chevron-down Created with Sketch Beta.

The Business Lawyer

Spring 2022 | Volume 77, Issue 2

A Decade at the Consumer Financial Protection Bureau

Eric J Mogilnicki and Lucille Catherine Bartholomew


  • The successes of the CFPB’s first decade understate its influence. Not only have its enforcement actions deterred misconduct, but its supervision of financial institutions has prevented and remediated consumer harm, and its regulatory initiatives have offered wide-ranging protections to consumers.
  • However, the CFPB’s design—and the choices that its leaders have made to reverse their predecessors’ decisions—have led to substantial inconsistency in the formulation, implementation, and enforcement of federal consumer financial law.
  • This inconsistency helps explain why the CFPB is still, ten years after its creation, a political lightning rod.
A Decade at the Consumer Financial Protection Bureau

Jump to:


The Consumer Financial Protection Bureau (“CFPB”) was born when an idea met its moment. The idea was a consumer protection agency for financial products, and the moment was the turmoil of the subprime mortgage crisis and the Great Recession. Those circumstances led, in 2010, to the first new financial regulator since the Office of Thrift Supervision was created in response to the savings and loan crisis three decades earlier.

Any look back at the first ten years of the CFPB should start with its enormous successes. Its enforcement actions have secured over $12.9 billion in consumer relief and $1.6 billion in civil money penalties (“CMPs”). Those impressive numbers understate its influence. Not only have the CFPB’s enforcement actions deterred misconduct, but its supervision of financial institutions has prevented and remediated consumer harm, and its regulatory initiatives have offered wide-ranging protections to consumers.

These successes trace in part to the way that the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) reimagined consumer protection for financial services and products. The act took eighteen federal statutes that were formerly enforced by seven agencies and handed primary enforcement and exclusive regulatory authority over them to the CFPB. From this tangle of rules and regulators, Congress created a single agency “to implement and, where applicable, enforce Federal consumer financial law consistently.”

However, Congress’ solution to regulatory inconsistency has resulted in a different kind of regulatory inconsistency. The Dodd-Frank Act not only consolidated the enforcement of consumer financial law in the CFPB, but also consolidated the agency’s control in the hands of a single director. By design, the director may act rapidly and unilaterally, without the check of obtaining agreement from co-equals, as in a commission structure like the Federal Trade Commission (“FTC”), or the necessity of seeking funding from Congress. This design—and the choices that the CFPB’s leaders have made to reverse their predecessors’ decisions—have led to substantial inconsistency in the formulation, implementation, and enforcement of federal consumer financial law.

This inconsistency helps explain why the CFPB is still, ten years after its creation, a political lightning rod. During its first years, Republicans criticized the CFPB for veering too far left. More recently, Democrats have criticized it for veering too far to the right. This partisan divide is inconsistent with the persistent public support for the CFPB.

A Brief History of the CFPB

The CFPB was first proposed in 2007 by then-Harvard Law School Professor Elizabeth Warren. Warren’s proposal gained traction with the collapse of the subprime mortgage market, and the new agency was included in the sweeping Dodd-Frank Act. That Act took pains to keep the CFPB independent from Congress and the President alike. The CFPB is an independent bureau within the Federal Reserve, and is not funded through the congressional appropriations process. Instead, the CFPB director may simply requisition funding directly from the Federal Reserve, up to a capped amount of $717.5 million in 2021. No director has spent all of the available funding.

The Dodd-Frank Act structured the CFPB to be led by a single director, appointed by the President for a five-year term, who could be removed only for “inefficiency, neglect of duty, or malfeasance in office.” However, in June 2020, the U.S. Supreme Court ruled in Seila Law LLC v. Consumer Financial Protection Bureau that this limitation was an unconstitutional infringement on the President’s authority to fire executive branch employees. This ruling, which allows the President to terminate the director at any time and for any reason, will contribute to inconsistency at the CFPB, as future directors will be lucky, rather than likely, to serve a full five-year term. The Court declined to issue a more sweeping opinion that would have invalidated the CFPB as a whole, instead severing the removal restriction from the rest of the Consumer Financial Protection Act (“CFPA”).

CFPB Leadership

The consolidation of authority in the CFPB’s director has given each successive leader the power to create a bureau that corresponds to their own vision for the agency. This process has routinely meant rolling back—rather than building upon, or even around—the accomplishments of their predecessors.

