CFPB Enforcement Actions

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2016-10-03

Beginning of the period for which the CFPB alleged FirstCash made MLA-covered pawn loans exceeding the 36% cap and used noncompliant agreements and disclosures.

2021-11-12

The CFPB filed its lawsuit against FirstCash, Inc. and 19 subsidiaries alleging Military Lending Act violations.

2025-07-11

The parties filed the stipulated final judgment and proposed order, and the court entered the judgment resolving the lawsuit; the order imposed $5 million in redress, a $4 million civil penalty, and prospective MLA compliance requirements.

2025-07-22

The CFPB terminated the 2013 Cash America consent order after determining that the predecessor had fulfilled its obligations, including paying a $5 million penalty and providing consumer redress.

Suggested considerations

• Compliance teams at creditors offering potentially MLA-covered consumer credit should consider mapping every product, including pawn loans, against the definition of consumer credit and testing whether fees and charges are included in the 36% Military Annual Percentage Rate calculation under 32 C.F.R. § 232.3(i).
• Firms should consider implementing documented procedures to determine covered-borrower status before or at account opening, using the Department of Defense database or another permitted method under the safe harbor in 32 C.F.R. § 232.5(b), and retaining the required evidence and timing records.
• Legal and product teams may wish to review loan agreements, disclosures, and servicing scripts for mandatory arbitration provisions and for all MLA disclosures required by 32 C.F.R. § 232.6, including the applicable payment-obligation and covered-borrower notices.
• Affected lenders should consider identifying loans made to servicemembers and covered dependents from October 3, 2016 onward, assessing potential MAPR, disclosure, and arbitration exposure, and evaluating remediation where historical controls were inadequate.
• Governance functions may wish to assign ownership for MLA compliance across underwriting, point-of-sale systems, branch operations, vendor management, complaint handling, and internal testing, with escalation for products that cannot reliably screen covered borrowers.
• Firms should consider reviewing the judgment and any applicable CFPB redress procedures before calculating restitution, and should avoid treating the termination of the predecessor’s 2013 consent order as relief from the separate FirstCash obligations.

What changed

The July 11, 2025 stipulated final judgment, entered by the court the same day, requires FirstCash and its subsidiaries to set aside $5 million to provide full redress in connection with thousands of unlawful pawn loans and pay $4 million to the CFPB victims relief fund. Going forward, the defendants must comply with the Military Lending Act, 10 U.S.C. § 987, and its implementing regulation, 32 C.F.R. part 232, including the 36% MAPR limit, the prohibition on mandatory arbitration, and required disclosures.

Key dates

2025-01-30

The CFPB issued the original Wise consent order, requiring approximately $450,000 in consumer redress and a $2.025 million civil money penalty.

2025-04-17

The CFPB published the rescission of Consumer Financial Protection Circular 2024-02 at 89 FR 27357; the rescission was later identified as relevant to the revised Wise penalty.

2025-05-15

The CFPB and Wise entered the Amended Consent Order, which superseded the January order and reduced the civil money penalty to $44,955.

2025-05-25 Deadline

Wise was required to reserve or deposit $449,550.99 in a segregated account within 10 days of the Amended Consent Order’s effective date, assuming the order became effective on May 15, 2025.

2025-07-14 Deadline

Wise was required to create and implement its comprehensive compliance plan within 60 days of the Amended Consent Order’s effective date, assuming an effective date of May 15, 2025.

