To keep receiving your weekly insights, all you need to do is subscribe to our new Consumer Financial Services Weekly Newsletter — it’s quick and easy.
We’ll see you there!
To keep you informed of recent activities, below are several of the most significant federal and state events that have influenced the Consumer Financial Services industry over the past week.
Federal Activities:
On October 29, the National Urban League and the Massachusetts Association of Community Development Corporations sued the Consumer Financial Protection Bureau (CFPB) and Acting Director Mark Paoletta in the U.S. District Court for the District of Massachusetts. They challenge the Bureau’s April 22, 2026, final rule amending Subpart A of Regulation B, which implements the Equal Credit Opportunity Act (ECOA). The complaint seeks declaratory and injunctive relief, including vacatur of the rule. It follows a similar May challenge by the National Fair Housing Alliance, Rise Economy, BLDS, LLC, and SolasAI. Similar to that case, it targets the rule’s three principal changes: the elimination of disparate-impact liability under ECOA, the narrowing of protections against discouraging prospective applicants, and new restrictions on special purpose credit programs (SPCPs) offered by for-profit lenders. The plaintiffs allege the CFPB violated the Administrative Procedure Act (APA) by acting arbitrarily and capriciously. They say it failed to explain the changes, respond to significant comments, consider reliance interests, or assess costs and benefits. They also allege procedural defects, including a 32-day comment period, noncompliance with the Regulatory Flexibility Act and the Small Business Regulatory Enforcement Fairness Act, and inadequate consultation with other agencies under the Dodd-Frank Act. They further allege that the CFPB made no changes despite receiving about 64,500 comments, 90% of which opposed the proposal. The complaint contends that the revised discouragement provisions conflict with ECOA, exceed the Bureau’s authority, and could make it harder to address redlining and targeted digital advertising. It places particular emphasis on alleged harms to nonprofit and community-development organizations, including added compliance costs, diverted resources, reduced opportunities to partner with for-profit lenders, and lenders ceasing new credit under previously available Massachusetts SPCPs. Finally, the plaintiffs allege that then-Acting Director Russell Vought lacked authority under the Federal Vacancies Reform Act and the Constitution to issue the proposed and final rules, which they argue makes the final rule void. For more information, click here.
On October 28, the Federal Trade Commission (FTC), the attorneys general (AG) of Colorado, Florida, Illinois, Iowa, Nebraska, Oklahoma, and Utah, and the People of the State of California (through the Los Angeles County Counsel and San Francisco City Attorney) sued restaurant software and fintech company Toast Inc. and affiliated entities in the U.S. District Court for the Northern District of California. The complaint alleges that Toast deceptively imposes hidden and unauthorized fees, enrolls customers in unwanted add-ons, makes cancellation difficult, and fails to deliver on its customer support promises. According to the complaint, restaurants must enroll in auto-renewing subscriptions. Toast allegedly fails to clearly disclose several charges, including a requirement that customers return hardware or pay its full retail value if they do not begin processing payments within 120 days, an $85 monthly processing fee even during temporary closures, and an early termination fee of $150 for each remaining month of the contract. The complaint also alleges that from September 2021 through late July 2023, Toast added an undisclosed $0.99 fee to certain online orders above $10, with the fee going to Toast rather than the restaurants. The agencies further allege that Toast uses a multistep cancellation process that requires 30 days’ written notice that is not clearly disclosed at enrollment, subjects customers to retention sales pitches, and can result in high early termination fees. They also allege that canceling a subscription is treated as a default on a Toast Capital loan, triggering immediate repayment of the full balance. Finally, the complaint alleges that Toast advertises “24/7/365” customer support while customers struggle to reach anyone who can help. The plaintiffs allege violations of the FTC Act, the Restore Online Shoppers’ Confidence Act, and related state laws. The Commission voted 2-0 to authorize the filing, and the case will be decided by the court. For more information, click here.
