January 2, 2026
CFS Bites of the Month - 2025 Annual Review: Banking
Ryan S. Stinneford, Thomas P. Quinn, Jr., Eric L. Johnson, Justin B. Hosie, and Kristen Yarows
In this article, we share a timeline of monthly "bites" for the past year applicable to banking.
CFPB Sues Banks and Peer-to-Peer Payment Network
On December 20, 2024, the CFPB filed a lawsuit in the U.S. District Court for the District of Arizona against the operator of a peer-to-peer payment network and three of its owner national banks for allegedly failing to protect consumers from network related fraud. The CFPB alleges that the operator and the banks rushed the peer-to-peer payment network to market to compete against other payment apps without implementing effective consumer safeguards to protect against fraud. The CFPB claims that customers lost more than $870 million over the network's 7-year existence due to these safeguarding failures. The CFPB alleges that the defendants violated the Consumer Financial Protection Act's prohibition on unfairness by allegedly failing to take timely, appropriate, and effective measures to prevent, detect, limit, and address fraud on the peer-to-peer payment network. The CFPB claimed consumers submitted hundreds of thousands of fraud complaints. The CFPB also alleged that the three banks violated the Electronic Fund Transfer Act and Regulation E for failing to conduct reasonable investigations of consumer error notices, and for failing to treat incorrect and unauthorized transfers as errors under the law. The CFPB sought to halt unlawful conduct, obtain consumer redress, and obtain a civil money penalty.
CFPB Approves FDX to Issue Standards for Open Banking
On January 8, 2025, the CFPB announced an approval to issue standards for open-banking under the Personal Financial Data Rights rule. The CFPB released the Personal Financial Data Rights rule in October 2024. The rule was intended to require financial providers to transfer personal financial data other providers at a consumer's request, without charge. The CFPB had established an application process to become recognized as an industry standard setting body and approved Financial Data Exchange, Inc. or FDX, subject to several conditions, including requiring FDX to: (1) Develop standards to promote open banking without regard to sponsorships or other financial incentives to give certain market players secret information or any other advantage; (2) Report to the CFPB on market use and/or maintain a publicly available recourse that allows companies to disclose their standards and certifications of adherence to the standards; and (3) Make any consensus standards that it adopts and maintains open to the public.
CFPB Takes Action Against National Bank Over Savings Accounts
On January 14, 2025, the CFPB announced an action against a national bank alleging the bank misled consumers about its "high interest" savings accounts. According to the CFPB, the bank misrepresented that its flagship savings account provided one of the nation's "best" and "highest" interest rates, but the bank froze the interest rate at a lower level than advertised while competitor's rates rose nationwide. The CFPB also alleged that bank representations created the net impression that the savings product would be its only high interest savings product with its features, but in 2019 the bank started offering a new high-interest savings product without converting the old accounts. The CFPB alleged that the bank misled consumers about its "high interest" accounts and didn't inform consumers with the older accounts about the new accounts, in order to maintain a two-tier system. The lawsuit alleged that the bank violated the Consumer Financial Protection Act's prohibition on deception and abuse, and violated the Truth in Savings Act. The CFPB filed the lawsuit in the U.S. District Court for the Eastern District of Virginia. The CFPB sought to stop the alleged unlawful conduct, provide redress for consumers, and impose civil money penalties. The CFPB voluntarily dismissed the suit a month later, in late February, 2025.
FDIC Withdraws from Colorado DIDMCA Case
On February 24, 2025, the FDIC withdrew an amicus brief that the prior administration filed in 2024, in support of a Colorado state law that allows state authorities to cap interest on loans taken out by its residents from out-of-state lenders. Trade groups filed a lawsuit over the state law that opts Colorado out of a clause in the Depository Institutions Deregulation and Monetary Control Act ("DIDMCA") that allows state-chartered banks to follow interest rates set by their home state when lending across state lines. In the FDIC's now-rescinded April 2024 amicus brief, it asserted that a loan is "made" in a state if either the borrower or lender enters into the transactions from the confines of the state borders. In the now-rescinded brief, the FDIC argued that if a Colorado borrower finalized a loan while physically present in Colorado, the loan falls under Colorado's opt-out law. In June 2024, the district court sided with the trade groups, ruling that a loan is made where the lender performs its loan-making functions rather than where the borrower is located.
