If the CFPB’s funding fell, the statutes would still stand
A federal appeals court called the consumer bureau’s funding unconstitutional, and for eighteen months every CFPB rule carried a question mark. Compliance teams had to sort the bureau’s past orders, current rules and pending rules, because each faced a different risk.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On October 19, 2022, the U.S. Court of Appeals for the Fifth Circuit ruled in Community Financial Services Association of America v. Consumer Financial Protection Bureau that the bureau’s funding mechanism violated the Constitution’s Appropriations Clause. The bureau draws its money from the Federal Reserve System rather than through annual appropriations. The court vacated the payment provisions of the bureau’s payday lending rule that were at issue. The ruling immediately raised questions about the validity of other CFPB rules and actions, at least in the Fifth Circuit’s states of Texas, Louisiana and Mississippi. The bureau asked the Supreme Court to review the case, and the Court agreed in February 2023. Meanwhile the bureau kept working, and regulated institutions had to decide how to treat its rules.
For compliance leaders at banks, credit unions and fintechs, the ruling posed an awkward question. If the regulator’s funding was unconstitutional, did its rules still bind? The legal answer stayed open for a year and a half. The practical answer depended on which kind of CFPB action was in question, and most commentary lumped them together.
Three kinds of action faced different risks. Past actions, such as consent orders and examination findings, were already in force against specific institutions. Current rules, many resting on statutes far older than the bureau, governed daily operations. Pending rules, with compliance dates still ahead, required investment in systems that a court might make unnecessary. Each needed its own decision, made with counsel.
Past actions: orders already in force
An institution under a CFPB consent order in October 2022 might have wondered whether the ruling offered a way out. In practice it offered little. Consent orders are agreements the institution signed. Challenging one on the funding theory would mean litigation, with uncertain results and a regulator relationship damaged in the meantime. Remediation already under way, such as refunds to customers or changes to fee practices, had value regardless of the order’s fate.
The prudent course was to keep meeting order requirements, document compliance carefully and ask counsel to monitor whether the litigation opened any realistic avenue. Examination findings were similar. They described practices that other regulators, state attorneys general or private plaintiffs could also pursue. Remediating them protected the institution from those parties too.
Guidance sat in a gray zone. Advisory opinions, circulars and bulletins explained how the bureau read the statutes rather than creating new duties. A court ruling on funding did little to change what those readings implied about a practice. A fee the bureau had called unfair would draw the same objection from a state attorney general or a class action lawyer, so the guidance stayed a useful map of risk.
Current rules: older than the bureau
Most consumer financial rules that institutions follow every day rest on older statutes. They include the Truth in Lending Act, the Equal Credit Opportunity Act, the Electronic Fund Transfer Act, the Real Estate Settlement Procedures Act and the Fair Credit Reporting Act. The CFPB writes and interprets many of the implementing regulations. But the statutes predate the bureau, many of the regulations were carried over from earlier agencies, and several of the statutes give consumers a private right to sue.
Suppose an institution stopped following a disclosure requirement because its regulatory source might be invalid. It would face private litigation, examination by its prudential regulator and possibly state enforcement. It would also face the risk that the Supreme Court would reverse. Prudential regulators examine banks and credit unions with total assets of 10 billion dollars or less for consumer compliance. State attorneys general can enforce many federal consumer financial protections under the Dodd-Frank Act. None of that depended on how the CFPB was funded.
For current rules, the sound decision was simple: keep complying. The useful planning work was elsewhere, in mapping which obligations rested only on a CFPB rule with no older regulatory or statutory basis. That list was short, and it was the only place the ruling could plausibly change day-to-day requirements.
Pending rules: building toward a date that might move
The hardest decisions concerned rules not yet in effect. The clearest example was the small business lending data rule under Section 1071 of the Dodd-Frank Act, finalized in March 2023. It required lenders to collect and report detailed data on credit applications from small businesses, which meant changes to application forms, loan systems and reporting pipelines. Trade groups sued in Texas, citing the Fifth Circuit’s reasoning, and in 2023 a federal court stayed the rule’s compliance dates for the plaintiffs and their members pending the Supreme Court’s decision.
Lenders faced a classic sequencing problem. Building early risked spending on a rule that might fall. Waiting risked a scramble if the Court upheld the bureau and dates snapped back. Institutions that handled it well separated the work. Data governance, application process mapping and vendor requirements were useful whatever happened, and they went ahead. Rule-specific reporting builds were designed but held. A dated decision point, tied to the expected ruling, triggered the rest.
The decision point had to allow for lead times outside technology. Section 1071 required lenders to ask applicants for demographic information and to limit which staff could see it. That meant new scripts for loan officers, training and changes to how branches handled applications. Those steps take months and cannot be compressed into the weeks after a court ruling, so the hold covered systems but not the process design and training plans.
Vendors shaped the timeline. Most lenders depend on loan origination and reporting software providers for rule changes. Asking those providers in writing for their delivery plans under each legal outcome turned an open question into a schedule. Boards needed a short summary as well: which pending rules were affected, what had been spent, what was on hold and when the next decision was due.
With hindsight
The Supreme Court reversed the Fifth Circuit in May 2024, holding by seven to two that the CFPB’s funding mechanism satisfies the Appropriations Clause. That removed the constitutional cloud over the bureau’s past actions, and compliance dates for the small business lending rule were reset. Within a year the bureau’s position changed for a different reason. After the change of administration in 2025, new leadership sharply reduced enforcement and supervision and dropped a number of cases. It reconsidered several rules, including the small business lending rule, and sought large staff reductions, much of it contested in court. Several states moved to strengthen their own consumer financial enforcement. By 2026, institutions have seen CFPB rules threatened twice, once by a court and once by policy. Those that sorted past, current and pending obligations separately, and kept building on statutory duties, have had the least to unwind.