Why the CFPB’s dormant authority put fintech partners on the exam calendar

The week

For years, a fast-growing fintech could reasonably tell its board that federal consumer examiners were a problem for someday. That changed on April 25, 2022.

That day, the Consumer Financial Protection Bureau announced that it would start using a largely unused provision of the Dodd-Frank Act. Dodd-Frank is the sweeping 2010 law that rewrote much of US financial regulation. This particular clause, section 1024(a)(1)(C), lets the bureau supervise a nonbank company. A nonbank is any firm that offers financial products without holding a bank charter: a lending app, a payments startup, a loan servicer.

Supervision is not the same as enforcement. Enforcement is the regulator suing a company after something has gone wrong. Supervision is closer to a standing audit relationship: examiners visit, ask for documents, interview staff and test whether the company is following consumer protection law, before anything blows up.

The bureau is the federal agency created after the 2008 financial crisis to police how companies treat people who borrow, pay and save. The provision lets it examine a nonbank when it has reasonable cause to determine that the company’s conduct poses risks to consumers. The company first gets notice and a chance to respond. The bureau’s announcement listed the kinds of information that could supply reasonable cause: consumer complaints, judicial opinions, administrative decisions, whistleblowers, state and federal partners, and news reports. The conduct it had in mind included potentially unfair, deceptive or abusive acts or practices and other possible violations of federal consumer financial law.

On paper, the power was not new. The bureau had written a procedure for using it in 2013, a short procedural rule describing the notice, the response and the decision. What was new was the intent: the bureau had never actually used the procedure to bring a nonbank under supervision, and now it said it would. Its announcement also observed that many nonbanks operating nationally branded themselves as fintechs, a clear signal to an industry that had grown up largely outside the examination system.

The same day, the bureau amended its procedural rule so that it could publish all or part of a final designation decision. If the bureau decided a company should be supervised, it could now say so publicly and explain why. The company would get a chance to comment on what was released. The bureau took public comments on that change and finalized a revised version in November 2022, clarifying the standard for deciding what to release.

The amendment reversed a default. Under the 2013 procedure, designation decisions had been treated as confidential supervisory information. A company could be brought under supervision without its customers, competitors or investors hearing about it from the bureau. The change applied to final decisions and orders, so a company that answered a notice well and was not designated would have nothing published at all. That gave firms a fresh reason to take the response stage seriously.

How the move fit the bureau’s agenda

The announcement did not arrive out of nowhere. Rohit Chopra had taken office as director in October 2021, and the bureau had already turned its attention to new kinds of consumer finance. That same October it ordered several large technology firms to provide information about their payment businesses. In December 2021 it sent similar orders to five buy now, pay later lenders. Both were market monitoring exercises, which gather information but carry no examination.

Designation filled a gap those inquiries could not. Market monitoring tells a regulator how a product works across an industry. Supervision lets examiners test how one company actually treats its customers, file by file. Before April 2022, the bureau’s examination reach over nonbanks depended almost entirely on product categories Congress had named and on size thresholds the bureau had set by rule.

Those categories were narrower than most outsiders assumed. The bureau supervised all mortgage companies, payday lenders and private student lenders regardless of size. It supervised "larger participants" in consumer reporting, debt collection, student loan servicing, international money transfers and auto financing once they crossed thresholds in its rules. It also supervised banks and credit unions with more than 10 billion dollars in assets. A fintech offering installment loans, earned wage access, a digital wallet or a novel savings feature could fall outside all of those.

Taken together, the two moves changed the question fintech leaders had to answer. Beyond "what kind of company are we?", they now had to ask "what does our conduct look like from the outside, and could we prove it is sound?"

Before this announcement, a nonbank’s exposure to federal consumer supervision depended mostly on what it was. Mortgage companies, payday lenders and private student lenders were supervised by category. Larger participants in certain markets, such as consumer reporting and debt collection, were supervised once they crossed a size threshold defined by rule. A fast-growing fintech offering a new kind of credit or payment product could fall between those categories for years.

