What the CFPB Regulates: Mortgages, Credit Cards, and More

The Consumer Financial Protection Bureau (CFPB) is a federal agency created in 2010 that has authority over consumer financial products and services—including mortgages, credit cards, payday loans, student loan servicing, and debt collection. What the CFPB regulates depends on the type of product, the size of the firm providing it, and whether it falls under the agency’s specific mandate, which explicitly excludes activities like insurance underwriting and securities trading.

The CFPB’s Scope and Founding Mission

Congress created the CFPB under the Dodd-Frank Act following the 2008 financial crisis, tasking it with regulating unfair, deceptive, or abusive acts and practices (UDAAP) in consumer finance. Unlike bank regulators that focus on safety and soundness, the CFPB’s singular focus is consumer protection—whether a lender is profitable or well-capitalized is not the agency’s concern.

The Bureau has authority over “consumer financial products and services”—a deliberately broad term that captures lending, credit reporting, money transmission, savings vehicles, and related services. What it does not regulate is equally important: it has no jurisdiction over insurance, securities products, or real estate transactions themselves (though it regulates mortgage lending).

Mortgages and Mortgage Servicing

The CFPB’s largest regulatory footprint sits in residential mortgage lending. All mortgage originators—banks, nonbank lenders, credit unions, and mortgage companies—must comply with CFPB rules on origination, disclosure, servicing, and loss mitigation. Key rules include the Real Estate Settlement Procedures Act (RESPA), Truth in Lending Act (TILA), Equal Credit Opportunity Act (ECOA), and Fair Housing Act (FHA) rules enforced by the CFPB.

Mortgage servicers—companies that collect payments and handle escrow, forbearance, and modifications—face particularly intense CFPB oversight. The agency has sued major servicers for violating loan modification procedures and escrow accounting rules. Even mortgage-backed securities servicers, who handle cash flows on behalf of investors, operate under CFPB examination authority if they service residential mortgages.

Credit Cards and General-Purpose Prepaid Cards

Credit card issuers and networks fall squarely under CFPB authority. The agency enforces the Truth in Lending Act (Regulation Z), Safeguards Rule (data security), and anti-discrimination rules. It also polices marketing claims, credit limit changes, penalty fees, and billing error procedures.

General-purpose prepaid cards (gift cards, payroll cards, reloadable travel cards) are also covered, though the CFPB exempts certain cards like store-branded or closed-loop cards that work at one merchant. The distinction matters: a Visa prepaid card is regulated; a GameStop gift card is not.

Payday Loans and Installment Loans

The CFPB regulates payday lenders, title lenders, and online installment loan companies—industries known for high-cost, short-term borrowing. Payday lenders must comply with TILA disclosures and cannot engage in unfair debt collection practices. The CFPB has proposed rules (currently under review) that would limit payday loan rollovers and require ability-to-repay underwriting.

Personal installment loans from fintech and online lenders also fall under CFPB authority if they offer credit to consumers.

Student Loan Servicing

The CFPB regulates student loan servicers, not the Department of Education’s direct loan program itself. Servicers of federal and private student loans must follow CFPB rules on disclosure, billing, interest rate calculations, and loss mitigation (income-driven repayment plans, deferments). The agency has brought enforcement actions against major servicers for mishandling forbearance requests and miscalculating balances.

Debt Collection

The CFPB enforces the Fair Debt Collection Practices Act (FDCPA), which prohibits harassment, false statements, and unfair practices by debt collectors. It also regulates the growing field of debt buying and resale. The agency has taken action against collectors for using robocalls, threats, and litigation abuse.

Check Cashing, Money Transmission, and Payment Processing

The CFPB oversees check cashers, money transmitters (wire services, remittance companies), and payment processors if they offer services to consumers. A MoneyGram or Western Union outlet must comply with anti-money-laundering rules and disclosure requirements overseen by the CFPB.

Firms and Transactions Outside CFPB Authority

Several important financial activities and firms escape CFPB jurisdiction:

Banks and bank regulators: Community banks under $10 billion in assets that are federally chartered or FDIC-insured are examined by the Federal Reserve, Office of the Comptroller of the Currency (OCC), or FDIC, not the CFPB. Only institutions over $10 billion face CFPB examination.

Insurance: The CFPB has no authority over insurance underwriting, premium-setting, or claims. Homeowner’s insurance, auto insurance, and life insurance are regulated by state insurance commissioners.

Securities and investment advice: Brokerages, investment advisors, and securities trading fall under the Securities and Exchange Commission and FINRA. The CFPB does not regulate stock picking or mutual fund fees.

Merchant banking and real property transactions: Banks engaged in merchant banking (acting as a principal in business investments) and real estate transactions themselves (appraisals, title services) are outside CFPB scope, though mortgage lending is not.

Small creditors: Creditors with less than approximately $10 million in annual consumer credit activity are exempt from CFPB examination, though they still must follow substantive rules (like TILA).

Examination and Enforcement

The CFPB examines covered entities—banks, nonbanks, and servicers—for compliance with consumer financial laws. It also conducts “supervisory guidance” reviews, issues regulatory guidance, and publishes annual compliance reports. When violations are found, the CFPB can issue cease-and-desist orders, seek restitution for consumers, levy civil penalties (up to $5,000 per violation), and refer cases for criminal prosecution.

The agency also has authority to declare practices “unfair, deceptive, or abusive,” which is a low bar compared to traditional “deceptive” standards and has made UDAAP a powerful enforcement lever.

State Regulator Coordination

The CFPB is not the only regulator of consumer finance; state attorneys general, state banking departments, and state-charted credit unions also have concurrent authority. The CFPB may coordinate with state enforcers or defer to state action if state law is at least as stringent as federal law. Some states have their own payday lending laws, foreclosure procedures, or mortgage servicing rules that exceed federal minimums; the CFPB respects those floors.

See also