Legal and Regulatory Developments
CFPB Narrows Supervision and Enforcement, Leaving Broader Focus to States
The CFPB confirmed in a recent memo to staff that it is shifting its tone on supervision and enforcement—even as reports circulate about significant staffing cuts and potential structural changes at the agency. While the document announces a return to core statutory enforcement and a retreat from expansive interpretations, how much activity the Bureau will undertake going forward remains uncertain. As the federal focus narrows, state enforcers and private litigants may step further into the spotlight.
State Attorney General Investigations: What Consumer Financial Services Companies Need to Know
State attorneys general (AGs) have long played a significant role in consumer protection enforcement, often acting as frontline regulators alongside federal agencies. For consumer financial services companies, an AG investigation can present both operational disruption and reputational risk. Understanding the process, potential pitfalls, and effective defense strategies can help make a significant difference in the outcome.
New York’s Consumer Protection Overhaul: A Lawsuit Magnet for Banks, Fintechs, and Other Financial Services Providers
New York lawmakers—with full support from the attorney general—are pushing a sweeping expansion of consumer protection laws that could turn routine financial transactions into the next big class action battleground and expand the enforcement arsenal of the NY AGs office.
California Bill Would Expand DFPI's Power to Police Financial Services Misconduct
A new proposal in California, Senate Bill 825 (SB 825), is intended to strengthen the enforcement authority of the state's Department of Financial Protection and Innovation (DFPI) by clarifying that it can take action against unfair, deceptive, or abusive acts or practices (UDAAPs)—even when the company involved is licensed under one of the state's existing financial services laws.
CFPB Pauses Enforcement of Nonbank Registration Deadlines
On April 11, 2025, the Consumer Financial Protection Bureau (CFPB) announced that it will not prioritize enforcement or supervisory actions against nonbank entities that miss upcoming registration deadlines under its Nonbank Registration Rule. These deadlines, including those scheduled for April 14 and July 14, 2025, were part of the Bureau's initiative to establish a public registry of nonbanks subject to federal, state, or local agency or court orders based on violations of consumer financial laws.
Crossing the Pond: What UK Fintechs Taking a Fresh Look at the U.S. Market Need to Know
For years, UK-based consumer finance and payments firms have viewed the U.S. regulatory landscape as complex, fragmented, and challenging when it comes to expansion. But 2025 may prove to be a turning point. The new Trump administration is ushering in a broad deregulatory shift in Washington and rolling back aggressive rulemaking and enforcement trends that characterized the Biden years. The U.S. financial services market—already the largest and most lucrative in the world—is now poised to become even more business-friendly, especially for providers of cryptocurrency and digital asset services.
A Legal Whirlwind Settles: Treasury Lifts Sanctions on Tornado Cash
On March 21, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) officially lifted sanctions on Tornado Cash, the decentralized cryptocurrency mixer it had blacklisted in August 2022. In a brief but notable update to its sanctions list, OFAC removed Tornado Cash's associated addresses, effectively reversing one of the Biden administration's most controversial enforcement actions in the crypto space.
FCC Approves Narrow Delay of New TCPA Revocation Rule
On April 7, the Federal Communications Commission (FCC) granted a limited waiver delaying by an additional year the effective date of certain parts of the new Telephone Consumer Protection Act (TCPA) rule. Specifically, the waiver delays the effective date for the requirement that a caller treat a single reasonable revocation as revocation from all future robocalls from that party on unrelated matters, and to accept that single revocation as applying to all its business units and entities, which the agency treats as the same "party."