The CFPB has expanded its jurisdiction and launched a new rulemaking agenda covering open banking, BNPL, and data broker oversight. In-house counsel have identified five high near-term exposure areas that demand immediate attention from finance leaders.
Key Takeaways
The Consumer Financial Protection Bureau has not been idle. While much of the financial regulatory attention in 2025 and early 2026 has focused on Basel IV and the SEC's climate disclosure rules, the CFPB has been quietly advancing the most ambitious expansion of its rulemaking agenda since the Bureau's founding. For financial institutions that have not been tracking this closely, the regulatory exposure that has accumulated is significant, and the window to prepare ahead of enforcement is narrowing.
"The CFPB's remit has expanded in three directions simultaneously," said Katherine Osei, partner in the consumer financial services regulatory practice at Hudson River Law. "Jurisdiction is broader, covering a wider range of non-bank financial service providers. Enforcement posture is more aggressive, with record civil money penalties in 2025. And the rulemaking pipeline is producing final rules faster than most legal teams can fully absorb. For financial institutions with consumer-facing products, the compliance burden has increased materially in the last 18 months."
The Hudson River Law team has distilled the CFPB's current rulemaking activity into five areas where financial institutions face the highest near-term exposure, either because rules are already in effect and enforcement has begun, or because proposed rules are expected to be finalised within the next 12 months with limited effective date grace periods.
Of the five areas, Section 1033 open banking compliance is the most operationally demanding for most institutions. The rule requires covered depository institutions and non-bank financial providers to make consumer financial data, account balances, transaction history, payment initiation information, available to authorised third parties through standardised APIs, upon consumer request. For institutions that have not previously built open banking infrastructure, the technical and security requirements represent a significant development undertaking.
"Section 1033 is not an IT project with compliance implications. It is a fundamental change to how financial institutions think about data ownership and consumer consent. The institutions treating it as a checkbox exercise are going to regret that approach when the enforcement actions begin." , Katherine Osei, Hudson River Law
The BNPL guidance is drawing particular attention from the growing number of financial institutions that have launched deferred payment products in the past three years. The CFPB's interpretation that BNPL products meeting certain structural criteria are subject to the Truth in Lending Act as open-end credit plans means that institutions without TILA-compliant disclosures, billing dispute procedures, and clear ability-to-repay processes are in immediate violation. The Bureau has signalled it will begin prioritising BNPL enforcement in the second half of 2026, giving affected institutions a narrowing window for remediation. Legal teams at institutions offering these products should treat an immediate compliance gap assessment as a top priority action.
The data broker rulemaking's reach into financial services may be the least well-understood of the five exposure areas. Most financial institutions purchase consumer data from third-party brokers for a range of purposes, credit underwriting, fraud detection, marketing, identity verification. The proposed CFPB rules, if finalised as currently drafted, would impose FCRA-like obligations on broker transactions that currently fall outside the FCRA's coverage, and would require financial institutions to review their data vendor contracts and data use practices to ensure compliance. That review process is underway at the most sophisticated institutions; many others have not yet started it.
Six high-exposure areas require new data infrastructure as the SEC's final climate disclosure rules come into effect.
62% of mid-market banks have significant capital model gaps under Basel IV output floor requirements, and supervisors are coming.
The output floor and SMA for operational risk are the two provisions with the greatest near-term capital impact.
