When Congress passed the Consumer Financial Protection Act it created and gave the Consumer Financial Protection Bureau (CFPB) rulemaking, enforcement, and supervisory authorities. Supervision is important because it helps to ensure the safety of products used by consumers and contributes clarity to market participants. The work of supervision doesn’t attract much press attention, much less than rulemaking or enforcement actions, but monitoring the day-to-day practices of companies is essential to fulfill the agency’s mission.
When Scott Bessent became the CFPB’s new Acting Director, he said the agency would suspend final rules that have not taken effect, seek continuances on active litigation, and not commence or settle enforcement actions. The memo did not put a full hold on supervision, but it called off public communications and said investigations should cease.
Acting Director Russell Vought made it official shortly after being named to replace Bessent: all supervisory activities would halt.
Reviewing the supervisory work performed during the last administration can help us understand what is at stake if the CFPB’s authority is not utilized. Supervision is efficient and expedient. It corrects problems early, before they become significant, without the cost or duration of enforcement activities. Experts point to the lack of supervision over non-bank mortgage finance companies as one of the key gaps leading to the financial crisis.
Under the leadership of Director Rohit Chopra, the CFPB used its supervisory authority to protect consumers from the perils of risky financial products. The supervisory team updated its work to track the shifting contours of a rapidly evolving financial services marketplace. The ways that people spend, save, and borrow have changed considerably since the launch of the CFPB. Now, Big Tech firms monetize our personal data. As a result, how firms store, collect, and disseminate information has introduced new threats to household financial security.
However, while much was new, legacy risks remained, and the CFPB’s supervisory team found new ways to address old problems. The agency implemented a dormant “risk-based authority” to monitor a company’s practices proactively when evidence reveals that their practices are likely to cause harm.
Every day, the public tells the CFPB to stay on the beat. In 2023, the CFPB received over 1.3 million consumer complaints about problems with more than 3,400 financial companies. The number of complaints from servicemembers, veterans, and their families has never been higher. These complaints show how frustrated people are with their financial institutions. The fact that people took their concerns to the CFPB underscores the agency’s unique role in restoring fairness. Their actions show the dissonance between the needs of the public and the recently announced plans to halt the CFPB’s work.
Until last week, the idea that supervision has value had bipartisan support. In testimony before the House Committee on Financial Services in February 2020, former Director Kathy Kraninger said, “We prevent harm by using supervision and enforcement to promote compliance with the law. To be effective, the Bureau must be consistent and transparent about our expectations of such compliance.” The idea that supervision would be halted is genuinely radical.
About the CFPB’s supervisory work
Congress gave the CFPB supervisory authority for banks with over $10 billion in assets, non-depository mortgage companies, payday lenders, and private student lenders. Through formal rulemaking procedures, the CFPB has established the ability to supervise “larger participant” student loan servicers, debt collectors, consumer reporting agencies, international money transfer firms, auto lenders, and digital payment apps. In these areas, the CFPB has exclusive supervisory authority.
The CFPB supervises firms through examinations, data analysis, and ongoing communication with firms to review and monitor their activities. It may also coordinate work with state and prudential regulators. As a principle, it tailors the scope of supervision to each institution’s risk profile. When supervisory work identifies trouble, examiners make referrals to the agency’s enforcement division.
Supervision benefits companies and consumers. By uncovering problems, examinations may quickly end practices harming customers. At the same time, through the issuance of guidance, the CFPB makes clear to companies how they can stay within the boundaries of the law. Its publication communications may take many forms: advisory opinions, FAQs, interpretive rules, supervisory highlights, and compliance bulletins, to name a few. Information in a supervisory highlight can use examples to call out risky practices or suggest compliance solutions. Law enforcement agencies may also use the CFPB’s operating circulars to understand federal consumer financial protection laws.
To Understand Supervision, Look to Its Accomplishments Under Chopra’s Leadership
The Supervision of Innovation: No-Action Letters and Sandboxes
The Director frequently called out Big Tech for seeking a free pass from financial protection laws. It reversed course from a previous administration that had been much more lenient on disruptors and innovators. During the first Trump administration, the CFPB’s focus fell on clearing paths for companies to try new ideas, but fell short in considering how these innovations might lead to new risks for consumers.
