The Consumer Financial Protection Bureau has supervisory and enforcement authority over a wide range of fintechs. This guide explains who the CFPB supervises, what CFPB exams look for, and how fintechs can prepare for CFPB oversight.
What Is CFPB Supervision? How the CFPB Oversees Fintechs
The Consumer Financial Protection Bureau (CFPB) is the primary federal agency responsible for consumer financial protection. Created by the Dodd-Frank Wall Street Reform and Consumer Protection Act in 2010, the CFPB has both supervisory (examination) authority and enforcement authority over a broad range of financial institutions and fintechs. For fintechs subject to CFPB oversight, understanding how supervision works — and how to prepare for it — is a critical compliance function.
What Is the CFPB's Mandate?
The CFPB's mandate under Dodd-Frank is to ensure that consumers have access to fair, transparent, and competitive markets for consumer financial products and services. The CFPB accomplishes this through:
- Rulemaking: Writing and enforcing consumer financial protection regulations (Regulation Z, Regulation E, Regulation V, and others)
- Supervision: Conducting examinations of covered entities to assess compliance
- Enforcement: Bringing enforcement actions against entities that violate federal consumer financial laws
- Consumer education and complaint management: Operating the Consumer Complaint Database and providing consumer financial education
Who Does the CFPB Supervise?
Depository Institutions
The CFPB has supervisory authority over banks, credit unions, and savings associations with more than $10 billion in assets. For smaller depository institutions, other federal banking regulators (OCC, FDIC, NCUA, Federal Reserve) enforce consumer financial protection laws.
Nonbank Covered Persons
Significantly for fintechs, the CFPB has supervisory authority over nonbank covered persons in certain categories regardless of asset size:
- Mortgage originators, brokers, and servicers
- Payday lenders
- Private student loan servicers
- Larger participants in markets for other consumer financial products and services, as defined by CFPB rulemaking
Larger Participant Rules
The CFPB has issued "larger participant" rules that define which nonbank companies in specific markets are subject to CFPB supervision based on size. Existing larger participant rules cover consumer reporting, consumer debt collection, international money transfers, student loan servicing, and automobile financing. The CFPB has proposed (and in some cases finalized) additional larger participant rules for digital payments — which would extend CFPB supervision to large general-purpose digital payment apps above a certain transaction threshold.
Enforcement Authority Over All Covered Persons
Even if a fintech is not subject to CFPB supervision (examination), the CFPB has enforcement authority over all "covered persons" and "service providers" that offer or provide consumer financial products or services. This means the CFPB can bring an enforcement action against virtually any fintech for UDAAP violations or violations of federal consumer financial laws, even without a prior examination.
What Does a CFPB Examination Cover?
CFPB examinations are conducted using the CFPB's examination procedures, which are publicly available at consumerfinance.gov. Examinations typically cover:
- Compliance management system (CMS): The overall structure of the institution's compliance program — board and management oversight, policies and procedures, training, monitoring and audit, and consumer complaint response
- UDAAP: Consumer-facing materials, marketing, fee practices, and account management for potential unfair, deceptive, or abusive acts or practices
- Product-specific laws: Depending on the products offered — Regulation E (electronic payments), Regulation Z (credit), FCRA (credit reporting), RESPA (mortgage), and others
- Fair lending: Analysis of credit decisions and pricing for potential discriminatory disparities
- Consumer complaints: Review of consumer complaint data and the institution's complaint response process
How to Prepare for CFPB Oversight
Whether or not a fintech is currently subject to formal CFPB supervision, building a CFPB-ready compliance program is good practice and positions the company for growth into supervised status. Key elements include:
- Written compliance policies and procedures: Documented procedures for all key compliance requirements, updated regularly
- Compliance management structure: Clear ownership of compliance at the board and management level, with a designated Chief Compliance Officer or equivalent
- Consumer complaint management: A formal process for receiving, investigating, responding to, and tracking consumer complaints
- Regular compliance testing: Internal audits or compliance reviews that test whether policies are being followed
- Training program: Regular compliance training for relevant staff, documented and tracked
- Exam readiness: Maintaining organized records and documentation that could be produced for an examiner — including policies, training logs, complaint records, and transaction data
Frequently Asked Questions
Does the CFPB supervise all fintechs?
Not all fintechs are subject to CFPB examination authority. CFPB supervision of nonbanks is based on specific categories (payday lenders, mortgage servicers, etc.) or larger participant rules. However, the CFPB has enforcement authority over all covered persons — including small fintechs — for violations of federal consumer financial laws.
What is the CFPB's complaint database?
The CFPB operates a public Consumer Complaint Database where consumers can file complaints about financial products and services. The CFPB routes complaints to companies and tracks their responses. A high volume of complaints or failure to respond appropriately can attract CFPB attention. Fintechs should monitor their complaint data and have formal complaint response processes in place.
What happens after a CFPB examination?
After an examination, the CFPB issues an examination report detailing findings. If violations are found, the CFPB may issue supervisory recommendations or, in serious cases, refer the matter to enforcement. A matter under review for potential enforcement action is called a "matter under review" (MUR). CFPB enforcement actions can result in consent orders requiring remediation, compliance improvements, and civil money penalties.
Can a fintech challenge CFPB supervision?
Nonbank entities subject to CFPB supervision based on the CFPB's risk-based supervisory designation (as opposed to larger participant rules) can seek to set aside the designation through a process established by the CFPB. This is a procedural right that is rarely used but does exist.
This article is for educational purposes only and does not constitute legal or compliance advice. CFPB authority and enforcement priorities are subject to change. Consult qualified legal counsel for guidance specific to your fintech's regulatory status and compliance program.