On October 27, the CFPB released its Semi-Annual Report to Congress covering January 1 through June 30, 2026, with a message from Acting Director Mark Paoletta. The report covers the final six months of Vought’s tenure, which the message describes as reversing abuses and overreach under former Director Rohit Chopra. On consumer complaints, the Bureau stopped publishing unverified complaint narratives and visualizations, aligned its process with the Fair Credit Reporting Act by directing consumers to dispute with consumer reporting agencies first, published an updated Company Portal Manual, and required two-factor authentication. The report highlights two fair lending rulemakings. The first is a final rule amending Regulation B, which implements ECOA. It affirms that ECOA does not authorize disparate impact liability and prohibits using race, color, national origin, or sex as eligibility criteria for SPCPs. The second amends the Regulation B provisions implementing § 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. It refocuses the coverage of credit transactions and financial institutions and removes data collection requirements the Bureau says are not in the statute, such as LGBTQIA+-owned business status and disaggregated race and ethnicity categories. On enforcement, the Bureau adopted new Enforcement Principles focused on actual consumer harm, due process, voluntary resolution, and avoiding duplicative work. On supervision, the Bureau adopted a new exam schedule focused on depository institutions, actual consumer fraud, and areas clearly within its statutory authority. It no longer relies on novel legal theories or duplicates other oversight, and exams are governed by the Humility in Supervision Pledge and emphasize conciliation, correction, and remediation. For more information, click here.
On October 27, the Office of Inspector General issued Audit Report 2026-IT-C-017, its 2026 audit of the CFPB’s information security program. The audit found that the CFPB’s program is not effective under federal metrics for evaluating agency information security programs. It reached a maturity level of two out of a possible five, meaning the program is defined but not consistently implemented. The report notes that the CFPB maintains databases containing millions of consumer complaints, sensitive financial information, and confidential supervisory records on financial institutions, which must be protected from sophisticated cyber threats. The audit identified weaknesses in three areas. First, asset inventories have gaps, multiple actively used datasets are missing from the data inventory, and hardware at vacated regional offices is not properly inventoried and may not be secure. Second, risk management framework processes rely on outdated baseline controls and reactive vulnerability management, and the CFPB failed to remediate critical and high-severity vulnerabilities within the required 30-day time frames, although it later made plans to address them. Third, policies and guidance have gaps or are outdated, including the cybersecurity risk strategy, security policies, and business impact analyses for nine newly authorized systems. Ten of 14 unresolved recommendations from prior annual information security audits remain open, and the auditors are reviewing evidence submitted after fieldwork ended to determine whether to close nine of those 10. The report makes eight new recommendations to strengthen asset management, risk framework implementation, and policy governance. The CFPB agreed with the recommendations, and the auditors will follow up to ensure they are fully addressed. For more information, click here.
On October 27, the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation (FDIC), published a joint notice in the Federal Register requesting public comment on a proposal to revise and extend for three years the Consolidated Reports of Condition and Income (Call Report). The agencies are specifically seeking comment on revisions to the Call Report related to an interim final rule issued by the FDIC that implements § 902 of the 21st Century ROAD to Housing Act, and the Office of Management and Budget (OMB) has already granted emergency approval for those revisions. Comments must be submitted by December 28, 2026, and may be sent to any or all of the agencies, which will share them among themselves. All comments are subject to public disclosure, so commenters should not include confidential information. For more information, click here.
