When was the last time you heard anyone talk about the CFPB? Just because it's been a while doesn’t mean the organization isn't functioning, its employees aren't working, or lenders aren't being examined. Certainly, it is worth knowing what the CFPB is up to, why, and where it might go from here.
Every person involved in residential lending should know that the Consumer Financial Protection Bureau (CFPB) was established in 2011 as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act. It was created, and with good reason, to protect consumers from unfair financial practices following the 2007-08 financial crisis. It was proposed by President Obama and led by its first director, Richard Cordray. Director Cordray certainly had his share of critics and proponents. (In 2017, he resigned, based on the political environment, returning to Ohio and working as an attorney and in various administration positions.)
During the first Trump administration, the CFPB endured various challenges. Its funding was questioned, its legality was questioned, and its daily procedures were challenged. Amid significant political debate regarding its structure and authority, “the Bureau” survived through “Trump 1” and the Biden administration. Various directors have come and gone, and most have political bias.
President Trump began his second administration (“Trump 2”) in January 2025, and in February, the Bureau immediately found itself in the crosshairs of cost-cutting. There was talk of reducing it to “5 guys and a phone,” given the administration's plan to take the CFPB down to the bare minimum staffing required by law. DOGE-directed layoffs occurred throughout 2025, but outright elimination of the Bureau proved problematic for the administration, given the congressional approval required. The agency has lost nearly 30 percent of its staff since September 2024.
Recently, the Consumer Financial Protection Bureau’s information security program has been deemed ineffective and filled with “weaknesses,” according to a new watchdog report. The CFPB’s security policies, procedures, and strategies are formalized and documented but not consistently implemented under the Federal Information Security Modernization Act model.
Without fully adopting the proper cybersecurity controls, the CFPB will struggle to protect its databases “from increasingly sophisticated cyber threats that could jeopardize the confidentiality and integrity of data crucial to the agency’s mission,” the report stated.
The databases are important. They contain sensitive financial information, consumer complaint data, and confidential financial institution supervisory records. But does the CFPB have the staff? Apparently not, as staffing woes could be connected to the unresolved status of 10 of 14 security recommendations from previous OIG audits.
Most recently, the Consumer Financial Protection Bureau is facing a second federal lawsuit challenging its rollback of longstanding fair lending protections. The National Urban League and Massachusetts Association of Community Development Corporations allege the agency unlawfully weakened rules designed to prevent discrimination in consumer and business lending. The lawsuit challenges changes to Regulation B, which implements the Equal Credit Opportunity Act. The changes narrow prohibitions against discouraging prospective borrowers from applying for credit, restrict certain special purpose credit programs intended to address lending disparities, and eliminate disparate-impact liability under Regulation B. The latter standard has allowed challenges to facially neutral lending practices that disproportionately harm protected groups without sufficient business justification.
The talk of firing all term and probationary employees garnered a lot of headlines and prompted reductions in force to dismiss a large portion of the agency’s workforce, but those actions didn’t have a major impact on operations because the courts paused them. For example, 182 employees were dismissed, but that was paused by the courts, and they were reinstated. Finally, the agency implemented two reductions in force in February and April. Those were paused by the courts, and so no employees were dismissed. This has to wreak havoc on morale.
On September 25, the U.S. District Court for the District of Oregon granted partial summary judgment in an action brought by 22 states and the District of Columbia, ruling that the CFPB’s acting director violated the APA and the constitutional separation of powers by refusing to request funding for the agency from the Fed. The court rejected the conclusion in DOJ’s Office of Legal Counsel (OLC) memorandum that “combined earnings” under the Dodd-Frank Act refers to the Fed’s profits after deducting interest expenses, meaning no funds could be transferred to the CFPB when the Fed operated at a loss.
These headlines are all a far cry from the news that the CFPB was making ten years ago with fines, enforcement actions, and other penalties. Meanwhile, in speaking with people at the CFPB, the missions of consumer education, enforcement, supervision, providing data and research, and setting rules and policies remain a focus and are still considered important. Lenders should know that the CFPB does not only “touch” lending but also, in theory, any financial transaction involving a consumer.
Just because the Consumer Financial Protection Bureau isn’t in the news every day, or its director isn’t grabbing headlines, doesn’t mean that it has gone away. Or that it is not relevant to lenders. Quite the contrary: Much of the residential lending world continues to operate with policies and procedures designed as a result of the CFPB’s directives. There is little reason to think that this will fade away. And there is no reason to believe that lenders and loan originators can ignore previous precedent. Put another way, just because there isn’t a 25-miles-per-hour sign in the neighborhood doesn’t mean a driver can go 60.
Related: NMP's latest coverage of the CFPB's enforcement pullback examines the agency's sharp reduction in investigations and examinations, even as mortgage lending remains an enforcement priority.
