Consumer Financial Protection Bureau (CFPB)

The Consumer Financial Protection Bureau is the federal agency dedicated to protecting consumers in the financial marketplace. Created by the Dodd-Frank Act in 2010 in response to the financial crisis, the CFPB consolidated consumer financial protection authority that was previously scattered across seven different federal agencies. It has rulemaking, supervision, and enforcement authority over banks, credit unions, mortgage companies, payday lenders, debt collectors, and other consumer financial service providers.

Current Law (2026)

Legal Authority

• 12 U.S.C. § 5491 — Establishment (creates the CFPB as an independent bureau within the Federal Reserve System; the Director is appointed by the President with Senate confirmation)
• 12 U.S.C. § 5492 — Executive and administrative powers (establishes the Bureau's general policy-making and administrative authority)
• 12 U.S.C. § 5493 — Administration (authorizes the Director to appoint staff including attorneys, compliance examiners, and economists)
• 12 U.S.C. § 5494 — Consumer Advisory Board (advises on emerging consumer financial practices and provides input on Bureau functions)
• 12 U.S.C. § 5497 — Funding (funded through transfers from Federal Reserve System earnings — not subject to congressional appropriations, giving the Bureau financial independence)
• 12 U.S.C. § 5511 — Purpose, objectives, and functions (the Bureau's purpose: ensure consumers have access to markets for consumer financial products that are fair, transparent, and competitive; the Bureau shall seek to implement and enforce federal consumer financial law)
• 12 U.S.C. § 5512 — Rulemaking authority (authorizes the Bureau to prescribe rules under federal consumer financial laws, including TILA, RESPA, ECOA, FCRA, FDCPA, and others)
• 12 U.S.C. § 5531 — Prohibiting unfair, deceptive, or abusive acts or practices (UDAAP authority — the Bureau may declare specific acts or practices unfair, deceptive, or abusive and take enforcement action)
• 12 U.S.C. § 5536 — Prohibited acts (makes it unlawful for any covered person to violate federal consumer financial law or engage in unfair, deceptive, or abusive acts)
• 12 U.S.C. § 5581 — Transfer of functions (transferred consumer protection functions from OCC, OTS, FDIC, Federal Reserve, NCUA, HUD, and FTC to the CFPB)

How It Works

The CFPB's creation fundamentally reorganized consumer financial regulation. Before 2010, consumer financial protection was divided among seven agencies, each focused primarily on the safety and soundness of the institutions they supervised — not on consumers. The CFPB consolidated this authority into a single agency whose sole mission is consumer protection.

The Bureau has three core functions. Rulemaking: the CFPB writes the rules implementing 18 federal consumer financial laws, including Truth in Lending (TILA), Real Estate Settlement Procedures Act (RESPA), Equal Credit Opportunity Act (ECOA), Fair Credit Reporting Act (FCRA), and Fair Debt Collection Practices Act (FDCPA). Supervision: the Bureau directly examines banks with over $10 billion in assets and certain nonbank financial companies (mortgage companies, payday lenders, private student lenders, debt collectors) for compliance with consumer protection laws. Enforcement: the Bureau can bring enforcement actions — through administrative proceedings or federal court — against any entity that violates consumer financial law.

The UDAAP authority (unfair, deceptive, or abusive acts or practices) gives the CFPB broad power to address harmful conduct even when no specific rule prohibits it. The "abusive" standard — new with Dodd-Frank — goes beyond traditional "unfair and deceptive" standards by targeting practices that take unreasonable advantage of consumers' lack of understanding, inability to protect their own interests, or reasonable reliance on a covered person.

The CFPB's funding structure is one of its most debated features. Rather than receiving annual congressional appropriations, the Bureau is funded through transfers from Federal Reserve System earnings — up to a statutory cap. This insulates the Bureau from political pressure through the appropriations process but has been challenged as unconstitutional (the Supreme Court upheld the funding mechanism in CFPB v. Community Financial Services Association, 2024).

The Bureau also operates a consumer complaint database — a public platform where consumers can submit complaints about financial products and companies, which the Bureau routes to companies for response and uses to identify systemic problems.

