Consumer Financial Protection Bureau (CFPB)
The Consumer Financial Protection Bureau (CFPB) is the U.S. federal agency created after the 2008 financial crisis to regulate consumer financial products — mortgages, credit cards, student and auto loans, debt collection, credit reporting. It writes rules, supervises institutions, and brings enforcement actions. Its funding, staffing and enforcement posture changed substantially during 2025 and 2026, and any description written before that is out of date.
| Established | 2010, by Title X of the Dodd-Frank Act |
| Began operating | July 2011 |
| Covers | Consumer financial products and services — lending, cards, servicing, debt collection, credit reporting |
| Core powers | Rulemaking, supervision, enforcement, consumer complaint handling |
| Funding mechanism | Transfers from the Federal Reserve, subject to a statutory cap |
| 2025 funding change | Cap reduced from 12% to 6.5% of the Federal Reserve’s 2009 operating expenses |
| Resulting FY2025 cap | Approximately $446 million, down from approximately $823 million |
| 2025 supervisory posture | A broad regulatory, supervisory and enforcement freeze, with a stated reduction in supervisory activity and a shift of focus toward depository institutions |
What the CFPB does
Four functions, and they are worth separating because they have been affected differently by recent changes.
Rulemaking. The Bureau issues regulations implementing federal consumer financial law — including rules inherited from other agencies at its creation, such as those under the Truth in Lending Act, the Fair Credit Reporting Act, and the Electronic Fund Transfer Act.
Supervision. It examines banks above an asset threshold and certain non-bank entities, reviewing compliance directly rather than waiting for a complaint.
Enforcement. It brings actions for violations of federal consumer financial law, including for unfair, deceptive or abusive acts and practices.
Consumer response. It operates a public complaint database, which has independent value as a source of evidence about what is going wrong in a market.
What changed in 2025 and 2026
This section is the reason to read this page rather than an older one. Three developments matter:
| Change | Detail |
|---|---|
| Funding cap reduced | Legislation signed in July 2025 cut the statutory cap from 12% to 6.5% of the Federal Reserve’s 2009 operating expenses, roughly halving the ceiling |
| Supervisory and enforcement pullback | A broad freeze instituted in February 2025, alongside a stated intention to substantially reduce supervisory events and refocus from non-depository to depository institutions |
| Structural uncertainty | Litigation over funding, significant staff reductions, and pending legislative proposals to rewrite how the Bureau supervises and enforces |
The practical consequence for compliance teams is that the Bureau’s reduced activity does not repeal any obligation. The statutes and regulations remain in force. Other enforcers — prudential banking regulators, the Federal Trade Commission, and state attorneys general, several of whom have expanded consumer financial enforcement — retain their own authority. A reduction in federal supervision is a change in the probability of examination, not in the underlying rules.
Why the CFPB matters for identity verification
The Bureau is not an AML regulator and does not administer Customer Identification Program requirements — those sit with FinCEN and the prudential regulators. Its relevance runs through a different channel, and it is a channel that cuts both ways.
Consumer financial law constrains how identity checks may be run. Fair lending and UDAAP principles mean a verification process that fails disproportionately for some groups is a compliance question, not only a performance one. Adverse action requirements mean an applicant declined on the basis of a check is owed an explanation, which is difficult when the decision came from a model nobody can interpret. And the Fair Credit Reporting Act governs the use of consumer report data, which many identity checks rely on.
The other direction is identity theft. Victims whose stolen identity was used to open credit face disputes and correction processes shaped by consumer financial regulation — which means weak verification at account opening creates a consumer-protection problem downstream, not merely a credit loss. Accurate identity document verification at application is what keeps a real person from spending months disputing an account they never opened, and KYC and AML workflows sit inside that constraint rather than outside it.
What the CFPB doesn’t do
It does not administer AML or CIP requirements. Those belong to FinCEN and the prudential banking regulators.
It does not supervise every institution. Supervisory authority depends on institution type and size, and the 2025 refocus narrowed it further in practice.
It does not resolve individual disputes as an adjudicator. The complaint database routes complaints to companies for response; it is not a tribunal.
Its reduced activity does not suspend any obligation. The rules remain in effect and other enforcers remain active, including state attorneys general.
Frequently asked questions
What does the CFPB regulate?
Consumer financial products and services — mortgages, credit cards, student and auto loans, debt collection, credit reporting, payments and deposit accounts. It writes rules under federal consumer financial law, supervises covered institutions, and brings enforcement actions.
Has the CFPB been shut down?
No, though its capacity has been substantially reduced. Legislation in July 2025 cut its statutory funding cap from 12% to 6.5% of the Federal Reserve’s 2009 operating expenses, and a broad supervisory and enforcement freeze was instituted in early 2025 alongside significant staff reductions. Its structure and authority remain the subject of litigation and pending legislation, so its current posture should be checked against primary sources.
Does the CFPB enforce KYC rules?
No. Customer Identification Program and anti-money-laundering requirements are administered by FinCEN and the federal banking regulators. The CFPB’s relevance to identity verification runs through consumer protection law — fair lending, UDAAP, adverse action notices, and the Fair Credit Reporting Act.
If the CFPB is less active, do the rules still apply?
Yes. Reduced supervision changes the likelihood of examination, not the legal obligations. The underlying statutes and regulations remain in force, and prudential regulators, the FTC and state attorneys general retain independent enforcement authority.
Related reading
- Customer Identification Program — the identity requirement that sits with FinCEN rather than with the CFPB
- Identity theft — the consumer harm that weak verification at account opening creates downstream
- Office of the Comptroller of the Currency — a prudential regulator whose supervisory authority is unaffected by these changes
- Client onboarding in financial services — where these obligations meet the account-opening experience
