In 2010, through enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank, P.L. 111-203), Congress established the CFPB to implement and enforce federal consumer financial law for certain financial products and institutions. Dodd-Frank consolidated in the CFPB certain consumer financial regulatory authorities that other agencies previously held and provided the CFPB with new powers not previously held by federal regulators.
Congress structured the CFPB as an independent bureau within the Federal Reserve System (Fed). The CFPB is headed by a single director, appointed by the President for a maximum of a five-year term with the advice and consent of the Senate. The Supreme Court held in Selia Law vs. CFPB that the President may fire the director at will, concluding that the express statutory protection to the contrary was unconstitutional. The Fed's Board of Governors does not influence the CFPB's operations other than through the Fed chair's role as a member of the Financial Stability Oversight Council (FSOC), which can overturn a CFPB rule with the consent of two-thirds of its members. (The CFPB director is also a voting member of FSOC.) Rather than being funded through regular appropriations, the CFPB funds its operations through monetary transfers from the Fed. The Fed's board must transfer amounts requested by the CFPB director based on the director's determination of need, subject to a statutory funding cap. For FY2024, the CFPB requested approximately $729 million, which was below its $785 million funding cap.
Dodd-Frank charges the CFPB to implement and enforce consumer protection laws, lead financial education initiatives, collect consumer complaints, and conduct consumer finance research. The CFPB has broad regulatory authority over providers of an array of consumer financial products and services, including deposit taking, mortgages, credit cards and other extensions of credit, loan servicing, collection of consumer reporting data, and consumer debt collection. Although the scope of the CFPB's regulatory power is considerable, it is also subject to certain statutory exceptions and limitations. The CFPB's regulatory authorities fall into three broad categories: supervision, including the power to examine and impose reporting requirements on financial institutions, enforcement of various consumer protection laws, and rulemaking.
The CFPB may issue regulations to implement 19 federal consumer protection laws that largely predate Dodd-Frank. These "enumerated consumer laws" govern a broad and diverse set of consumer financial services and providers. Dodd-Frank also empowers the CFPB with new authority to issue rules declaring acts or practices associated with consumer financial products and services to be unlawful because they are unfair, deceptive, or abusive.
Banks. Banks (i.e., institutions with bank, thrift, or credit union charters) are regulated for both safety and soundness and consumer compliance. Bank regulators conduct safety and soundness (prudential) regulation with the goal of ensuring that banks maintain profitability and avoid failure. Consumer compliance regulation is designed to ensure that banks comply with applicable consumer protection and fair-lending laws.
The CFPB and the federal banking regulators (i.e., the Fed, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and National Credit Union Administration) share consumer compliance regulation over banks, with their authorities varying depending on the bank's size. The CFPB holds primary consumer compliance regulatory authority over larger banks—those with more than $10 billion in assets. Banks with $10 billion or less in assets must comply with CFPB's rules implementing various consumer laws, but the bank regulators, rather than the CFPB, hold primary consumer compliance supervisory and enforcement authority over these smaller institutions.
Nonbanks. Nonbank financial institutions provide financial services but do not have bank, thrift, or credit union charters. Nonbanks have traditionally dominated third-party debt collection, payday lending, credit reporting, and certain other consumer financial markets. Since the Great Recession, nonbanks have also become increasingly important in the small business lending and mortgage origination and servicing markets. The CFPB may issue and enforce rules that affect these nonbank financial institutions, but the CFPB's supervisory authority over them varies based on their activities and size.
First, Dodd-Frank expressly authorizes the CFPB to supervise three categories of nonbank financial institutions regardless of size—mortgage companies, including lenders, brokers, and servicers; payday lenders; and private education lenders. Second, the CFPB may supervise nonbank institutions the CFPB determines are "larger participants" in a consumer financial market. Third, the CFPB may supervise a nonbank that, based on consumer complaints or other sources, the CFPB "has reasonable cause to determine … is engaging, or has engaged in, conduct that poses risks to consumers."
Exempted institutions. Dodd-Frank exempts some industries from the CFPB's regulatory jurisdiction. For example, the CFPB generally does not have rulemaking, supervisory, or enforcement authority over automobile dealers, real estate agents, or insurance companies, among others. There are, however, certain business practices that could trigger CFPB regulatory authority over otherwise exempt entities, such as when the entity engages in an activity governed by an enumerated consumer law—for example, debt collection activities subject to the Fair Debt Collection Practices Act (15 U.S.C. §§1692-1692p).
