In 2010, through enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank; P.L. 111-203), Congress established the CFPB to implement and enforce federal consumer financial law for certain financial products and institutions. Dodd-Frank consolidated in the CFPB certain consumer financial regulatory authorities that other agencies previously held and provided the CFPB with new powers not previously held by federal regulators.
Congress structured the CFPB as an independent bureau within the Federal Reserve System (Fed). The CFPB is headed by a single director, appointed by the President for a maximum of a five-year term with the advice and consent of the Senate. The Supreme Court held in Seila Law LLC v. CFPB that the President may fire the director at will, holding unconstitutional the express statutory protection to the contrary. The Fed's Board of Governors does not influence the CFPB's operations other than through the Fed chair's role as a member of the Financial Stability Oversight Council (FSOC), which can overturn a CFPB rule with the consent of two-thirds of its members. (The CFPB director is also a voting member of FSOC.) Rather than being funded through regular appropriations, the CFPB funds its operations through monetary transfers from the Fed. The Fed's board must transfer amounts requested by the CFPB director based on the director's determination of need, subject to a statutory funding cap, which Congress reduced by statutory amendment enacted in 2025.
Dodd-Frank charges the CFPB to implement and enforce consumer protection laws, lead financial education initiatives, collect consumer complaints, and conduct consumer finance research. The CFPB has broad regulatory authority over providers of an array of consumer financial products and services, including deposit taking, mortgages, credit cards and other extensions of credit, loan servicing, collection of consumer reporting data, and consumer debt collection. Although the scope of the CFPB's regulatory power is considerable, it is also subject to certain statutory exceptions and limitations. The CFPB's regulatory authorities fall into three broad categories: supervision, including the power to examine and impose reporting requirements on financial institutions, enforcement of various consumer protection laws, and rulemaking.
The CFPB may issue regulations to implement 19 federal consumer protection laws that largely predate Dodd-Frank. These enumerated consumer laws govern a broad and diverse set of consumer financial services and providers. Dodd-Frank also empowers the CFPB with the authority to issue rules declaring acts or practices associated with consumer financial products and services to be unlawful because they are unfair, deceptive, or abusive.
Banks. Banks (a term used in this In Focus to reference institutions with bank, thrift, or credit union charters) are regulated for both safety and soundness and consumer compliance. Bank regulators conduct safety and soundness (prudential) regulation with the goal of ensuring that banks maintain profitability and avoid failure. Consumer compliance regulation is designed to ensure that banks comply with applicable consumer protection and fair-lending laws.
The CFPB and the federal banking regulators (i.e., the Fed, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and National Credit Union Administration) share consumer compliance regulation over banks, with their authorities varying depending on the bank's size. The CFPB holds primary consumer compliance regulatory authority over larger banks—those with more than $10 billion in assets. Banks with $10 billion or less in assets must comply with CFPB's rules implementing various consumer laws, but the bank regulators, rather than the CFPB, hold primary consumer compliance supervisory and enforcement authority over these smaller institutions.
Nonbanks. Nonbank financial institutions provide financial services but do not have bank, thrift, or credit union charters. Nonbanks have traditionally dominated third-party debt collection, payday lending, credit reporting, and various other consumer financial markets. Since the Great Recession, nonbanks have also become increasingly important in the small business lending and mortgage origination and servicing markets. The CFPB may issue and enforce rules that affect these nonbank financial institutions, but the CFPB's supervisory authority over them varies based on their activities and size.
First, Dodd-Frank expressly authorizes the CFPB to supervise three categories of nonbank financial institutions regardless of size—mortgage companies, including lenders, brokers, and servicers; payday lenders; and private education lenders. Second, the CFPB may supervise nonbank institutions the CFPB determines are larger participants in a consumer financial market. Third, the CFPB may supervise a nonbank that, based on consumer complaints or other sources, the CFPB "has reasonable cause to determine … is engaging, or has engaged in, conduct that poses risks to consumers."
Exempted Institutions. Dodd-Frank exempts some industries from the CFPB's regulatory jurisdiction. For example, the CFPB generally does not have rulemaking, supervisory, or enforcement authority over automobile dealers, real estate agents, or insurance companies, among others. There are, however, certain business practices that could trigger CFPB regulatory authority over otherwise exempt entities, such as when the entity engages in an activity governed by an enumerated consumer law—for example, debt collection activities subject to the Fair Debt Collection Practices Act.
