Consumer Credit in United States

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2025-09-10

Tricolor and affiliates filed for Chapter 7 bankruptcy and moved toward liquidation.

2025-12-17

The U.S. Attorney’s Office for the Southern District of New York announced criminal charges against Tricolor executives in connection with the alleged fraud.

2026-08-18

The SEC announced the civil enforcement action against Daniel Chu, Jerome Kollar, and Ameryn Seibold in the U.S. District Court for the Southern District of New York.

Suggested considerations

• Firms should consider performing a targeted review of whether the same receivable, loan, vehicle, inventory item, or other asset can be pledged across multiple warehouse facilities, securitizations, lenders, or managed accounts, including through affiliates and special-purpose vehicles.
• Compliance teams may wish to test collateral eligibility and borrowing-base reporting back to source-level records, payment histories, lien and ownership data, servicing systems, and independent third-party evidence rather than relying solely on management certifications.
• Securitization sponsors, underwriters, and investors should consider reviewing controls for detecting loans that are delinquent, charged off, non-paying, fictitious, materially impaired, or otherwise ineligible but reported as current or eligible.
• Firms should consider reconciling loan-level collateral tapes across all funding channels and establishing exception escalation, independent sign-off, segregation of duties, and documented remediation for duplicate identifiers or inconsistent pledging data.
• Finance and compliance functions may wish to assess whether offering documents, investor presentations, lender certificates, and management meetings accurately describe liquidity constraints, funding needs, collateral encumbrances, and portfolio performance.
• Boards and senior-management committees should consider reviewing governance over collateral operations, securitization disclosures, liquidity reporting, related-party or affiliate financing, and controls over executive certifications.
• Investment managers and lenders may wish to incorporate independent collateral verification, borrowing-base audit rights, data-access rights, concentration and duplication analytics, and covenant triggers into new and renewed transactions.
• Firms with relevant exposure should consider preserving records, communications, collateral tapes, system audit trails, certifications, underwriting files, and exception reports in light of parallel SEC and criminal proceedings.

What changed

The publication does not introduce a new rule, threshold, filing requirement, or compliance deadline. It announces an enforcement complaint under the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934, including alleged control-person liability against Chu and aiding-and-abetting liability against all three defendants. The SEC seeks injunctions, disgorgement with prejudgment interest, civil penalties, and officer-and-director bars against Chu and Kollar.

Key dates

2026-08-14

The CFPB announced and implemented the cessation of discretionary publication of complaint narratives and associated visualizations in the Consumer Complaint Database; previously published narratives remain subject to proactive FOIA Reading Room disclosure.

Suggested considerations

• Compliance teams may wish to continue treating CFPB complaints as supervisory and potential enforcement inputs, notwithstanding the removal of narratives from the public database.
• Firms should consider maintaining controls that support complete, accurate, and timely responses to CFPB complaints, including documented investigation, escalation, remediation, and quality-assurance procedures.
• Complaint-management owners may wish to monitor whether the removal of public narratives affects internal trend analysis and should preserve their own historical complaint records and supporting evidence.
• Legal and regulatory affairs teams should consider reviewing previously published complaint narratives concerning the firm in the CFPB FOIA Reading Room and assessing whether existing disclosure, litigation, reputation, and remediation processes remain appropriate.
• Firms should consider retaining evidence supporting complaint responses because complaint information may continue to be shared with prudential regulators, the FTC, and federal or state agencies, and may remain accessible through FOIA.
• Management may wish to avoid interpreting the change as a basis for reducing complaint-governance staffing, monitoring, root-cause analysis, or board and senior-management reporting.

What changed

The CFPB will no longer publish consumer-submitted complaint narratives or related data visualizations in the Consumer Complaint Database. The Bureau characterizes publication of these materials as discretionary rather than statutorily required and states that the materials are unverified, potentially misleading, and not necessarily evidence of legal violations.