The revived authority changed the trigger from category to conduct. A company could now be examined because of what it did and what consumers complained about, regardless of charter or size. The difference is like that between a building inspector who visits every restaurant over a certain size and one who visits any kitchen that neighbors report for smoke. The second kind of inspector can show up at a small, new place, and the trigger is something the owner partly controls.

Writing a larger participant rule takes a formal rulemaking, with a proposal, public comment and a final rule. It can take a year or more and covers a whole market. Designation works one company at a time and needs no rulemaking at all. That made it the bureau’s fastest route to examining a firm whose product did not fit an existing category.

That shift touched three groups in different ways: the signal that starts a designation, the fintech that might receive one, and the bank that sponsors the fintech’s product. The sections below define the terms, take each group in turn, then trace the costs, compare two companies and end with tests a board can apply.

Five terms behind the story

A few terms make the rest of the story easier to follow.

Fintech. Short for financial technology. In practice it means companies, often venture-backed, that deliver lending, payments, savings or investing mainly through apps and websites rather than branches. Many are software companies first and financial companies second, at least culturally. Their release cycles, hiring and board conversations reflect that, which matters once examiners start asking for evidence.

Sponsor bank. Many fintechs do not hold a bank charter of their own. Instead they partner with a licensed bank that holds the customer accounts or makes the loans, while the fintech designs the product, runs the app and handles marketing. The customer often sees only the fintech’s brand. The bank’s name sits in the fine print. Many sponsor banks are community banks under 10 billion dollars in assets, which places their own consumer compliance with their prudential regulator rather than with the bureau.

Compliance management system. Despite the name, this is not a piece of software. It is the whole set of habits, people and records a company uses to make sure it follows the law. Examiners usually break it into two halves. The first is oversight: what the board and senior management know, decide and fund. The second is the program itself: written policies and procedures, training, monitoring and testing, complaint management and an independent compliance audit. Examiners use the phrase constantly, and it is the frame through which they look at everything else.

Designation. The formal decision, under this provision, that a particular nonbank will be supervised. The process starts with a notice of reasonable cause that describes the conduct and the information behind it. The company can respond in writing and ask for a supplemental oral response. It can also consent to supervision without contesting the notice. If it contests, the bureau’s director makes the final decision. A designated company could later petition to end supervision, though not until two years after the order. After the April 2022 rule change, the decision could be made public in whole or in part, with the company able to comment on what was released.

Complaint portal. The bureau runs a public website where consumers can submit complaints about financial companies. Complaints submitted there are routed to the company for a response and tracked. Companies are generally expected to respond within 15 days and to close most complaints within 60. The bureau also publishes complaint data in a searchable public database, with the consumer’s narrative included when the consumer agrees. That routing puts each complaint in front of the company and leaves a tracked record of how it responded.

The signal: complaints as an early warning

The statute ties designation to reasonable cause, and the bureau said complaints are one source of it. That made complaint data more consequential than many fintech leaders had assumed. Complaints submitted through the bureau’s portal are routed to the company and tracked. A pattern in them is visible to the regulator before any examiner arrives.

The regulator is reading the same mail the company is, and may be reading more of it. If a loan app has a recurring problem, say customers repeatedly charged a fee they did not expect, the bureau can see the cluster forming. By the time a notice letter arrives, the evidence has been accumulating for months.

How a pattern becomes reasonable cause

Complaints were one item on a longer list. The bureau also named court opinions, administrative decisions, whistleblowers, information from state and federal partners, and news reports. Those sources tend to reinforce each other. A state attorney general’s settlement, a cluster of portal complaints and a former employee’s tip about collection practices tell a stronger story together than any one does alone.

State regulators matter more here than many founders realized. A lender licensed in dozens of states is examined by many of them, and state findings can travel. Several states have their own consumer complaint channels. California’s 2020 consumer financial protection law gave its financial regulator broader authority over providers that had previously been unlicensed. A fintech that treated each state inquiry as a separate nuisance was missing the way those signals could add up in Washington.

The designation threshold is also low by design. Reasonable cause to determine that conduct poses risks is not a finding that the company broke the law. The bureau stressed that point when it later published decisions. A company can be entirely compliant and still be designated if the signals suggest risk, which is exactly why the quality of its own evidence matters.