Agency Independence and Operations. Separate from the underlying legal issues informing the policy choices, policymakers debate the degree of independence the CFPB should have from Congress and the President, with some arguing that the agency can operate more effectively when insulated from political pressures and others countering that such insulation decreases accountability. Dodd-Frank protected the CFPB director from presidential removal, except for cause. In Seila Law LLC v. CFPB, however, the Supreme Court held this statutory removal protection unconstitutional. As a result, the CFPB director now serves at the pleasure of—and may be removed at will by—the President. In line with Seila Law and other Supreme Court rulings involving presidential control over independent agencies, President Trump, through Executive Order 14215, stated that "it shall be the policy of the executive branch to ensure presidential supervision and control of the entire executive branch," including independent agencies such as the CFPB.
The CFPB's unique funding source provides independence from congressional appropriators and has been the subject of legal challenges. The Supreme Court in 2023 ruled, in Community Financial Services Association of America v. CFPB, that the CFPB's funding is constitutional. On July 4, 2025, the President signed P.L. 119-21, which modified the formula for the CFPB's statutory funding cap by reducing the cap from 12% to 6.5% of the Fed's 2009 operating expenses. Under the new formula, the CFPB's FY2025 funding limit decreased from $823 million to $446 million. The funding cap is adjusted annually for inflation and is approximately $467 million for FY2026. Some Members have proposed subjecting the CFPB to appropriations, increasing its funding cap, or otherwise modifying the CFPB budget. In a July 2026 Senate Banking Committee hearing, former acting Director Russell Vought advocated moving the CFPB budget to appropriations.
The Trump Administration has at various points attempted to reduce the CFPB's staff from roughly 1,700 to 200 and later to 556. These staff reduction proposals are the subject of ongoing litigation. The litigation has been temporarily stayed until either 60 days after nominee Brian Johnson is confirmed as CFPB Director or January 3, 2027, to give Johnson, if confirmed, a chance to weigh in on the plans.
Recent Regulatory and Legislative Action. While regulations arguably can engrain protections for consumers, some believe that they may also constrain innovation and increase costs for firms and consumers or cause other externalities. The 119th Congress and former acting CFPB Director Vought have rescinded several previously issued CFPB rulemakings and guidance.
For example, the CFPB finalized a rule in December 2024 applicable to financial institutions with $10 billion or more in assets that generally would have capped overdraft fees at $5 or an alternative price at the institution's costs. Alternatively, financial institutions could have treated overdrafts like credit products, by providing consumer disclosures in accordance with the Truth in Lending Act (P.L. 90-321). Congress overturned this rule using the fast-track legislative procedures of the Congressional Review Act (CRA; P.L. 119-10).
In March 2024, the CFPB issued a final rule that would have capped credit card late fees at $8 for card issuers and their affiliates with 1 million or more open accounts. Shortly after this rule was finalized, the Chamber of Commerce and other plaintiffs filed a lawsuit seeking to prevent the CFPB from implementing the rule, arguing, among other things, that it was contrary to law. In April 2025, a federal district court vacated the rule after the CFPB filed a motion with the court in which it agreed with the plaintiffs that the rule violated the Credit Card Accountability Responsibility and Disclosure Act of 2009 (P.L. 111-24). In July 2026, the CFPB filed a request for information on credit card late fees for interagency review.
In December 2024, the CFPB published a final rule bringing certain nonbank digital payment and digital wallet companies under its supervisory regime, allowing the CFPB to subject these companies to reporting requirements and examinations. Congress overturned this rule via the CRA.
In May 2026, the CFPB issued a final rule amending its regulations implementing Section 1071 of Dodd-Frank, which requires certain financial institutions to provide the CFPB data on small business credit applications. The May 2026 rule increased from 100 to 1,000 the number of annual covered credit originations that defines which financial institutions are subject to the rule and reduces the data points that covered financial institutions must collect.
In May 2025, the CFPB withdrew 67 "guidance documents, interpretive rules, advisory opinions, and policy statements."
The CFPB's supervisory and enforcement priorities have also shifted during the Trump Administration. In February 2025, the CFPB instituted a broad regulatory, supervisory, and enforcement freeze. The CFPB stated it would decrease the total quantity of supervisory "events" by 50% and shift its focus from non-depository institutions to depository institutions. In calendar year 2025, the CFPB withdrew, dismissed, terminated, and otherwise resolved the vast majority of enforcement actions that were opened prior to President Trump's inauguration. In the first 18 months of the Trump Administration, the CFPB initiated one new public enforcement action—a significant decrease relative to prior years.