Key dates

2026-06-08

CFPB issued the Statement on Ability To Repay and Immigration Status referenced by the agencies

2026-07-13

FDIC, OCC, and NCUA issued the interagency guidance on lending to individuals not legally authorized to work in the United States

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that capacity-to-repay analysis captures employment-authorization-related income instability.
• Firms should consider whether credit policy, risk grading, and portfolio monitoring procedures explicitly address elevated repayment uncertainty for non-work-authorized borrowers.
• Institutions may wish to reassess documentation and verification controls for income, employment, and supporting records in light of the agencies' stated focus on safe-and-sound lending.
• Teams should consider whether fair-lending, TILA, and ECOA controls are aligned with the CFPB's June 8, 2026 statement and the interagency guidance.
• Risk and finance functions may wish to evaluate whether allowance, concentration risk, and credit-loss assumptions need updating where exposure to this borrower segment is material.

What changed

The publication does not create a new lending ban or a new standalone rule. Instead, it restates that institutions should identify, measure, monitor, and control the credit risks associated with borrowers who are not legally authorized to work in the United States through underwriting practices that assess willingness and capacity to repay according to the credit terms. The guidance specifically links this issue to the CFPB's June 8, 2026 Statement on Ability To Repay and Immigration Status and reminds creditors of obligations under the Truth in Lending Act as implemented by Regulation Z,...

Key dates

2026-07-13

OCC, FDIC, and NCUA issued the interagency guidance

2026-06-08

CFPB issued its Statement on Ability To Repay and Immigration Status, referenced by the guidance

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that repayment capacity, source of repayment, and overall financial condition are assessed consistently for borrowers whose work authorization is uncertain.
• Firms may wish to test whether account management, credit classification, and allowance methodologies adequately capture elevated credit risk linked to employment authorization uncertainty.
• Institutions may wish to review consumer compliance controls for alignment with TILA, Regulation Z, ECOA, and Regulation B when evaluating applicants affected by immigration or work-authorized status.
• Risk and compliance teams may wish to update portfolio monitoring, concentration analysis, and documentation standards so that the identified credit risk factors are reflected in governance and reporting.
• Community banks may wish to verify that loan policy language and examiner-facing documentation clearly show how these risks are being identified, measured, monitored, and controlled.

What changed

The publication is guidance, not a new rule or statute, and it reinforces existing expectations rather than imposing a new legal prohibition. It states that lending to individuals not legally authorized to work in the United States may present elevated credit risk because their ability to generate income, maintain employment, and remain financially stable may be more uncertain.

Key dates

2026-06-24

CFPB published the announcement describing the consumer complaint portal reforms.

Suggested considerations

• Compliance teams may wish to obtain and operationalize the revised CFPB Company Portal Manual, mapping each substantive and administrative response category to documented decision criteria and approval controls.
• Nationwide consumer reporting agencies and other portal participants should consider testing whether complaint response coding is applied consistently across business units, products, and servicing locations, particularly for non-monetary relief and administrative returns.
• Firms should consider retaining evidence of the identity, authority, and relationship of any third party submitting or assisting with a complaint, while ensuring those controls do not improperly prevent authorized representatives from obtaining assistance.
• CRAs should consider enhancing intake and case-management fields to identify the consumer's prior direct FCRA dispute, the relevant dispute date, information disputed, investigation outcome, and supporting documentation.
• Compliance teams may wish to distinguish CFPB portal handling from the underlying duties in FCRA sections 611 and 623, including the reasonable-investigation and reinvestigation obligations that may arise after a consumer dispute is properly received.
• Companies should consider monitoring portal communications and API-related implementation materials for additional CFPB specifications concerning address validation, data exchange, administrative response categories, and apparent abuse.
• Complaint-management governance should consider the CFPB's 30-calendar-day operational backlog definition for internal escalation and management information, while avoiding the assumption that the definition changes a statutory response deadline.
• Credit repair and consumer-assistance businesses should review whether their complaint-submission practices accurately identify third-party involvement and avoid automated, duplicative, or unsupported disputes that could be treated as process abuse.

What changed

The CFPB issued a revised Company Portal Manual clarifying the use of substantive and administrative closure categories, including the category "Closed with non-monetary relief," to improve consistency across companies and CRAs. The portal now requires users creating online accounts to verify both an email address and mobile phone number through two-factor authentication, adds relationship categories and clarifying text requiring third parties to disclose their involvement, and is expected to add address validation at complaint submission.

