Executive Summary

• Under Director Rohit Chopra, the Consumer Financial Protection Bureau (CFPB) used its four years during the Biden Administration attempting to radically reshape the financial services industry; it did so with such haste and foggy policy that senior congressional Republicans accused Chopra of abuses of power. 

• The most disturbing trends across the agency’s actions were twofold: self-determinations that expanded the remit of the CFPB’s regulatory scope and an increased reliance on the use of regulatory authority seemingly designed to circumvent the traditional rulemaking process. 

• While significant portions of the Chopra agenda are vulnerable to recission under the Congressional Review Act, those same actions are under unprecedented legal challenge – a reflection of both bad policy and worse process. 

Policy by Traditional Means 

Small Business Data Collection 

In January 2021, shortly after the Biden Administration took office, the Consumer Financial Protection Bureau (CFPB) proposed a significant expansion in bank reporting requirements. Specifically, the agency would implement a Dodd-Frank provision – a rule it had previously ignored for more than a decade – requiring banks to provide more information on lending to small businesses. Under Dodd-Frank section 1071, lenders would be required to identify women-owned, minority-owned, and small businesses, and collect data relating to the race, sex, and ethnicity of these business owners. Lenders would also need to identify the purpose of the loan, the action taken with regard to the loan application, the business’s gross annual revenue, and “any additional data that the [CFPB] determines would aid in fulfilling the purposes of this section.” 

Banks immediately decried the overwhelming expansion in both compliance costs and paperwork hours. Additional reporting requirements do not magically create additional available capital at lenders (if anything, it will do the opposite). But this was only the tip of the iceberg – the rule also proposed the creation of a federal database of small credit business applications (government databases with critical personal data are rarelyy efficient, effective, cheap to create and operate, or immune from fraud or hacking), and added that “If an applicant does not provide any ethnicity, race, or sex information for any principal owners, the Bureau is proposing that the financial institution must collect at least one principal owner’s race and ethnicity (but not sex) via visual observation or surname.” 

The rule was finalized in March 2023, three months before the CFPB suffered an extraordinary data breach: An employee forwarded the personal details of more than a quarter million consumers to a personal email account. By January 2024, both the Senate and the House had voted to kill the rule; the subsequent veto by President Biden means the rule remains in force. 

Junk Fees 

One consistent theme of the Biden Administration has been an assault on “junk fees.” The CFPB was an enthusiastic early supporter of this war, drafting rules primarily relating to late credit card payment fees and overdraft fees. While the Biden Administration and its agencies have typically declined to define the concept of a junk fee with any degree of precision, consistent themes emerge in the examples they provide and in how they use the term.  

First, and perhaps most important, usage of the term junk fee implies that the practice is illegal or illicit. Frequently used language includes words such as “unfair” (with reference to the Consumer Financial Protection Act), “coercive,” “deceptive,” “otherwise illegal,” and astonishingly, “illegal.” This is, of course, untrue – in every case mentioned above, the practice relates to a legal revenue stream supervised by the federal regulators themselves. To imply that businesses operating within the remits authorized to them by the agencies and Congress is somehow inappropriate is a dishonest mischaracterization of the regulatory environment in which businesses operate. As one example, the regulatory structure in which late credit card fees operate is run by the CFPB itself, which sets maximums. To rail at companies operating within the bounds the agency itself set is blatantly incoherent policy. It is likely that the primary function of the term junk fee is to provide implied illegality because actual illegality does not exist. 

The assault on so-called junk fees saw its nadir with the February 2023 proposed rule on overdraft lending, subjecting financial institutions with over $10 billion in assets to Truth in Lending Act requirements for overdraft loans. The rule has not been finalized and the next CFPB director is likely to halt this effort.   

Annexation of Fintech 

In April 2022, the CFPB announced its intentionto exercise a “dormant” authority granted to it under Dodd-Frank to expand the scope of the entities it supervises to include nonbanks and fintechs. The lack of a unified federal approach to fintech regulatory oversight has created a turf war in Washington. The CFPB’s proposal marked its foray into the field, yet compared to the other regulatory agencies competing for authority over these entities, the CFPB is particularly ill-equipped to regulate fintechs. This is because it lacks the knowledge, manpower, and resources to do so; more important, it has demonstrated an extreme antipathy to the entities it regulates.  

Remarkably, the speed and pace with which the CFPB under the leadership of Director Chopra sought to reshape American finance led the Chamber of Commerce to file letters alleging the CFPB had embarked on “imprudent and unlawful actions,” House Republicans to accuse the CFPB of “conspiring with state agencies to pursue duplicative enforcement actions,” and Senate Republicans to accuse Chopra of “abuses of power.” 

Open Banking Rule 

In October 2024, the CFPB finalized a long-awaited open banking rule that seeks to give consumers better control over their financial data and make it easier to shop around for competing products and services. For the first time, consumers would be able to request that their financial services providers share their privileged information with third-party competitors and fintechs offering competing products.  