Congress Votes to Overturn CFPB Overdraft Fees Rule
On March 27, 2025, the Senate voted to overturn the CFPB's rule that limits overdraft fees at large banks to $5. The rule was finalized during the Biden Administration and faced challenges in court from banking industry groups. The measure to block the rule was brought under the Congressional Review Act and cleared the Senate on a 52-48 vote that largely fell along party lines, with Senator Josh Hawley (R-Missouri) being the only lawmaker to cross party lines. The Senate passed a similar legislative effort earlier in March to block the CFPB rule establishing supervisory authority over larger digital payment providers. On April 9, the House voted (217-211) to overturn the rule. President Trump then signed the resolution on May 9, 2025, officially ending the CFPB Overdraft Fees Rule.
CFPB Dismisses Lawsuit Against Large Bank
On April 11, 2025, media outlets reported that the CFPB dismissed a lawsuit against a large bank. Specifically, the CFPB filed a notice of dismissal without prejudice in its lawsuit against this large bank. The bank had filed a motion to dismiss in March, and the CFPB did not file a response to the motion. The CFPB had filed the lawsuit back in December 2024, alleging the bank unfairly managed a prepaid debit card program that delivers various government benefits to consumers. The lawsuit also alleged that the bank failed to provide consumers with a reasonable way to obtain effective and timely assistance, forced consumers to close their accounts and request new cards instead of honoring stop payment requests, failed to provide correct and complete information to enrollment-fraud victims, and charged consumers ATM fees that they did not owe.
President Trump Signs Repeal of Digital Payment Rules
On May 9, 2025, in addition to the CFPB Overdraft Fees Rule, President Trump also signed a repeal of the CFPB's digital payment rules pursuant to the Congressional Review Act. Congress passed the measures under the CRA, allowing the administration and Congress to repeal rules finalized at the end of a previous administration. The digital payment oversight rule would have allowed CFPB examiners to determine whether digital payment providers processing at least 50 million transactions each year complied with federal consumer protection laws. Both rules were the subject of ongoing litigation by trade groups.
CFPB Dismisses its Lawsuit Against Large Retail Corporation
On May 13, 2025, the CFPB announced that it was dismissing its lawsuit against a large retailer, which it had sued along with a fintech, over its delivery driver program. The CFPB had initiated the lawsuit in December of 2024, alleging that the retailer forced its delivery drivers to use costly deposit accounts to get paid and deceived the drivers about how they could access their earnings, alleging violations of the CFPA, Truth in Savings Act, Regulation DD, the Electronic Funds Transfer Act, and Regulation E. The notice requested that the case be dismissed with prejudice.
New York AG Takes Action Against Bank
As noted above, in February of 2025, the CFPB dropped its lawsuit against a large bank for allegedly deceiving consumers about the interest rates on their savings accounts. However, on May 14, 2025, the New York Office of Attorney General filed a similar lawsuit against that bank. The complaint alleged that the bank promised depositors one of the country's highest interest rates on their savings accounts, but froze their rate at just 0.30% even as interest rates rose nationally. The lawsuit also alleged that the bank kept depositors in the dark when it launched new savings accounts that had interest rates of up to 4.35%. A representative for the bank released a statement that it disagrees "with the attorney general's claims and will vigorously defend" itself in court. The New York Attorney General, Letitia James, said the lawsuit seeks to ensure that the bank "does not escape accountability" after the CFPB dropped its case.