Key dates

2023-10-12

CFPB and DOJ issued the joint statement concerning fair lending and credit opportunities for noncitizen borrowers; it was published in the Federal Register on October 18, 2023.

2026-01-12

CFPB and DOJ withdrew the October 2023 joint statement. The withdrawal was published at 91 FR 1138 and became effective on this date.

Suggested considerations

• Compliance teams may wish to identify underwriting, eligibility, pricing, servicing, and adverse-action processes that reference immigration, citizenship, visa, residency, or work-authorization status.
• Firms should consider documenting the legitimate credit, repayment-risk, creditor-rights, remedies, or legal-compliance rationale for collecting or using immigration-related information, rather than treating the withdrawal as an unrestricted authorization to use the information for any purpose.
• Firms may wish to reassess policies adopted in response to the 2023 joint statement, while preserving controls designed to prevent intentional discrimination or unjustified disparate treatment based on race, color, religion, national origin, sex, marital status, or age.
• Compliance teams may wish to test whether immigration-related variables or proxies produce inconsistent eligibility, pricing, or servicing outcomes across protected groups and whether decisioning documentation supports the stated legitimate purpose.
• Firms should consider retaining existing fair-lending governance, adverse-action notice, data-quality, model-risk, and complaint-monitoring controls because the withdrawal does not amend ECOA or Regulation B or eliminate consumer rights.
• California creditors and other firms operating under state or local fair-lending laws may wish to separately assess obligations that are not displaced by the federal withdrawal, including potentially broader state civil-rights protections.

What changed

The nonbinding October 2023 joint statement is withdrawn effective January 12, 2026; no new statutory or regulatory obligation, safe harbor, or mandatory underwriting standard is created. The agencies state that creditors may consider immigration or citizenship status, including when assessing creditworthiness, financial risk, creditor rights and remedies regarding repayment, or compliance with other laws.

Key dates

2025-12-15

The CFPB and Federal Reserve announced and issued the final threshold amendments based on the 2.1% CPI-W increase as of June 1, 2025.

2026-01-01

The $73,400 Regulation Z and Regulation M thresholds became effective.

2026-12-31

The stated $73,400 thresholds apply through the end of the 2026 calendar year, subject to the applicable transaction-date rules.

Suggested considerations

• Compliance teams may wish to update underwriting, product-classification, and regulatory-coverage logic so that transactions of $73,400 or less are treated as within the applicable Regulation Z or Regulation M framework for the relevant 2026 transaction date.
• Firms should consider reviewing transaction-value calculations, including the total contractual obligation for consumer leases, to confirm that threshold determinations are made using the applicable regulatory definitions and the amount in effect at consummation.
• Lenders and lessors may wish to test disclosures, notices, document generation, and exception handling for transactions close to $73,400, including boundary cases and rounding controls.
• Compliance teams should consider retaining the prior $71,900 threshold for transactions governed by the 2025 threshold and applying $73,400 only to transactions covered by the 2026 period.
• Mortgage and private education lending teams should consider confirming that their systems do not incorrectly treat the $73,400 threshold as an exemption, because those Regulation Z categories remain covered regardless of loan amount.
• Firms may wish to document the annual CPI-W-based threshold change in regulatory inventories, procedures, monitoring scripts, and quality-assurance testing. Independent commentary from Sheppard Mullin characterized the change as an inflation-driven update to the exemption amount rather than a substantive change to TILA or CLA coverage, which supports focusing implementation on system and classification controls.

What changed

Effective January 1, 2026, the Regulation Z exemption threshold under 12 CFR 1026.3(b) and the Regulation M exemption threshold under 12 CFR 1013.2(e) increased to $73,400 from $71,900. The adjustment is based on the annual percentage increase in CPI-W as of June 1, 2025, reported as 2.1%, and is reflected in Regulation Z comment 3(b)-3.xvii and Regulation M comment 2(e)-11.xvii. Regulation Z and Regulation M generally apply to covered consumer credit transactions and consumer leases at or below $73,400; transactions above that amount are generally outside the relevant coverage.