Programs designed to exempt firms from risk, such as no-action letters (NALs) and regulatory sandboxes, were central to the first Trump Administration’s innovation-first approach. In 2017, the CFPB served a NAL to an algorithmic underwriter permitting it to make loans with alternative data. It maintained a Project Catalyst (CAST) agreement with a paycheck advance lender. In 2019, the CFPB re-issued the NAL, revised the regulatory sandbox program, and opened a trial disclosure project. In comments made at the announcement of the 2019 programs, Director Kathy Kraninger said the Bureau is “tasked with the mission of facilitating innovation and access to financial products and services for consumers.” In total, the Office of Innovation granted 10 NALs. In 2019, the CFPB published a report lauding the algorithmic lender’s NAL for expanding credit access for protected class members.
However, at least one of the NAL programs did not fulfill Kraninger’s vision. In 2020, a report from two advocacy groups showed how the algorithmic lender’s use of non-individualized educational factors disadvantaged graduates of Historically Black Colleges and Universities and Hispanic-Serving Institutions. The lender and the two advocacy groups reached an agreement under which a civil rights law firm would conduct ongoing monitoring of the lender’s loans. The CFPB issued a new NAL for the lender.
Under Director Chopra, the CFPB showed more restraint and also put new emphasis on not permitting innovation sandboxes and NALs to create “winners and losers.” In 2022, it rescinded the NAL and CAST programs because they were not “consumer beneficial,” nor were they pro-competition because the special exemptions were not available to all companies in markets.
In January 2025, the CFPB reinstated the NAL program, but with conditions that protect competition and prevent “revolving-door” practices.
Financial markets remained innovative under Director Chopra. In contradiction to the “wait-and-see” models of prior eras, it held new types of companies accountable for following consumer protection laws from day one and avoided surprise outcomes.
Reining in Big Tech
Big Tech did not receive an AI exemption from consumer protection.
The CFPB’s work on Big Tech payment platforms was initiated under Director Chopra in 2021. The CFPB issued a market-monitoring order to six large Big Tech payment platforms, which formed the basis for the first new larger participant rulemaking in 2024. Payment apps and digital wallets have become critical financial instruments. Millions use them to transfer funds and make purchases, including lower—and middle-income consumers. The CFPB did not turn away from concerns about access, as evidenced by its spotlight on involuntary account closures.
Under Director Chopra, the CFPB identified significant consumer protection risks arising from data harvesting, monetization, and anti-competitive threats to our economy. While payment app platforms may have attracted the most attention, the CFPB also took steps to monitor other emerging product areas. The CFPB included merchant cash advance companies inside the scope of its Section 1071 small business data rule. By doing so, the CFPB held this category of non-bank fintech lenders to the same data collection rules that apply to other small business lenders. In 2023, when an issue spotlight from research and markets found that consumers often received inaccurate information from chatbots, the CFPB made clear its examiners would review these technologies to ensure their use did not hinder the obligations of those companies to provide truthful answers to consumer questions.
Big Tech’s effects have spilled over to other places by permitting non-tech companies to embed fees into everyday activities. “We are paying attention,” noted General Counsel Seth Frotman, “to what you might call the growing financialization of nearly every sector of the economy.” Coffee shop apps and school lunch payment portals take deposits and initiate funds transfers, payroll companies extend credit, employers place debts on workers for job training, and soon, the Internet of Things will bring finance to household appliances.
The tech platform initiative and the personal financial data rights rule that followed later shared the aim of righting the balance between consumers and Big Tech. They supported competition and choice. “When a consumer has the power to vote with their feet,” he said at a 2023 payments conference, “you’ll see how our system will give them better service as well.”
Artificial Intelligence
The agency reminded firms that compliance with consumer financial protection laws is necessary regardless of how a financial service is offered.
The CFPB took many steps to rein in the emerging risks of AI. In 2022, it released a circular on adverse-action notice requirements for algorithmic lending. In May of 2022, it published an operating circular asserting that existing anti-discrimination laws compelling lenders to explain their adverse decisions are equally applicable to credit decisions made with complex algorithms. In April 2023, it published a policy statement noting that the use of dark patterns to take advantage of customers could be a form of abusive conduct. A June 2024 operating circular provided answers on how employers can appropriately use algorithms and background dossiers when hiring.
