The shifting landscape for US financial regulatory enforcement
July 2025 | SPECIAL REPORT: FINANCIAL SERVICES
Financier Worldwide Magazine
July 2025 Issue
Consumer financial services firms in the US face a tangled web of enforcement. More than 10 federal agencies have the authority to investigate, enter into settlements with, and file suit against firms, and during the Biden administration these agencies worked both independently and in tandem to enforce federal law.
While the Trump administration is paring back the federal government, several state enforcement agencies intend to ‘fill the gap’ using state law — and may also be able to enforce certain federal laws.
Firms currently operating in the US, and those considering entering the market, should understand these overlapping authorities and have a comprehensive plan in place to mitigate these risks.
Waning federal supervision and enforcement
Within the US, the primary federal consumer financial protection regulator for larger depository institutions and nonbanks is the Consumer Financial Protection Bureau (CFPB). To date, the Trump administration’s deregulatory focus has primarily targeted the CFPB.
Russel Vought, acting director of the CFPB, has halted virtually all activity since assuming control of the agency. The CFPB has dismissed most cases from the prior administration, declined its next infusion of funding, and rescinded over 60 interpretive rules, advisory opinions and policy statements. These changes suggest a shift from the regulatory efforts of the Biden administration and could leave a regulatory void that others may seek to fill.
Beyond the CFPB, banks and credit unions in the US are subject to federal supervision and enforcement from the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation and National Credit Union Administration. While these agencies are unlikely to see the same changes as the CFPB, their leaders have similarly signalled a deregulatory approach.
For example, the Comptroller of the Currency recently reversed the Biden administration’s approach to crypto through an interpretive letter permitting national banks to conduct cryptocurrency-related activities without supervisory non-objection, and federal banking agencies plan to rescind a Biden-era rule that imposed new obligations under the Community Reinvestment Act.
For non-depository institutions such as FinTech platforms and instalment lenders, the Federal Trade Commission (FTC) generally can also enforce federal consumer financial law. The FTC’s mandate covers both consumer protection and competition, giving it another lens to evaluate firms, but its authority to obtain penalties or remedies is narrower than the CFPB’s.
Finally, the Department of Justice (DOJ) enforces several applicable laws, including various federal criminal and civil laws, anti-corruption laws and anti-discrimination laws. Under the False Claims Act, the DOJ can secure treble damages for false claims made to the government, providing a strong motivation for settlement.
While the Trump administration has reversed the prior administration’s positions on certain anti-discrimination laws, it has expressed a commitment to supporting military members, and the DOJ enforces the Servicemembers Civil Relief Act which provides various protections for those in military service.
Filling the void: state enforcement and supervision priorities
While the US federal government is signalling a lighter enforcement touch, several states have stated they will increase enforcement of consumer protection laws. Firms should take note, as states in 2025 are uniquely well-positioned to act against financial services firms.
Federal agencies can only enforce certain laws within their purview, while states often have broader authority to pursue financial firms. State banks, lenders, brokers and loan servicers often must obtain a licence from a state regulator.
As a result, state regulators may examine licensed firms at their discretion, use examinations to identify potential violations of law, and impose penalties, including consumer remediation, monetary fines and, in extreme cases, revoking the firm’s ability to operate in the state. Separate from financial regulators, state attorneys general can file suit on behalf of their residents and obtain fines, penalties and injunctions against further violations of law.
Over the past decade, states have become well-practiced in working together against financial firms. After the Great Recession, multistate enforcement actions resulted in billions of dollars in consumer remediation. During the first Trump administration, states again renewed their coordination, bringing several enforcement actions invoking state and federal law against financial institutions. Today, there are several permanent multistate organisations that coordinate enforcement actions, including the Conference of State Bank Supervisors and various attorneys general task forces.
State enforcement may have been helped by former CFPB leadership, which left roadmaps both for the states to directly enforce federal law and to independently strengthen state laws. In 2022, the CFPB released an interpretive rule (since rescinded by Mr Vought) reaffirming states’ authority under the Dodd-Frank Act to enforce federal consumer protection laws in the absence of federal action.
