Why the CFPB’s dormant authority put fintech partners on the exam calendar
By reviving a rarely used power to supervise nonbanks whose conduct poses risks to consumers, the CFPB made exam readiness something fintechs had to build before scale, and something their sponsor banks had to check.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On April 25, 2022, the Consumer Financial Protection Bureau announced that it would begin using a largely unused provision of the Dodd-Frank Act to supervise nonbank companies. The provision lets the bureau examine a nonbank when it has reasonable cause to determine, after notice and a chance to respond, that the company’s conduct poses risks to consumers. Reasonable cause can rest on complaints or information from other sources. The bureau had written a procedure for this in 2013 but had never used it to bring a nonbank under supervision. It named fintech firms among the companies that could be reached. The same day, it amended its procedural rule so that it could publish all or part of a final designation decision, giving the company a chance to comment on what was released.
Before this announcement, a nonbank’s exposure to federal consumer supervision depended mostly on what it was. Mortgage companies, payday lenders and private student lenders were supervised by category. Larger participants in certain markets, such as consumer reporting and debt collection, were supervised once they crossed a size threshold defined by rule. A fast-growing fintech offering a new kind of credit or payment product could fall between those categories for years. The revived authority changed the trigger from category to conduct. A company could now be examined because of what it did and what consumers complained about, regardless of charter or size. That shift touched three groups in different ways: the signal that starts a designation, the fintech that might receive one, and the bank that sponsors the fintech’s product.
The signal: complaints as an early warning
The statute ties designation to reasonable cause, and the bureau said complaints are one source of it. That made complaint data more consequential than many fintech leaders had assumed. Complaints submitted through the bureau’s portal are routed to the company and tracked. A pattern in them is visible to the regulator before any examiner arrives.
For a fintech, the practical response was to treat its complaint stream as a supervisory input, not a customer service queue. That meant classifying complaints by product and issue, tracking root causes, and reporting trends to management with the same seriousness as fraud losses. It also meant counting complaints that arrive through every channel, including app store reviews, social media and the sponsor bank’s own contact center. A company that only counts tickets in its help desk tool will see a smaller problem than the regulator sees.
The signal works in the other direction too. Companies that resolve complaints quickly and fix the causes leave a record that weakens any claim of risk. The same data that could start a designation is the best evidence against one.
The fintech: building a compliance system before scale
Supervision asks a company to show its work. Examiners look for a compliance management system: board and management oversight, written policies, training, monitoring and testing, complaint management and an independent audit. Banks have run these for decades. Many venture-backed fintechs in 2022 had a general counsel, a small compliance team and a product roadmap that moved faster than either.
The gap was rarely bad intent. It was missing evidence. A product team might change a fee disclosure in a sprint without a compliance sign-off recorded anywhere. Marketing might test new loan offers without a fair lending review. Collections might be outsourced with a vendor contract that said nothing about call recording or dispute handling. None of these is unusual in a startup. Each is a finding in an exam.
Exam readiness has concrete parts. A change management process that records compliance approval for any customer-facing change. A complaint system that links each complaint to a resolution and a root cause. Vendor oversight files for collectors, call centers and marketing partners. Records retention that can reproduce what a customer saw on a given date. Building these at fifty employees is cheaper than retrofitting them at five hundred under examination. The trade-off is speed. Every control adds some friction to product release, and founders need to decide where that friction is worth it.
The sponsor bank: diligence on a partner’s exam readiness
Many fintech products reach consumers through a bank partner that holds the accounts or originates the loans. The bank is already examined by its prudential regulator, and it remains responsible for consumer compliance on products offered under its charter. The revived authority added a second possibility: the fintech partner itself could be supervised directly by the CFPB.
For the bank, that raised the stakes of partner diligence. If a partner’s complaint pattern was serious enough to draw a designation, the bank would want to have seen it first. Oversight programs needed access to the partner’s full complaint data, not a monthly summary. They needed the right to review the partner’s compliance management system and test it. And they needed contract terms that required the partner to notify the bank promptly of any regulatory inquiry or designation notice.
Banks also had to think about concentration. A sponsor bank with many fintech programs could find several partners under scrutiny at once if the bureau focused on a product type, such as earned wage access or buy now, pay later. Partner risk ratings that included complaint trends and regulatory attention, reviewed by the bank’s risk committee, gave the board a view across the portfolio.
The publication change mattered here as well. A public designation would name the company and describe the risks found. For a bank, that is reputational exposure by association. Contracts that set out how the parties would handle a public regulatory action, including communications and possible program changes, were worth negotiating in advance. Organizations should check with counsel on how these provisions interact with their own regulatory obligations.
Across all three groups, the authority rewarded the same habit. Keep the evidence an examiner would ask for, whether or not one is coming, because partners, investors and other regulators ask for much of the same evidence anyway.
With hindsight
The authority was used, though less dramatically than some expected. Commentators later observed that the threat of a public order pressed many companies that received notices to consent rather than contest. The most visible case came in December 2024, when it ordered supervision of Google’s payment unit after a contested designation, and the company sued. After the change of administration, the bureau withdrew that order in May 2025, and the suit was dropped. In September 2025 it finalized a rule, effective that October, rescinding most of the procedural amendments made since 2022 and restoring confidentiality to designation decisions. Bank-fintech arrangements drew scrutiny from other directions: the federal banking agencies sought public comment on them in July 2024, and enforcement against sponsor banks over partner oversight continued. By 2026, the federal designation route is quieter. The evidence it called for, from complaint root causes to change records, is still what sponsor banks, states and investors ask fintechs to show.