In August, the CFPB’s General Counsel and Chief Technologist submitted a letter to Treasury Secretary Janet Yellen, affirming that Big Tech firms cannot receive exemptions from regulations and honoring competition requires agencies to enforce rules consistently across the economy by “establishing clear, straightforward rules encouraging firms to invest in better products and services.” In that direction, the CFPB published a supervisory highlight in January 2025 showing how companies using algorithmic credit scoring models should make credit decisions.
The CFPB was well-versed in “lawyer-speak ” and “examiner-speak,” but it needed to have the capacity for “technologist-speak.” The CFPB’s accomplishments on AI reflect the capacity-building hires made at the outset of the term. Led by its chief technologist, it established a special team made up of people with expertise in advanced technologies. Most likely, the individuals recruited by the CFPB for this work could have earned more in private industry. Those hires deserve credit for putting the interests of the public ahead of their personal gains.
Common sense says we want “humans in the loop” to monitor AI. Now is not the right time to walk away.
Reasonable cause to assert authority based on risk
The agency invoked a dormant risk-based authority to initiate supervision of non-bank companies when it has “reasonable cause” to believe a nonbank’s practices pose risks to consumers. Under the Consumer Financial Protection Act (CFPA), the CFPB can make this determination based on evidence it receives, such as consumer complaints or judicial decisions.
In November 2023, it issued the first supervisory order, identifying four categories of practices at World Acceptance Corporation (WAC) that cause consistent harm based on evidence it collected. WAC told loan applicants that add-on insurance coverages sold in connection to loans were mandatory, used aggressive debt collection practices, did not resolve disputes about the accuracy of information submitted to consumer reporting agencies, and depended on serial loan refinancing for profitability.
In December 2024, The CFPB issued its second supervisory order, this time against Google Payment Corporation. The CFPB had received complaints that Google ignored requests for investigations it had received from people who used its digital wallet.
These two firms are examples of non-banks operating in markets (lending and payments) competing with fully-supervised banks and credit unions. By asserting the right to supervise these companies, the CFPB fostered regulatory parity.
Supervision for compliance with the Military Lending Act (MLA)
The MLA caps interest rates on loans to military borrowers at 36 percent, prohibits mandatory arbitration or other contracts that force military borrowers to waive rights, prevents automatic repayment through debits on military allotments, and eliminates prepayment penalties. Starting in 2013, the CFPB examined covered lenders to ensure compliance with the law.
During the first Trump Administration, the CFPB’s leadership reversed course and announced that it would no longer consider MLA compliance in exams. Acting Director Mick Mulvaney argued that while the CFPA gave the CFPB authority to assess for compliance with 18 “federal consumer financial laws,” the MLA was not one of them. These were elective policy choices, and according to reports in the New York Times, no lender had previously sought relief from examinations.
In June 2021, under Director Chopra, the CFPB issued a new interpretive rule clarifying that it did. By taking back this authority, the CFPB regained a vital tool to protect servicemembers and their dependents from high-cost loans. When the CFPB stops watching out for servicemembers, it puts our servicemembers at risk. When servicemembers or their households fall prey to predatory lenders, it undermines military preparedness.
Student loans
The CFPB’s supervisory work shed light on difficulties faced by student borrowers during and after the pandemic, resulting from colleges and universities’ growing reliance on adding new fees to the cost of attendance to increase their profit margins. The CFPB is charged with supervising student loan services. If the CFPB steps back, 40 million student borrowers will lose an ally.
The pandemic upended the repayment of student debt. When pandemic-era accommodations were suspended in September 2023, interest began accruing on $1.5 trillion in student loans owed by more than forty million people. In 2024, the CFPB documented problems with the “return to repayment” of student loans after the pandemic hiatus. From its examinations, the CFPB documented evidence of shoddy customer service and frequent instances where borrowers could not resolve disputes. In some cases, the delays prevented people from getting timely loan forgiveness.