Director Richard Cordray

Although the CFPB opened in July 2011, President Obama did not name its first director, Richard Cordray, until January 2012. Facing a difficult political battle to confirm his choice, coupled with Republican concerns about the scope and creation of the CFPB, President Obama appointed Director Cordray during a congressional recess, thereby bypassing the Senate approval process. Cordray was formally re-nominated and confirmed by the Senate in July 2013.

Director Cordray implemented a progressive agenda at the CFPB, including new regulations, aggressive enforcement actions, and a public Consumer Complaint Database that allows consumers to submit complaints about financial institutions. This agenda led the Chairman of the House Financial Services Committee to call for Director Cordray to be fired, accusing him of “conducting unlawful activities, abusing his authority, and denying market participants due process.” Cordray remained as director until his resignation in November 2017, whereupon President Trump appointed White House Budget Director Mick Mulvaney as acting director.

Acting Director Mick Mulvaney

A frequent critic of the CFPB under Director Cordray, Acting Director Mulvaney promptly set a very new direction for the Bureau. Indeed, he quickly emailed the CFPB staff outlining his intention to change “the entire governing philosophy of the Bureau,” which he characterized as “aggressively ‘pushing the envelope’ of the law in the name of the ‘mission.’” Acting Director Mulvaney then set out to push the envelope in the opposite direction, insisting that the CFPB works “for everyone: those who use credit cards, and those who provide those cards.” Enforcement would be used as a “last resort,” and only when supported by quantifiable and unavoidable harm to the consumer. In short, he promised, “we will be reviewing everything that we do, from investigations to lawsuits and everything in between.”

Acting Director Mulvaney made several significant structural changes, including restructuring the Office of Fair Lending so that it reported directly to the Director’s Office, and dissolving the Office of Student and Young Consumers. He also placed temporary freezes on hiring, enforcement, and regulatory initiatives, although the CFPB continued to pursue pending litigation. Acting Director Mulvaney also decided that the CFPB was more properly called the Bureau of Consumer Financial Protection, or the “BCFP,” and unveiled a seal for the Bureau with this new acronym. These actions attracted sharp Democratic criticism, including an accusation that he was attempting to dismantle the CFPB.

Director Kathleen Kraninger

In December 2018, the Senate confirmed President Trump’s nominee, Kathleen Kraninger, as CFPB director on a party-line, 50 to 49 vote. Director Kraninger followed in Acting Director Mulvaney’s footsteps by walking back several of Director Cordray’s initiatives, including by halting CFPB examinations of financial institutions for compliance with the Military Lending Act (“MLA”). She also supported the Trump Administration’s effort to make the CFPB more responsive to presidential direction by supporting the plaintiffs’ constitutional arguments in the Seila Law case. However, she also sought to find some middle ground. Her first action was to restore the CFPB acronym, while saying that the Bureau would use the Mulvaney-era BCFP name for certain reports and legal filings. More substantively, she decided to preserve half of the Cordray-era Payday Lending Rule, and established a steady pace of enforcement actions.

Acting Director Dave Uejio

Director Kraninger resigned on Inauguration Day in January 2021 at President Biden’s request. That same day, President Biden appointed Dave Uejio, a long-time CFPB employee, to serve as acting director until a permanent replacement was confirmed. Like Acting Director Mulvaney, Acting Director Uejio promptly emailed the Bureau staff to announce “a change of direction.” For Acting Director Uejio, that course correction included “reversing policies of the last administration that weakened enforcement and supervision” and “rescind[ing] public statements conveying a relaxed approach to enforcement of the laws in our care.” He promptly reversed guidance that afforded regulatory relief to financial services providers as a result of the COVID-19 pandemic, issued an interpretive rule reversing the CFPB’s position on its authority to examine supervised institutions for compliance with the MLA, and rescinded a CFPB policy statement on the “abusive” standard.

President Biden nominated FTC Commissioner Rohit Chopra to serve as director of the CFPB in February 2021. After a relatively placid confirmation hearing, the Senate Committee on Banking, Housing, and Urban Affairs deadlocked along partisan lines on whether to confirm Chopra. On September 30, 2021—nearly eight months after his nomination—Chopra was confirmed by the Senate on a 50 to 48 party-line vote. The delay and closeness of that vote, like the 50 to 49 vote to confirm Director Kraninger, reflects the continuing lack of congressional consensus on how the CFPB should be run. Moreover, the two transitions of CFPB leadership between the political parties illustrate how the predictable, five-year terms for directors established in the Dodd-Frank Act have been supplanted by a series of much shorter tenures by acting directors and directors. Director Chopra will be the Bureau’s fifth leader in the last five years, and the CFPB has been led by a Senate-confirmed leader for just six of its ten years.