Key dates

2025-11-21

CFPB announced the Humility in Supervision Pledge and stated that examiners would read it to supervised entities at the beginning of examinations.

2026-01-01

The pledge applies to the CFPB’s 2026 examination cycle, including the announced focus on priority markets, tangible and identifiable consumer harm, and narrower examination scopes.

Suggested considerations

• Compliance teams may wish to map their 2026 CFPB examination readiness materials to clearly identified products, statutory and regulatory requirements, and documented consumer-harm risks, with particular attention to servicemembers, veterans, and their families.
• Firms should consider maintaining a concise examination scoping pack that identifies relevant business lines, applicable federal consumer financial laws, prior findings, consumer-impact metrics, and information that can be produced without unnecessary overcollection.
• Supervised entities may wish to designate personnel to validate the scope and priority areas when advance examination notice is received and to document any requests that appear unrelated to the stated scope.
• Firms should consider preserving written records of discussions concerning supplemental information requests, scope changes, Matters Requiring Attention, and any proposed self-reporting or supervisory remediation.
• Compliance teams may wish to continue preparing for enforcement-quality examinations because the pledge does not limit the CFPB’s statutory authority or eliminate potential liability for violations, consumer harm, disclosure failures, or unfair, deceptive, or abusive acts or practices.
• Entities experiencing examination activity inconsistent with the pledge may consider escalating the matter through CFPB supervisory channels, while avoiding reliance on the pledge as a defense against substantive compliance deficiencies.

What changed

The CFPB stated that 2026 examinations will focus on pressing consumer threats, particularly issues affecting service members, their families, and veterans, and matters within the Bureau’s statutory authority. The Bureau will seek to avoid duplicative supervision where states or other regulators are already performing substantially the same work. Supervised entities are expected to receive advance notice of scheduled examinations, clearer expectations, and requests limited to the defined scope and identified priorities.

Key dates

2016-10-03

Beginning of the period for which the CFPB alleged FirstCash made MLA-covered pawn loans exceeding the 36% cap and used noncompliant agreements and disclosures.

2021-11-12

The CFPB filed its lawsuit against FirstCash, Inc. and 19 subsidiaries alleging Military Lending Act violations.

2025-07-11

The parties filed the stipulated final judgment and proposed order, and the court entered the judgment resolving the lawsuit; the order imposed $5 million in redress, a $4 million civil penalty, and prospective MLA compliance requirements.

2025-07-22

The CFPB terminated the 2013 Cash America consent order after determining that the predecessor had fulfilled its obligations, including paying a $5 million penalty and providing consumer redress.

Suggested considerations

• Compliance teams at creditors offering potentially MLA-covered consumer credit should consider mapping every product, including pawn loans, against the definition of consumer credit and testing whether fees and charges are included in the 36% Military Annual Percentage Rate calculation under 32 C.F.R. § 232.3(i).
• Firms should consider implementing documented procedures to determine covered-borrower status before or at account opening, using the Department of Defense database or another permitted method under the safe harbor in 32 C.F.R. § 232.5(b), and retaining the required evidence and timing records.
• Legal and product teams may wish to review loan agreements, disclosures, and servicing scripts for mandatory arbitration provisions and for all MLA disclosures required by 32 C.F.R. § 232.6, including the applicable payment-obligation and covered-borrower notices.
• Affected lenders should consider identifying loans made to servicemembers and covered dependents from October 3, 2016 onward, assessing potential MAPR, disclosure, and arbitration exposure, and evaluating remediation where historical controls were inadequate.
• Governance functions may wish to assign ownership for MLA compliance across underwriting, point-of-sale systems, branch operations, vendor management, complaint handling, and internal testing, with escalation for products that cannot reliably screen covered borrowers.
• Firms should consider reviewing the judgment and any applicable CFPB redress procedures before calculating restitution, and should avoid treating the termination of the predecessor’s 2013 consent order as relief from the separate FirstCash obligations.

