CFPB Settles First Action Under New Leadership: Current State of the CFPB and a Look Ahead

The Consumer Financial Protection Bureau (“CFPB” or “Bureau”) has seen significant changes since President Donald Trump fired former Director Rohit Chopra in January 2025. Under Acting Director Russell Vought, the CFPB has reversed a substantial number of prior Bureau initiatives, including dismissing actions with prejudice, withdrawing guidance, terminating ongoing consent order obligations, and rescinding rules. 

Significantly, earlier this month, the CFPB released its first settlement under Acting Director Vought. The final judgment settles a lawsuit filed by the Biden-era CFPB in 2021 alleging violations of the Military Lending Act (“MLA”), including allegations that the defendant made loans to borrowers in excess of the MLA’s maximum allowable annual percentage rate of 36%. The monetary provisions of the order are not trivial. The settlement requires the defendants to pay a civil money penalty of $4 million and reserve $5 million for the purpose of providing redress to impacted consumers.

This Legal Update discusses the current state of the Bureau and what to expect ahead.

Current State of the CFPB: Acting Director and Staffing

Acting Director Vought, who is also the director of the Office of Management and Budget, has served as acting director of the Bureau since February 2025.¹ The Trump Administration initially nominated Jonathan McKernan to be the CFPB’s permanent director, but in May 2025, the Administration nominated McKernan for undersecretary of domestic finance at Treasury. The Administration has not announced another nominee for Bureau director, and it is possible that Vought could remain acting director for the foreseeable future.²

In April 2025, Acting Director Vought attempted to eliminate approximately 90% of the agency’s staff, but this effort is currently on hold pending litigation. Mark Paoletta, the CFPB’s chief legal officer, explained that CFPB leadership identified “vast waste” in the agency’s size and that the firings were designed to right-size the Bureau to better align with the Trump Administration’s policy. If permitted to go forward, approximately 200 employees would remain, with 50 of these employees in Supervision and another 50 in Enforcement. In addition, the newly passed reconciliation act, known as the One Big Beautiful Bill Act, reduces the amount of funding that the CFPB can request from the Federal Reserve from 12 percent of the Federal Reserve annual operating budget to 6.5 percent. This reduction in funding capacity also could impact staffing levels in the future.

In addition, in connection with a lawsuit filed by the National Treasury Employees Union, which represents CFPB employees and certain other federal government employees, the CFPB currently is prohibited from taking other actions, such as destroying certain agency data and enforcing an order that employees stop all work.

Substantial Rollback of Prior Actions

In the first few months of Acting Director Vought’s tenure, the Bureau has reversed several prior Bureau actions, including actions taken under Trump-appointed Director Kathy Kraninger.

• Enforcement: The Bureau moved to dismiss a number of pending lawsuits with prejudice. Dismissing a case with prejudice is significant because it essentially prohibits the Bureau from filing the same claims against the defendant in the future. In addition, the Bureau terminated certain finalized administrative consent orders entered during the last Administration that were still in effect, waiving any alleged noncompliance with the orders. Along these lines, the Bureau also moved to vacate a settlement previously entered by a federal court. Notably, the lawsuit was filed during President Trump’s first term while the Bureau was under the leadership of his appointee, Director Kraninger. The court denied the motion, citing the public interest in the finality of judgments. Along with its motion to vacate the settlement, the Bureau issued a press release asserting that the prior Bureau “abused its power” and acted with “zero evidence” to further the goal of DEI in lending.

These rollbacks indicate that current Bureau leadership may be open to outreach from regulated entities challenging prior CFPB positions. In addition, as discussed below, the Bureau has continued limited public enforcement matters.

