UDAAP, Fair Credit Reporting Act, or applicable state law.
• BNPL providers should consider preserving existing Regulation Z implementation records, including disclosures, account statements, dispute and error-resolution procedures, refund processes, complaint files, and change-management documentation, because the CFPB's announcement did not authorize retrospective noncompliance and future policy could change.
• Firms may wish to verify the current status of the 2024 interpretive rule and monitor CFPB Federal Register notices, supervisory publications, litigation developments, and any replacement rule or guidance.
• Product and legal teams should consider reassessing whether each BNPL product is subject to Regulation Z based on its structure and applicable statutory provisions, rather than relying solely on the withdrawn interpretive rule.
• Compliance teams may wish to continue testing disclosures, payment schedules, fees, refund handling, billing-error response, complaint management, and marketing for compliance with remaining federal and state requirements.
• Multi-state providers should consider separately reviewing state licensing, rate, fee, disclosure, dispute-resolution, privacy, and unfair-practices requirements; independent commentary specifically identified New York legislation imposing BNPL licensing and supervision requirements, a 16 percent interest cap, fee restrictions, and additional consumer safeguards.
• Firms may wish to maintain contingency plans that allow rapid restoration or modification of credit-card-style Regulation Z controls if federal enforcement priorities or the legal status of BNPL products changes.

What changed

The CFPB stated that enforcement actions based on Use of Digital User Accounts to Access Buy Now, Pay Later Loans, 89 Fed. Reg. 47,068 (May 31, 2024), would not be a priority. The Bureau said it would redirect enforcement and supervision resources toward pressing consumer threats, particularly those involving servicemembers, veterans, taxpayers, and small businesses. The Bureau also said it was contemplating appropriate action to rescind the interpretive rule; subsequent CFPB materials identified the rule as withdrawn on 2025-05-12.

Key dates

2025-02-07

The Fifth Circuit stayed the Section 1071 rule pending appeal in Texas Bankers Association v. CFPB and tolled compliance deadlines only for the case’s plaintiffs and intervenors, subject to further court modification.

2025-04-30

The CFPB published the policy statement announcing that it would not prioritize enforcement or supervision against entities outside the Fifth Circuit stay.

2025-05-12

The CFPB withdrew the policy statement as part of its broader withdrawal of policy statements, interpretive rules, advisory opinions, and other guidance.

2025-06-18

The CFPB issued an interim final rule extending Section 1071 compliance dates for all regulated entities by approximately one year; the earliest revised date for the highest-volume tier was July 1, 2026.

2026-05-01

The CFPB issued a final reconsideration rule revising Regulation B subpart B and extending the revised framework’s general compliance date to January 1, 2028.

Suggested considerations

• Compliance teams may wish to avoid treating the 2025-04-30 announcement as a formal repeal, exemption, or safe harbor, and should document the distinction between enforcement prioritization and continuing statutory or regulatory obligations.
• Covered lenders should consider preserving existing Section 1071 governance, data mapping, recordkeeping, and implementation work where proportionate, while assessing whether the 2026 final reconsideration rule changes the applicable scope, data points, procedures, or implementation timetable.
• Firms should consider identifying whether they are plaintiffs, intervenors, or members of an association covered by the Texas Bankers Association stay, because the original court order did not apply uniformly to all covered institutions.
• Compliance teams may wish to monitor the CFPB’s Section 1071 rulemaking, the status of Texas Bankers Association v. CFPB, and subsequent Federal Register amendments rather than relying on the withdrawn policy statement as current guidance.
• Lenders should consider retaining an audit trail for any decision to pause, scale, or continue implementation, including legal analysis of the applicable rule version, court orders, CFPB amendments, and operational or fair-lending risks.
• Covered institutions may wish to assess whether existing small-business application and demographic-data processes could support future reporting, because the CFPB’s enforcement posture did not eliminate potential litigation, examination, state-law, fair-lending, or reputational exposure.

What changed

The CFPB stated that it would deprioritize enforcement and supervision of the Small Business Lending Rule against entities not covered by the court-ordered stay, citing limited resources and the perceived unfairness of treating similarly situated institutions differently. The statement did not create a formal exemption, alter Regulation B, remove Section 1071 data-collection and reporting obligations, or expand the Fifth Circuit’s stay, which initially tolled compliance dates only for the plaintiffs and intervenors in Texas Bankers Association v. CFPB.

Key dates

2024-07-08

The final rule was published at 89 Fed. Reg. 56028.

2024-09-16

The final rule became effective.

2025-01-14 Deadline

Initial implementation deadline for larger participant CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(1).

2025-04-11

The CFPB announced its policy of not prioritizing enforcement or supervision actions for failures to meet future registration deadlines under 12 CFR part 1092.

2025-04-14 Deadline

Implementation registration deadline for other CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(2).

2025-07-14 Deadline

Implementation registration deadline for all other covered nonbanks under 12 CFR 1092.206(a)(3).

Suggested considerations

• Compliance teams may wish to document whether the entity is a covered nonbank and whether any agency or court order meets the covered-order criteria in 12 CFR 1092.201, including the requirement that the order be a final public order identifying the entity and imposing obligations based in whole or in part on specified consumer-law or UDAAP violations.
• Firms should consider preserving an inventory of potentially covered orders, registration data, and supporting legal analyses even if they elect not to file while the CFPB's prioritization policy remains in effect.
• Covered entities may wish to assess whether filing by the applicable date remains preferable for licensing, supervisory, litigation, diligence, or reputational reasons, rather than treating the announcement as a definitive exemption.
• Compliance teams should monitor for a proposed rulemaking, final rule, formal withdrawal, or further CFPB communication that changes the status or scope of 12 CFR part 1092.
• CFPB-supervised registered entities should continue evaluating the separate annual written-statement requirements in 12 CFR 1092.204 and should not assume that the announcement eliminates obligations other than the future registration-deadline enforcement priority described.
• Firms may wish to record the policy statement as an enforcement-risk and resource-allocation development, not as a statutory safe harbor against other CFPB, state, or private-party consequences for underlying consumer-law violations.