What changed

The July 11, 2025 stipulated final judgment, entered by the court the same day, requires FirstCash and its subsidiaries to set aside $5 million to provide full redress in connection with thousands of unlawful pawn loans and pay $4 million to the CFPB victims relief fund. Going forward, the defendants must comply with the Military Lending Act, 10 U.S.C. § 987, and its implementing regulation, 32 C.F.R. part 232, including the 36% MAPR limit, the prohibition on mandatory arbitration, and required disclosures.

Key dates

2024-05-31

The CFPB published Use of Digital User Accounts to Access Buy Now, Pay Later Loans at 89 Fed. Reg. 47,068, treating covered BNPL lenders as card issuers under Regulation Z.

2025-05-06

The CFPB announced that it would not prioritize enforcement actions based on the BNPL interpretive rule and was contemplating rescission.

2025-05-12

The CFPB subsequently withdrew the 2024 BNPL interpretive rule as part of its withdrawal of guidance documents.

Suggested considerations

• Compliance teams may wish to document the distinction between the CFPB's enforcement-priority statement and a formal repeal, noting that the announcement itself did not provide a safe harbor from the Truth in Lending Act, Regulation Z, UDAAP, Fair Credit Reporting Act, or applicable state law.
• BNPL providers should consider preserving existing Regulation Z implementation records, including disclosures, account statements, dispute and error-resolution procedures, refund processes, complaint files, and change-management documentation, because the CFPB's announcement did not authorize retrospective noncompliance and future policy could change.
• Firms may wish to verify the current status of the 2024 interpretive rule and monitor CFPB Federal Register notices, supervisory publications, litigation developments, and any replacement rule or guidance.
• Product and legal teams should consider reassessing whether each BNPL product is subject to Regulation Z based on its structure and applicable statutory provisions, rather than relying solely on the withdrawn interpretive rule.
• Compliance teams may wish to continue testing disclosures, payment schedules, fees, refund handling, billing-error response, complaint management, and marketing for compliance with remaining federal and state requirements.
• Multi-state providers should consider separately reviewing state licensing, rate, fee, disclosure, dispute-resolution, privacy, and unfair-practices requirements; independent commentary specifically identified New York legislation imposing BNPL licensing and supervision requirements, a 16 percent interest cap, fee restrictions, and additional consumer safeguards.
• Firms may wish to maintain contingency plans that allow rapid restoration or modification of credit-card-style Regulation Z controls if federal enforcement priorities or the legal status of BNPL products changes.

What changed

The CFPB stated that enforcement actions based on Use of Digital User Accounts to Access Buy Now, Pay Later Loans, 89 Fed. Reg. 47,068 (May 31, 2024), would not be a priority. The Bureau said it would redirect enforcement and supervision resources toward pressing consumer threats, particularly those involving servicemembers, veterans, taxpayers, and small businesses. The Bureau also said it was contemplating appropriate action to rescind the interpretive rule; subsequent CFPB materials identified the rule as withdrawn on 2025-05-12.

Key dates

2025-02-07

The Fifth Circuit stayed the Section 1071 rule pending appeal in Texas Bankers Association v. CFPB and tolled compliance deadlines only for the case’s plaintiffs and intervenors, subject to further court modification.

2025-04-30

The CFPB published the policy statement announcing that it would not prioritize enforcement or supervision against entities outside the Fifth Circuit stay.

2025-05-12

The CFPB withdrew the policy statement as part of its broader withdrawal of policy statements, interpretive rules, advisory opinions, and other guidance.

2025-06-18

The CFPB issued an interim final rule extending Section 1071 compliance dates for all regulated entities by approximately one year; the earliest revised date for the highest-volume tier was July 1, 2026.

2026-05-01

The CFPB issued a final reconsideration rule revising Regulation B subpart B and extending the revised framework’s general compliance date to January 1, 2028.

