The CFPB and consumer protection

The Consumer Financial Protection Bureau was created by Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. It consolidated consumer-protection rulemaking and supervisory authority — previously dispersed across the OCC, the Federal Reserve, the FDIC, the Office of Thrift Supervision, the National Credit Union Administration, the Federal Trade Commission, and the Department of Housing and Urban Development — into a single federal regulator. The premise was simple: before 2010, no single agency had clear ownership of consumer financial protection, and the agencies that did have authority had competing mandates. The CFPB was designed to provide that ownership.

This article describes what the CFPB actually does: its rulemaking authority over which laws, its supervisory and enforcement authorities, the consumer complaint process, and the political and legal contestation that has surrounded the agency since its creation. The CFPB's authority has been the subject of more legal and political challenge than that of any peer regulator; the current state of play is described here, but readers should expect change.

Mandate and structure

The CFPB's mandate is to "regulate the offering and provision of consumer financial products or services under the Federal consumer financial laws." Those laws include the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Fair Credit Reporting Act (jointly with the FTC), the Equal Credit Opportunity Act, the Real Estate Settlement Procedures Act, the Home Mortgage Disclosure Act, the Fair Debt Collection Practices Act, the Gramm-Leach-Bliley Act privacy provisions, the Consumer Leasing Act, and the prohibition against unfair, deceptive, or abusive acts or practices (the UDAAP authority unique to the CFPB). The implementing regulations — Regulation Z, Regulation DD, Regulation E, Regulation V, Regulation B, and others — were transferred from the previous regulators to the CFPB by Dodd-Frank.

The agency is led by a single Director, appointed by the President and confirmed by the Senate for a five-year term. The Supreme Court held in Seila Law v. CFPB (2020) that the prior statutory restriction on removing the Director only for cause was unconstitutional; the Director now serves at the pleasure of the President. The agency is funded by transfers from the Federal Reserve System rather than congressional appropriation — a structural feature challenged in CFPB v. Community Financial Services Association (2024), in which the Supreme Court held that the funding mechanism is constitutional. The two cases together leave the agency intact as a structural matter while making its policy direction more sensitive to changes in administration.

What the CFPB can do

The CFPB has four principal functions.

Rulemaking. The CFPB issues regulations implementing the federal consumer financial laws. Major CFPB rulemakings in the past decade include the Qualified Mortgage rule under Regulation Z, the integrated mortgage disclosure rule (TRID), the small-dollar lending rule, the prepaid-accounts rule under Regulation E, the Section 1033 personal financial data rights rule, and proposed or finalized rules on credit-card late fees, overdraft fees at banks above defined asset thresholds, and arbitration clauses. Several recent rulemakings have been subject to litigation or rescission; the live status of any specific rule should be checked against the CFPB's website before relying on it.

Supervision. The CFPB has direct supervisory authority over banks, credit unions, and savings associations with more than $10 billion in assets, and over non-bank entities in defined markets including mortgage origination and servicing, payday lending, private student lending, and (since the agency's "larger participant" rules) consumer reporting, debt collection, and student loan servicing. Supervision means on-site examinations, periodic information requests, and the issuance of supervisory letters. For banks below $10 billion, consumer-compliance examination is conducted by the prudential regulator (OCC, Fed, FDIC, or NCUA), with the CFPB retaining rulewriting authority.

Enforcement. The CFPB can bring administrative actions and federal-court lawsuits against institutions that violate the consumer financial laws. Remedies include civil money penalties, restitution to harmed consumers, injunctive relief, and (in some cases) bans on individual officers. The agency publishes consent orders and litigation outcomes; the cumulative enforcement record since 2011 includes orders requiring billions of dollars in consumer restitution.

Consumer assistance and education. The CFPB operates a complaint portal at consumerfinance.gov/complaint, accepting consumer complaints about banks, credit unions, mortgage servicers, debt collectors, credit reporting agencies, and other consumer-finance providers. The agency forwards each complaint to the institution and the prudential regulator, tracks the institution's response, and publishes a public version of the complaint (with the consumer's identifying details removed) in the Consumer Complaint Database. The database is the largest publicly available source of consumer-finance grievance data in the country.