On October 26, the U.S. Court of Appeals for the Eighth Circuit affirmed a District of North Dakota judgment in Corner Post, Inc. v. Board of Governors of the Federal Reserve System vacating the 21-cent debit card interchange fee cap set by the Federal Reserve in Regulation II. Corner Post, a North Dakota truck stop and convenience store, challenged the rule under the APA after the Supreme Court held its challenge timely in 2024. The district court granted summary judgment for Corner Post, vacated the cap, and stayed its decision pending appeal. The panel reviewed de novo and, citing Loper Bright, gave the Board no deference, including under the Durbin Amendment’s own provision on deference. It held that the statute’s “incremental cost” term, which the Board must consider in regulating interchange fees under 15 U.S.C. § 1693o-2(a)(4)(B), means marginal cost, which is the added cost of one additional transaction. The court reasoned that the statute’s references to “a particular electronic debit transaction” and its instruction not to consider costs “not specific to a particular electronic debit transaction” point to excluding fixed costs. The Board never defined “incremental cost,” and it admitted that some fixed costs factored into the cap. The court found that the flat per-transaction cap and the statute’s call for “standards” in the plural did not square with the statute. It noted that fees need not match marginal cost exactly and that the Board may use a reasonable proxy, such as average variable cost, but it must at least sort transaction-specific costs from other costs. The court remanded for the agency to develop a fee structure consistent with the statute. It said the Board’s proposed lower cap of 14.4 cents, which has not been adopted, does not affect its assessment of the current rule. For more information, click here.
On October 22, President Donald Trump issued Executive Order 14438, “Decreasing Housing Costs for the American People,” which sets a policy of reducing regulatory barriers to mortgage origination, embracing innovative risk and value assessment technologies, and promoting competition in the housing and mortgage markets. The order directs the Federal Housing Finance Agency (FHFA) director, if he determines it is in the best interests of the Enterprises (Fannie Mae and Freddie Mac), the FHFA, and the public, to have the Enterprises establish a pilot program for mortgages made after its creation. The program would use automated valuation models and other data to identify borrowers who meet equity requirements and to proactively cancel mortgage insurance. It would also require servicers, to the extent permitted by law and operationally feasible, to notify borrowers promptly and to cut unnecessary documentation and appraisal costs. The order creates a Task Force on Manufactured Housing Innovation, co-chaired by the secretary of Housing and Urban Development and the FHFA director. Within 180 days, the Task Force must submit recommendations on modern manufacturing methods for factory-built housing, including reciprocal recognition of approvals among agencies, elimination of duplicative federal requirements, and use of federal financing authorities to encourage production. It must also evaluate whether federal grants may be conditioned on, or used to encourage, state and local adoption of standardized permitting and licensing, and prepare legislative recommendations. In addition, the order directs the FHFA director, subject to the same best-interests determination and consistent with safety and soundness and applicable law, to have the Enterprises expand the title acceptance pilot into a nationwide ongoing program. The program would accept automated title reviews in lieu of lender’s title insurance on eligible refinances. The director is to consider raising the 80% loan-to-value limit, removing geographic limits, adding title-assessment providers, waiving certain documentation on limited cash-out refinances, and reducing related fees, and must require that savings be passed through to borrowers. Finally, the secretaries of Agriculture and Veterans Affairs must, consistent with applicable law and available appropriations, reduce interest rates on their direct single-family home loans. The order creates no enforceable rights and is subject to applicable law and appropriations. For more information, click here.
On October 20, Fannie Mae issued Information Security and Business Resiliency Supplement Bulletin 26-01, effective January 18, 2027, to notify companies subject to the Fannie Mae Information Security and Business Resiliency Supplement (the Supplement) that a new version has been published. Beyond minor clerical edits, the update adds a new section (Section 4) on governance of “Super Intelligence” (SI), a term used in place of “Artificial Intelligence” to align with evolving industry terminology, without changing the scope of the requirements. The new section requires companies that use SI in connection with their underlying agreements to maintain an SI governance program, manage SI supply chain risk, and make disclosures to Fannie Mae. The Information Security Program section now cites the National Institute of Standards and Technology (NIST) Framework 800-53 as an example industry standard and adds an insurance policy requirement. Other changes include updated multifactor authentication (MFA) implementation requirements, a shift from a “qualified independent auditor” to an “independent third-party security professional” for security assessments, updated encryption standards, and replacement of the term “vendor” with “third party” throughout. The cybersecurity incident section now requires initial notification to Fannie Mae within a 36-hour period, followed by prompt supplemental details, and expands reporting to include all data attributes of affected individuals and a copy of the notification letter sent to them. Fannie Mae may restore access at its sole discretion. The business continuity sections add a business impact analysis, a communication strategy for incident response, and disaster recovery planning with clarified annual testing, while removing several requirements, including the annual threat risk assessment and certain lessons-learned tracking. Finally, a company is deemed to accept amendments if it does not reject them within the applicable period. The Supplement governs in the event of any inconsistency with the Bulletin. For more information, click here.