Similarly, shortly before leaving office, Rohit Chopra, the then director of the CFPB, released a report recommending that states enhance their consumer protection laws by: (i) incorporating the ‘abusiveness’ standard into state laws prohibiting unfair and deceptive acts and practices; (ii) strengthening investigatory authority and imposing stronger remedies and penalties; (iii) creating state law private rights of action; (iv) extending consumer protections to small businesses; and (v) enhancing protections against so-called ‘junk fees’.
Finally, federal reductions in staffing may provide states greater resources to pursue their own enforcement actions. With reductions in force and voluntary federal agency departures, states are well-positioned to hire these highly-trained personnel. Large-scale departures from the CFPB in particular are expected to drive former federal enforcement attorneys to state offices; we are already seeing this occur in Maryland, New York, Virginia and other states.
Evaluating the federal and state enforcement landscape
With a fractured and evolving enforcement landscape, those already conducting business in the US and those looking to operate here should invest time developing a plan to address regulatory supervision and respond to enforcement actions if they arise.
When evaluating the federal enforcement landscape over the coming years, firms should consider the scenarios outlined below.
First, notwithstanding the reduction in staffing at the federal financial regulators, these agencies are all retaining enforcement teams, and these teams will be asked to do more with less. While the Trump administration has signalled its intention to reduce enforcement of certain laws, the CFPB has affirmed its intention to protect members of the military through the Military Lending Act, and the DOJ continues to enforce the Servicemembers Civil Relief Act. We have seen the Comptroller of the Currency revisit concerns about ‘debanking’ firms and individuals for political reasons, and we expect to see continued activity on these federal priorities.
Second, even if current enforcement activity declines, there is a presidential election in 2028, and a new administration may take a very different approach to enforcement. Notably, most changes to agencies during the first few months of the Trump administration have been through executive orders or action by agency leaders. These are not acts of Congress or formal rules promulgated under the Administrative Procedures Act, and a new administration can quickly reverse these changes.
Finally, many consumer protection laws have significant statutes of limitations — and in some instances we have seen federal agencies assert that statutes of limitations do not apply to the government. These two factors combined would allow new federal agency leaders to reach back several years to impose remediation and penalties. For example, following the Great Recession of 2008-10, we saw enforcement actions target conduct from five or more years earlier, with some actions addressing harms dating back as far as a decade.
In the near term, state action remains a significant area of concern. States have robust enforcement authority across a wide range of laws, and firms ignore states at their peril.
While one state may only affect a small portion of a firm’s business, a single improperly handled enforcement action can quickly become a nationwide issue. Even before investigations become public, state regulators and attorneys general use the networks they have built up to discuss ongoing cases, and states are well-practiced in pooling resources to obtain remediation for millions of consumers at once.
Once an enforcement action becomes public – through a settlement, securities filing, press release or otherwise – other state agencies may follow suit, using the fact pattern in one jurisdiction as a template to identify similar issues in their own state.
States not only can enforce state law, but according to guidance issued under the Biden administration, may be able to enforce federal consumer protection laws as well. While this guidance has been rescinded and the contours of this authority have not been firmly established, state agencies are aware of these theories and may attempt to use them.
States often find new enforcement actions through complaints and media coverage. Consumers whose complaints are not resolved by a firm often reach out to state agencies, and these complaints can form the basis of an investigation. Similarly, enforcement staff track poor media coverage of a firm, unfavourable online reviews, and other indirect complaints by consumers. We have seen several enforcement actions arise from a single complaint, emphasising the need to handle every consumer interaction carefully.
Financial services firms should evaluate whether they want to serve customers nationwide, as many firms do not operate in all 50 states. In some instances, a small firm may not be able to develop a nationwide licensing and compliance operation; in other instances, a mature firm may intentionally exclude states due to substantive limitations under state law, licensing requirements, or enforcement priorities that make operating in that state untenable.
For financial services firms, enforcement in the US is changing, but remains an area of risk. Given the consequences of even a minor enforcement action, it is critical that firms appreciate these changes, develop plans to reduce their risk, and understand how to respond if faced with an enforcement action.
Sasha Leonhardt is a partner and Lauren Frank is a counsel at Orrick, Herrington & Sutcliffe LLP. Ms Leonhardt can be contacted by email: sleonhardt@orrick.com. Ms Frank can be contacted by email: lfrank@orrick.com.
© Financier Worldwide
BY
Sasha Leonhardt and Lauren Frank
Orrick, Herrington & Sutcliffe LLP