How It Affects You

State Variations

• State usury laws, lending restrictions, and licensing requirements operate alongside federal rules

Implementing Regulations

• 12 CFR Part 1070 — CFPB disclosure of records and information (FOIA requests, responses, fees, confidential treatment)

• 12 CFR Part 1073 — CFPB debt collection (notice requirements and voluntary repayment agreements where CFPB is creditor agency)

• 12 CFR Part 1082 — State official enforcement notification procedures (notifying CFPB when a state official takes enforcement action under Dodd-Frank Title X)

• 12 CFR Part 741 — NCUA requirements for federally insured credit unions (§ 741.220 — privacy of consumer financial information)

• 12 CFR Part 1080 — Rules Relating to Investigations: the CFPB's procedures for conducting investigations of potential violations of consumer financial law, including the Bureau's Civil Investigative Demand (CID) authority under Dodd-Frank § 1052 (12 U.S.C. § 5562). A CID is the CFPB's primary investigative tool — functionally equivalent to a grand jury subpoena in civil enforcement investigations, compelling the production of documents, tangible objects, written reports, and oral testimony. Key provisions:

  • § 1080.4 — Initiating investigations: the Enforcement Director may initiate an investigation whenever there is reason to believe a consumer financial law may have been violated; investigations may be non-public; CFPB policy is to conduct investigations non-publicly unless the subject consents or public disclosure becomes necessary for enforcement
  • § 1080.5 — Notification of purpose: any person compelled by a CID must be notified at the time of service of the investigation's general subject matter and the applicable law at issue; the notification-of-purpose requirement gives the recipient meaningful notice while protecting investigative details
  • § 1080.6 — Civil investigative demands: a CID may require production of documents, answers to written interrogatories, or oral testimony ("investigational hearing testimony"); a CID must specify the documents or information sought with sufficient definiteness that a reasonable person can identify what is required; recipients may petition the CFPB to modify or set aside a CID (§ 1080.6(f)) within 20 days; the Bureau must rule on objections before seeking court enforcement
  • § 1080.7 — Investigational hearings: the CFPB may require oral testimony under oath; witnesses may be represented by counsel; the hearing is non-public; witnesses may assert constitutional privileges; CFPB staff (not a judge) conduct the hearing, distinguishing investigational hearings from the adjudicative hearings under Part 1081
  • § 1080.10 — Noncompliance with CIDs: if a person fails to comply with a CID, the CFPB may seek enforcement in federal district court (Dodd-Frank § 1052(e)); courts have uniformly upheld CFPB CID authority when the demand is relevant to a lawful investigation and not unduly burdensome
  • § 1080.12 — Immunity orders: in rare circumstances, the CFPB may compel testimony from a witness who asserts a Fifth Amendment privilege by obtaining a court order granting immunity; statements made under such orders cannot be used against the witness in a criminal prosecution
  • § 1080.14 — Confidentiality: all material produced in response to a CID and all information derived from it are non-public unless the CFPB determines otherwise; the non-public rule prevents investigation subjects from alerting potential co-respondents; the CFPB may share CID material with other law enforcement agencies under inter-agency information sharing protocols

  The CID is the most coercive non-litigation tool in the CFPB's arsenal. Companies receiving a CID should treat it as the functional equivalent of a federal subpoena: respond fully and accurately (false or misleading responses expose respondents to separate liability), preserve all potentially responsive documents, and engage experienced regulatory counsel immediately. The 20-day window to petition for modification or quashing is a hard deadline. CFPB enforcement investigations have preceded major enforcement actions against mortgage servicers, auto lenders, payday lenders, debt collectors, and student loan servicers, typically taking 12–36 months from CID to consent order or litigation.

• 12 CFR Part 1081 — Rules of practice for adjudication proceedings (formal enforcement hearings under Dodd-Frank § 1053)

The CFPB's formal enforcement adjudication process under Part 1081 operates as an administrative court system for civil enforcement actions against financial services companies. When CFPB's enforcement division determines that a company violated a consumer financial protection law, it can either sue in federal district court or bring an in-house administrative proceeding — Part 1081 governs the latter. Key provisions:

