
Our Take
CFPB is on thin ice but consumer protection laws are still on the books. Although Secretary Bessent is nominally taking on a second role, it appears that his responsibilities – as well as those of most CFPB staff – will be significantly limited. Industry critics of the CFPB, including the financial institutions it supervises, have cheered the agency’s activities coming to a standstill. However, behind those cheers the sudden cessation of enforcement raises numerous questions about how banks should proceed with compliance activities and implementation of programs to comply with pending rulemaking. While banks will make their own legally-informed choices on how to proceed, there are several factors to consider. The 2010 Dodd-Frank Act (DFA) gave rulemaking and enforcement authority for consumer protection laws to the CFPB along with the mandate to educate consumers, conduct research, and collect consumer complaints. This statute remains on the books, as do the consumer protection laws the CFPB is charged with enforcing, which largely predate the DFA. Laws in place before the CFPB’s existence were previously enforced by other agencies including the Fed, OCC, FDIC and NCUA, along with state attorneys general and through civil litigation. It is increasingly likely that Republicans will succeed in cutting CFPB funding through budget reconciliation, but it would take a further act of Congress to revert consumer protection rulemaking, as well as full examination and enforcement authority, to other agencies. In the meantime, banks are still required to comply with consumer protection laws and the question on enforcement of those laws is a matter of who and when, not if.
Banks are not off the hook. In addition to banks having a continued obligation to comply with existing laws, it is also important to remember that actions by financial institutions and new CFPB leadership are subject to both actual courts and the court of public opinion. Consumers alleging harm can sue financial institutions and consumer groups may file a suit against the order to freeze CFPB activities. There have also been prominent cases of consumer harm hitting the headlines and damaging the reputations of financial institutions as well as receiving criticism from both sides of the aisle. With all of these factors in play, the CFPB freeze does not mean that banks are free to abandon their consumer protection compliance programs. They should still maintain policies, procedures and controls to minimize the risk of consumer harm as pausing, deferring or eliminating compliance activities could increase both legal and reputational risk. Although the ultimate fate of rules that are not yet effective and undergoing legal challenge remains to be seen, those that are a statutory requirement of the DFA may survive with modifications.
1. Congress can attach policy changes to budget bills that pass with a simple majority through the reconciliation process.