.svg)
A court ruling and a lawsuit seeking its protection mean the US Consumer Financial Protection Bureau (CFPB) remains active, although the trend for state-level regulation is creating challenges for payments firms.
On December 30, 2025, the District of Columbia federal district court ordered the Trump administration to continue funding the agency at least until a February appeals hearing, rejecting claims that the CFPB is legally barred from requesting transfers from the Federal Reserve.
The court characterised the administration’s funding stance as an attempt to circumvent an injunction preventing efforts to wind down the agency.
This followed a complaint for declaratory and injunctive relief filed on December 22 by 21 states and the District of Columbia. Their attorneys general sought to halt what they described as unlawful defunding of the bureau, arguing that the CFPB’s statutory obligations, notably collection and sharing of consumer complaint data, cannot simply be suspended.
Under the second Trump administration, the role of the CFPB has diminished significantly. The agency has dismissed or wound down several legacy enforcement actions, stepped back from aggressive buy now, pay later (BNPL) oversight and revoked multiple advisory opinions and interpretive rules issued under prior leadership.
These actions do not repeal existing law, but they materially reduce enforcement momentum.
There has been some continued activity at the bureau, with the open banking framework still under consideration. However, potential changes to “larger participant” supervision thresholds could reduce CFPB oversight coverage across several non-bank markets.
The attempts by the administration to cut off the CFPB’s funding are shaping the pace and scope of all this activity. With the bureau signalling limits on its ability to draw new resources, capacity is being rationed across staffing, litigation and policymaking.
States take over
The trend towards deregulation in US financial services is bringing a shift towards a less predictable, more state-driven system with asymmetric risk.
With the CFPB largely having stepped back from its previous activity, organisations’ exposure to federal enforcement may be lower in the near term. However, the risk is being redistributed, not removed.
The dismissal of actions and the deprioritisation of themes such as BNPL reduce headline litigation risk from the CFPB. However, the absence of clear federal priorities increases model risk: firms can no longer infer safe operating practices from past enforcement patterns. In addition, back-loaded enforcement following a change of government remains a live possibility.
A key development is that, as with the lawsuit filed in December 2025, states are filling the vacuum. Several are advancing their own supervisory regimes across BNPL, overdraft practices and digital assets, and attorneys general are coordinating on consumer-protection issues.
For example, in July 2025, the New York State Department of Financial Services (NYDFS) issued a voluntary request for information to guide future rulemaking for BNPL products, following the May 2025 passage of the BNPL Act, which established a supervisory regime for BNPL providers.
The result of states taking on regulatory authority is a patchwork of standards that raises friction for multi-state operators and increases the probability of inconsistent disclosure expectations, divergent product classifications and parallel investigation or settlement tracks.
In practice, firms may face higher coordination and litigation-defence costs, even where federal scrutiny has decreased.
Dealing with fragmentation and uncertainty
Organisations regulated by the CFPB should proceed with caution, treating the coming months as a period of defensive stabilisation and strategic optionality.
A key step will be to implement a structured state-law horizon scanning and escalation process and map their obligations in New York, California and other jurisdictions that are stepping into the gap left by the CFPB’s withdrawal.
They may opt for a standardised “highest common denominator” disclosure approach where divergence is material, or make a decision on whether to localise compliance or withdraw from some jurisdictions.
In addition, firms should prepare for a potential enforcement rebound by closing known remediation actions and documenting corrective outcomes. They should also consider maintaining litigation-ready records on complaints handling and fee transparency.
Rapid policy changes based on temporary enforcement signals carry the risk that regulatory priorities could revert to those in place before the second Trump administration.
Senior management must understand the degree of regulatory uncertainty. Firms should maintain clear, up-to-date reporting covering rules in effect, policy vacuums, state-level variations and deferred-risk exposures created by current decisions.
The near-term environment is less centrally enforced but more fragmented and path-dependent. Firms that focus on durable consumer-protection practices rather than following short-term enforcement signals will be better positioned to withstand state-level scrutiny, pivot if and when federal standards are reintroduced and compete on trust in a volatile regulatory cycle.