• § 1081.100 — Scope: Part 1081 applies to all proceedings initiated by the CFPB under Dodd-Frank § 1053; the hearing officer presides as an independent adjudicator with authority to administer oaths, issue subpoenas, rule on motions, and manage the evidentiary record under APA § 556
• § 1081.200 — Commencement by Notice of Charges: the Bureau opens a proceeding by filing a Notice of Charges specifying the respondent, the factual allegations, the violated law or regulation, and the relief sought; the Notice is publicly docketed
• § 1081.201 — Answer: the respondent must file an answer within 14 days of service — a compressed timeline compared with most federal agency NOVAs (which typically allow 30 days); failure to answer results in the hearing officer treating the allegations as admitted
• § 1081.203 — Scheduling conference: the hearing officer convenes a scheduling conference to set deadlines for discovery, pre-hearing submissions, and the hearing date; the CFPB and respondent negotiate the schedule subject to the officer's supervision
• Subpart C — Hearings: the hearing is on the record under APA formal adjudication procedures; parties may present evidence, call and cross-examine witnesses, and submit proposed findings of fact; the hearing officer rules on admissibility
• Subpart D — Decision and Appeals: after the hearing closes, the hearing officer issues a recommended decision; the CFPB Director reviews the record and issues the final order; either party may petition for reconsideration; final CFPB orders are reviewable in federal court of appeals
• Subpart E — Temporary Cease-and-Desist Orders: the CFPB can seek a temporary C&D against a respondent without waiting for a full hearing — analogous to a temporary restraining order — by showing that the respondent's conduct is likely to cause substantial consumer harm or dissipation of assets pending the proceeding; the temporary C&D is itself reviewable in federal district court within 10 days

The practical significance: the CFPB's choice of forum (federal court vs. in-house adjudication) affects respondent strategy substantially. In-house proceedings give the CFPB home-court advantages (familiar hearing officers, CFPB-friendly procedural rules), while federal district court offers respondents Article III judges, full Federal Rules of Civil Procedure, and Seventh Amendment jury-trial rights for legal claims. The Supreme Court's Jarkesy v. SEC (2024) ruled that defendants in SEC fraud proceedings involving civil penalties have a Seventh Amendment right to a jury trial — a decision that significantly affected in-house SEC proceedings and raised analogous questions about CFPB administrative adjudications.

Recent rulemakings: The Part 1081 rules were amended in 2020 to align with recent APA and due-process developments and to clarify the hearing officer's procedural authority; no further substantive amendments since.

• 12 CFR Part 1015 — Mortgage Assistance Relief Services (Regulation O / MARS Rule): the CFPB's rule prohibiting advance fees and deceptive practices by companies offering mortgage modification, foreclosure prevention, or short sale assistance. The rule eliminated an industry of foreclosure rescue scammers that proliferated during the 2008–2012 mortgage crisis:

  • § 1015.3 — Prohibited representations: providers may not represent they will obtain a loan modification, stop foreclosure, or change any other terms of a mortgage if they cannot perform; may not claim to be affiliated with the borrower's lender or loan servicer without written authorization; may not claim to offer government-approved programs unless authorized; may not misrepresent the terms of any agreement; these prohibitions cover representations in advertising, communications, or any other commercial context
  • § 1015.5 — Prohibition on advance fees: mortgage assistance relief service providers may not request or receive any fee until: (1) the provider has obtained a written modification or relief agreement from the lender/servicer; AND (2) the consumer has received, reviewed, and accepted the agreement; the advance fee ban is absolute for the covered services — no upfront retainer, application fee, or "processing fee" is permitted; this provision alone eliminated most of the pre-Rule foreclosure rescue industry because the business model depended on collecting fees upfront before delivering any result
  • § 1015.4 — Required commercial disclosures: advertisements and commercial communications about MARS services must prominently disclose that: (1) the company is not associated with the government or the consumer's lender; (2) the lender may not agree to any modification; and (3) if the consumer stops paying their mortgage, they may lose their home; these mandatory disclosures prevent deceptive implications that the company has special access or that relief is guaranteed
  • § 1015.7 — Attorney exemption: licensed attorneys are exempt from most Regulation O requirements (including the advance fee ban) if they: provide mortgage assistance relief services as part of the practice of law; are licensed to practice in the state where the consumer or property is located; and comply with applicable state ethics rules; however, attorneys are still subject to the disclosure requirements and the prohibition on deceptive representations; the exemption reflects that attorneys may legitimately charge fees for legal services that happen to result in mortgage modifications — the rule targets scammers, not lawyers

  The MARS Rule was one of the most effective post-2008 consumer protection interventions. Before the rule, "foreclosure rescue" companies collected fees of $1,000–$5,000 or more from desperate homeowners while promising — but rarely delivering — loan modifications. The FTC and CFPB have brought dozens of MARS Rule enforcement actions; violations are strict-liability for the advance fee provision. State attorneys general may also enforce the Rule under § 1015.10. Companies assisting foreclosure relief providers with prohibited practices (providing scripting, marketing, or payment processing for MARS scammers) are also liable under the facilitating provision (§ 1015.6). Recent enforcement: FTC v. Consumer Defense LLC (D. Utah) — $22 million judgment for advance fees collected from struggling homeowners; numerous similar actions.

