The structure is the thing worth understanding, and it has three layers.
First: there is no general federal ceiling. Rate limits on consumer credit are set by state law, and they vary by state, by the type of lender, and often by the type and size of the loan. Published material on the Truth in Lending Act makes the complementary point from the other direction: that statute regulates the information a lender must give, not the price it may charge.
Second: federal law decides which state's ceiling reaches a bank. 12 USC 85 provides that a national banking association may "take, receive, reserve, and charge on any loan or discount made, or upon any notes, bills of exchange, or other evidences of debt, interest at the rate allowed by the laws of the State, Territory, or District where the bank is located, or at a rate of 1 per centum in excess of the discount rate on ninety-day commercial paper in effect at the Federal reserve bank in the Federal reserve district where the bank is located, whichever may be the greater, and no more." Where a state fixes no rate at all, the same section supplies a fallback of 7 percent or the Federal Reserve figure, whichever is greater.
Congress then wrote the same rule for a different set of banks. 12 USC 1831d, headed "State-chartered insured depository institutions and insured branches of foreign banks", opens by saying its purpose is "In order to prevent discrimination against State-chartered insured depository institutions", and gives such a bank the ability to charge, "notwithstanding any State constitution or statute which is hereby preempted for the purposes of this section", interest at the greater of the Federal Reserve figure or "the rate allowed by the laws of the State, territory, or district where the bank is located." Two statutes, two categories of bank, one rule.
That mechanism produces a familiar result: a credit card issued by a bank headquartered in a permissive state can carry a rate the cardholder's own state forbids its local lenders to charge. The live guide to credit and debt describes the effect and the 1978 decision behind it. How far the same reasoning reaches arrangements between a bank and a non-bank lender is actively contested, and this page does not resolve it.
Third: the remedy, where it applies, is unusually harsh. 12 USC 86 provides that taking or charging a rate greater than section 85 allows, "when knowingly done, shall be deemed a forfeiture of the entire interest which the note, bill, or other evidence of debt carries with it, or which has been agreed to be paid thereon." If the excess has actually been paid, the payer "may recover back, in an action in the nature of an action of debt, twice the amount of the interest thus paid", provided "such action is commenced within two years from the time the usurious transaction occurred." 12 USC 1831d(b) gives the parallel remedy against a state-chartered insured bank, with the same two-year limit running from the date of payment. Note what is forfeited: not the excess above the ceiling, but the entire interest the instrument carries.
The federal ceilings that exist are scoped to a class, not to lending generally. The Military Lending Act's implementing regulation provides at 32 CFR 232.4(b) that "A creditor may not impose an MAPR greater than 36 percent in connection with an extension of consumer credit" to a covered borrower, meaning an active-duty servicemember or a dependent. It is a genuine cap and it is enforceable, and it says nothing at all about what may be charged to anyone else. Published material on payday loans makes the same point about the same provision.
A second one is scoped to the lender instead. 12 USC 1757(5)(A)(vi) provides that for a federal credit union "the rate of interest may not exceed 15 per centum per annum on the unpaid balance inclusive of all finance charges", and then lets the National Credit Union Administration Board set a higher ceiling for periods of up to 18 months where it determines that market rates have risen and prevailing rate levels threaten the safety and soundness of credit unions. So the operative ceiling for a federal credit union is the statutory figure unless the Board has raised it, which is why the current number is published by NCUA rather than fixed in the statute. It binds that one category of lender and nobody else.
Two things usury is not. It is not the same as criminal lending: a licensed lender that overcharges has a civil problem, while enforcing a debt by threat is a federal crime under a different chapter entirely. And it is not the same as a rate being deceptive. A disclosed, accurate, lawful rate can still be ruinous, and an undisclosed rate can be well within a state's ceiling.