The Dodd-Frank Act authorized the CFPB to engage in rulemaking and guidance related to “federal consumer financial law,” which includes eighteen preexisting federal consumer financial laws transferred to it from seven other agencies, and to its organic authority under the CFPA. The CFPB has promulgated well over a hundred formal rules over its first ten years, and it has provided hundreds more guidance and policy statements.

While the CFPB’s leaders have noted the importance of giving financial institutions clear “rules of the road” to follow, they have also made clear their intention to substantially change those rules. In erasing and blurring the bright lines drawn by their predecessors, well-intentioned directors and acting directors have created regulatory delays and reversals that are inimical to an agency established “to implement and enforce Federal consumer financial law consistently.” This section will discuss some of the more prominent regulatory developments of the CFPB’s first ten years.

Mortgage Lending and Servicing

The Dodd-Frank Act required the CFPB to take a number of steps with respect to mortgage lending and servicing. One such mandate was to integrate the mortgage loan disclosures under the Truth in Lending Act (“TILA”) and the Real Estate Settlement Procedures Act (“RESPA”), with the goal of simplifying mortgage disclosures and helping borrowers better understand mortgage transactions. This resulted in the TILA-RESPA Integrated Mortgage Disclosures, or TRID. The CFPB was also required to amend Regulation Z to ensure that lenders made a reasonable and good-faith determination of a borrower’s ability-to-repay certain mortgage loans (“ATR”), and to create a presumption of compliance for “qualified mortgages” (“QM”), which resulted in the ATR/QM Rule.

The ATR-QM Rule has undergone many changes. For example, the initial ATR/QM Rule included a “GSE patch” that provided a presumption of compliance for QMs for certain loans eligible for purchase by Fannie Mae or Freddie Mac. In December 2020, the CFPB released final rules extending the GSE patch and adding other types of loans to the definition of a QM. In April 2021, Acting Director Uejio postponed the mandatory compliance date for these rules.

Fair Lending

The Dodd-Frank Act gave the CFPB rulemaking authority for Regulation B, which implements the Equal Credit Opportunity Act (“ECOA”), and amended the ECOA to require covered lenders to provide any written appraisals or valuations developed in connection with loan applications, and to gather data on loan applications received from women-owned, minority-owned, and small businesses. In January 2013, the CFPB finalized a rule amending Regulation B to implement the appraisal requirement. After it was sued in 2019 to compel it to act, the CFPB launched a rulemaking process to implement the data collection requirement, and it issued a notice of proposed rulemaking in September 2021.

Prepaid Card Rule

The CFPB also inherited rulemaking authority for electronic fund transfers under Regulation E, which implements the Electronic Fund Transfer Act (“EFTA”). In 2012, the CFPB used that authority and its authority over Regulation Z to issue a proposed Prepaid Card Rule, which imposes restrictions on prepaid card issuers related to prepaid fees, disclosures, treatment of unauthorized transactions, and credit features. The final rule was issued in 2016, with an initial effective date of October 1, 2017, but Director Cordray extended this date to allow more time for its implementation. During that extension, Acting Director Mulvaney moved to further delay the effective date and to prune the proposed rule. Under Director Kraninger, the Prepaid Card Rule was partially invalidated, a decision that the Bureau, under Acting Director Uejio, only partially appealed.

Debt Collection Rule

Pursuant to the CFPA, the CFPB became the first federal agency empowered to promulgate rules under the Fair Debt Collection Practices Act (“FDCPA”). Director Cordray issued an Advanced Notice of Proposed Rulemaking in November 2013, but the CFPB did not propose a Debt Collection Rule until May 2019. The Rule became final in two stages, in November 2020 and January 2021, under Director Kraninger. Under Acting Director Uejio, the CFPB proposed to delay the effective date of the Debt Collection Rule and then reversed course.

The Debt Collection Rule includes, among other things: a presumption on the lawful number of collection calls per week; requirements for validation notices; and a requirement that creditors provide certain notice to debtors before furnishing information to consumer reporting agencies. At the same time, the Debt Collection Rule creates an opt-out model that allows debt collectors to use email, text messages, and voicemail to contact consumers about outstanding debts.