Agency independence and existence. Separate from the underlying legal issues informing the policy choices, policymakers debate the degree of independence the CFPB should have from Congress and the President, with some arguing that the agency can operate more effectively when insulated from political pressures and others countering that such insulation decreases accountability. Through Executive Order 14215, President Trump stated that "it shall be the policy of the executive branch to ensure Presidential supervision and control of the entire executive branch," including independent agencies such as the CFPB. Some, including some Members of Congress, have argued that the CFPB should not exist at all. The Trump Administration has attempted to reduce the CFPB's staff from roughly 1,700 to 200. This proposal is the subject of ongoing litigation.
The CFPB's unique funding source provides it some degree of independence from congressional appropriators and has been the subject of legal challenges. The Supreme Court in 2023 ruled, in Community Financial Services Association of America v. CFPB, that the CFPB's funding is constitutional. Some Members have proposed subjecting the CFPB to appropriations. Others argue that the current budgetary structure of the CFPB is appropriate, as it insulates the CFPB while providing sufficient resources. The House Committee on Financial Services voted to submit a committee print providing for reconciliation pursuant to H.Con.Res. 14. As amended, the committee print would limit the funding cap of the CFPB to $249 million in FY2025 and limit other unobligated balances.
Dodd-Frank also protected the CFPB director from presidential removal, except for cause. However, the Supreme Court in Seila Law v. CFPB held this statutory removal protection unconstitutional. As a result of Seila Law, the CFPB director now serves at the pleasure of—and may be removed at will by—the President. Some policymakers have called for the CFPB to be led by a multimember commission with partisan balance, while others argue that the current structure is appropriate.
Proper degree of regulation. In line with the Biden Administration's policy initiative of reducing consumer fees, the CFPB issued regulations that would (a) generally cap credit card late fees at $8 or actual costs for issuers with 1 million or more credit card accounts and (b) generally cap overdraft fees at the higher of either $5 or actual costs or treat overdraft like credit and impose additional disclosure requirements for depository institutions with $10 billion or more in assets.
These rules have prompted robust debate regarding their efficacy. Some hailed these rules as protecting vulnerable consumers from excessive fees. Others argue that these rules would exceed CFPB statutory authority, curtail access to banking services, represent arbitrary price controls, and reduce competition. A memorandum from new acting leadership has indicated a change in direction on these policies, stating that the CFPB "shall not engage in attempts to create price controls."
While both of these rules were finalized, neither has gone into effect. A federal court vacated the credit card late fee rule at the request of the CFPB because the Trump Administration agreed with the plaintiffs in the case that the rule was inconsistent with the law. The overdraft rule, scheduled to go into effect in October 2025, is also the subject of litigation. Additionally, the House and Senate have passed S.J.Res. 18 to overturn the overdraft rule in accordance with the Congressional Review Act. The resolution is awaiting the President's signature.
During the Biden Administration, the CFPB subjected a number of nonbank financial institutions to its supervision using both its larger participant and consumer risk authorities. For example, in December 2024, the CFPB subjected Google Payment Corporation to its supervision using its consumer risk authority, but in May 2025, the CFPB withdrew that supervisory order. Another rule, finalized in November 2024, subjected certain digital wallets and payment apps to CFPB supervision pursuant to its larger participants authority. The House and Senate have passed S.J.Res. 28 in accordance with the Congressional Review Act to disapprove of the CFPB's digital wallet and payment apps rule. If signed by the President, S.J.Res. 28 would have the effect of rescinding the rule and preventing the CFPB from implementing a substantially similar rule in the future. The CFPB during the Biden Administration also issued a rule creating a registry of prior nonbank enforcement actions and a rule implementing Dodd-Frank Section 1071, which would require financial institutions to collect and report demographic, pricing, and other data on small business lending.
While these regulations may engrain protections for consumers, they may also constrain innovation and increase costs for firms and consumers or cause other externalities. The CFPB's regulatory scrutiny has shifted during the new Trump Administration. In February 2025, the CFPB instituted a broad regulatory, supervisory, and enforcement freeze; withdrew some enforcement actions; and criticized various other regulatory actions under prior leadership. Additionally, the CFPB has announced that it is reconsidering existing rulemaking and guidance. The CFPB during the Trump Administration announced that it would not prioritize enforcement of the nonbank enforcement action registry and that it will revise the Section 1071 rule.