On February 10, 2025, CFPB employees arrived to work and found themselves locked out. Acting Director Russell Vought had issued a stop-work order halting all examinations, enforcement actions, and rulemaking. Staff were barred from agency systems. Within weeks, active enforcement matters were being transferred to the Department of Justice, consent order monitoring had stalled, and the agency that produced some of the most consequential consumer protection enforcement actions of the past decade was effectively dormant.
Banks and fintechs noticed. Compliance teams began asking whether pending policy reviews were still necessary. Staffing plans were reassessed. The logic was understandable. Why build for an examiner that isn’t coming?
The problem with that logic is that the laws didn’t change.
What’s Actually on Pause, and What Isn’t
The CFPB’s authority to enforce consumer financial protection laws derives from statutes that Congress enacted and only Congress can repeal. The Truth in Lending Act. The Equal Credit Opportunity Act. The Fair Credit Reporting Act. The Electronic Fund Transfer Act. The Fair Debt Collection Practices Act. Section 1031 of Dodd-Frank, which created the UDAAP prohibition. None of these were amended. None were repealed. What the administration suspended was the federal agency’s enforcement apparatus, not the obligations those statutes place on financial institutions.
That distinction is doing a lot of work right now, and many institutions aren’t tracking it carefully enough.
In May 2025, the CFPB withdrew 67 pieces of informal guidance, including key UDAAP and fair lending interpretive documents that had shaped compliance programs for years. This has been read in some quarters as a signal that UDAAP is off the table. It isn’t. The statutory prohibition in Section 1031 remains in effect. What changed is the CFPB’s position on how that prohibition applies to certain practices, not the prohibition itself. Institutions that stripped out UDAAP controls based on that withdrawal are exposed, particularly to state-level enforcement.
State Regulators Didn’t Stand Down
Dodd-Frank explicitly preserved state enforcement authority under federal consumer protection laws. That was deliberate. Congress knew that federal enforcement priorities shift with administrations and built in a backstop.
State attorneys general have used it. When the CFPB dropped its lawsuit against Capital One in February 2025, New York Attorney General Letitia James filed a nearly identical case in May, alleging the same core violations. Other states followed similar logic in their own markets. Coordinated multi-state enforcement actions are no longer an anomaly. They’re the expected response when federal regulators pull back.
For institutions operating across multiple states, this creates a compliance exposure that a purely federal-centric view will miss. If your state regulatory risk mapping was built around the assumption that CFPB supervision was the primary enforcement mechanism, it needs to be updated.
Consent Orders Remain in Force
Institutions currently operating under CFPB consent orders face a specific and underappreciated risk. The obligations in those orders don’t terminate because the CFPB has stopped monitoring compliance with them. A consent order is a legally binding agreement. Violating one creates independent legal exposure: potential contempt, private litigation, and a documented record of non-compliance that will be relevant whenever the regulatory environment shifts again.
The CFPB’s current posture also doesn’t mean enforcement won’t resume. The agency retains statutory authority. Leadership changes. Court orders have already forced the agency to remain funded. Treating consent order obligations as optional in the interim is a risk that isn’t justified by the current enforcement climate.
What Banks and Fintechs Should Do Now
Three things are worth addressing immediately.
First, map your state-level exposure. If your institution operates across multiple states, identify which state attorneys general have active consumer protection enforcement programs and whether your current practices create state-law risk independent of the CFPB. This analysis doesn’t require a major project. It requires an honest assessment of where your consumer-facing products operate and what the enforcement posture looks like in those markets.
Second, treat consent order obligations as fully active and document that treatment. If your institution is currently under a CFPB order, your compliance monitoring for those obligations should continue unchanged, and that continuity should be documented at the management level.
Third, don’t reduce consumer complaint management. In the absence of federal examination pressure, unresolved consumer complaints create private litigation risk and state regulatory exposure. These are often harder to manage than a structured federal exam, and they produce a paper trail that outlasts any particular administration’s enforcement priorities.
The institutions that will be best positioned when federal enforcement normalizes, and it will at some point, are the ones that maintained their programs through the pause rather than treating it as permission to coast. The gap between a compliant program and a defensible record is built over time, not rebuilt on demand.
Sources
CFPB Stop-Work Order and Freeze of Activities | Foley & Lardner (Feb. 2025)
The Continued State Enforcement of Federal Financial Regulatory Laws | Orrick (Mar. 2025)
The Status of The CFPB: A Year-End Review | Winston & Strawn (Dec. 2025)
Latest Developments at the CFPB and Implications for Financial Institutions | Reed Smith (Feb. 2025)