UDAAP and the Payday Lending Rule

In addition to its rulemaking authority for the eighteen enumerated statutes, the Dodd-Frank Act also granted the CFPB organic authority to regulate consumer financial products with respect to “unfair, deceptive, or abusive” acts and practices (“UDAAP”). Under Director Cordray, the CFPB used this organic UDAAP rulemaking authority to promulgate a Payday Lending Rule in November 2017 to regulate short-term and high-cost loans (“2017 Rule”). The 2017 Rule had two major sections: the “mandatory underwriting provisions” that required payday lenders to reasonably determine the borrower’s ability to repay certain loans, and the “payment provisions” that limited repeated attempts to withdraw funds from a consumer’s account. There was prompt pushback from congressional Republicans and the payday lending industry, as well as a federal lawsuit challenging the rule.

In June 2019, under the leadership of Director Kraninger, the CFPB delayed the compliance date for the mandatory underwriting provisions of the 2017 Rule in order to decide whether to retain them. One year later, it issued a new final rule that removed the mandatory underwriting provisions entirely, but did not amend or modify the payment provisions (“2020 Rule”). In the preamble to the 2020 Rule, the CFPB withdrew the 2017 Rule’s determination that extending payday loans to borrowers without assessing ability to repay was unfair or abusive. In 2021, the Bureau prevailed in litigation that began with the 2017 Rule, although the court extended the compliance date for the 2020 Rule to June 2022.

The future of the Payday Lending Rule remains unclear. An appeal of the district court order upholding the 2020 Rule is pending as of this writing, and Acting Director Uejio criticized both the payday lending industry and the amendments to the 2017 Rule under Director Kraninger. Under Director Chopra’s leadership, the CFPB may seek to reinstate the underwriting provisions, or seek to use its UDAAP enforcement authority to similar ends.

Arbitration Rule

The Dodd-Frank Act required the CFPB to study the issue of arbitration and to consider regulating the use of arbitration clauses in consumer financial services contracts. The CFPB completed that study in March 2015 under Director Cordray, and it promulgated a final arbitration rule in July 2017 prohibiting arbitration clauses that restricted civil class actions. However, in November 2017, a Republican Congress and President disapproved of the rule pursuant to the Congressional Review Act (“CRA”). Under the CRA, the CFPB is now prohibited from enacting any rule that is “substantially the same” as the arbitration rule absent congressional authorization.

The CFPB’s Rulemaking Agenda

The CFPB’s rulemaking efforts are ongoing, and its Spring 2021 rulemaking agenda sets forth its long- and short-term plans. In the months following issuance of that agenda, the Bureau issued a Notice of Proposed Rulemaking under section 1071 of the Dodd-Frank Act to require financial institutions to collect and report data regarding applications made by women-owned, minority-owned, and small businesses. Other planned regulatory activities include rules for: the availability of electronic consumer financial account data in electronic form pursuant to Dodd-Frank Act section 1033; Property Assessed Clean Energy financing; Automated Valuation Models; the transition away from the LIBOR index for mortgage and other consumer loans; and an assessment of a rule implementing the Home Mortgage Disclosure Act.

Innovation at the CFPB

At the same time that the Dodd-Frank Act provided the CFPB with broad authority to issue new regulations, it also instructed the new agency to identify and address “outdated, unnecessary, or unduly burdensome regulations,” and to ensure that “markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation.” While each director has embraced facilitating innovation as a priority, their widely disparate approaches to this mission have sent mixed signals to potential innovators.

Director Cordray created Project Catalyst to conduct outreach to and engage in collaborations with innovators. However, the CFPB’s early efforts to foster innovation were constrained by “an uneasy compromise between the desire to assist innovators and a hesitancy to cede any of the Bureau’s authority.” For example, the CFPB published a No-Action Letter (“NAL”) Policy, but made clear that NALs would be non-binding on it, the courts, other regulators, or private litigants and could be modified or revoked at any time. Unsurprisingly, requests for NALs were scarce, and the Cordray-era NAL Policy only resulted in one NAL in three years. The same was true of the CFPB’s initial trial disclosure program, which was created in 2013 but attracted zero successful applications.

Subsequent directors struck a different balance between regulation and innovation. Under Director Kraninger, the CFPB released three new policies to create safe spaces for institutions to innovate and compete. One such effort was a revised NAL Policy, which provided greater assurances that the CFPB will not bring a supervisory or enforcement action against institutions seeking to deliver innovative products or services. The revised NAL Policy also streamlined the application process and reduced the burden on applicants. Since the new NAL Policy was released, the CFPB has issued several notable NALs, including one to the U.S. Department of Housing and Urban Affairs (“HUD”) on behalf of counseling agencies participating in the HUD housing counseling program, and a NAL template to the Bank Policy Institute on behalf of bank members interested in offering small-dollar lending products to consumers.