• Rulemaking and Guidance: The Bureau has engaged in rulemaking to rescind certain effective rules and withdraw certain proposed rules. Among others, the Bureau issued a proposed rule to rescind the rule creating the Repeat Offender Registry.³ As another example, the Bureau withdrew its proposed data broker rule amending Regulation V.⁴ In addition, the CFPB issued an interim final rule to rescind protections and flexibilities added during the COVID pandemic that allowed mortgage servicers to offer more streamlined loss mitigation options to borrowers.⁵  

Further, in May 2025, the Bureau rescinded approximately 60 guidance documents, including previously issued bulletins, consumer protection circulars, and policy statements, among other guidance documents.⁶ The reason for these actions was the new leadership’s concern that previously the Bureau used such guidance as de facto rulemaking to avoid the requirements of the Administrative Procedure Act.  To the extent that was the case, any obligations implicitly imposed by the guidance is no longer in effect. The underlying laws, though, have not changed in most cases.

A Look Ahead: What to Expect from the CFPB

An April 2025 memo outlining the Bureau’s 2025 supervisory and enforcement priorities states that the Bureau will focus on protecting servicemembers and their families. It also indicates that the Bureau will prioritize “actual fraud against consumers” and “measurable consumer damages.” According to the memo, mortgages will receive the highest priority, with other areas of focus including the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, and “fraudulent” fees. Further, the memo states that the Bureau will not pursue supervision under novel legal theories and understands that its “primary enforcement tools are its disclosure statutes,” possibly signaling that the current CFPB will be less likely to find a practice unfair or abusive if it is clearly disclosed. The Bureau plans to deprioritize areas such as student loans, medical debt, peer-to-peer platforms, and digital payments. The Bureau also stated that it would focus on “getting money back directly to consumers” rather than imposing penalties.

The first CFPB settlement under Acting Director Vought generally is consistent with these priorities. It focuses on protecting servicemembers. On the other hand, even though the Bureau’s April 2025 priorities memo indicated that it would focus on consumer redress rather than penalties, the civil money penalties imposed by the settlement are sizeable. As explained above, the defendant will be required to pay a civil money penalty of $4 million, and reserve $5 million for the purpose of providing redress to impacted consumers. The CFPB continues to pursue a limited number of other public enforcement actions.  

Reading the tea leaves, it seems likely that we can expect to see a substantially lower level of Bureau enforcement, but that enforcement will not halt altogether and will be particularly focused on traditional fraudulent activities. Further, settlements may continue to impose substantial monetary requirements, including civil money penalties in the millions of dollars.

Potential for Increased State Activity

A decrease in CFPB enforcement actions may motivate state regulators to fill the enforcement void. We have not seen a dramatic increase in state actions to date, but it will necessarily take states time to hire staff and initiate investigations that will ultimately lead to public settlements. Notably, there have been reports of former CFPB staff joining various state regulator and attorney general offices.

While states have their own consumer financial laws that they enforce, including UDAP/UDAAP prohibitions, they could also enforce certain federal consumer financial laws. With some limitations on actions against national banks or federal savings associations, Section 1042 of the Dodd-Frank Act provides that state attorneys general may bring a civil action to enforce Title X of the Dodd-Frank Act or regulations issued under Title X of the Dodd-Frank Act.⁷ Similarly, Section 1042 provides that a state regulator may bring a civil action or other appropriate proceeding to enforce the provisions of Title X of the Dodd-Frank Act or regulations issued under Title X of the Dodd-Frank Act with respect to any entity that is state-chartered, incorporated, licensed, or otherwise authorized to do business under state law.⁸ With respect to a national bank or federal savings association, Section 1042 provides that state attorneys general may bring an action to enforce a regulation prescribed by the Bureau under Title X of the Dodd-Frank Act.⁹

Enforcing Title X of the Dodd-Frank Act could include enforcing the Act’s UDAAP prohibition. Whether states have the authority under the Dodd-Frank Act to enforce the 18 enumerated federal consumer financial laws—such as the Truth in Lending Act and the Fair Credit Reporting Act, and their implementing regulations—is a trickier question.