Running complaints as a risk program

For a fintech, the practical response was to treat its complaint stream as a supervisory input, not a customer service queue. That meant classifying complaints by product and issue, tracking root causes, and reporting trends to management with the same seriousness as fraud losses. It also meant counting complaints that arrive through every channel, including app store reviews, social media and the sponsor bank’s own contact center. A company that only counts tickets in its help desk tool will see a smaller problem than the regulator sees.

A workable program has a few concrete parts:

• A written definition of a complaint broad enough to include expressions of dissatisfaction that agents resolve on the first call, as well as formal written grievances.
• A taxonomy shared with the sponsor bank, so both parties code the same issue the same way.
• Rates rather than raw counts, normalized per thousand active accounts or per transaction volume, so growth does not masquerade as deterioration.
• A compliance review of any complaint that alleges discrimination, a misleading disclosure, an unauthorized charge or abusive collection, regardless of how the agent coded it.
• A monthly report to senior management, and a quarterly one to the board, showing the top root causes and the fixes made.

Ownership matters as much as tooling. Customer support usually owns the queue, but it is measured on speed and satisfaction, not legal risk. A workable split gives support ownership of intake and resolution, gives compliance ownership of the taxonomy and the legal review, and gives product owners responsibility for fixing root causes in their area. Internal audit then tests the whole chain once a year by sampling complaints from each channel and tracing them to their resolution.

The evidence an examiner would ask for follows from that split: the complaint policy, the taxonomy and its change history, samples of complaints with their resolutions, the management reports, and minutes showing that leaders discussed them and assigned fixes. A company that can produce those within days of a request is showing the oversight half of its compliance system, rather than claiming it.

Suppose a payments app logs forty support tickets a month about delayed refunds and considers that manageable. Meanwhile, frustrated customers are also posting one-star reviews about the same delays, calling the partner bank’s hotline, and filing complaints through the federal portal. Each channel looks small on its own. Added together, and viewed from outside, they look like a pattern of consumer harm. Its leadership is managing a number that is smaller than the one that matters.

What the signal can and cannot show

Complaint data has real limits, and fintech leaders were right to point them out. Volumes rise with customer counts, so a fast-growing company will see more complaints even if its products are improving. Some customers file portal complaints as a faster route to service. Others use them to contest debts they owe. A raw count says little without context.

Those objections argue for better analysis, not for ignoring the data. Some companies can show their complaint rate per thousand accounts falling, explain the spike after a product launch, and separate service frustration from legal risk. They are in a far stronger position than those that dismiss the numbers. Regulators read complaints with context too. The company that supplies it first shapes how the pattern is read.

The signal works in the other direction as well. Companies that resolve complaints quickly and fix the causes leave a record that weakens any claim of risk. The same data that could start a designation is the best evidence against one. One company can say it saw an issue in March, traced it to a change in its refund logic, fixed it in April and contacted affected customers. That company is telling a story of control, not of risk.

The fintech: building a compliance system before scale

Supervision asks a company to show its work. Examiners look for a compliance management system: board and management oversight, written policies, training, monitoring and testing, complaint management and an independent audit. Banks have run these for decades. Many venture-backed fintechs in 2022 had a general counsel, a small compliance team and a product roadmap that moved faster than either.

The gap was rarely bad intent. It was missing evidence. A product team might change a fee disclosure in a sprint without a compliance sign-off recorded anywhere. Marketing might test new loan offers without a fair lending review. Collections might be outsourced with a vendor contract that said nothing about call recording or dispute handling. Each is common in a startup, and each is a finding in an exam.

A word on two of those terms. A sprint is the short work cycle, often two weeks, that software teams use to plan and ship changes; it is built for speed, which is its virtue and its risk. A fair lending review checks whether a credit offer, its pricing or its marketing could treat people differently on the basis of race, sex, age or other protected characteristics, even unintentionally. Running a quick marketing test that sends better offers to some neighborhoods than others can create exactly that problem without anyone meaning it to.