Under Director Kraninger, the CFPB also implemented two regulatory sandboxes designed to clear away legal obstacles for innovative financial products or services. First, it finalized a Compliance Assistance Sandbox (“CAS”) Policy, which allows the CFPB to issue “approvals” to regulated entities that provide a binding assurance that specific aspects of a consumer financial product or service are compliant with legal provisions. Such an approval may be used to help the CFPB amend or support a regulation or an Official Interpretation.

Second, the CFPB rolled out a new Trial Disclosure Sandbox, which allows the CFPB to determine that applicants are in compliance with, or exempt from, federal disclosure requirements for a limited period of time. This new policy removed many of the restrictions on applicants and stated that approval of a trial disclosure would protect the underlying conduct from a private right of action or a federal or state enforcement or supervisory action.

Director Kraninger expressed the hope that the Bureau’s efforts to foster innovation during her tenure will serve as a lasting accomplishment. However, when asked directly during his confirmation hearings if he would retain the No-Action Letter, CAS, and Trial Disclosure Policies, Chopra stated only that he would work with the CFPB staff to identify ways to promote “consumer-friendly innovation.”


Although high-profile enforcement actions often attract the headlines, and regulatory issues reach Congress and the courts, the CFPB’s non-public supervisory activities may deliver the most value to consumers. “Supervision is at the heart of [the CFPB]—something underscored by the percentage of [CFPB] personnel and resources dedicated to conducting exams.” Examinations allow it to detect issues and require appropriate corrective action without a public enforcement action. The confidential nature of the CFPB’s supervisory efforts makes it difficult to assess how well supervision is functioning and the extent to which its approach to supervision varies under different leadership. However, the available record on supervision suggests that, as with regulation, the CFPB has not achieved consistency over time.

CFPB Enforcement Authority, Guidance, and Highlights

The Dodd-Frank Act gave the CFPB broad supervisory authority to examine certain entities for compliance with federal consumer financial laws. This supervisory authority extends to banks with more than $10 billion in assets, certain non-depository “covered persons,” “larger participants” in certain markets for a consumer financial product or service, and any party the Bureau has “reasonable cause to determine . . . is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”

The Dodd-Frank Act also authorized the director to issue supervisory guidance “as necessary or appropriate to carry out the law and prevent regulated entities from evading it.” A day before Director Kraninger resigned, the CFPB adopted a final rule making clear that while supervisory guidance provides insight into supervisory expectations, priorities, and “appropriate practices,” it does not have the “force and effect of law.” This rule prohibits the CFPB from bringing enforcement actions or issuing supervisory criticism based on an institution’s failure to comply with supervisory guidance.

The CFPB has also created, and then eliminated, Supervisory Recommendations. Created under Acting Director Mulvaney, Supervisory Recommendations allowed the CFPB “to recommend actions for management to consider taking . . . when the Bureau has not identified a violation of Federal consumer law, but has observed weaknesses in the CMS [Compliance Management System].” This tool provided a path for the CFPB’s examination team to help financial institutions recognize and improve deficiencies even where there was no formal violation of law. In March 2021, under Acting Director Uejio, the CFPB rescinded this guidance, explaining that every supervisory expectation, regardless of whether there was a violation of law, should be treated as a Matter Requiring Attention and that the CFPB would no longer issue Supervisory Recommendations.

The CFPB also provides guidance through its quarterly Supervisory Highlights. Because examination findings are confidential, Supervisory Highlights serves to “share key examination findings” on an anonymous basis. In doing so, Supervisory Highlights offers important clues about what issues are resolved in the supervisory process rather than escalated to the Office of Enforcement.

The Line Between Supervision and Enforcement

The line between supervision and enforcement is an important one for both consumers and supervised institutions. For consumers, supervision allows the CFPB to address issues promptly, and often to prevent—rather than later identify and remediate—violations of law. For financial institutions, supervision allows them to strengthen their procedures, and to resolve conflicts with the Bureau over the law’s requirements without the reputational harm of a public enforcement action. However, supervision is not transparent, and the CFPB has provided little information about how it determines whether a particular issue warrants supervisory or enforcement attention.

The available evidence suggests that the line between supervision and enforcement moves with each director. To begin with, the directors themselves have indicated that these standards change from administration to administration. Moreover, although the Bureau’s Supervisory Highlights are often brief and may not include all relevant facts and circumstances, they suggest that the CFPB has not acted consistently when faced with similar instances of misconduct over time. In particular, allegations that led to enforcement actions under Director Cordray appear to have received supervisory resolution in the years that followed his tenure.