Suggested considerations

• Compliance teams may wish to avoid treating the 2025-04-30 announcement as a formal repeal, exemption, or safe harbor, and should document the distinction between enforcement prioritization and continuing statutory or regulatory obligations.
• Covered lenders should consider preserving existing Section 1071 governance, data mapping, recordkeeping, and implementation work where proportionate, while assessing whether the 2026 final reconsideration rule changes the applicable scope, data points, procedures, or implementation timetable.
• Firms should consider identifying whether they are plaintiffs, intervenors, or members of an association covered by the Texas Bankers Association stay, because the original court order did not apply uniformly to all covered institutions.
• Compliance teams may wish to monitor the CFPB’s Section 1071 rulemaking, the status of Texas Bankers Association v. CFPB, and subsequent Federal Register amendments rather than relying on the withdrawn policy statement as current guidance.
• Lenders should consider retaining an audit trail for any decision to pause, scale, or continue implementation, including legal analysis of the applicable rule version, court orders, CFPB amendments, and operational or fair-lending risks.
• Covered institutions may wish to assess whether existing small-business application and demographic-data processes could support future reporting, because the CFPB’s enforcement posture did not eliminate potential litigation, examination, state-law, fair-lending, or reputational exposure.

What changed

The CFPB stated that it would deprioritize enforcement and supervision of the Small Business Lending Rule against entities not covered by the court-ordered stay, citing limited resources and the perceived unfairness of treating similarly situated institutions differently. The statement did not create a formal exemption, alter Regulation B, remove Section 1071 data-collection and reporting obligations, or expand the Fifth Circuit’s stay, which initially tolled compliance dates only for the plaintiffs and intervenors in Texas Bankers Association v. CFPB.

Key dates

2024-07-08

The final rule was published at 89 Fed. Reg. 56028.

2024-09-16

The final rule became effective.

2025-01-14 Deadline

Initial implementation deadline for larger participant CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(1).

2025-04-11

The CFPB announced its policy of not prioritizing enforcement or supervision actions for failures to meet future registration deadlines under 12 CFR part 1092.

2025-04-14 Deadline

Implementation registration deadline for other CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(2).

2025-07-14 Deadline

Implementation registration deadline for all other covered nonbanks under 12 CFR 1092.206(a)(3).

Suggested considerations

• Compliance teams may wish to document whether the entity is a covered nonbank and whether any agency or court order meets the covered-order criteria in 12 CFR 1092.201, including the requirement that the order be a final public order identifying the entity and imposing obligations based in whole or in part on specified consumer-law or UDAAP violations.
• Firms should consider preserving an inventory of potentially covered orders, registration data, and supporting legal analyses even if they elect not to file while the CFPB's prioritization policy remains in effect.
• Covered entities may wish to assess whether filing by the applicable date remains preferable for licensing, supervisory, litigation, diligence, or reputational reasons, rather than treating the announcement as a definitive exemption.
• Compliance teams should monitor for a proposed rulemaking, final rule, formal withdrawal, or further CFPB communication that changes the status or scope of 12 CFR part 1092.
• CFPB-supervised registered entities should continue evaluating the separate annual written-statement requirements in 12 CFR 1092.204 and should not assume that the announcement eliminates obligations other than the future registration-deadline enforcement priority described.
• Firms may wish to record the policy statement as an enforcement-risk and resource-allocation development, not as a statutory safe harbor against other CFPB, state, or private-party consequences for underlying consumer-law violations.

What changed

The CFPB stated that it will not prioritize enforcement or supervision actions concerning failures to submit registration information by future deadlines under the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders, codified at 12 CFR part 1092. The stated policy covers, among other entities, nonbanks subject to the implementation deadlines in 12 CFR 1092.206(a)(2) and 12 CFR 1092.206(a)(3). The CFPB will instead focus enforcement and supervision resources on pressing threats to consumers.

Key dates

2025-03-28

The CFPB announced that it would not prioritize supervision or enforcement involving penalties or fines under the Payment Withdrawal and Payment Disclosure provisions and said it was considering a rulemaking to narrow the rule's scope.

2025-03-30

The Payment Withdrawal and Payment Disclosure provisions of the Payday, Vehicle Title, and Certain High-Cost Installment Loans Regulation became operative after litigation-related delays.