What an examination asks for

An exam usually begins with a written information request, sent weeks before examiners arrive. It asks for organization charts, board and committee minutes, policies and procedures, training records, complaint logs, audit reports, vendor contracts, marketing samples and transaction-level data for testing. The examiners then interview staff, test samples of accounts against the rules and compare what the policies say with what the files show.

Findings are communicated in a written report. Serious ones come with required corrective action and deadlines, and the bureau can refer the worst to its enforcement staff. The report and its findings are generally confidential supervisory information. That limits what a company can share with investors, partners or the press without the bureau’s permission, a constraint that surprises many founders. The rules on sharing are specific, and a company should check them with counsel before it tells anyone what examiners found.

Exam readiness has concrete parts:

• A change management process that records compliance approval for any customer-facing change.
• A complaint system that links each complaint to a resolution and a root cause.
• Vendor oversight files for collectors, call centers and marketing partners.
• Records retention that can reproduce what a customer saw on a given date.

That last item deserves emphasis because it surprises many executives. Apps change constantly. The screen a customer saw when agreeing to a loan in February may have been redesigned twice by June. If an examiner asks what the fee disclosure looked like on February 14, the company needs to be able to answer precisely, not reconstruct it from memory. In a bank this is routine. In a startup that ships updates weekly, it has to be designed in.

The legal floor is concrete too. The rules implementing the Truth in Lending and Electronic Fund Transfer Acts generally require creditors and account providers to keep evidence of compliance for two years. The Equal Credit Opportunity Act’s rules require keeping credit application records for 25 months. A company that versions its disclosure screens, stores them with effective dates and links each customer agreement to the version shown can meet those obligations without heroics.

Different products, different exposure

The authority did not land evenly across the industry. A firm already supervised by category, such as a mortgage lender or a payday lender, gained little new exposure, because examiners could already reach it. The change mattered most for firms whose products fit no existing category.

A consumer installment lender outside the payday category faced questions under the Truth in Lending Act on cost disclosures and under fair lending law on pricing and approvals. If it reported to credit bureaus, the Fair Credit Reporting Act applied too. A payments app or digital wallet faced error resolution and unauthorized transfer rules under the Electronic Fund Transfer Act. Earned wage access and buy now, pay later providers faced a different problem: in 2022 it was still unsettled how far existing credit rules applied to them. Each type needed a different testing plan, and a generic compliance policy would not have satisfied any of them.

The sponsor bank relationship also shaped exposure. Where the bank was the lender of record, many disclosures and credit decisions were legally the bank’s, even if the fintech built them. Where the fintech lent under its own state licenses, the fintech owned those obligations directly. Knowing which applied to each product, and documenting it, was part of readiness.

The case for waiting, and why it was weak

Founders had arguments for deferring this work. Controls slow releases and cost scarce engineering time. The sponsor bank already ran a compliance program, and many fintechs assumed it covered them. The bureau had never used the authority, and might not use it much. A startup that spent heavily on compliance infrastructure before finding product-market fit could fail for ordinary commercial reasons first.

Some of that held up. The authority was used sparingly, as the hindsight below shows, and many fintechs never received a notice. But the argument mistook the audience. The same evidence examiners would want, sponsor banks were starting to require under their own supervisory pressure, state regulators asked for in licensing exams, and investors requested in diligence. A fintech building records for the bureau was building them for everyone else at the same time.

Building these at fifty employees is cheaper than retrofitting them at five hundred under examination. The trade-off is speed. Every control adds some friction to product release, and founders need to decide where that friction is worth it. A sensible answer is to concentrate controls where consumers are directly affected, such as pricing, fees, disclosures, collections and credit decisions, and to keep lighter processes for internal tools and cosmetic changes.

Sequencing the build

A fintech starting from little can sequence the work so the first steps carry the most weight. In the first quarter, it can name an accountable compliance owner who reports to the chief executive, write down which laws apply to each product, and start recording approvals for customer-facing changes. Those three steps cost little and create evidence immediately.