For example, the CFPB brought an enforcement action in 2012 based on allegations that a financial institution “promised, but did not deliver, a cash bonus” to new customers. The resulting consent order required refunds of at least $75 million to approximately 250,000 customers. In 2020, when a financial institution allegedly failed to provide advertised bonuses to consumers who opened new accounts, the CFPB resolved the matter without enforcement, and by requiring that the financial institution enhance its training and quality control procedures “to ensure that . . . all consumers eligible for the advertised bonuses received them.”

In another example, the CFPB brought an enforcement action in 2017 against a major bank for allegedly notifying student borrowers that they were in default when they were not, and for collecting late fees that those borrowers did not owe. The resulting consent order required the bank to refund $3.75 million to thousands of affected customers and pay a CMP of $2.75 million. But in 2019, when the CFPB found that a mortgage servicer engaged in an unfair practice by charging “thousands of consumers” improper late fees, leading to “substantial” aggregate harm, the CFPB declined to bring an enforcement action, and used its supervisory authority to require that the mortgage servicer change its policies and procedures regarding late fees; conduct a review of affected borrowers; and provide monetary remediation to those affected without entry of a consent order.

The CFPB also pursued multiple enforcement actions under Director Cordray alleging false threats made to delinquent debtors. For example, in a 2014 enforcement action, it alleged that, among other things, a payday lender baselessly threatened debtors with lawsuits, extra fees, and harmful reports to credit reporting agencies, and ordered $5 million in refunds and imposed a $5 million CMP. In 2015, the CFPB brought an enforcement action against another small-dollar lender to pay $7.5 million in restitution and a $3 million CMP for falsely threatening consumers with litigation for non-payment of debts. However, when the CFPB alleged in 2019 and 2020 that several firms falsely threatened borrowers with litigation, additional fees, and asset seizures, it resolved the matters through the supervisory process, requiring changes to training, scripts, and other compliance processes, and consumer redress.

In a 2015 joint action with the U.S. Department of Justice, the Cordray-led CFPB sued a bank for alleged redlining in violation of the ECOA, claiming that the bank “avoid[ed] lending in, majority-Black-and-Hispanic areas.” The action was resolved through a consent order that required the bank to pay $25 million in subsidies for impacted loan applicants, $1 million for advertising and outreach in neighborhoods with majority Black and Hispanic populations, and a $5.5 million CMP. In contrast, the CFPB claimed in 2020 that one or more lenders “intentionally redlin[ed] majority-minority neighborhoods” through their marketing campaigns, but resolved those claims on a supervisory basis, requiring that the lenders implement minority outreach programs and improve their compliance management systems.


The CFPB has expansive enforcement authority. It may bring an enforcement action alleging a violation of any federal consumer financial law through an administrative adjudicative proceeding or by seeking equitable relief and civil penalties in federal or state court. The Bureau’s enforcement authority extends to all “covered persons” discussed above, as well as entities that are covered by an enumerated consumer law.

As with rulemaking and supervision, the CFPB’s leaders have taken widely different approaches to enforcement. They have been able to do so, in part, because the CFPB’s enforcement process provides substantial discretion to the Bureau in how it conducts each step of an investigation. The absence of checks and balances within the process has led, in a handful of cases, to courts striking down particularly aggressive enforcement tactics.

Civil Investigative Demands

The CFPB has broad statutory authority to issue Civil Investigative Demands (“CID”). A CID recipient may petition the CFPB to modify or set aside the CID within twenty days of service, or before the specified return date, whichever is shorter. Such petitions are rare, as they are heard and decided by the CFPB director and are published, making an otherwise confidential investigation a matter of public record. The director has rarely granted relief.

The CFPB’s confidence in its CID review process has sometimes proven misplaced. For example, the Dodd-Frank Act requires that each CID “state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.” In one case where the director ruled that the CFPB had met this standard, the Fifth Circuit found that the CFPB had engaged in “‘the absurdity of giving a notification that notifies of no purpose whatsoever.’” In another, the D.C. Circuit refused to enforce a CID with a “Notification of Purpose [that] gives no description whatsoever of the conduct the CFPB is interested in investigating.” In response to these cases, the CFPB changed its CID policies in April 2019 “to ensure they provide more information about the potentially wrongful conduct under investigation.”

