On March 26, the U.S. Court of Appeals for the Fourth Circuit reversed a district court’s decision holding a credit union liable for a wire transfer in a business email compromise scam case where the credit union lacked “actual knowledge” of the mismatch between the account number and beneficiary.

In a surprising turn of events, the Consumer Financial Protection Bureau (CFPB or Bureau) and Townstone Financial, Inc. (Townstone) have jointly moved to vacate the Stipulated Final Judgment and Order previously entered in the CFPB’s enforcement action against the mortgage lender alleging redlining practices. This motion, filed on March 26, 2025, comes after significant allegations by the CFPB regarding the Bureau’s own handling of the case, which began in 2020 under the first Trump administration and continued under the Biden administration.

In a significant policy shift under the Trump administration, the new Federal Housing Finance Agency (FHFA) Director Bill Pulte issued an order on March 25, 2025 terminating special purpose credit programs (SPCPs) supported by the government sponsored enterprises, Fannie Mae and Freddie Mac (together, the GSEs). This directive, effective immediately, will significantly impact banks with mortgage-based SPCPs.

On March 20, the Arkansas governor signed into law Arkansas Act 347, known as the Earned Wage Access Services Act. Sponsored by Representative David Ray (R) and Senator Ben Gilmore (R), this legislation aims to regulate earned wage access (EWA) providers. Notably, “providers” is defined to include a person engaged in the business of offering earned wage access, but not an employer that advances a portion of earned wages directly to employees or independent contractors.

Last month, we discussed the motion filed by the National Consumers League and four small business owners to intervene in the case of Insurance Marketing Coalition Limited. v. FCC. This motion aimed to challenge the Eleventh Circuit panel’s decision that vacated the FCC’s 2023 Order, known as the One-to-One Rule. Last week, the District of Columbia, along with 27 states, filed an amicus brief in support of a petition for rehearing en banc.

On March 18, President Donald Trump dismissed the two Democratic commissioners from the Federal Trade Commission (FTC). The removal of Commissioners Alvaro Bedoya and Rebecca Kelly Slaughter has sparked significant controversy and legal challenges.

On March 14, the U.S. Court of Appeals for the Fourth Circuit issued a ruling addressing the obligations of furnishers under the Fair Credit Reporting Act (FCRA) to conduct reasonable investigations of disputed information, whether the disputed information be legal or factual in nature. The issue of whether the distinction between “legal” and “factual” disputes is relevant under the FCRA has been hotly contested in recent years. The Fourth Circuit’s new decision follows in the footsteps of the Eleventh and Second Circuits by replacing a “legal vs. factual” test with a “readily and objectively verifiable” test.

Dear Mary,

Our company experienced a cybersecurity incident. It seemed pretty minor — just a few suspicious emails and an employee’s account being locked. To my dismay, we’re now hearing from our IT team that the issue is more serious. We have cyber insurance, but we didn’t notify our carrier right away. Did we make a mistake? When should I reach out to our insurance provider?

– Unsure Insured of San Francisco