Suggested considerations

• Firms should consider mapping each remittance-transfer customer journey to the applicable Regulation E disclosure, receipt, cancellation, refund, error-notice and error-resolution requirements, including transfers funded from prepaid accounts or foreign bank accounts.
• Compliance teams may wish to test whether advertisements and product interfaces accurately state ATM fees, transfer fees, exchange rates, recipient amounts and other costs for the relevant U.S. customer population, rather than relying on global or non-U.S. customer data.
• Firms should consider validating that exchange rates are disclosed using the required Exchange Rate terminology, rounded consistently to no fewer than two and no more than four decimal places, and accompanied by the required date-of-availability information.
• Compliance teams may wish to review controls for delayed or unavailable transfers to ensure remittance fees are refunded within the applicable Regulation E timeframe and that notices of error are investigated, resolved and documented appropriately.
• Firms should consider reviewing change-in-terms notices, foreign-language receipts, combined disclosures, record-retention controls and written policies and procedures for prepaid accounts and remittance transfers.
• Boards and senior management of covered payment providers may wish to receive documented reporting on material Regulation E deficiencies, consumer-redress calculations, remediation progress and testing results.
• Firms should distinguish the rescinded Circular 2024-02 from the underlying binding requirements of the EFTA, Regulation E, the Prepaid Rule and the CFPA, and should avoid treating the penalty reduction as a relaxation of disclosure or refund obligations.

What changed

The May 15, 2025 Amended Consent Order supersedes the January order. Wise must reserve or deposit $449,550.99 in a segregated account for affected-consumer redress, subject to the order’s treatment of qualifying prior payments, and must pay a $44,955 civil money penalty under 12 U.S.C. § 5565(c)(4), rather than the prior $2.025 million penalty. Wise must create and implement a comprehensive compliance plan within 60 days of the order’s effective date, covering its remittance-transfer and prepaid-account services, applicable federal consumer financial law, and the order’s requirements.

Key dates

2020-07-15

The CFPB filed its enforcement action against Townstone Financial and Barry Sturner alleging unlawful redlining-related conduct.

2024-11-07

The Northern District of Illinois entered the stipulated final judgment and order, including a $105,000 civil money penalty and restrictions concerning Equal Credit Opportunity Act compliance.

2025-03-26

The CFPB and Townstone jointly filed a Rule 60(b)(6) motion seeking relief from and vacatur of the stipulated final judgment and order.

2025-03-28

The CFPB publicly announced its request to vacate the Townstone judgment, dismiss the case, and return the penalty.

2025-06-12

The Northern District of Illinois denied the joint motion, finding that the parties had not shown the extraordinary circumstances required for Rule 60(b)(6) relief; the judgment therefore remained in effect.

Suggested considerations

• Compliance teams at mortgage lenders may wish to treat the Townstone stipulated final judgment entered on November 7, 2024 as remaining operative unless and until a court orders otherwise; the June 12, 2025 denial means the announced vacatur did not change the firm's obligations.
• Firms may wish to continue monitoring fair-lending risk using application, approval, origination, pricing, geography, marketing, and servicing data, while documenting legitimate business explanations for geographic or demographic disparities.
• Mortgage lenders and brokers may wish to review marketing, community outreach, loan-officer activity, branch and office locations, underwriting practices, and public-facing statements for potential discouragement or differential treatment under the Equal Credit Opportunity Act and Regulation B.
• Firms with CFPB consent orders may wish to avoid assuming that a change in CFPB leadership or enforcement priorities permits unilateral suspension, modification, or refund of settlement obligations; any such relief generally requires the relevant court or other legally authorized process.
• Legal and compliance teams may wish to preserve records supporting fair-lending analyses and governance decisions, including data definitions, screening methodology, model limitations, qualitative review, escalation decisions, and communications concerning public statements or marketing content.
• Industry participants may wish to distinguish the CFPB's litigation position in Townstone from a binding change to redlining standards: the publication did not repeal, amend, or narrow the Equal Credit Opportunity Act, Regulation B, the Fair Housing Act, or applicable supervisory expectations.

What changed

The CFPB publication announced a proposed litigation step, not a new regulation, supervisory requirement, or generally applicable enforcement policy. The joint motion alleged that the prior redlining investigation and settlement were materially flawed, including alleged reliance on mortgage application and origination disparities, analysis of Townstone's public statements, and infringement of First Amendment rights. The motion sought to vacate the stipulated final judgment and order, dismiss the case, and return the $105,000 penalty.