Statutes of Limitations

The CFPB has also exceeded its authority to bring legal actions outside the statute of limitations. In general, it may not bring an action more than three years after the date of discovery of the violation, unless the relevant federal consumer financial law provides for a longer period. However, the CFPB claimed in PHH Corp. v. Consumer Financial Protection Bureau that these limitations did not apply in administrative proceedings. This position, combined with its complete discretion to choose an administrative proceeding, would have allowed the CFPB to avoid statutes of limitations altogether. The D.C. Circuit rejected this position, noting that such a result would be “absurd” and “nonsensical.”

Administrative Proceedings

The CFPB’s enforcement discretion extends to choosing whether an enforcement action is brought as a lawsuit or an administrative proceeding. In CFPB administrative hearings, pretrial discovery is limited, and cases are heard by administrative law judge. The administrative law judge then recommends a resolution to the director, who is free to reject and replace that recommendation with a different resolution. Parties may ultimately seek judicial review of administrative decisions in a federal court of appeals. The CFPB routinely settles cases administratively, but only two administrative proceedings have led to a formal hearing. Both eventually reached federal court; the director’s decision was overturned in one case, while the other is pending before the Tenth Circuit.

Civil Money Penalties

The CFPB also exercises significant discretion over the type and amount of remedies it will demand. In addition to seeking damages, restitution, disgorgement, and injunctive relief, the CFPB may impose a CMP of up to $1 million per day, depending on the mental state of the defendant. The Dodd-Frank Act requires the CFPB to consider certain factors when deciding the amount of the CMP, including the financial resources of the defendant, the gravity of the violation, the severity of the harm to consumers, any history of previous violations, and “other matters as justice may require.” The Bureau rarely explains its reasoning in announcing a CMP, and has varied widely in its approach to obtaining CMPs through settlement. This inconsistency contrasts with the approach taken by other financial regulators, such as the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency, that employ a detailed CMP matrix.

Enforcement Trends Over Time

Enforcement activity has ebbed and flowed with each new director. As a general matter, enforcement activity has picked up with Democratic directors, and has slowed or become more targeted under Republican directors.

The Cordray Era

As discussed above, Director Cordray took an aggressive approach to enforcement. Under his leadership, the CFPB exacted over $11 billion in consumer relief and brought over 200 enforcement actions, including 57 in 2015, the most in a single year. His approach was also subject to criticism, particularly for its reliance on enforcement actions rather than written guidance or rulemaking to describe the CFPB’s views on the law.

Enforcement actions under Director Cordray spanned a wide spectrum of laws and industry participants. In several cases, the CFPB brought similar cases against multiple market participants. One such set of cases led to consent orders against multiple banks for allegedly engaging in deceptive and unfair marketing and billing practices relating to debt protection and credit monitoring services marketed as credit card “add-on” products. The CFPB undertook a similar step with regard to student lending companies that had allegedly charged improper late fees, overstated minimum balances due, and maximized fees through processing payments, and actively enforced the mortgage servicing laws in the aftermath of the financial crisis. It also entered into settlements with several auto finance companies under the ECOA, which was met with substantial criticism from the House Financial Services Committee.

During the Cordray era, the CFPB relied heavily on its UDAAP authority, including the new “abusive” acts or practices prong. In one of the earliest enforcement actions, it alleged that a debt relief services company engaged in abusive acts or practices when it improperly charged consumers for services that it knew or should have known would not benefit them. The following year, the CFPB sued ITT Educational Services, a for-profit college, alleging that the school engaged in abusive acts or practice when it steered students towards high-interest loans.

Unfortunately, the “abusive” standard has not been defined by the CFPB, nor has it been subject to consistent deployment across enforcement actions. For example, the CFPB alleged in one enforcement action that creating “an artificial sense of urgency” for a consumer considering a payday loan was abusive, but in a similar enforcement action, the CFPB alleged that creating “an artificial sense of urgency” for a consumer considering a student loan was alleged to be deceptive. Similarly, the CFPB alleged that it was “abusive” to open an account without a consumer’s consent in one action, after alleging in a prior case that it was “unfair” to create loans and withdraw funds from a consumer account without the consumer’s consent.

Another theme to enforcement under Director Cordray was the use of enforcement actions, rather than guidance or regulation, to establish the CFPB’s views of the law. Often disparaged by critics as “regulation by enforcement,” he defended this approach by explaining that “anybody else with the same facts and circumstances should also recognize that they are at significant risk for violation of the law and ought to be conforming their conduct accordingly.” Criticism of this approach came to a head in PHH Corp. v. Consumer Financial Protection Bureau, when then-Judge Kavanaugh rebuked the CFPB for its interpretation of RESPA:

When a government agency officially and expressly tells you that you are legally allowed to do something, but later tells you “just kidding” and enforces the law retroactively against you and sanctions you for actions you took in reliance on the government’s assurances, that amounts to a serious due process violation.