The complaint process, in detail

The CFPB complaint process is the most visible consumer-facing service the agency provides. The process works as follows:

1. The consumer submits a complaint via consumerfinance.gov/complaint, by phone, by mail, or by fax. The complaint includes a description of the issue, the institution name, supporting documentation if available, and the consumer's contact information.
2. The CFPB forwards the complaint to the institution (and to the institution's prudential regulator) and assigns it a tracking number. The institution is expected to respond within fifteen days, with a final response within sixty days in most product categories.
3. The institution's response is shared with the consumer and recorded in the CFPB's database. The consumer can give feedback on the response, which becomes part of the record.
4. A scrubbed version of the complaint and the institution's response is published in the public Consumer Complaint Database.

The complaint process is not adjudicative — the CFPB does not decide who is right between the consumer and the institution, and submitting a complaint does not preserve legal rights or replace any required filing under specific consumer-protection laws (an unauthorized-transaction notice under Regulation E, for example, must still be made to the bank within the regulatory time frame regardless of whether a CFPB complaint is also filed). What the process does provide is escalation: institutions respond differently to complaints that have a CFPB tracking number than to those that do not.

The UDAAP authority

The CFPB's most distinctive substantive authority is the prohibition on "unfair, deceptive, or abusive acts or practices" — UDAAP — under §§1031 and 1036 of Dodd-Frank. The unfair and deceptive prongs largely parallel the FTC Act's familiar UDAP standard; the "abusive" prong is new with Dodd-Frank and gives the CFPB authority to act against practices that materially interfere with a consumer's ability to understand a product, take unreasonable advantage of a consumer's inability to protect their interests, or take unreasonable advantage of a consumer's reasonable reliance on the institution to act in their interests.

The scope of the abusive standard has been contested both in policy guidance and in litigation; the agency has issued and rescinded policy statements on it, and the substantive boundaries continue to be developed through enforcement cases. UDAAP, broadly, is the authority under which the CFPB pursues practices that violate no specific regulation but that the agency considers unfair, deceptive, or abusive in light of the totality of the circumstances.

Political and legal contestation

The CFPB has been the subject of recurring legal and political challenge since its creation. The Director-removability question was resolved in Seila Law; the funding-structure question was resolved in Community Financial Services Association; individual rules have been challenged on the merits in multiple cases. Several rulemakings — the credit-card late-fee rule, the Section 1071 small-business data collection rule, the larger-participant rule for digital wallets — have been stayed, modified, or rescinded through litigation, rulemaking action, or political turnover at the agency. A consumer reading this article should treat the existence of CFPB authority as settled and the application of CFPB authority to any specific rule as more contingent than at most peer regulators.

What this means for a depositor

For most consumer interactions with a bank, the relevant CFPB activity is the underlying rule rather than the agency itself: Regulation E governs your fraud rights, Regulation DD requires your APY disclosure, Regulation Z structures your credit-card disclosures. The CFPB enters the picture when the rule is unclear, when the bank declines to apply it as you expected, or when the dispute resists resolution at the bank level. The complaint portal is the channel; the prudential regulator (OCC, Fed, FDIC, or NCUA) is a parallel channel for institutions below the CFPB's direct supervisory threshold. Both can be used; using both does not strengthen the case but does ensure the file reaches the agency most likely to act.

Limits and uncertainty

The CFPB's structural authorities are settled by the two Supreme Court cases noted above. The application of those authorities to specific rules and enforcement programs continues to shift with administration and with litigation. The agency's overdraft, credit-card late-fee, and Section 1033 rulemakings have been particularly active areas of contestation. Where this site cites a specific CFPB rule or guidance document, it carries a date; readers should confirm current status before relying on a specific provision. The agency itself is durable; its specific outputs are mutable.