What changed

The CFPB stated that it will not prioritize enforcement or supervision actions concerning failures to submit registration information by future deadlines under the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders, codified at 12 CFR part 1092. The stated policy covers, among other entities, nonbanks subject to the implementation deadlines in 12 CFR 1092.206(a)(2) and 12 CFR 1092.206(a)(3). The CFPB will instead focus enforcement and supervision resources on pressing threats to consumers.

Key dates

2025-03-28

The CFPB announced that it would not prioritize supervision or enforcement involving penalties or fines under the Payment Withdrawal and Payment Disclosure provisions and said it was considering a rulemaking to narrow the rule's scope.

2025-03-30

The Payment Withdrawal and Payment Disclosure provisions of the Payday, Vehicle Title, and Certain High-Cost Installment Loans Regulation became operative after litigation-related delays.

Suggested considerations

• Firms should continue treating 12 C.F.R. §§ 1041.7 and 1041.9 as operative unless and until a legally effective amendment changes them.
• Compliance teams may wish to preserve controls that prevent additional payment-transfer attempts after two consecutive failed transfers for insufficient funds unless a new authorization satisfying the rule is obtained.
• Firms should review pre-withdrawal, post-failure, and other payment-related notices for compliance with the applicable content, timing, and delivery requirements in 12 C.F.R. § 1041.9.
• Lenders may wish to document the CFPB announcement separately from their formal compliance risk assessment, because the announcement describes enforcement priorities rather than a legal exemption or limitation on private, state, or other applicable enforcement exposure.
• Firms should assess state attorney general and state regulator exposure, including the possibility of enforcement under the Consumer Financial Protection Act and applicable state consumer-protection laws.
• Compliance teams may wish to monitor any CFPB notice of proposed rulemaking, Federal Register publication, litigation, and subsequent effective-date activity before changing production controls.
• Covered lenders should retain evidence of payment-attempt logic, consumer authorizations, notices, exceptions, and records required by the rule so that supervisory or state inquiries can be addressed.

What changed

The CFPB stated that it would deprioritize enforcement and supervision actions concerning penalties or fines associated with the rule's Payment Withdrawal and Payment Disclosure provisions. The operative rule continues to restrict a covered lender from attempting additional payment withdrawals after two consecutive failed attempts caused by insufficient funds unless the consumer provides a new authorization, and it requires specified payment-related notices, including notices before certain withdrawals and after two consecutive failed attempts.

Key dates

2020-07-15

The CFPB filed its enforcement action against Townstone Financial and Barry Sturner alleging unlawful redlining-related conduct.

2024-11-07

The Northern District of Illinois entered the stipulated final judgment and order, including a $105,000 civil money penalty and restrictions concerning Equal Credit Opportunity Act compliance.

2025-03-26

The CFPB and Townstone jointly filed a Rule 60(b)(6) motion seeking relief from and vacatur of the stipulated final judgment and order.

2025-03-28

The CFPB publicly announced its request to vacate the Townstone judgment, dismiss the case, and return the penalty.

2025-06-12

The Northern District of Illinois denied the joint motion, finding that the parties had not shown the extraordinary circumstances required for Rule 60(b)(6) relief; the judgment therefore remained in effect.

Suggested considerations

• Compliance teams at mortgage lenders may wish to treat the Townstone stipulated final judgment entered on November 7, 2024 as remaining operative unless and until a court orders otherwise; the June 12, 2025 denial means the announced vacatur did not change the firm's obligations.
• Firms may wish to continue monitoring fair-lending risk using application, approval, origination, pricing, geography, marketing, and servicing data, while documenting legitimate business explanations for geographic or demographic disparities.
• Mortgage lenders and brokers may wish to review marketing, community outreach, loan-officer activity, branch and office locations, underwriting practices, and public-facing statements for potential discouragement or differential treatment under the Equal Credit Opportunity Act and Regulation B.
• Firms with CFPB consent orders may wish to avoid assuming that a change in CFPB leadership or enforcement priorities permits unilateral suspension, modification, or refund of settlement obligations; any such relief generally requires the relevant court or other legally authorized process.
• Legal and compliance teams may wish to preserve records supporting fair-lending analyses and governance decisions, including data definitions, screening methodology, model limitations, qualitative review, escalation decisions, and communications concerning public statements or marketing content.
• Industry participants may wish to distinguish the CFPB's litigation position in Townstone from a binding change to redlining standards: the publication did not repeal, amend, or narrow the Equal Credit Opportunity Act, Regulation B, the Fair Housing Act, or applicable supervisory expectations.

What changed

The CFPB publication announced a proposed litigation step, not a new regulation, supervisory requirement, or generally applicable enforcement policy. The joint motion alleged that the prior redlining investigation and settlement were materially flawed, including alleged reliance on mortgage application and origination disparities, analysis of Townstone's public statements, and infringement of First Amendment rights. The motion sought to vacate the stipulated final judgment and order, dismiss the case, and return the $105,000 penalty.