In the next two quarters, it can consolidate complaint channels into one system, agree a taxonomy with the sponsor bank, and begin versioning disclosure screens with effective dates. It can also review its main vendor contracts, starting with collections and customer support, for audit rights, call recording and dispute handling. By the end of the first year, it can commission an independent compliance review, from an outside firm or a qualified internal audit function, and report the results to the board.

The order matters because examiners read a company’s history. A program that started recording decisions a year before a notice arrived shows a pattern. One that started the week after shows a reaction.

The sponsor bank: diligence on a partner’s exam readiness

Many fintech products reach consumers through a bank partner that holds the accounts or originates the loans. The bank is already examined by its prudential regulator, the agency responsible for its safety and soundness, and it remains responsible for consumer compliance on products offered under its charter. The revived authority added a second possibility: the fintech partner itself could be supervised directly by the CFPB.

Who examines whom

The answer depends on the bank. A bank or credit union with more than 10 billion dollars in assets is supervised by the bureau for federal consumer financial law. Below that line, consumer compliance is examined by the prudential regulator: the OCC for national banks, the Federal Reserve or the FDIC for state banks, depending on membership, and the NCUA for federal credit unions, alongside state regulators. The bureau could already examine some service providers to the large institutions it supervises.

Most sponsor banks in 2022 sat below the 10 billion dollar line. Their consumer compliance examiners came from the prudential regulator, while their fintech partners could now draw a separate set of examiners from the bureau. Two sets of examiners might look at the same product from different angles, with findings neither party fully controlled. A bank that did not know what its partner was telling the bureau, or what the bureau was asking, could be surprised by conclusions about its own product.

Credit unions faced a variation. Many partnered with fintechs through credit union service organizations or direct vendor arrangements. Unlike the bank regulators, the NCUA has long lacked authority to examine credit union vendors directly, and it has repeatedly asked Congress for that power. A credit union therefore leaned even harder on its own contract rights to see inside a partner’s operations, because its regulator could not easily do it for them.

Data, not summaries

For the bank, that raised the stakes of partner diligence. If a partner’s complaint pattern was serious enough to draw a designation, the bank would want to have seen it first. Oversight programs needed access to the partner’s full complaint data, not a monthly summary. They needed the right to review the partner’s compliance management system and test it. And they needed contract terms that required the partner to notify the bank promptly of any regulatory inquiry or designation notice.

The difference between a summary and full data is not a technicality. A monthly summary is written by the partner, which has every incentive to present its numbers kindly. Raw complaint records let the bank’s own team spot the clusters, read the words customers actually used, and ask why a category grew. A bank that only reads summaries has outsourced its judgment.

Contract terms that do the work

Program agreements written in the 2010s often focused on revenue share, technology and marketing approval. The designation authority exposed gaps. Terms worth negotiating included:

• A feed of complaint records at the individual level, coded to a shared taxonomy, delivered on a fixed schedule.
• Audit and testing rights over the partner’s compliance program, including the right to sample files and listen to collection calls.
• Notice of any regulatory inquiry, information request or notice of reasonable cause within a set number of business days.
• A process for handling confidential supervisory information, since neither party may freely share what its own examiners found.
• Prior approval of customer-facing changes to pricing, fees, disclosures and marketing on products under the bank’s charter.
• Termination and wind-down provisions that protect customers if the program has to end quickly.

None of those terms is novel in banking. What changed was the urgency. A partner under bureau supervision could face findings, required remediation and possibly public attention on a schedule the bank did not set.

Watching the whole portfolio

Banks also had to think about concentration. A sponsor bank with many fintech programs could find several partners under scrutiny at once if the bureau focused on a product type, such as earned wage access or buy now, pay later. Earned wage access lets workers draw pay they have already earned before payday; buy now, pay later splits a purchase into a few installments at checkout. Both were growing quickly and both raised fresh questions about fees and disclosures. Partner risk ratings that included complaint trends and regulatory attention, reviewed by the bank’s risk committee, gave the board a view across the portfolio.

A useful partner rating combines a few measures the bank already collects: complaint rate and trend, the share of complaints alleging legal issues, open audit findings, the partner’s own regulatory contacts, and how quickly it delivers requested data. A partner that is slow to produce data is telling the bank something about how it would fare under examination.

