CFPB Updates 2026

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2026-08-14

The CFPB announced and implemented the cessation of discretionary publication of complaint narratives and associated visualizations in the Consumer Complaint Database; previously published narratives remain subject to proactive FOIA Reading Room disclosure.

Suggested considerations

• Compliance teams may wish to continue treating CFPB complaints as supervisory and potential enforcement inputs, notwithstanding the removal of narratives from the public database.
• Firms should consider maintaining controls that support complete, accurate, and timely responses to CFPB complaints, including documented investigation, escalation, remediation, and quality-assurance procedures.
• Complaint-management owners may wish to monitor whether the removal of public narratives affects internal trend analysis and should preserve their own historical complaint records and supporting evidence.
• Legal and regulatory affairs teams should consider reviewing previously published complaint narratives concerning the firm in the CFPB FOIA Reading Room and assessing whether existing disclosure, litigation, reputation, and remediation processes remain appropriate.
• Firms should consider retaining evidence supporting complaint responses because complaint information may continue to be shared with prudential regulators, the FTC, and federal or state agencies, and may remain accessible through FOIA.
• Management may wish to avoid interpreting the change as a basis for reducing complaint-governance staffing, monitoring, root-cause analysis, or board and senior-management reporting.

What changed

The CFPB will no longer publish consumer-submitted complaint narratives or related data visualizations in the Consumer Complaint Database. The Bureau characterizes publication of these materials as discretionary rather than statutorily required and states that the materials are unverified, potentially misleading, and not necessarily evidence of legal violations.

Key dates

2026-06-25

The joint final rule was issued and published in the Federal Register as 91 FR 38246.

2026-10-01

The joint final rule becomes effective. Its standards become available for consideration in later agency-specific reporting requirements, but existing reporting requirements do not change solely because of this effective date.

Suggested considerations

• Compliance teams may wish to inventory all regulatory data collections submitted to the CFPB, SEC, CFTC, Federal Reserve, OCC, FDIC, NCUA, FHFA, or Treasury and identify the systems, vendors, data owners, and filing processes supporting each collection.
• Firms should consider assessing whether legal entities in their reporting perimeter already have active ISO 17442 LEIs, while recognizing that the joint rule does not presently impose an LEI-obtaining or renewal requirement.
• Data-governance teams may wish to map current entity, product, instrument, location, date, and currency fields to the joint standards and document data lineage, semantic definitions, validation controls, and taxonomy dependencies.
• Technology and regulatory-reporting teams should consider evaluating whether reporting platforms can produce machine-readable data and accommodate future agency-specific identifier, schema, taxonomy, or transmission requirements without duplicative migrations.
• Firms with SEC or MSRB reporting exposure may wish to monitor the SEC's agency-specific implementation and assess the potential effect on municipal securities data, including whether CUSIP remains acceptable.
• Compliance teams may wish to monitor each covered agency's rulemakings and other implementation actions rather than treating October 1, 2026 as a deadline to change all existing regulatory filings.

What changed

The final rule establishes common identifiers and technical conventions for certain regulatory data collections, including ISO 17442 as the common Legal Entity Identifier standard, identifiers for products or financial instruments, dates, geographic locations, states, countries, and currencies. It also establishes a principles-based standard for data transmission and schema and taxonomy formats, requiring data to be machine-readable, semantically defined, consistently identified in accordance with the applicable regulatory requirement, and based on nonproprietary or openly licensed standards...

Key dates

2026-06-24

CFPB published the announcement describing the consumer complaint portal reforms.

Suggested considerations

• Compliance teams may wish to obtain and operationalize the revised CFPB Company Portal Manual, mapping each substantive and administrative response category to documented decision criteria and approval controls.
• Nationwide consumer reporting agencies and other portal participants should consider testing whether complaint response coding is applied consistently across business units, products, and servicing locations, particularly for non-monetary relief and administrative returns.
• Firms should consider retaining evidence of the identity, authority, and relationship of any third party submitting or assisting with a complaint, while ensuring those controls do not improperly prevent authorized representatives from obtaining assistance.
• CRAs should consider enhancing intake and case-management fields to identify the consumer's prior direct FCRA dispute, the relevant dispute date, information disputed, investigation outcome, and supporting documentation.
• Compliance teams may wish to distinguish CFPB portal handling from the underlying duties in FCRA sections 611 and 623, including the reasonable-investigation and reinvestigation obligations that may arise after a consumer dispute is properly received.
• Companies should consider monitoring portal communications and API-related implementation materials for additional CFPB specifications concerning address validation, data exchange, administrative response categories, and apparent abuse.
• Complaint-management governance should consider the CFPB's 30-calendar-day operational backlog definition for internal escalation and management information, while avoiding the assumption that the definition changes a statutory response deadline.
• Credit repair and consumer-assistance businesses should review whether their complaint-submission practices accurately identify third-party involvement and avoid automated, duplicative, or unsupported disputes that could be treated as process abuse.

What changed

The CFPB issued a revised Company Portal Manual clarifying the use of substantive and administrative closure categories, including the category "Closed with non-monetary relief," to improve consistency across companies and CRAs. The portal now requires users creating online accounts to verify both an email address and mobile phone number through two-factor authentication, adds relationship categories and clarifying text requiring third parties to disclose their involvement, and is expected to add address validation at complaint submission.

Key dates

2023-10-12

CFPB and DOJ issued the joint statement concerning fair lending and credit opportunities for noncitizen borrowers; it was published in the Federal Register on October 18, 2023.

2026-01-12

CFPB and DOJ withdrew the October 2023 joint statement. The withdrawal was published at 91 FR 1138 and became effective on this date.

Suggested considerations

• Compliance teams may wish to identify underwriting, eligibility, pricing, servicing, and adverse-action processes that reference immigration, citizenship, visa, residency, or work-authorization status.
• Firms should consider documenting the legitimate credit, repayment-risk, creditor-rights, remedies, or legal-compliance rationale for collecting or using immigration-related information, rather than treating the withdrawal as an unrestricted authorization to use the information for any purpose.
• Firms may wish to reassess policies adopted in response to the 2023 joint statement, while preserving controls designed to prevent intentional discrimination or unjustified disparate treatment based on race, color, religion, national origin, sex, marital status, or age.
• Compliance teams may wish to test whether immigration-related variables or proxies produce inconsistent eligibility, pricing, or servicing outcomes across protected groups and whether decisioning documentation supports the stated legitimate purpose.
• Firms should consider retaining existing fair-lending governance, adverse-action notice, data-quality, model-risk, and complaint-monitoring controls because the withdrawal does not amend ECOA or Regulation B or eliminate consumer rights.
• California creditors and other firms operating under state or local fair-lending laws may wish to separately assess obligations that are not displaced by the federal withdrawal, including potentially broader state civil-rights protections.

What changed

The nonbinding October 2023 joint statement is withdrawn effective January 12, 2026; no new statutory or regulatory obligation, safe harbor, or mandatory underwriting standard is created. The agencies state that creditors may consider immigration or citizenship status, including when assessing creditworthiness, financial risk, creditor rights and remedies regarding repayment, or compliance with other laws.