CFPB Drops Settlement with Credit Union
On July 2, 2025, media outlets reported that the CFPB dropped its settlement with a credit union over its alleged overdraft fees. Under the consent order, the CFPB had alleged that the credit union overcharged overdraft fees in two ways: (1) charging overdraft fees when the service member had sufficient funds at the point of sale but a negative balance once the purchase was posted to the account, sometimes days later; and (2) charging overdraft fees when the servicemember had a peer-to-peer payment that showed the funds were available, but they didn't post until the next business day due to specific cutoff times. The CFPB settled with the credit union in November of 2024, for $95 million, the largest ever assessed against a credit union. The settlement required the credit union to pay a $15 million fine and pay $80 million in refunds to serve members who were charged allegedly charged the overdraft fees.
CFPB Ends Order with Bank over Mortgage Data
On June 5, 2025, the CFPB terminated its consent order with a large bank over allegations that the bank submitted false mortgage data. The bank settled the case with the CFPB in November 2023, and the consent order had a five-year monitoring term. The consent order included a requirement that the bank pay a $12 million fine. On the CFPB's website where it previously shared the consent order, it provided a notice saying that the Bank has fulfilled its obligations under the order, including paying the civil money penalty.
CFPB Lifts Consent Order Against Credit Union
On July 21, 2025, the CFPB terminated its consent order against a credit union and waived any alleged non-compliance pursuant to its authority under 12 U.S.C. § 5563(b)(3), which addresses how orders involving the CFPB can be modified, terminated, or set aside. The CFPB announced that the credit union fulfilled certain obligations under the order, including paying a $1.5 million civil money penalty and verifying that mandatory refunds were made. The consent order resolved allegations that the credit union's online and mobile banking platforms were implemented in violation of the Consumer Financial Protection Act because it disrupted consumers' access to their accounts.
President Trump Issues Executive Order Prohibiting "Debanking"
On August 7, 2025, President Trump issued an Executive Order: Prohibiting Politicized or Unlawful Debanking. The order directed federal banking regulators to adopt policies to ensure that financial institutions do not use reputational risk or other equivalent concepts as a basis for restricting access to banking services. According to the Executive Order "no American should be denied access to financial services because of their political or religious beliefs," and "banking decisions must solely be made on the basis of individualized, objective, and risk-based analyses." The Order requires Federal banking regulators to review financial institutions for past or current policies encouraging politicized or unlawful debanking and take remedial actions, including fines or consent decrees. The Order also requires Federal banking regulators to review supervisory and complaint data for instances of unlawful debanking based on religion and refer such cases to the Attorney General. President Trump accused Federal regulators of encouraging banks to flag individuals for transactions with companies, or for using terms like "Trump" or "MAGA" in peer-to-peer payments, without evidence of criminal activity.
FDIC Updates Approach to Pre-Filled Information for CIP Rule
On August 5, 2025, the FDIC released a Financial Institution Letter that updates the agency's supervisory approach regarding whether an FDIC-supervised institution can use pre-populated consumer information for the purpose of opening an account to satisfy Customer Identification Program ("CIP") requirements. The CIP rule, among other things, requires financial institutions to implement reasonable procedures for verifying the identity of a person seeking to open an account, to the extent reasonable and practicable, and maintain records of the information used to verify a person's identity. The CIP rule requires an institution to collect certain information from a customer opening an account. According to the FDIC, the requirement to collect identifying information "from the customer" under the CIP rule does not preclude the use of pre-filled information. The Letter says that FDIC examiners will consider the pre-filled information to be from the customer provided that (1) the customer has opportunity and the ability to review and correct the accuracy of the information, and (2) the institution's processes for opening an account that involves pre-populated information allow the institution to form a reasonable belief as to the identity of its customer and are based on the institution's assessment of the relevant risks, including the risk of fraudulent account opening or takeover.