The publication change mattered here as well. A public designation would name the company and describe the risks found. For a bank, that is reputational exposure by association. Contracts that set out how the parties would handle a public regulatory action, including communications and possible program changes, were worth negotiating in advance. Whether such provisions fit a sponsor bank’s own supervisory obligations is a question for its lawyers.

Costs that land outside the compliance team

A designation notice can slow a sponsor bank’s new launches, prompt hard questions from investors and turn a complaint pattern into a news story.

Money. Supervision consumes time from senior people, requires document production on deadlines and often leads to remediation work, such as refunds to affected customers or system changes. The cost of building controls early is real, but it is predictable. The cost of building them while under examination is higher and arrives on someone else’s schedule.

Management attention. A designation response is drafted by lawyers but rests on facts only operators know. Product leads, the head of customer support and the engineering owner of the disclosure screens all end up assembling evidence. In a company of a hundred people, that can stall a roadmap for weeks. A company with organized records spends those weeks retrieving files rather than reconstructing history.

Growth and partners. A fintech’s ability to grow depends on its sponsor bank’s willingness to keep the program running. A bank that sees a rising complaint pattern, or receives word of a designation notice, may slow new launches or tighten terms. Exam readiness is therefore also partner readiness. Banks facing their own supervisory pressure tend to pass costs along, through higher program fees, larger reserve requirements or minimum compliance staffing written into the agreement.

Investors. Venture and growth investors increasingly ask the same questions examiners do, because regulatory trouble can stall a company’s plans. A clean, well-documented compliance program supports a company’s value. A messy one becomes a discount. Acquirers, especially banks buying fintechs, run their own consumer compliance diligence, and gaps found late can reprice or end a deal.

Reputation. Once designation decisions could be published, a supervisory matter that might once have stayed between the company and its regulator could become a news story. For a brand that depends on consumer trust, that is a material risk.

Customers and staff. The underlying point of the authority is consumer protection. Complaint patterns are people having a bad time with a product. Fixing root causes improves the product, reduces support costs and makes frontline staff’s jobs easier. Good compliance and good customer experience usually point in the same direction.

The costs also fall unevenly. A large fintech with a mature compliance team absorbs an examination as one more workstream. A small one with a single compliance officer may find the response consumes most of that person’s year. That asymmetry is one reason the authority’s critics argued it favored incumbents, a fair point about burden that does not change what a well-run company should keep on file.

Two fintechs that look alike until an examiner asks

Suppose two fintechs are at the same stage, each with around a hundred employees and a bank partner.

The first, a small-dollar lending app, has a compliance lead who sits in product planning meetings. Every change to pricing, fees or disclosures goes through a short approval step that is recorded automatically in the team’s workflow tool. Complaints from every channel flow into one system, each tagged with a product, an issue and a root cause. Once a month, the leadership team reviews the top five root causes and what has been done about them. Screenshots and copies of every version of customer-facing terms are archived with dates. When its sponsor bank asks for complaint data, it sends the raw file the same day.

The second has talented people and good intentions but no such system. Compliance reviews happen when someone remembers to ask. Complaints live in three places, and nobody adds them up. The collections vendor’s contract is a two-page template. When the bank asks for complaint data, the team spends a week assembling a slide deck.

Now send each a notice of reasonable cause describing a pattern of complaints about unexpected fees. The first company pulls the complaint records, shows the root cause it found, the date of the fix, the disclosure versions before and after, and the refunds it made. Its response may not avert supervision, but it frames the company as one that finds and fixes problems, and it may well choose to consent and treat the exam as routine. The second spends the response period trying to establish what its own fee screen said a year earlier.

Neither company has necessarily broken any law. But only the first can prove what it did and why. In an examination, that is most of the game.

The second company’s gaps are typical. On the fintech side, the familiar ones are:

• Treating complaints as a customer service metric rather than a risk signal, so the board never sees them.
• Counting only one channel and missing the larger picture the regulator sees.
• Letting product changes ship without a recorded compliance decision, even when the review actually happened in conversation.
• Outsourcing collections, call centers or marketing without contract terms and monitoring that cover consumer protection.
• Assuming that because the bank partner is regulated, the fintech is covered.