In 2022, the CFPB published an interpretive rule taking the position that because Title X declares that it is unlawful for a covered person or service provider to offer or provide any consumer a financial product or service that is not in conformity with the 18 enumerated federal consumer financial laws, states have the authority to bring an action under the Dodd-Frank Act for violations by a covered person or service provider of any of the enumerated consumer financial laws.¹⁰ A federal court has agreed with this view.¹¹ The current Bureau has taken a different view. In May 2025, the CFPB rescinded its previously issued interpretive rule and took the position that Congress did not intend to permit states to enforce “any provision of any [f]ederal consumer financial law.”¹²

Section 1042 of the Dodd-Frank Act provides that state attorneys general or state regulators must provide notice to the Bureau when initiating an action to enforce Title X of the Dodd-Frank Act or regulations issued under Title X of the Dodd-Frank Act. In response, the CFPB may intervene in the state action as a party to prevent state enforcement. The Bureau can remove the action to an appropriate United States district court, be heard on all matters arising in the action, and appeal orders or judgments.¹³

In addition to authority under the Dodd-Frank Act, certain federal consumer financial laws expressly provide state enforcement authority. States, for example, may bring suit under the Fair Credit Reporting Act.¹⁴

Conclusion and Compliance Considerations

As the Bureau’s trajectory becomes clearer, regulated entities should continue to ensure their practices comply with the law and regulations applicable to the Bureau’s stated priorities—including the MLA and the Servicemembers Civil Relief Act. Moreover, this is not the time to skimp on compliance with other consumer financial laws. The applicable statute of limitations can extend well into the future, and it is possible that in three and a half years a more aggressive Bureau could bring an action based on an entity’s conduct during the current Administration. Further, given the potential for increased state scrutiny, regulated entities should ensure they maintain robust compliance management programs covering both state and federal obligations.

 

---

 

¹ Before Acting Director Vought, Scott Bessent served as acting director for less than a week.

² The Federal Vacancies Reform Act limits how long an acting officer may fill a vacant presidentially appointed, Senate-confirmed position in an executive agency. Specifically, the Act provides that during presidential inaugural transitions, if a vacancy exists within 60 days after the inauguration, then the acting director may serve up to 210 days, beginning 90 days after inauguration day or 90 days after the date the vacancy occurred, whichever is later. 5 U.S.C. § 3349a. Further, the Act also allows a person to serve for additional 210-day periods after the first or second nomination is rejected, withdrawn, or returned. Id. § 3346(b).

³ CFPB, “Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders; Proposed Rescission,” 90 Fed. Reg. 20406 (May 14, 2025). In June 2024, the CFPB finalized a rule requiring nonbank covered persons to provide information about their compliance with certain public orders. 

⁴ CFPB, “Protecting Americans From Harmful Data Broker Practices (Regulation V); Withdrawal of Proposed Rule,” 90 Fed. Reg. 20568 (May 15, 2025). In December 2024, the CFPB issued a proposed rule to amend Regulation V which implements the Fair Credit Reporting Act. The proposed rule included requirements related to the flow of consumer information and would have brought companies operating as data brokers and information intermediaries under the FCRA’s regulatory umbrella.

⁵ CFPB, “Protections for Borrowers Affected by the COVID-19 Emergency Under the Real Estate Settlement Procedures Act (RESPA), Regulation X; Rescission,” 90 Fed. Reg. 20791 (May 16, 2025). Some industry groups have called on the CFPB to expand the flexibilities to offer streamlined loss mitigation options to borrowers and make those flexibilities permanent.

⁶ CFPB, “Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal,” 90 Fed. Reg. 20084 (May 12, 2025).

⁷ 12 U.S.C. § 5552(a).

⁸ Id.

⁹ Id.

¹⁰ CFPB, “Authority of States To Enforce the Consumer Financial Protection Act of 2010,” 87 Fed. Reg. 31940, 31941 (May 26, 2022).

¹¹ Pennsylvania by Shapiro v. Mariner Fin., LLC, No. CV 22-3253, 2024 WL 169654, at *13 (E.D. Pa. Jan. 12, 2024) (holding that a state could bring an action under Section 1042 to enforce the Truth in Lending Act, one of the enumerated consumer financial laws).

¹² CFPB, “Authority of States To Enforce the Consumer Financial Protection Act of 2010; Rescission,” 90 Fed. Reg. 20565 (May 15, 2025).

¹³ 12 U.S.C. § 5552(b).

¹⁴ 15 U.S.C. § 1681s(c).