The CFPB realized that supervising higher education involves monitoring not just student lending but also the practices of colleges and the bankers with whom they partner. In her remarks at the Consumer Federation of America’s 2024 Financial Services Conference, CFPB Student Loan Ombudsman Julia Barnard discussed how colleges of all types have become “financialized.” Tuition, room and board, and books are expensive, but schools frequently partner with financial companies to derive additional revenues. Many burden their students with junk fees for services that should be inseparable from the cost of attendance. Some collect data on their students and monetize it through marketing partnerships. As a sign of how opaque the cost of college has become, many schools now hire enrollment management companies whose algorithms help them maximize their tuition revenue. Colleges are inviting bankers to have a seat inside their ivory towers, to their profit but to the detriment of students and our educational system itself.
In 2022, the CFPB published a supervisory highlight identifying three troubling practices in student loan servicing. First, some schools withheld transcripts from students who owed funds to their schools, even if the amounts were tiny, regardless of potential harm to students’ prospects. Second, when servicers changed, borrowers often had trouble getting accurate and up-to-date loan information. Third, it found cases where servicers were not fulfilling obligations under the Public Service Loan Forgiveness, Income-Driven Repayment, and Teacher Loan Forgiveness programs. Some of these problems were documented again in 2024 in the Special Edition Student Lending Supervisory Highlight. By communicating these examples, the CFPB made clear that servicers, loan holders, and originators must avoid these violations and should implement compliance procedures to prevent them from occurring in the future.
In 2022, it issued a separate bulletin instructing servicers on providing consumers with information about the Public Service Loan Forgiveness program. In early 2023, the CFPB issued a bulletin on some student loan servicers who failed to distinguish between loans with prohibitions on discharge versus those that can be discharged in bankruptcy and identified such failures as unfair. In March 2023, a special junk fees supervisory highlight noted that some servicers erroneously accepted credit card payments – a prohibited practice – but reversed the transactions later, triggering late fees and adverse credit reports.
Payments and Overdrafts
While some institutions stopped charging overdraft and NSF fees, others continue relying on penalty junk fees. Using its supervisory authority, the CFPB targeted stubborn financial institutions that continued to use their banking charters to extract millions (or billions) from consumers for simple mistakes.
In October 2022, the CFPB published a circular stating that charging a penalty fee resulting from an “authorize positive, settle negative” (APSN) payment sequence was unfair. In other words, if a bank conveys to the consumer that funds exist to cover a transaction but then charges a fee when it settles, the consumer has been mistreated. During the same month, it issued a bulletin advising financial institutions that it would use its supervisory and enforcement authorities to address charges for returned deposit items. Common sense says consumers cannot prevent, or even anticipate, when a deposited check will be returned, and the CFPB applied it to thwart a practice that unfairly drains money from the pockets of households and businesses.
The practice and its regulatory response were discussed in a supervisory highlight on junk fees in March of the following year. The CFPB said it expected banks to stop charging fees from APSN sequences and noted that banks had already provided hundreds of millions in redress to over 170,000 consumers. Additionally, examiners found tens of thousands of cases where institutions had charged multiple overdrafts for a single payment order – also an unfair practice.
Repeat Offenders
One lesson from the first years of the CFPB under Director Chopra is that some companies repeatedly break the law.
In 2022, the CFPB established its Repeat Offender (“RO”) Unit to address corporate recidivism by companies. This unit follows up on all consent orders the CFPB has made with the ROs. By designating them as ROs, requiring them to register, and placing them under ongoing review, the CFPB ensured these companies would fall under special scrutiny. Two years later, it established a registry to assist law enforcement agencies. State and federal regulators will use it as a resource to identify concerning trends. It rectifies the problem of siloed enforcement.
If the past is a guide for the future, repeat offenders will expose people to risk again. Removing supervision invites trouble.
Conclusion
This CFPB used its supervisory authority to accomplish a lot, and in fact, far more occurred than could be covered in this article. During the Chopra era, supervisors modernized their approaches to keep pace with emerging technologies and new financial products. As well, the agency never lost sight of existing problems. It held long-time repeat offenders and risk-takers accountable by never “closing the case.” From a strategic point of view, this CFPB was more cautious about innovation than the agency had been in the prior administration.
These actions are the manifestations of supervisory authority. They illustrate what could be lost if supervision remains halted.
Hopefully, the “eyes closed” approach announced this week will be short-lasting. Unfortunately, more people will be hurt each day that no one is watching. A choice to pull back from supervision is radical and extreme.