On October 8, Nacha issued a request for information and request for comment (RFI/RFC) seeking industry input on first-party fraud in the Automated Clearing House (ACH) Network, with responses due by Friday, December 11, 2026. First-party fraud occurs when an account holder falsely tells the Receiving Depository Financial Institution (RDFI) that an authorized debit was unauthorized, leading the RDFI to return the debit, generally using Return Reason Code R10. Nacha reports anecdotally that this fraud is increasing, and it asks respondents about its scope and significance, the roles and responsibilities of the parties in identifying it, and possible mitigants. The ideas explored include standardized company entry descriptions, authorization-related indicators, and account information provisioning-related indicators. Some of these may also serve Pay by Bank scenarios. The RFI also examines ways for originating parties to show that a debit was authorized, including making proof of authorization part of an RDFI’s review of a Written Statement of Unauthorized Debit (WSUD) or creating a new arbitration process. Under the current Nacha Operating Rules, an Originating Depository Financial Institution may dishonor an unauthorized return only for certain administrative reasons, and an Originator generally cannot reinitiate a debit returned as unauthorized. The RFC portion proposes amending § 3.11 of the Nacha Operating Rules to clarify that an RDFI’s obligation to “promptly” recredit a consumer Receiver does not require recrediting before the RDFI must provisionally recredit under Regulation E. For a nonconsumer, it does not require recrediting before the expiration of a comparable period reasonably necessary to investigate the claim. Nacha says some RDFIs read “promptly” to mean same-day recredit, which may keep them from reviewing the WSUD or starting a Regulation E investigation. The proposal would not change the timing of the return or the need to recredit before returning the entry. It carries a proposed effective date of June 18, 2027, and Nacha says it requires no operational changes, so an RDFI may implement any changes on its own timeline. For more information, click here.
State Activities:
On October 27, a coalition of 20 states and the District of Columbia, led by Oregon and Illinois, filed a complaint in the U.S. District Court for the District of Oregon against Treasury Secretary Scott Bessent, the U.S. Department of the Treasury, Acting Director Jenna Casanova, the Financial Crimes Enforcement Network (FinCEN), Attorney General Todd Blanche, and Homeland Security Secretary Markwayne Mullin. The plaintiffs challenge FinCEN’s March 2025 interim final rule and August 14, 2026, final rule exempting domestic companies and U.S. persons from beneficial ownership information (BOI) reporting under the Corporate Transparency Act (CTA). They allege these rules effectively repeal the CTA by excluding more than 99.9% of the entities Congress required to report, and that the executive branch cannot repeal a statute through rulemaking. The complaint alleges that the rules violate the APA because the Treasury secretary’s limited authority to exempt additional classes of entities, and the general exemption authority in the Bank Secrecy Act, do not permit exemptions of this scope. It also alleges the rules are arbitrary and capricious because they rely on conclusory and unsupported justifications, cite a general deregulation executive order, and do not explain why reporting by domestic entities would “not be highly useful” to law enforcement. The plaintiffs further allege that the final rule added a freeze on updating FinCEN identifiers for U.S. persons. They also allege that it announced, without notice or comment, a “Data Purge” of previously reported BOI to occur by about February 10, 2027, which they say would violate the CTA’s five-year retention requirement and the Federal Records Act. The states allege harm from losing access to data they use for criminal and civil investigations, financial institution supervision, and state tax enforcement, and they cite FinCEN’s October 2026 refusal to provide the Illinois Department of Financial and Professional Regulation with BOI access. They ask the court to declare the rules unlawful and vacate them, and to grant immediate relief to prevent destruction of the data. For more information, click here.