The Mulvaney Era

Acting Director Mulvaney wasted no time in rejecting Director Cordray’s approach to enforcement. He announced that while the CFPB was prepared to take “dramatic action to protect consumers,” “bringing the full weight of the federal government down on the necks of the people we serve should be something that we do only reluctantly, and only when all other attempts at resolution have failed.” To that end, he implemented a temporary freeze on the CFPB’s enforcement efforts. He later released the freeze and announced his first enforcement action in April 2018, which included a CFPB-record $1 billion CMP. This high-profile enforcement action was followed by several other actions against large banks, including one related to allegedly miscalculated credit card rates, and a separate action related to a gap insurance product offered in connection with auto financing.

The Kraninger Era

Director Kraninger appeared to seek a path between the approaches of her two predecessors to enforcement. She described the CFPB’s mission as “articulating clear rules of the road for regulated entities” and then using “purposeful enforcement” to “focus on the right cases to reinforce clear rules of the road and prevent harm by making sure bad actors know they will be held to account.”

Director Kraninger brought enforcement actions at a faster rate than Acting Director Mulvaney, and at a slower rate than Director Cordray in his later years. During her tenure, the CFPB’s enforcement cases tended to focus on “bad actors”—generally smaller financial institutions accused of willful or egregious wrongdoing. For example, the CFPB brought a “sweep” of enforcement actions against relatively small mortgage companies that allegedly deceived servicemembers and veterans in violation of the CFPA and several cases against credit repair organizations charging illegal fees. As noted above, many other issues were resolved through supervision that might have led to public enforcement actions under Director Cordray.

Director Kraninger also took action to address the uncertainty surrounding the abusiveness standard, which had become a target of criticism by congressional Republicans. Under her leadership, the CFPB held a symposium on abusive acts or practices and released a policy statement providing that it would limit enforcement of the “abusive” standard to cases in which the harm outweighs the benefit of an act or practice, and would limit the monetary relief sought for a violation of the standard “where the person made a good-faith effort to comply with the law based on a reasonable—albeit mistaken—interpretation of the abusiveness standard.”

The Uejio Era

Like Acting Director Mulvaney, Acting Director Uejio promptly announced a sharp change in the CFPB’s approach to enforcement. The CFPB quickly put this new approach, which included a focus on racial justice, into action in an enforcement action alleging unfair, deceptive, and abusive practices involving immigration bonds for detained immigrants. In the accompanying press release, Acting Director Uejio explained that the CFPB “is prioritizing the case to send a strong signal that financial scams targeting communities of color will not be tolerated.”

Acting Director Uejio oversaw more than ten enforcement actions against both large and small institutions. The vast majority of these cases included UDAAP allegations. Several of these actions suggest that the CFPB will once again, as it did with regard to auto finance companies under Director Cordray, seek to punish financial institutions for the misconduct of parties to which they provide financial services. Acting Director Uejio also reversed Director Kraninger’s policy statement on the enforcement of the “abusive” standard. In rescinding the policy, the Acting Director characterized the guidance as stating “a policy of declining to enforce the full scope of Congress’s definition of an abusive practice.”

The Next Ten Years

Establishing a new agency is difficult work, and the staff and leaders of the CFPB deserve enormous respect for their ingenuity, productivity, and commitment to improving financial services for all Americans. After ten years of growth, the next decade will include the hard work of growing the CFPB into a mature agency. Such maturity will eventually be critical to its survival as an independent agency. Indeed, the CFPB need look back only to some of its now-defunct predecessors, such as the Office of Thrift Supervision and the Federal Home Loan Bank Administration, to know that its current independence and authority should not be taken for granted.

One critical ingredient in securing the future of the CFPB would be for it to reflect the consistency called for by the Dodd-Frank Act. A mature agency has an institutional memory and respect for precedent that serves as ballast when new waves of change arrive. Such an agency will eschew short-term maneuvers, particularly those that can be reversed when partisan tides change, in order to build a record of steady progress that commands a broad base of respect and acceptance. If the CFPB can accomplish the unglamorous but essential goal of consistency, we can look forward to celebrating another decade of accomplishment in ten years’ time.