CFPB Announces Accelerated Rulemaking for Personal Financial Data Rights Rule
On July 29, 2025, media outlets reported that the CFPB filed two documents in the ongoing litigation over its Personal Financial Data Rights Rule ("PFDR Rule") that it released October 2024. The documents noted that within the following three weeks, the CFPB plans to issue an advanced notice of proposed rulemaking to reconsider its PFDR Rule. The CFPB noted that it plans to use the rulemaking "with a view to substantially revising it and proposing a robust justification." The CFPB wrote in its motion that it seeks to comprehensively reexamine the PFDR Rule "alongside the stakeholders and broader public to come up with a well-reasoned approach to these complex issues that aligns with the policy preferences of new leadership and addresses the defects" in the initial PFDR Rule. The CFPB requested the court put the ongoing litigation on hold and extend all briefing deadlines until after it completes the new rulemaking process. On May 23, 2025, the CFPB filed a notice in the ongoing litigation, indicating that CFPB leadership has determined that the final rule "is unlawful and should be set aside."
CFPB Takes Action Against Fintech Bank Partner
On August 21, 2025, the CFPB commenced an adversary proceeding and filed a complaint and proposed stipulated final judgment in connection with Chapter 11 bankruptcy proceedings for a fintech serving as a service provider for other fintechs and their bank partners. This entity was providing certain services including advertising, deposit account maintenance, offering debit cards and services, bill payment, and funds transfers. The CFPB alleged that the fintech engaged in unfairness in violation of the Consumer Financial Protection Act, by failing to properly maintain records of consumer funds. According to the CFPB, funds the fintech's records did not align with the records maintained by the banks, with a shortfall estimated at between $60 and $90 million. The alleged discrepancies were discovered during initial bankruptcy proceedings against the fintech resulting in partner banks freezing consumer accounts, which prevented some consumers from accessing their accounts for up to eight months. The stipulated final judgment and order would require the fintech to pay a nominal $1 fine in redress (as a means for the CFPB to access the civil penalty fund); ban the fintech from participating in, assisting with, or receiving any consideration in connection with deposit-taking activities, the transmission of funds, or acting as the custodian of funds. The stipulated final judgment and order also prevent the fintech from selling customer information. The court entered the final judgment and order on September 12, 2025.
Bank Regulators Remove Disparate Impact References from Examination and Guidance Manuals
In response to Executive Order 14281 (Restoring Equality of Opportunity and Meritocracy (April 23, 2025)), which called for the elimination of "the use of disparate-impact liability in all contexts to the maximum degree possible...", the bank regulatory agencies began removing references to disparate impact in bank examination manuals. On July 14, 2025, the OCC removed references to disparate impact liability from the Fair Lending booklet of the Comptroller's Handbook. (OCC Bulletin 2025-16) The FDIC followed suit on August 29, 2025, by removing such references from its Consumer Compliance Examination Manual. (FDIC FIL-41-2025) The NCUA also did so as of September 4, 2025, removing disparate impact references from its Fair Lending Guide. (NCUA Press Release, September 4, 2025). As of the date of this Year in Review Update, the Federal Reserve Board has yet to do so.
CFPB Drops Four Consent Orders
On September 22, 2025, media outlets reported that the CFPB dropped consent orders with a technology company, two banks, and a mortgage company, implemented under the prior administration. The technology company has already paid a $25 million civil money penalty, and the bank paid a $15 million penalty. The CFPB originally alleged that the technology company and another company violated consumer protection laws by allegedly mishandling credit card transaction disputes and misled consumers about whether some transactions were interest-free. The CFPB originally alleged that one of the banks blocked out-of-work consumers from accessing unemployment benefits during the pandemic. Both consent orders had required 5 years of compliance and cooperation. The other bank allegedly reported inaccurate data about its mortgage transactions for 2011 in violation of HMDA. The CFPB also dropped its consent order with a mortgage servicer that allegedly accepted payments for mortgage business referrals and improperly used credit reports for marketing purposes. All companies had compliance and monitoring requirements under their consent orders that it appears they are no longer obligated to fulfill.