On October 22, the New York City Department of Consumer and Worker Protection (DCWP) updated its FAQs on the Stopping Harassment and Intimidation and Ensuring Lawful Debt Collection (SHIELD) Rule, adding clarifications on electronic consent, documentation of an unavailable call-back person, and automated phone routing ahead of the rule’s January 1, 2027, effective date. The DCWP characterizes these as operational clarifications rather than amendments to the rule. New FAQ III.3 explains that a debt collector may obtain a consumer’s revocable written consent to electronic communications through an initial electronic confirmation link, provided the process satisfies 6 RCNY § 5-77(b)(5) and applicable state and federal law. The initial message must be sent solely to obtain consent, and the consumer must take an affirmative action, with an electronic signature that complies with New York’s Electronic Signatures and Records Act and the federal E-SIGN Act. Only one initial consent-seeking message is excluded from the limit of three communications per distinct consumer account within seven days, so the clarification does not exempt repeated consent requests. The updated response to FAQ VII.6 allows collectors to document the unavailability of the call-back person identified in a validation notice using standard status codes in the account record, such as “VAC,” “CALL,” or “OOO,” without sharing private or medical details. New FAQ VII.9 confirms that the rule does not prohibit interactive voice response menus or automated routing for inbound calls. DCWP-licensed debt collection agencies must still comply with 6 RCNY § 2-194, which the FAQ describes as requiring a call-back number routed to a natural person qualified to answer questions, with the call answered within a cumulative 120-second connection window during business hours. For collectors not required to be licensed, following that standard is a best practice rather than a mandate, and an automated system may route a call to a designated representative when the listed call-back person is unavailable. For more information, click here.
On October 21, the New York State Department of Financial Services (DFS), through Acting Superintendent Kaitlin Asrow, proposed repealing and replacing Part 14 of Title 3 of the New York Codes, Rules and Regulations (3 NYCRR), which governs bank investments in operating subsidiaries and other entities, to take effect upon publication of a Notice of Adoption in the State Register. The proposal implements the superintendent’s authority under Banking Law §§ 97(4-a) and 97(5) and applies to New York state-chartered banks and trust companies and, unless otherwise specified, to branches and agencies of foreign banks. It defines key terms, including “control,” “operating subsidiary,” “previously approved activity,” “well capitalized,” and “well managed,” and excludes certain entities from the operating subsidiary definition, such as securitization trusts and subsidiaries holding bank premises. Under the proposal, a bank generally must apply for prior approval to acquire or establish an operating subsidiary, perform new activities in an existing one, or establish an Edge Act subsidiary. The investment may proceed 30 days after the superintendent receives the application unless the superintendent objects or requires more time or information. Approval expires if the bank does not act within 12 months. A bank that is well capitalized and well managed may instead give written notice within 10 days after the investment for a list of 33 specified activities and for activities substantively the same as previously approved ones. Banks may also use after-the-fact notice for certain activities, such as factoring and personal property leasing. Additional investments of no more than 1% of capital and surplus, and certain repeat activities, require neither approval nor notice. For non-controlling equity investments in other entities, the proposal similarly provides for after-the-fact notice with specified representations and certifications, prior approval where those cannot be made, and an exemption for small follow-on investments. It also adds a new section authorizing tax equity finance transactions as the functional equivalent of a loan, subject to conditions including an aggregate limit of 5% of capital and surplus (up to a 15% ceiling with the superintendent’s approval) and advance written notice. Finally, it sets informational requirements for filings, including a full description of the transaction, the legal authority relied upon, and the bank’s control of the subsidiary. For more information, click here.