CFPB regulations covering mortgages, debt collection, and payday loan payment practices remain on the books and enforceable, but several high-profile rules finalized in 2024 and early 2025 have since been repealed by Congress, vacated by federal courts, or formally disavowed by the bureau itself. Open banking and small business lending rules are being reconsidered, and the Consumer Financial Protection Bureau has withdrawn dozens of guidance documents and shrunk its enforcement footprint sharply under the Trump administration.
What follows is where each major rule stands right now, and what has changed around them.
Rules Still in Force
Ability-to-Repay and Qualified Mortgage (Regulation Z)
The Ability-to-Repay/Qualified Mortgage rule, effective January 10, 2014, requires mortgage lenders to make a reasonable, good-faith determination that a borrower can repay a residential mortgage before making the loan. Loans that meet defined criteria qualify as Qualified Mortgages and give lenders specific protections from legal liability. A December 2020 amendment replaced the earlier debt-to-income threshold for the General QM definition with a price-based standard.1Consumer Financial Protection Bureau. Ability-to-Repay and Qualified Mortgage Standards Under the Truth in Lending Act2Consumer Financial Protection Bureau. Ability-to-Pay Qualified Mortgage Rule
Debt Collection (Regulation F)
Regulation F, effective November 30, 2021, implements the Fair Debt Collection Practices Act and is the first comprehensive federal update to debt collection rules in decades. Collectors cannot call before 8 a.m. or after 9 p.m. local time, and they are presumed to comply with the law if they do not call more than seven times in seven consecutive days about a particular debt. The rule requires a clear opt-out mechanism for email and text messages and sets detailed validation requirements so consumers get enough information to identify and dispute a debt.3Consumer Financial Protection Bureau. Debt Collection Practices (Regulation F)4eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F) Regulation F remains in effect.
Payday Lending Payment Provisions
The 2017 Payday Lending Rule originally had two pieces: mandatory underwriting and payment restrictions. The CFPB rescinded the underwriting piece in 2020. The surviving payment provisions took effect on March 30, 2025, and prohibit lenders from attempting to withdraw payment from a consumer’s account after two consecutive failed attempts unless the consumer provides new authorization.5National Consumer Law Center. Rule on Bounced Payday and High-Cost Loan Payments Now in Effect
There’s a catch. On March 28, 2025, the CFPB announced it would not prioritize enforcement or supervision of the rule. State attorneys general can still enforce it, and consumers can invoke its protections in private lawsuits.5National Consumer Law Center. Rule on Bounced Payday and High-Cost Loan Payments Now in Effect
Rules Repealed, Vacated, or Blocked
Overdraft Fee Cap
In December 2024, the CFPB finalized a rule that would have capped overdraft fees at $5 for banks with more than $10 billion in assets, unless those banks demonstrated actual cost justification or treated overdraft coverage as a credit product subject to Truth in Lending Act disclosures. The rule was set to take effect October 1, 2025.6Consumer Financial Protection Bureau. Overdraft Lending: Very Large Financial Institutions Final Rule It never did. On May 9, 2025, President Trump signed a Congressional Review Act resolution repealing the rule, which bars the CFPB from issuing a substantially similar regulation in the future.7Consumer Financial Protection Bureau. Overdraft Lending: Very Large Financial Institutions
Credit Card Late Fee Cap
A March 2024 rule would have lowered the safe harbor amount for credit card late fees from roughly $30 to $8 for issuers with one million or more open accounts. On April 15, 2025, a federal judge in the Northern District of Texas vacated the rule after the CFPB and the plaintiffs jointly moved to dismiss the case, with the bureau agreeing the rule violated the CARD Act and was “contrary to law.”8Independent Community Bankers of America. Judge Scraps CFPB Credit Card Late Fee Rule
Medical Debt on Credit Reports
The CFPB finalized a rule on January 7, 2025, that would have prohibited consumer reporting agencies from including medical debt on credit reports and barred creditors from considering medical debt in credit decisions.9Consumer Financial Protection Bureau. Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V) On July 11, 2025, a federal judge in the Eastern District of Texas vacated the rule in Cornerstone Credit Union League v. CFPB, holding that it exceeded the bureau’s authority under the Fair Credit Reporting Act. The CFPB itself joined the plaintiffs’ motion asking the court to strike down the rule.10Berkeley Center for Consumer Law and Economic Justice. Court Overturns Federal Rule, Keeps Medical Debt on Credit Reports Medical debt can continue to appear on credit reports.
Disparate-Impact Liability Under Regulation B
On April 22, 2026, the CFPB issued a final rule amending Regulation B that eliminates disparate-impact liability under the Equal Credit Opportunity Act. It removes language in the regulation and its commentary that had supported “effects test” claims, where a lender could face enforcement action even without intent to discriminate if its practices had a disproportionate impact on protected groups. The rule also narrows the definition of prohibited “discouragement” to require proof of intent under a reasonable-person standard, and it restricts Special Purpose Credit Programs from using race, color, national origin, or sex as eligibility criteria.11Federal Register. Equal Credit Opportunity Act (Regulation B) The change followed executive orders directing federal agencies to eliminate disparate-impact theories where possible.