Judge Blocks CFPB's Open Banking Rule
On October 29, 2025, news outlets reported that the United States District Court for the Eastern District of Kentucky paused the compliance deadlines on the CFPB's open banking rule. The rule was finalized in 2024 under the previous administration and sought to allow consumers the ability to access and share data from bank accounts, credit cards, mobile wallets, payment apps, and other financial products. As noted above, in July 2025, the CFPB indicated it would begin a rulemaking to reconsider and revise the rule. Banking groups filed a lawsuit arguing that the regulation exceeded the CFPB's authority and imposed costly burdens on the industry. U.S. District Judge Danny Reeves in Lexington, Kentucky, agreed with the banking groups saying that the "plaintiffs and their members are being compelled to incur expenses that would be unrecoverable and unnecessary." The Judge also said that the plaintiffs were likely to succeed on the merits of their lawsuit.
Bank Regulatory Agencies Drop Reputation Risk; Issue Notice of Proposed Rulemaking
In response to Executive Order 14331 (Guaranteeing Fair Banking for All Americans (August 7, 2025)), which expressed concerns that consumers were being debanked due to their constitutionally or statutorily protected beliefs, affiliations, or political views, the FDIC and OCC have issued a notice of proposed rulemaking to remove reputation risk as a basis for supervisory criticism. It would do so by amending existing regulations to remove references to reputation risk in existing regulations, and by adopting two new regulatory provisions (one in OCC regulations, and another in FDIC regulations) that would affirmatively prohibit the use of reputation risk as the basis for taking adverse action against an institution. The notice of proposed rulemaking was published in the Federal Register on October 30, 2025. The comment period for this proposed regulation closes on December 29, 2025. The NCUA has also ceased using reputation risk and equivalent concepts in its examination and supervisory processes. (NCUA Advisory Letter to Credit Unions 25-CU-05). As of the date of this Year in Review Update, the Federal Reserve Board has yet to do so.
10th Circuit Lifts Preliminary Injunction over DIDMCA Opt-Out
On November 10, 2025, the United States Court of Appeals for the Tenth Circuit reversed a lower court injunction against the enforcement of Colorado's DIDMCA opt-out. In June of 2023, the Colorado legislature passed H.B. 23-1229, which provides that Colorado's interest and fee limitations function as an opt-out from Section 521 of DIDMCA. In March of 2024, three trade groups sued over the legislation, and a federal district court granted the trade groups' preliminary injunction. The Tenth Circuit held that "loans made in such State" refers to loans in which either the lender or the borrower is located in the opt-out state and because Colorado opted out of Section 1831d of DIDMCA, that statute no longer preempts Colorado's interest-rate cap for loans from out-of-state banks to Colorado borrowers. Thus, Colorado's rate and fee limitations apply.
CFPB Notifies Court it Cannot Access Funds from the Fed
On November 10, 2025, the Department of Justice filed a notice of potential lapse in appropriations to pay the expenses of the Bureau in the National Treasury Employee Union litigation. The DOJ's Office of Legal Counsel wrote a memorandum addressed to Acting Director Vought regarding whether the CFPB can continue to draw funds from the Federal Reserve system under 12 U.S.C. § 5497 when the Fed. is operating at a loss. The memo included that the Federal Reserve began operating in late 1914 and was profitable in every subsequent year until 2022, after which its costs have exceeded its revenue. The DOJ Office of Legal Counsel concluded that it was legally prohibited from drawing cash from the Federal Reserve to support the CFPB's operations when the Fed is operating at a loss. The CFPB anticipates having sufficient funds to continue operations until at least December 31, 2025. The CFPB notified the court that, "[i]n light of the Office of Legal Counsel opinion, the Acting Director of the Bureau anticipates preparing a report to the President and to congressional appropriations committees, as statutorily required, identifying the "funding needs of the Bureau."
