Consumer Financial Protection Bureau (CFPB)

The Consumer Financial Protection Bureau is the federal agency created by title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act to write, supervise for, and enforce federal consumer financial law. Its enabling provision, 12 USC 5491(a), reads: "There is established in the Federal Reserve System, an independent bureau to be known as the 'Bureau of Consumer Financial Protection', which shall regulate the offering and provision of consumer financial products or services under the Federal consumer financial laws." Title X's own defined shorthand throughout is simply "the Bureau".

Both names in circulation are official, which is unusual. The statute says Bureau of Consumer Financial Protection; the Code of Federal Regulations heads chapter X of title 12, where the Bureau's regulations live, "Consumer Financial Protection Bureau", and that is the form the agency uses for itself. This page uses the CFR form and the abbreviation CFPB, because those are what a reader will meet on a disclosure or a complaint page.

The authority map is the useful thing to know, because the Bureau's reach is a list rather than a subject. 12 USC 5481(12) defines "enumerated consumer laws" as eighteen named statutes, and the Bureau's rulemaking and enforcement authority attaches to those plus title X itself. In the statute's order they are: the Alternative Mortgage Transaction Parity Act; the Consumer Leasing Act; the Electronic Fund Transfer Act, except its interchange section; the Equal Credit Opportunity Act; the Fair Credit Billing Act; the Fair Credit Reporting Act, except two sections; the Homeowners Protection Act; the Fair Debt Collection Practices Act; subsections (b) through (f) of section 43 of the Federal Deposit Insurance Act; sections 502 through 509 of the Gramm-Leach-Bliley Act, with one carve-out; the Home Mortgage Disclosure Act; the Home Ownership and Equity Protection Act; the Real Estate Settlement Procedures Act; the S.A.F.E. Mortgage Licensing Act; the Truth in Lending Act; the Truth in Savings Act; section 626 of the Omnibus Appropriations Act, 2009; and the Interstate Land Sales Full Disclosure Act.

The carve-outs are what prove this is a map and not a shorthand. Paragraph (F) brings in the Fair Credit Reporting Act "except with respect to sections 615(e) and 628 of that Act (15 USC 1681m(e), 1681w)", which are the identity-theft red flags rules and the records disposal rule. Those two stayed with the agencies that had them. Anyone reasoning from "the CFPB administers the FCRA" to a conclusion about either of those sections gets the wrong answer.

The $10 billion line splits who examines and who sues, not whose rules apply. This is the single most misstated thing about the agency. A Bureau regulation, such as Regulation Z or Regulation F, binds a covered institution whatever its size. What the asset line divides is supervision and enforcement. Under 12 USC 5515(a) the Bureau's supervisory and enforcement authority reaches an insured depository institution or insured credit union "with total assets of more than $10,000,000,000 and any affiliate thereof", and 5515(b)(1) gives it "exclusive authority to require reports and conduct examinations on a periodic basis" of those institutions. Under 12 USC 5516(a), for an institution with total assets of "$10,000,000,000 or less", 5516(d)(1) provides that "the prudential regulator is authorized to enforce the requirements of Federal consumer financial laws and, with respect to a covered person described in subsection (a), shall have exclusive authority (relative to the Bureau) to enforce such laws." The Bureau keeps two narrow footholds below the line: it may include its examiners "on a sampling basis" of the prudential regulator's examinations (5516(c)(1)), and where it believes there has been a material violation it notifies the prudential regulator in writing, which must respond in writing within 60 days (5516(d)(2)). So a complaint about a small community bank is a matter for that bank's prudential regulator, even though the rule the bank broke was written by the Bureau.

The boundary against the Federal Trade Commission runs the opposite way from the shorthand. The two agencies are not divided by institution size. The FTC Act's own enforcement provision, 15 USC 45(a)(2), excepts "banks, savings and loan institutions ..., Federal credit unions ..., common carriers ..., air carriers and foreign air carriers", so the FTC's unfair-or-deceptive-practices authority does not reach depository institutions at all, of any size. The Bureau reaches them, subject to the supervision line above. In the other direction, 12 USC 5481(14) is explicit that "Federal consumer financial law" as the Bureau administers it "does not include the Federal Trade Commission Act", so a practice the FTC would attack under its own statute is not automatically within the Bureau's remit either.

The complaint function is a routing mechanism rather than an adjudication. The Bureau's own description of the process at consumerfinance.gov/complaint is that it forwards the complaint to the named company and asks the company for a response, which is why a workable mailing address is a requirement rather than a formality. A complaint is not a claim, and the process produces a company answer rather than a determination or an award.

The Bureau writes regulations under the eighteen enumerated consumer laws and under title X itself, publishing them in title 12, chapter X of the Code of Federal Regulations. Where an institution is above the asset line, the Bureau examines it and can bring enforcement actions itself. Where it is below, the Bureau's regulations still apply, the prudential regulator examines and enforces, and the Bureau's route is a referral. For non-bank consumer finance companies, such as mortgage servicers, payday lenders and larger debt collectors, the asset line does not apply and the Bureau supervises directly under separate provisions of title X.

For a consumer, the practical sequence is that a substantive right comes from one of the eighteen statutes or its regulation, and the Bureau is one of the places to raise a failure to honor it. A complaint at consumerfinance.gov is forwarded to the company, which is asked to respond. That runs alongside, and does not replace, whatever the statute itself provides, which is usually a private right of action with its own deadline. Filing a complaint does not stop those deadlines running.

This is a public agency rather than a product, so what follows is what its structure does and does not deliver for a consumer.

What the structure gives

• One agency writes the rules across eighteen statutes, so a mortgage, a credit card and a debt collector are governed by regulations drafted to fit together.
• The Bureau's regulations bind institutions of every size, so a small bank's customer has the same substantive rights as a large bank's.
• A single public complaint route covers products that were previously spread across several agencies.
• Regulations arrive with published official commentary, which is often the only place a statutory phrase is worked out in enough detail to apply.

What the structure does not give

• Below the $10 billion asset line the Bureau cannot enforce; the prudential regulator has exclusive authority, and the consumer's route runs through that regulator instead.
• Two Fair Credit Reporting Act sections sit outside the Bureau's authority entirely, so "the CFPB handles credit reporting" is not true across the board.
• A complaint produces a company response, not a decision, an award, or an investigation.
• The Bureau's authority does not include the Federal Trade Commission Act, so conduct that is unfair but outside the eighteen statutes may be somebody else's problem.
• Enforcement priorities and published guidance can change without any change to the underlying statutes and regulations, so the practical picture and the legal one are not the same thing.