Rules Being Reconsidered
Personal Financial Data Rights (Open Banking)
The CFPB finalized the Personal Financial Data Rights rule under Section 1033 of the Consumer Financial Protection Act in October 2024. It would require banks, credit card issuers, and other financial data providers to let consumers access and share transaction histories, account balances, and upcoming bills with authorized third parties at no cost, and it would prohibit those third parties from using the data for purposes the consumer did not request, such as targeted advertising. Compliance was set to phase in between April 2026 for the largest institutions and April 2030 for the smallest.12Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule
The rule has effectively stalled. A federal judge in the Eastern District of Kentucky issued a preliminary injunction blocking enforcement, and in a May 2026 legal filing, the Trump administration called the rule “unlawful and should be set aside.”13America’s Credit Unions. Judge Blocks Implementation of CFPB’s Open Banking Rule The CFPB issued an Advance Notice of Proposed Rulemaking in August 2025 to reconsider key provisions, including data security requirements and fee structures.14Consumer Financial Protection Bureau. Personal Financial Data Rights
Small Business Lending Data (Section 1071)
Section 1071 of the Dodd-Frank Act directs the CFPB to collect data on small business lending, similar to how mortgage data is collected under the Home Mortgage Disclosure Act. The bureau finalized its implementing rule in March 2023, but it drew litigation in three jurisdictions, and the Fifth Circuit granted a stay pending appeal in Texas Bankers Association v. CFPB.15American Bankers Association. Litigation Tracker On May 1, 2026, the CFPB published a revised final rule that narrows the original substantially, adopting what the bureau called an “incremental approach” focused on core lending products, core lenders, and mostly statutory data points. The mandatory compliance date is January 1, 2028.16Federal Register. Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)
Guidance Withdrawn and Enforcement Deprioritized
On May 12, 2025, the CFPB withdrew 67 guidance documents in a single action, including interpretive rules, policy statements, and advisory opinions spanning the bureau’s history. The withdrawn materials covered Buy Now Pay Later loans, earned wage access programs, medical debt collection, algorithmic scoring in hiring, overdraft practices, and whistleblower protections, among other topics.17SBA Office of Advocacy. CFPB Withdraws 67 Interpretive Rules, Policy Statements, and Advisory Opinions The bureau said it would only reissue guidance that is “necessary” and would reduce compliance burdens rather than increase them, and it would deprioritize enforcement against parties that do not conform to the withdrawn materials during the review.18Federal Register. Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal
The bureau also rescinded its registry requiring certain nonbank companies to report final public enforcement orders against them. The SBA’s Office of Advocacy supported the rescission, estimating small entity savings of between $28.7 million and $143.4 million over ten years.19SBA Office of Advocacy. Advocacy Supports CFPB’s Rescission of the Nonbank Registry Rule
Enforcement activity dropped sharply. In 2025, the bureau dismissed or withdrew from 19 enforcement actions, terminated or modified 22 pending orders, and closed roughly 40 percent of its pending investigations, focusing the cuts on student market cases, cases built on disparate-impact liability, and matters the bureau said targeted “wrong” consumer choices rather than fraud. Consent orders related to redlining were terminated, and the bureau said it would concentrate remaining resources on cases involving identifiable consumer fraud, intentional discrimination, and Military Lending Act violations.20Consumer Financial Protection Bureau. 2025 Enforcement Lookback
Staffing Cuts and the Funding Fight
On February 7, 2025, President Trump designated Russ Vought, who concurrently served as Director of the White House Office of Management and Budget, as Acting Director of the CFPB.21Consumer Financial Protection Bureau. About the Director In April 2025, the bureau began a reduction in force affecting more than 1,500 of its roughly 1,700 employees. A federal judge initially blocked the mass layoffs; an appeals court later lifted that prohibition. The administration’s initial plan to cut staff to about 200 was scaled back, and as of early 2026, the target headcount was approximately 550. The reductions would eliminate roughly five out of every six positions in supervision and about four-fifths of enforcement staff. The bureau’s budget was also cut by roughly half through the reconciliation bill signed by President Trump.22Federal News Network. White House Scales Back Plan to Dismantle the CFPB but Still Wants to Slash Staff by Two-Thirds
The bureau’s funding source is under separate legal attack. In November 2025, the CFPB filed notice in NTEU v. Vought that the Department of Justice’s Office of Legal Counsel had issued an opinion concluding the bureau could not legally request funds from the Federal Reserve because, in OLC’s view, the Federal Reserve had no “combined earnings” from which the bureau was authorized to draw.23Consumer Financial Protection Bureau. CFPB Notifies Court It Cannot Lawfully Draw Funds From the Federal Reserve Federal Judge Amy Berman Jackson rejected that interpretation on December 30, 2025, ruling that the bureau could not engineer a “funding lapse” by declining to request transfers. In January 2026, Acting Director Vought submitted a $145 million funding request to Federal Reserve Chair Jerome Powell, stating he disagreed with the court’s interpretation but was complying. The D.C. Circuit has agreed to rehear the case en banc.24Consumer Financial Services Law Monitor. CFPB Complies With Court’s Funding Order in NTEU v. Vought The outcome will affect whether the bureau has the resources to enforce any of the rules described above.