CFPB Issues Proposed Rule Regarding 1071 Rule
On November 13, 2025, the Bureau published a proposed rule to revise certain provisions of Regulation B, which implements the Equal Credit Opportunity Act (ECOA). The Bureau is reconsidering coverage of certain credit transactions and financial institutions; the small business definition; inclusion of certain data points and how others are collected; and the compliance date. The Bureau claims that these proposed changes would streamline the rule, reduce complexity for lenders, and improve data quality, advancing the purposes of section 1071 and comply with recent executive directives. The Bureau also claims that a longer-term approach to advance the statutory purposes of section 1071 would be to commence the collection of data with a narrower scope to ensure its quality and to limit, as much as possible, disturbance to small businesses. The Bureau noted that it intends to approach the section 1071 rule like the Bureau did with the Home Mortgage Disclosure Act with an incremental approach. Public comments on the proposed rule must be received on or before December 15, 2025.
CFPB Issues Proposed Rule on ECOA
On November 13, 2025, the CFPB published a proposed rule for public comment that amends provisions related to disparate impact discouragement of applicants or prospective applicants, and special purpose credit programs under Regulation B, the regulation implementing the Equal Credit Opportunity Act ("ECOA"). The Bureau proposes changes to Regulation B to provide that ECOA does not authorize disparate-impact liability (effects test), further define discouragement, and add prohibitions and restrictions for special purpose credit programs. In 2020, the CFPB issued a Request for Information on ECOA and Regulation B that solicited information about disparate impact, prospective applicants, and special purpose credit programs, among other topics. Earlier this year, President Trump issued two executive orders, one titled "Ending Illegal Discrimination and Restoring Merit-Based Opportunity," and the other titled "Restoring Equality of Opportunity and Meritocracy" that are relevant to the CFPB's administration of ECOA. Public comments on the proposed rule must be received on or before December 15, 2025
OCC Proposes Rule to Rescind Certain Data Collection Requirements for National Banks
On November 18, the Office of the Comptroller of the Currency published a proposed rule in the Federal Register that would rescind its "Fair Housing Home Loan Data System" regulation codified at 12 CFR part 27. Part 27 establishes recordkeeping requirements and a data collection system for monitoring national banks and their subsidiaries for compliance with the Fair Housing Act and the Equal Credit Opportunity Act. According to the notice of proposed rulemaking, part 27 "requires national banks to (i) engage in quarterly recordkeeping of certain home loan data if the national bank is required to report loans under the Home Mortgage Disclosure Act (HMDA reporters) or if the national bank is a non-HMDA reporter that receives 50 or more home loan applications a year ...; (ii) attempt to obtain all of the prescribed information for applications for home loans; (iii) maintain certain additional information in loan files; and (iv) collect certain information on a log, if the OCC orders the national bank to maintain a log of inquiries and applications."
The OCC has "determined that part 27 is obsolete because it is largely duplicative of and inconsistent with revisions to other legal authorities that require national banks to collect and retain certain information on applications for home loans. In addition, because part 27 only applies to national banks, national banks have more home loan data collection requirements than other depository institutions. Moreover, the burden the rule imposes on national banks is not justified by the limited utility of data collected under part 27. Also, when part 27 was promulgated, the OCC stated that the regulation's requirements were designed to assist agency examiners in performing full and complete fair housing examinations. However, since then, the OCC has found that agency examiners generally base their fair lending supervisory activities on data collected under other legal authorities that require national banks to collect and maintain information on applications for home loans. To the extent OCC examiners may consider part 27 data, it is most useful for assessing a national bank's fair lending risk; however, the OCC has other tools for identifying fair lending risk at national banks. The OCC believes that the proposed recission of part 27, therefore, would not have a material impact on the availability of data necessary for the OCC to conduct its fair housing supervisory activities."
Comments on the proposed rule were due by December 18, 2025.
View all of the 2025 CFS Bites of the Month year-end recaps by topic on the 2025 Year-End Recap page.
Still hungry? Please join us for our next CFS Bites of the Month. Here is our lineup for 2026. If you missed any of our prior Bites, request a replay on our website.