CFPB Withdraws 67 Guidance Documents

May 13, 2025

By: David A. Bowen, Michael R. Schumann, and Brett J. Ashton

On May 9,2025, the Consumer Financial Protection Bureau (“CFPB”) filed a formal notice withdrawing 67 regulatory guidance documents in the Federal Register (here). The withdrawal of these various policy statements, interpretative rules, and advisory opinions (collectively, the “Withdrawal”) is effective May 12, 2025. However, the CFPB stated that the Withdrawal is not final. Further review will determine which guidance documents remain withdrawn, and the withdrawn guidance will not be enforced during this review period.

The CFPB’s stated reasons for issuing the Withdrawal are:

To align CFPB guidance with its current policy to only issue guidance when necessary and if reduces compliance burdens rather than increases them.
There is no need for the guidance to remain in place because the CFPB is reducing its enforcement activities to eliminate overlap with other federal and state regulators.
Reliance interests cannot preserve non-binding guidance, which does not create substantive rights. Unlawful guidance exceeding statutes or regulations nullifies reliance interest. If lawful, guidance should be withdrawn and reissued only if necessary to reduce compliance burdens.

Summary of Withdrawn Guidance:

Authority of States to Enforce the Consumer Financial Protection Act of 2010, 87 Fed. Reg. 31940 (May 26, 2022) – An interpretive rule describing states’ authority to pursue violations of federal consumer financial protection law, including enforcing those laws against a broader range of persons and bringing concurrent enforcement actions with the CFPB.
Circular 2022-03: Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms, 87 Fed. Reg. 35864 (June 14, 2022) - Creditors who use complex algorithms, including artificial intelligence or machine learning, in any aspect of their credit decisions must still provide a notice that discloses the specific principal reasons for taking an adverse action. A creditor cannot justify noncompliance with ECOA and Regulation B’s requirements based on the mere fact that the technology it employs to evaluate applications is too complicated or opaque to understand.
The Fair Credit Reporting Act’s Limited Preemption of State Laws, 87 Fed. Reg. 41042 (July 11, 2022) – An interpretive rule pushing states to enact more consumer reporting laws, noting that the FCRA only limits state powers if complying with both the FCRA and state law is impossible. Therefore, states can create stricter laws than the FCRA with a few exceptions.
Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information, 87 Fed. Reg. 54346 (Sept. 6, 2022) – Inadequate security for sensitive consumer information collected by a covered financial institution can constitute an unfair practice in violation of the CFPB, in addition to other federal laws governing data security for financial institutions (e.g., GLBA Safeguards rule).
Circular 2022-06: Unanticipated Overdraft Fee Assessment Practices, 87 Fed. Reg. 66935 (Nov. 7. 2022) – An assessment of overdraft fees can constitute an unfair act or practice under the Consumer Financial Protection Act (CFPA), even if the entity complies with the Truth in Lending Act (TILA) and Regulation Z, and the Electronic Fund Transfer Act (EFTA) and Reg. E.
Bulletin 2022-06: Unfair Returned Deposited Item Fee Assessment Practices, 87 Fed. Reg. 66940 (Nov. 7, 2022) – Blanket policies of charging Returned Deposited Item fees to consumers for all returned transactions irrespective of the circumstances or patterns of behavior on the account can be unfair under the CFPA.
Circular 2023-02: Reopening Deposit Accounts That Consumers Previously Closed, 88 Fed. Reg. 33545 (May 24, 2023) – It can be considered an unfair practice under the CFPA if financial institutions reopen closed deposit accounts unilaterally to process debits or deposits.
Statement of Policy Regarding Prohibition on Abusive Acts or Practices, 88 Fed. Reg. 21883 (Apr.12, 2023) – Summarizes how the CFPB analyzes the elements of abusiveness through relevant examples, with the goal of providing an analytical framework to for how to identify violative acts or practices.
Statement on Enforcement and Supervisory Practices Relating to the Small Business Lending Rule Under the Equal Credit Opportunity Act and Regulation B, 88 FR 34833 (May 31, 2023) – Informs covered financial institutions that the CFPB intends to focus on ensuring that covered lenders do not discourage small business loan applicants from providing responsive data, including responses to lenders' ECOA-mandated demographic data requests.
Consumer Information Requests to Large Banks and Credit Unions, 88 Fed. Reg. 71279 (Oct. 16, 2023) – Reminds large banks and credit unions to comply in a timely manner with consumer requests for information about their financial accounts.
Circular 2024-03: Unlawful and Unenforceable Contract Terms and Conditions, 89 Fed. Reg. 51955 (June 21, 2024) – Contract terms for consumer financial products or services can violate the prohibition against deception if federal or state law renders those terms, especially those waiving consumer rights, unlawful or unenforceable.
Circular 2024-05: Improper Overdraft Opt-In Practices, 89 Fed. Reg. 80075 (Oct. 2, 2024) – A bank or credit union can violate the EFTA and Reg. E if it lacks proof of affirmative consent for enrollment in overdraft services.

The full list of the CFPB guidance subject to the Withdrawal can be found on pages 4-10 here.

