.svg)
The Consumer Financial Protection Bureau (CFPB) has seen significant changes since the Trump administration took office, with rulemakings overturned, delayed or suspended and the legality of the agency’s funding challenged.
President Trump’s new acting director ordered staff to cease almost all work and supervision activities. The resulting disruption continues to affect CFPB operations and create uncertainty for financial services regulation.
Gaps in federal consumer-protection rules increase compliance, liability and reputational risk, forcing payment service providers (PSPs) and banks to navigate a fast-changing state-level patchwork while maintaining customer trust.
Early preparation will help organisations manage these risks in 2026, and international firms must consider the evolving regulatory landscape when deciding whether to enter or remain in the US market.
Rolling back federal oversight
In April 2025, Congress nullified the Payment Apps Rule, which would have subjected digital payment apps such as Venmo and PayPal to CFPB oversight. The Open Banking Rule, requiring institutions to share consumer financial data upon request, was vacated and remains in limbo.
At the same time, the Overdraft Rule, which would have capped most overdraft fees, was overturned, and the buy now, pay later (BNPL) interpretive rule, which would have classified BNPL providers as card issuers subject to Regulation Z, was withdrawn, eliminating transparency and consumer protections.
States stepping up
Many state-level regulators see federal regulators’ step back as a call to action.
The New York State Department of Financial Services (NYDFS) has issued a voluntary request for information to inform future rulemaking for BNPL products, following the May 2025 passage of the BNPL Act, which established a supervisory regime for BNPL providers.
States have also signaled coordination on consumer protection: in April 2025, 23 attorneys general sent a letter to Congress urging the House of Representatives to uphold the CFPB’s Overdraft Rule. In the letter, the attorneys general, including those from New York, California and New Jersey, argued the rule protects consumers from excessive and often unexpected charges that can lead to involuntary account closures, damaging customers’ credit and even driving them out of the banking system altogether.
Meanwhile, state regulators have sought to hold companies accountable through enforcement, such as in California’s case against Coinhub, illustrating that non-compliance carries significant financial and reputational risk.
2026 priorities
The US regulatory landscape in 2026 is fragmented, dynamic and enforcement-driven. Firms that treat compliance as a strategic asset, anticipating state rules, embedding consumer protections, and documenting controls, will reduce exposure to enforcement risk and strengthen trust with consumers and partners.
Regulators are expected to focus on strengthening consumer protections for stablecoins and other crypto products to address the scams and risks these innovations can bring.
The 2025 GENIUS Act established a clear framework for stablecoin issuers, emphasising transparency, truthful marketing and consumer choice. As implementation continues in 2026, firms should align internal policies and reporting to meet these federal expectations while balancing market participation.
Several states have passed laws to oversee digital assets, prompting regulators to develop the accompanying rules and consumer safeguards that customers increasingly expect.
In September 2025, the NYDFS revised its virtual currency guidance to reinforce customer protections, and California’s Department of Financial Protection and Innovation has created a licensing regime for digital financial assets, with consumer-protection obligations phasing in through July 2026.
Where federal regulations are limited, banks and PSPs must act responsibly by protecting data, ensuring fair fees and offering transparent products.
They should conduct regular compliance audits, implement robust customer-disclosure practices, monitor state-specific rules and establish clear internal policies for handling complaints and disputes.
In this evolving regulatory environment, firms that embrace strong consumer protections will not only stay ahead of regulatory scrutiny, but also build trust and differentiate themselves in a competitive market.