Suggested considerations

• Firms should continue treating 12 C.F.R. §§ 1041.7 and 1041.9 as operative unless and until a legally effective amendment changes them.
• Compliance teams may wish to preserve controls that prevent additional payment-transfer attempts after two consecutive failed transfers for insufficient funds unless a new authorization satisfying the rule is obtained.
• Firms should review pre-withdrawal, post-failure, and other payment-related notices for compliance with the applicable content, timing, and delivery requirements in 12 C.F.R. § 1041.9.
• Lenders may wish to document the CFPB announcement separately from their formal compliance risk assessment, because the announcement describes enforcement priorities rather than a legal exemption or limitation on private, state, or other applicable enforcement exposure.
• Firms should assess state attorney general and state regulator exposure, including the possibility of enforcement under the Consumer Financial Protection Act and applicable state consumer-protection laws.
• Compliance teams may wish to monitor any CFPB notice of proposed rulemaking, Federal Register publication, litigation, and subsequent effective-date activity before changing production controls.
• Covered lenders should retain evidence of payment-attempt logic, consumer authorizations, notices, exceptions, and records required by the rule so that supervisory or state inquiries can be addressed.

What changed

The CFPB stated that it would deprioritize enforcement and supervision actions concerning penalties or fines associated with the rule's Payment Withdrawal and Payment Disclosure provisions. The operative rule continues to restrict a covered lender from attempting additional payment withdrawals after two consecutive failed attempts caused by insufficient funds unless the consumer provides a new authorization, and it requires specified payment-related notices, including notices before certain withdrawals and after two consecutive failed attempts.

Key dates

2020-07-15

The CFPB filed its enforcement action against Townstone Financial and Barry Sturner alleging unlawful redlining-related conduct.

2024-11-07

The Northern District of Illinois entered the stipulated final judgment and order, including a $105,000 civil money penalty and restrictions concerning Equal Credit Opportunity Act compliance.

2025-03-26

The CFPB and Townstone jointly filed a Rule 60(b)(6) motion seeking relief from and vacatur of the stipulated final judgment and order.

2025-03-28

The CFPB publicly announced its request to vacate the Townstone judgment, dismiss the case, and return the penalty.

2025-06-12

The Northern District of Illinois denied the joint motion, finding that the parties had not shown the extraordinary circumstances required for Rule 60(b)(6) relief; the judgment therefore remained in effect.

Suggested considerations

• Compliance teams at mortgage lenders may wish to treat the Townstone stipulated final judgment entered on November 7, 2024 as remaining operative unless and until a court orders otherwise; the June 12, 2025 denial means the announced vacatur did not change the firm's obligations.
• Firms may wish to continue monitoring fair-lending risk using application, approval, origination, pricing, geography, marketing, and servicing data, while documenting legitimate business explanations for geographic or demographic disparities.
• Mortgage lenders and brokers may wish to review marketing, community outreach, loan-officer activity, branch and office locations, underwriting practices, and public-facing statements for potential discouragement or differential treatment under the Equal Credit Opportunity Act and Regulation B.
• Firms with CFPB consent orders may wish to avoid assuming that a change in CFPB leadership or enforcement priorities permits unilateral suspension, modification, or refund of settlement obligations; any such relief generally requires the relevant court or other legally authorized process.
• Legal and compliance teams may wish to preserve records supporting fair-lending analyses and governance decisions, including data definitions, screening methodology, model limitations, qualitative review, escalation decisions, and communications concerning public statements or marketing content.
• Industry participants may wish to distinguish the CFPB's litigation position in Townstone from a binding change to redlining standards: the publication did not repeal, amend, or narrow the Equal Credit Opportunity Act, Regulation B, the Fair Housing Act, or applicable supervisory expectations.

What changed

The CFPB publication announced a proposed litigation step, not a new regulation, supervisory requirement, or generally applicable enforcement policy. The joint motion alleged that the prior redlining investigation and settlement were materially flawed, including alleged reliance on mortgage application and origination disparities, analysis of Townstone's public statements, and infringement of First Amendment rights. The motion sought to vacate the stipulated final judgment and order, dismiss the case, and return the $105,000 penalty.