Proponents of the rule note the opportunities for enhanced competition, better products and services for consumers, improved data security, and decreased barriers to entry for financial services providers. Opponents of the rule question whether the CFPB is operating within the scope of its powers and note the increased opportunities for fraud as well as the unequal flow of rights to fintechs and responsibilities to the traditional banking sector.  

Despite opposition the rule met with unusual public and bipartisan political support, suggesting that it will survive future Congresses – provided it withstands legal challenge. Two bank trade groups immediately sought to argue in court that the rule exceeds the CFPB’s mandate and will expose consumers to unacceptable levels of fraud.  

Medical Debt 

The CFPB announced as early as January 2022 efforts to consider barring medical data on credit reports. While there were plenty of signals to expect this rulemaking effort, the timing of the CFPB’s finalized rule is remarkable – less than two weeks before President-elect Trump’s inauguration. It is hard to imagine a better candidate for overturning the rule via the Congressional Review Act as, once again, the rule is characterized by both bad policy and bad process. Decreasing the accuracy of credit reporting necessarily leads to less risk data. To offset this increased uncertainty, lenders will need to raise the prices of all loans for all consumers to account for hidden costs. More pressing, the contents of credit reporting are covered by the Fair Credit Reporting Act, which does not empower the CFPB with discretionary authority as to what should or shouldn’t be included. 

The Road Not Traveled 

No consideration of the CFPB’s actions would be complete without at least briefly considering its inactions. Outside of an aggressive posture against the traditional tech titans, the CFPB was relatively silent on crypto, leaving that turf battle to the Securities and Exchange Commission (SEC) and the Commodities Futures Trading Commission (CFTC). No movement was made on Biden campaign promises to create a government-backed credit bureau to compete with Equifax, TransUnion, and Experian. 

Constitutionality 

In May 2024, the Supreme Court ended years of uncertainty by ruling that the CFPB’s funding structure is constitutional, removing the biggest legal challenge to the existence of the CFPB since the court’s own decision and allowing the president to fire the CFPB director for cause.  

Policy by Non-Traditional Means 

Guidance 

The traditional rulemaking process is tedious, lengthy, and fraught with peril – in many cases intentionally. This creates incentives for “activist” – or at the very least highly active – federal agencies to pursue alternative paths to rulemaking, most obviously via the release of “guidance” or “advisory opinions.” One more pressing example of this was seen in May 2022 with the release of an advisory opinion “clarifying” that the Equal Credit Opportunity Act prohibits lenders from discriminating against existing customers, not simply new ones. This not only significantly expands a lender’s potential scope for liability but is necessarily duplicative of existing standards for existing customers and once again expands the CFPB’s fiefdom, arrogating an expanded population to itself. Even if the rulemaking itself weren’t bad policy, it was implemented using a bad process, making it suspect from inception. 

Another example of the use (or misuse) of guidance was seen in the ongoing attempts by the CFPB and others to define “unfair, deceptive or abusive acts or practices” – the acts that govern the CFPB’s ability to intervene. In March 2023 the CFPB issued guidance attempting to clarify its understanding of “abusive” by reference to the equally nebulous concept of “unfair advantage.” While a somewhat ridiculous example, the ability of the CFPB to determine so easily the scope of its own supervisory universe without reference to a rule or the congressional delegation of authority remains troubling. 

Enforcement 

While the CFPB is often tarred with the brush of rulemaking by enforcement, Biden’s CFPB took fewer enforcement actions during his term (96) than Trump in his first term (114) or Obama in his second term (161) (although the pace of agency enforcement action is believed to have slowed while the CFPB awaited the results of constitutionality challenges). What is remarkable, however, is the post-election flurry of enforcement actions the CFPB has taken, with lawsuits on Zelle fraud, Walmart delivery drivers, and alleged Rocket Mortgage kickbacks. 

Also remarkable is the unprecedented scale of the legal challenge facing the CFPB, as the agency defends its rulemakings in the courts; the CFPB is fending off challenges to small business data-reporting requirements, credit card late fees, its guidance on abusive practices, and more. It is likely that the CFPB under its new director will choose not to defend these regulations in court.  

Data Request 

A key tenet of Biden’s CFPB is the notion that no data request was too onerous or unnecessary. Late 2021 saw the CFPB order Apple, Meta, Amazon, Google, PayPal, and others turn over details on how the tech giants handle customer payments data. This was for many the first indication that the CFPB not only intended to return to a far more active supervisory stance but also that its scope extended significantly beyond the traditional banking sector – to the schadenfreude of those banks. In November 2023, the CFPB made good on its threat, proposing a rule that would subject tech firms with digital payment platforms or wallets to the same scrutiny as banks. 

Conclusions 

It is difficult to see if basic, existential questions of constitutionality slowed the pace of rulemaking at the CFPB under President Biden’s tenure. But it wasn’t simply a case of poorly considered policy seemingly rushed out: Many of these actions significantly expanded the scope of the CFPB’s powers, and in ways insulated from the traditional rulemaking process or congressional oversight. This CFPB certainly moved fast and definitely broke things. While it is not uncommon for any new administration to seek to undo the efforts of the previous administration, the truly interesting cases will not be considered by the Congressional Review Act but by the courts.