Key Takeaways:

The CFPB's withdrawal of previously issued guidance reflects its current supervision and enforcement priorities outlined in Director Voight's April 11, 2025, memorandum to CFPB staff. These priorities echo the principles of President Trump's rescinded Executive Order 13891, emphasizing that regulatory guidance should not create new legal obligations, be issued only when necessary and reduce compliance burdens. Agencies should follow formal procedures, such as notice-and-comment rulemaking, as required by the Administrative Procedure Act.

Financial institutions should not make any changes to their compliance efforts until the CFPB’s review of the withdrawn rules are complete. Krieg DeVault’s Financial Institutions attorneys continue to monitor developments and are able to assist your institution or company with financial regulatory matters.

Disclaimer: The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have.

Practices & Industries

Practices

Industries

May 13, 2025

By: David A. Bowen, Michael R. Schumann, and Brett J. Ashton

To align CFPB guidance with its current policy to only issue guidance when necessary and if reduces compliance burdens rather than increases them.
There is no need for the guidance to remain in place because the CFPB is reducing its enforcement activities to eliminate overlap with other federal and state regulators.
Reliance interests cannot preserve non-binding guidance, which does not create substantive rights. Unlawful guidance exceeding statutes or regulations nullifies reliance interest. If lawful, guidance should be withdrawn and reissued only if necessary to reduce compliance burdens.

Summary of Withdrawn Guidance:

Authority of States to Enforce the Consumer Financial Protection Act of 2010, 87 Fed. Reg. 31940 (May 26, 2022) – An interpretive rule describing states’ authority to pursue violations of federal consumer financial protection law, including enforcing those laws against a broader range of persons and bringing concurrent enforcement actions with the CFPB.
Circular 2022-03: Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms, 87 Fed. Reg. 35864 (June 14, 2022) - Creditors who use complex algorithms, including artificial intelligence or machine learning, in any aspect of their credit decisions must still provide a notice that discloses the specific principal reasons for taking an adverse action. A creditor cannot justify noncompliance with ECOA and Regulation B’s requirements based on the mere fact that the technology it employs to evaluate applications is too complicated or opaque to understand.
The Fair Credit Reporting Act’s Limited Preemption of State Laws, 87 Fed. Reg. 41042 (July 11, 2022) – An interpretive rule pushing states to enact more consumer reporting laws, noting that the FCRA only limits state powers if complying with both the FCRA and state law is impossible. Therefore, states can create stricter laws than the FCRA with a few exceptions.
Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information, 87 Fed. Reg. 54346 (Sept. 6, 2022) – Inadequate security for sensitive consumer information collected by a covered financial institution can constitute an unfair practice in violation of the CFPB, in addition to other federal laws governing data security for financial institutions (e.g., GLBA Safeguards rule).
Circular 2022-06: Unanticipated Overdraft Fee Assessment Practices, 87 Fed. Reg. 66935 (Nov. 7. 2022) – An assessment of overdraft fees can constitute an unfair act or practice under the Consumer Financial Protection Act (CFPA), even if the entity complies with the Truth in Lending Act (TILA) and Regulation Z, and the Electronic Fund Transfer Act (EFTA) and Reg. E.
Bulletin 2022-06: Unfair Returned Deposited Item Fee Assessment Practices, 87 Fed. Reg. 66940 (Nov. 7, 2022) – Blanket policies of charging Returned Deposited Item fees to consumers for all returned transactions irrespective of the circumstances or patterns of behavior on the account can be unfair under the CFPA.
Circular 2023-02: Reopening Deposit Accounts That Consumers Previously Closed, 88 Fed. Reg. 33545 (May 24, 2023) – It can be considered an unfair practice under the CFPA if financial institutions reopen closed deposit accounts unilaterally to process debits or deposits.
Statement of Policy Regarding Prohibition on Abusive Acts or Practices, 88 Fed. Reg. 21883 (Apr.12, 2023) – Summarizes how the CFPB analyzes the elements of abusiveness through relevant examples, with the goal of providing an analytical framework to for how to identify violative acts or practices.
Statement on Enforcement and Supervisory Practices Relating to the Small Business Lending Rule Under the Equal Credit Opportunity Act and Regulation B, 88 FR 34833 (May 31, 2023) – Informs covered financial institutions that the CFPB intends to focus on ensuring that covered lenders do not discourage small business loan applicants from providing responsive data, including responses to lenders' ECOA-mandated demographic data requests.
Consumer Information Requests to Large Banks and Credit Unions, 88 Fed. Reg. 71279 (Oct. 16, 2023) – Reminds large banks and credit unions to comply in a timely manner with consumer requests for information about their financial accounts.
Circular 2024-03: Unlawful and Unenforceable Contract Terms and Conditions, 89 Fed. Reg. 51955 (June 21, 2024) – Contract terms for consumer financial products or services can violate the prohibition against deception if federal or state law renders those terms, especially those waiving consumer rights, unlawful or unenforceable.
Circular 2024-05: Improper Overdraft Opt-In Practices, 89 Fed. Reg. 80075 (Oct. 2, 2024) – A bank or credit union can violate the EFTA and Reg. E if it lacks proof of affirmative consent for enrollment in overdraft services.

The full list of the CFPB guidance subject to the Withdrawal can be found on pages 4-10 here.

Key Takeaways: