For more insights and analysis from Cleary lawyers on policy and regulatory developments from a legal perspective, visit What to Expect From a Second Trump Administration.

The new administration has recently taken steps to reduce or even eliminate the role of the Consumer Financial Protection Bureau (CFPB) in the supervision of certain financial institutions and the enforcement of federal consumer protection statutes.  While these actions represent a significant departure from the prior administration’s approach to consumer protection, and while a less active CFPB will likely reduce the federal regulatory burden on entities that have been subject to CFPB supervision, consumer financial protection enforcement is not likely to disappear. Instead, it will likely shift to state attorneys general (AG), which had already been active, along with the CFPB, in consumer protection.  This means entities that provide products or services in the consumer finance space will need to continue to be attentive to federal consumer protection statutes (such as the Consumer Financial Protection Act) that can be enforced by states, to state consumer protection statutes, and to state AG inquiries.

Congress created the CFPB in the wake of the 2008 financial crisis, as part of the Dodd-Frank Act.[1]  The CFPB has had vocal critics since its inception, and during Democratic administrations, it has been perceived as an aggressive and sometimes controversial enforcer. The agency has statutory authority to enforce a wide variety of federal consumer financial protection laws, such as the Consumer Financial Protection Act, the Fair Debt Collection Practices Act, and the Fair Credit Reporting Act.[2] The CFPB’s stated mission is ensuring that “markets for consumer financial products are transparent, fair, and competitive.”[3] The CFPB supervises entities such as banks, lenders, credit reporting agencies, and debt collection companies.[4]  Overall, the CFPB reflects a consolidation of consumer financial protection authority that had previously existed across many federal agencies, and that, in many respects, continues to exist in those agencies.[5] For example, the Federal Trade Commission has, and uses, authority to enforce the Fair Debt Collection Practices Act and the Fair Credit Reporting Act.[6]

In the last two weeks, the Office of Management and Budget has instructed CFPB staff members to cease supervision and enforcement activity, ordered a temporary shutdown of the agency’s headquarters, terminated some employees, and ordered staff to suspend the effective date of final rules that were not yet in effect.[7] Most notably, OMB has stated publicly that the CFPB will not take its next drawdown of funding from the Federal Reserve.[8] The situation continues to unfold, and the future of the CFPB remains uncertain.

Nevertheless, entities regulated by the CFPB should continue to focus on compliance with federal and state consumer protection laws for at least three reasons. First, consumer protection laws enforced by the CFPB remain in force, and the CFPB work stoppage order has already been challenged in court by the National Treasury Employees Union.[9]  A federal judge has ordered the executive branch to pause the termination of CFPB employees without cause and forbidden it from reducing the amount of money available to the CFPB pending resolution of the plaintiffs’ motion for a temporary restraining order.[10]  If the legal challenges succeed, the CFPB may continue to exist, engaging in a reduced degree of enforcement activity centered on priorities the administration has yet to announce.

Second, a subsequent administration with a more active enforcement approach is likely to argue that violations of the Consumer Financial Protection Act discovered during the current administration could still be enforced via administrative actions. Although statutory language indicates that the statute of limitations for the Consumer Financial Protection Act runs for only three years “after the date of discovery of the violation to which an action relates,” the CFPB has previously argued that statutes of limitations do not apply to its administrative actions.[11]

Third, even if the work stoppage is longer-term, or even if the CFPB is otherwise a less aggressive enforcer over the next few years, regulated entities can still expect consumer protection enforcement from other authorities, such as the Federal Trade Commission, the Department of Justice, and most notably state attorneys general, who are beyond the reach of federal executive orders. Moreover, a number of the statutes that the CFPB enforces, including the Fair Debt Collection Practices Act and Fair Credit Reporting Act, also include private rights of action and are routinely used as the basis for private class action litigation.

State consumer protection enforcement is already strong and could be a particular area of increased activity in the coming years, although state priorities and enforcement tools vary. First, state consumer protection enforcement under federal law is robust. For instance, the federal Consumer Financial Protection Act explicitly allows for state enforcement, as well as state enforcement of CFPB regulations.[12] State attorneys general use this authority: for example, in 2023, the CFPB and the New York State Office of the Attorney General sued a lender under the Consumer Financial Protection Act and state law, alleging deceptive car loan practices.[13] Second, consumer protection enforcement under state law is also robust. For example, after suing under state law, the New York AG entered into a billion-dollar settlement with allegedly predatory lenders.[14]

Shortly before the change in administration, the outgoing CFPB released a detailed report explaining how states can strengthen their consumer protection capabilities, essentially providing a roadmap for states to pick up the slack if CFPB enforcement decreased.[15] Companies and financial institutions should be prepared for some states to take the outgoing CFPB’s suggestions during the coming years. The outgoing CFPB’s recommendations include the following:[16]

  • Passing state laws modeled after the Consumer Financial Protection Act that ban “abusive” practices;
  • Ensuring “that Attorneys General have adequate investigatory authorities and can pursue remedies that protect consumers and make them whole;”
  • Removing requirements that plaintiffs prove individual monetary harm when exercising private rights of action;
  • Ensuring “that consumer protection law also protects businesses” from business-to-business unfair and deceptive practices;
  • Authorizing “forms of private enforcement that can remain viable in the face of forced arbitration;”
  • Banning “junk fees and abuse of personal data.”

Overall, the outgoing CFPB’s report advised that “Federal law should be a floor, not a ceiling, for the protection of consumers.”[17]

Some states had already started implementing the actions recommended by the outgoing CFPB, such as Massachusetts, which already has a statute that protects businesses from business-to-business unfair and deceptive practices.[18] Additionally, seven states passed consumer privacy laws in 2023, with six more states doing so in 2024.[19] State consumer protection priorities vary, however, and so companies should be prepared to respond to a variety of priorities, particularly as states reassess their focus in light of changes at the federal level.

Companies should recognize that while the future of the CFPB is uncertain, compliance with consumer protection laws should remain a priority. This is particularly true given the prospect of increased consumer protection enforcement at the state level, as some states will continue their existing level of enforcement of consumer financial protection laws, with some following the outgoing CFPB’s recommendations to get even tougher.

[1] https://www.consumerfinance.gov/data-research/research-reports/building-the-cfpb/

[2] https://www.consumerfinance.gov/ask-cfpb/what-laws-does-the-cfpb-enforce-en-2121/

[3] https://www.consumerfinance.gov/about-us/

[4] https://www.usa.gov/agencies/consumer-financial-protection-bureau

[5] https://www.consumerfinance.gov/data-research/research-reports/building-the-cfpb/

[6] https://www.ftc.gov/news-events/news/press-releases/2024/11/ftc-takes-action-against-phantom-debt-collector-collected-millions-bogus-debt-consumers; https://www.ftc.gov/system/files/documents/cases/de2_complaint_against_vivint_smart_home.pdf

[7] https://apnews.com/article/trump-consumer-protection-cease-1b93c60a773b6b5ee629e769ae6850e9;  https://www.usatoday.com/story/money/2025/02/16/layoffs-halted-cfpb-consumer-watchdog-musk-trump/78871464007/

[8] https://apnews.com/article/cfpb-trump-vought-consumer-protection-52e00309b2f1b55d4de6eadd0057bd50

[9] https://www.nteu.org/media-center/news-releases/2025/02/10/cfpbsepofpowers; https://www.nteu.org/-/media/Files/nteu/docs/public/cfpb/CFPBDismantle.pdf

[10] https://storage.courtlistener.com/recap/gov.uscourts.dcd.277287/gov.uscourts.dcd.277287.19.0_1.pdf

[11] 12 U.S.C. § 5564(g), https://www.americanbar.org/groups/business_law/resources/business-law-today/2020-october/discovering-a-limit-to-power/#:~:text=%C2%A7%205536.-,12%20U.S.C.,which%20an%20action%20relates.%E2%80%9D)

[12] 12 U.S.C. § 5552

[13] https://files.consumerfinance.gov/f/documents/cfpb_credit-acceptance-corporation_complaint_2023-01.pdf

[14] https://ag.ny.gov/sites/default/files/2024-03/nyag-v-yellowstone-et-al.pdf

[15] https://files.consumerfinance.gov/f/documents/cfpb_strengthening-state-level-consumer-protections_2025-01.pdf

[16] https://files.consumerfinance.gov/f/documents/cfpb_strengthening-state-level-consumer-protections_2025-01.pdf (executive summary)

[17] https://files.consumerfinance.gov/f/documents/cfpb_strengthening-state-level-consumer-protections_2025-01.pdf (page 12)

[18]https://files.consumerfinance.gov/f/documents/cfpb_strengthening-state-level-consumer-protections_2025-01.pdf (page 27); Mass. Gen. Stat. ch. 93A, § 11.

[19] https://www.troutman.com/insights/the-rise-of-state-attorney-general-privacy-enforcement.html