Curtailing the Authority of the CFPB Continues

Since taking office, the Trump administration has severely curtailed the Consumer Financial Protection Bureau’s (CFPB) rulemaking and enforcement activity. The Reg E Reader has been following along as state agencies, nonprofits, and private litigants attempt to pick up where the CFPB left off.^[1]  Recently, the United States House of Representatives and a federal court of appeals weighed in on the continued reduction of the CFPB’s authority.  

House and Senate Gut Reg E’s Protections from the Reach of Large Nonbanks

On April 9, 2025, the United States House of Representatives voted to pass a joint resolution disapproving the CFPB’s rule relating to ‘‘Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications”^[2] (the Rule), in an attempt to nullify the “force and effect of the rule.”^[3]The rule brings “non-bank covered persons” under the umbrella of the CFPB’s supervisory authority via the Consumer Financial Protection Act.^[4] The Rule defines a nonbank covered person as a “larger participant” if it, first, facilitates an annual covered consumer payment transaction volume of at least 50 million transactions as defined in the rule; and second, is not a small business concern.^[5] 

The House voted to nullify the rule along party lines with 219 yays, 211 nays, and 3 abstentions.^[6]  The Senate passed the resolution on March 5, 2025. The White House has already indicated that President Trump will sign the bill into law, so we expect the Congressional Review Act resolution  to become law in short order.^[7] In so doing, the President will use his Article II powers to formally rescind the CFPB’s oversight over nonbank companies that process more than 50 million consumer transactions annually.

The Rule also defined larger market participants for consumer payment applications and extended the CFPB’s authority to supervise them, ensuring that companies handling more than 50 million transactions per year followed federal law just like large banks, credit unions, and other financial institutions already supervised by the CFPB. The Rule, which was finalized in November 2024 and took effect on January 9, 2025, enabled the CFPB to oversee big tech companies in three key areas—privacy and surveillance, errors and fraud, and debanking.

Courts Entertain a Spectrum of Challenges

Federal courts continue to shape the CFPB’s future in adjudicating a myriad of cases involving the CFPB brought by both CFPB defenders and those who favor a reduction in its reach. Landing on both sides of the issue, courts have used their discretion as to when judicial intervention is necessary to “ensure that the Bureau continued to fulfill specific statutory obligations.”^[8] 

One case we are closely monitoring was brought by the National Treasury Employees Union (NTEU) against Acting Director Russell Vought and the Trump administration. The NETU brought the case under the Administrative Procedure Act, accusing Vought and the administration of mounting a campaign to dismantle the CFPB.

On April 3, 2025, the NTEU filed a temporary restraining order (TRO) that would maintain the existence of the CFPB as it stood before the administration change. The district court sided with the NTEU, granting a TRO against the administration to prevent irreparable harm.^[9] According to the court, the evidence shows “a hurried effort to dismantle and disable the agency entirely.” The administration appealed the ruling.

The Court of Appeals for the D.C. Circuit heard oral arguments on April 9, 2025. While Judges Neomi Rao and Gregory Katsas signaled an openness to trimming the scope of the trial court’s preliminary injunction, Judge Cornelia Pillard said it would be “perilous” to do so without more information on the CFPB’s statutory obligations.

We will continue to update the Reg E Reader as new developments shape Reg E enforcement. For further information, or if you have any questions, please contact the authors of this blog post or your regular Winston contacts.

---

[1] Previous Reg E Reader posts have explored nonprofits’ standing to litigate in lieu of Bureau enforcement and the growing risks of class action litigation regarding Reg E issues.  

[2] “The Act,” Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications, 89 Fed. Reg. 99582 (Dec. 10, 2024).

[3] The joint resolution can be accessed here.

[4] The term “covered person” means “(A) any person that engages in offering or providing a consumer financial product or service; and (B) any affiliate of a person described [in (A)] if such affiliate acts as a service provider to such person.” 12 U.S.C. § 5481(6).

[5] The Act at 1. 

[6] The roll call from the vote is available here.

[7] The statement from the White House can be accessed here.

[8] See Nat’l Treasury Emps. Union, et al. v. Vought, Case 1:25-cv-00381-ABJ (D.C. Cir. Apr. 1, 2025).

[9] NTEU v. Vought, Dkt. 102 at 2.