CFPB Narrows Its Supervision of Nonbanks

On Tuesday, August 26, the Consumer Financial Protection Bureau (CFPB) announced a proposed rule that would likely decrease the number of nonbanks it supervises under Section 1024(a)(1)(C) of the Consumer Financial Protection Act (CFPA).

Under this provision, the CFPB may supervise a nonbank company engaged in conduct that it has reasonable cause to determine poses “risks to consumers” with respect to the nonbank’s offering or provision of financial products or services.¹ In 2022, the CFPB under the Biden administration announced that it would begin to exercise such “dormant” authority to oversee nonbanks it believed posed risks to consumers – a move that faced criticism by industry participants and policymakers.  

The proposed rule would clarify the meaning of “conduct that poses risks to consumers,” limiting its scope to activities that present a high likelihood of significant harm to consumers. It is the latest action by the Trump administration to scale back the CFPB’s supervisory activities over nonbanks, a move the CFPB previewed in an April memo highlighting its new supervision and enforcement priorities.

The risk from prior interpretations of ‘risk to consumers’

In the proposed rule, the CFPB notes that it has not previously defined what conduct constitutes “risk to consumers” and has instead issued individual orders to help shape the meaning. The CFPB highlights three main concerns with this prior approach:

• The CFPB’s interpretation of “risks to consumers” may be inconsistent between orders due to the “ad hoc nature” of individual orders.
• The lack of a clear definition creates uncertainty for nonbank institutions as to what standard the CFPB may apply to their case.
• Without clarity on the meaning of “risks to consumers,” the CFPB may not always apply the “best reading” of section 1024(a)(1)(C) in individual cases.

The proposed rule aims to mitigate the issues caused by this approach by holding the CFPB to a consistent, known standard. 

The proposed definition of ‘risk to consumers’

The proposed rule would define “conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services” under section 1024(a)(1)(C) of the CFPA as conduct that: “(a) presents a high likelihood of significant harm to consumers; and (b) is directly connected to the offering or provision of a consumer financial product or service as defined in section 1002 of the CFPA.” 

The proposed standard, therefore, would take a narrower approach from past interpretations of “risks to consumers,” which sometimes included “immaterial potential harms” and not just “serious conduct.” To support this tailored definition, the CFPB states that, “Congress would not have expected it to expend its supervisory resources on issues that are speculative in likelihood or trivial in impact” and that the CFPB must focus “only on the specific categories of products and services that Congress charged the Bureau with overseeing.”

The CFPB seeks comments on the proposed standard generally, and specifically, whether “risks to consumers” must be potential violations of law under section 1024(a)(1)(C). It also requests, among other things, estimates of behavioral changes as a result of the proposed standard, including impacts on consumers and the entities potentially subject to the proposed rule, and additional data on estimates of staffing requirements and costs for compliance with supervisory activities.

Looking forward

The proposed rule tracks this CFPB’s intent on shifting its attention away from fintechs and other nonbank companies and toward depository institutions, which the CFPB cited as a top priority in an April 2025 internal memo to staff. In the memo, the CFPB stated it would refocus its supervisory efforts on depository institutions and away from nonbanks, anticipating that only 30% of future supervisory efforts would focus on nonbanks as compared to its current estimate of 60%.

In terms of industry impact, beyond limiting the number of entities the CFPB designates for supervision under section 1024(a)(1)(C), the CFPB acknowledges that under the proposed rule, entities may be more encouraged to engage in activity with “some probability of harm to consumers, but that does not rise to the level of a high likelihood of significant harm.” It is also possible that the CFPB may choose to rescind additional prior orders that no longer align with its revised definition of “risk to consumers.”

Comments on the proposed rule are due on or before September 25, 2025.

Notes

1. 12 USC 5514(a)(1)(C)

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as "Cooley"). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction, and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. When advising companies, our attorney-client relationship is with the company, not with any individual. This content may have been generated with the assistance of artificial intelligence (Al) in accordance with our Al Principles, may be considered Attorney Advertising and is subject to our legal notices.