• 12 CFR Part 1075 — Consumer Financial Civil Penalty Fund Rule: the CFPB's regulations implementing Dodd-Frank Act § 1017(d) (12 U.S.C. § 5497(d)), which requires all civil penalties collected by CFPB in enforcement actions to be deposited into a dedicated Civil Penalty Fund and distributed either to victims of violations or to consumer education and financial literacy programs. The Civil Penalty Fund is a distinctive feature of CFPB's enforcement design — rather than penalties flowing to the U.S. Treasury as general revenue, they remain dedicated to consumer harm remediation:

  • § 1075.102 — Fund Administrator: the CFPB Director designates a Civil Penalty Fund Administrator who manages distributions; the Fund Administrator reports to the CFPB's Chief Financial Officer and is responsible for identifying eligible victims, making allocation decisions, and reporting on fund activity
  • § 1075.103 — Eligible victims: a victim is eligible for Civil Penalty Fund payment if (1) a CFPB final order imposed a civil penalty for violations that harmed the victim; and (2) the victim's harm is not fully compensated through other remedies ordered in the same action (restitution, disgorgement, or payments from redress funds set up by the respondent); the Civil Penalty Fund is supplementary to direct redress — it compensates residual uncompensated harm after other remedies are applied
  • § 1075.104 — Payments to victims: the CFPB uses Civil Penalty Fund money to compensate eligible victims' uncompensated harm; payments are made directly to victims (or to a subaccount administered by a payment administrator if the class is large); the Fund Administrator tracks each class of victims corresponding to each enforcement action
  • § 1075.105–1075.106 — Allocation: when the fund has sufficient money to fully compensate all eligible victims across all pending classes: the Fund Administrator allocates the full uncompensated harm amount to each victim class; when funds are insufficient to fully compensate all classes: the Fund Administrator allocates proportionally — each victim class receives a share equal to its uncompensated harm as a percentage of total uncompensated harm across all classes; the proportional allocation prevents first-in-time enforcement actions from exhausting the fund at the expense of victims from later actions
  • § 1075.107 — Consumer education and financial literacy: if, after allocating to all eligible victim classes, funds remain in the Civil Penalty Fund — because victims cannot be identified or located, or because full compensation has been achieved — the Fund Administrator may allocate residual funds to consumer education and financial literacy programs operated or funded by the CFPB; this secondary use ensures penalty dollars continue to benefit consumers even when victim-specific distribution is impractical

  The Civil Penalty Fund approach reflects a consumer-protection philosophy: wrongdoers' fines should remediate consumer harm rather than subsidize general government revenue. In practice, CFPB enforcement actions commonly include both redress orders (restitution to identifiable victims paid by the respondent directly) and civil penalties; the Civil Penalty Fund handles compensation for victims who couldn't be identified or reached through the primary redress process, and for harms that exceed the respondent's ability to pay. Recent enforcement context: following major enforcement actions (Wells Fargo fake accounts — $100M civil penalty; Navy Federal Credit Union — $95M civil penalty), substantial funds have flowed through the Civil Penalty Fund; the Fund Administrator publishes an annual report on fund activity and distributions.

• 12 CFR Part 1091 — Procedures for Supervisory Designation Proceedings: the rules governing how the CFPB may designate a nonbank financial company — one not automatically subject to CFPB supervision under the "larger participant" rules — for CFPB supervision by finding it poses risks to consumers. This "risk-based supervision" authority (12 U.S.C. § 5514(a)(1)(C)) supplements the CFPB's market-segment supervision authority and allows the Bureau to supervise any nonbank company when warranted by its consumer risk profile. Key provisions:

  • § 1091.102 — Notice of Reasonable Cause: the CFPB initiates a designation proceeding by serving the company with a written "Notice of Reasonable Cause" — a finding by the Bureau's initiating official that CFPB may have reasonable cause to determine the company is engaging in conduct that poses risks to consumers; the Notice may be based on consumer complaints collected through the CFPB's complaint system or on information from other sources; the Notice identifies the factual basis and documents relied on (consistent with protecting sensitive information)
  • § 1091.103/1091.105 — Notice content and response: the Notice must inform the respondent that it has 30 days to file a written response with the recommending official; the response must contest the reasonable cause finding, include supporting documents, and may request a supplemental oral presentation; failure to respond within 30 days waives the oral response opportunity
  • § 1091.106 — Supplemental oral response: if requested, the recommending official holds an oral presentation (telephone, video conference, or in person at CFPB headquarters); the proceeding has no discovery and no witnesses — it is a structured advocacy opportunity, not a formal adjudicatory hearing
  • § 1091.108 — Recommended determination: within 45 days of the response (or 90 days if an oral response was held), the recommending official issues a recommended determination on whether reasonable cause exists; the recommended determination and the full record are submitted to the CFPB Director
  • § 1091.109 — Director's determination: the Director has 45 days to adopt, modify, or reject the recommended determination and must issue either (a) a decision and order subjecting the respondent to CFPB supervision, or (b) a notification that the respondent is not subject to supervision; a no-supervision notification has no precedential effect and does not bar future proceedings
  • § 1091.110 — Voluntary consent: a company may voluntarily consent to CFPB supervision at any time during the proceeding, ending the proceeding; voluntary consent is the most common outcome

  The designation proceeding is the mechanism through which the CFPB has sought to bring fintech companies, buy-now-pay-later providers, and other nonbank financial entities under direct examination. The Biden CFPB announced a policy of more aggressively using this authority to supervise consumer-facing nonbanks. The Trump CFPB paused the use of this authority in early 2025. Because designation subjects the respondent to regular CFPB examinations for compliance with consumer financial laws, companies have a strong incentive to challenge Notices of Reasonable Cause or negotiate voluntary consent with favorable terms.

Pending Legislation

• S 3561 — Define BNPL in TILA, require CFPB rules and supervision. Status: Introduced.
• HR 6891 — Add BNPL to federal lending rules, give CFPB one year to write regulations. Status: Introduced.
• S 3660 — Cap late fees at $8 for large card issuers, require CFPB rulemaking. Status: Introduced.
• HR 7035 — Ban exclusive credit-card network routing, limit CFPB enforcement scope. Status: Introduced.
• HR 7588 — Require consumer attestation under penalty of perjury for CFPB complaints. Status: Introduced.
• HR 2429 — Stop the Scammers Act: creates a CFPB whistleblower award and protection program and raises the agency's funding ceiling. Status: Introduced.

Recent Developments

• DOGE attempt to shut down CFPB (2025): In February 2025, DOGE operatives gained access to CFPB systems and the Trump administration's acting director Russell Vought effectively halted new CFPB activity — stopping enforcement actions, withdrawing pending rules, halting supervision, and directing staff to pause work. Vought tweeted "CFPB RIP." Federal courts issued preliminary injunctions blocking the most drastic steps, finding that the administration could not simply refuse to execute the CFPB's statutory functions. The Bureau continued operating under judicial oversight, though at significantly reduced activity levels.
• Director Rohit Chopra fired; acting leadership: Chopra was removed as Director on January 31, 2025. Treasury Secretary Scott Bessent served briefly as acting director before Trump designated OMB Director Russ Vought as Acting Director on February 7, 2025. The Trump administration installed acting directors with explicit deregulatory mandates. The CFPB announced it would not enforce several Biden-era rules, dropped numerous pending enforcement actions, and began a review to rescind or substantially modify rules including the credit card late fee cap (dropped to $8), the small-business lending data rule (§ 1071), open banking rules, and medical debt credit reporting rules.
• Supreme Court funding decision preserved the agency: CFPB v. Community Financial Services Association (2024) upheld CFPB's Federal Reserve-based funding mechanism as constitutional — ruling 7-2 that Congress had the authority to fund the Bureau outside the annual appropriations process. This resolved the most significant structural challenge to the agency's existence. However, CFPB's survival as a legal entity doesn't prevent the executive branch from choosing not to enforce its mandates.
• Rules unwound or abandoned: Biden-era rules that the Trump CFPB dropped or paused include: the credit card late fee cap ($8 limit on late fees for large card issuers — dropped pending reconsideration), small business lending data collection under § 1071 (paused), overdraft fee rulemaking (dropped), medical debt credit reporting prohibition (reversed), and open banking/data portability rules. The practical effect is a substantial rollback of consumer financial protections finalized in 2023-2024.
• State attorneys general stepping in: California (DFPI), New York (DFS), and other state consumer financial regulators announced expanded enforcement of consumer financial laws as federal CFPB enforcement retreated. State AGs filed suits challenging CFPB inaction. The patchwork of state protection will be uneven — states without strong consumer financial regulators will see protection gaps.