Banks had their own recurring gaps:

• Accepting summarized complaint reports from partners instead of underlying data.
• Diligence that is thorough at onboarding and thin afterward.
• Contracts silent on regulatory inquiries, notification timelines and public communications.
• Looking at each partner in isolation and missing concentration in a single product type.

Across all three groups, the authority rewarded the same habit. Keep the evidence an examiner would ask for, whether or not one is coming, because partners, investors and other regulators ask for much of the same evidence anyway.

Five tests of exam readiness

For a fintech:

• How many complaints did we receive last quarter across every channel, including app stores, social media, the federal portal and our bank partner’s contact center? Who adds them up?
• If an examiner asked what our fee disclosure looked like on a specific date last year, could we pull up the exact version a customer saw?
• If a designation notice arrived tomorrow, who would respond, and what would we be able to show?

For a sponsor bank:

• Do we receive each partner’s full complaint data, or a summary they prepare?
• What do our contracts require partners to tell us about regulatory inquiries, and how quickly?

Each test has a natural owner. The first belongs to whoever runs customer support, with compliance checking the coding. The second belongs to the head of product and engineering, since versioning is a build decision. The third belongs to the general counsel, who should have a named response team and a document index ready. On the bank side, the partner oversight function owns the fourth, and the contract owner, often in legal or the fintech program office, owns the fifth.

These questions need no technical expertise. Each produces an answer that tells a board a great deal about whether the company can show its work. A board that asks them twice a year, and expects the answers to improve, will learn more about its consumer risk than from any single compliance report.

With hindsight

The authority was used, though less dramatically than some expected. Most companies that received notices consented to supervision rather than contesting it, the bureau later said. That detail matters: for many firms, the practical choice was not whether to be examined but how ready they were when it began.

The first public test came in February 2024. The bureau published an order, dated November 2023, placing World Acceptance Corporation, a consumer installment lender, under supervision after the company contested its designation. The bureau said the order was not a finding of wrongdoing. Notably, the first published target was a traditional storefront lender, not a fintech, a reminder that the trigger was conduct rather than technology.

The most visible case came in December 2024, when the bureau published an order, dated the previous month, placing Google’s payment unit under supervision after a contested designation, and the company sued. It was exactly the kind of public designation the April 2022 rule change had made possible, and it showed how quickly a supervisory matter could become a headline and a courtroom dispute.

The bureau also revised the procedures twice more, finalizing the publication standard in November 2022 and changing deadlines, notice contents and other mechanics in April 2024. Separately, in late 2024 it finalized a larger participant rule that would have brought big digital payment and wallet providers under supervision by category.

Then the political winds shifted. After the change of administration, Congress used the Congressional Review Act to overturn the digital payments rule, and the President signed that resolution in May 2025. The bureau withdrew both published designation orders that month, and Google’s suit was dropped. In September 2025 it finalized a rule, effective that October, rescinding most of the procedural amendments made since 2022 and restoring confidentiality to designation decisions. The publication power that had raised the reputational stakes was, for the most part, gone.

That rule also gave the clearest account of how much the authority had been used. The bureau said it had supervised fewer than 20 companies under it. Only two orders had been published, and the rest had been entered by consent. The tool was real and it reached firms, but it never became the broad sweep of the fintech sector that some had feared in 2022.

Bank-fintech arrangements drew scrutiny from other directions in the meantime. The federal banking agencies issued final interagency guidance on third-party risk management in June 2023. In April 2024 Synapse, a middleware firm that connected fintech apps to partner banks, filed for bankruptcy. Many end users could not reach their money for months while the parties disputed whose records were right. In June 2024 the Federal Reserve took an enforcement action against Evolve Bank & Trust, a Synapse partner, over its management of fintech partnerships. The banking agencies sought public comment on bank-fintech arrangements in July 2024, and the FDIC proposed recordkeeping requirements for custodial accounts that September. The pressure on the bank side of the partnership never depended on this one tool.

Synapse also proved the records argument in a way no examiner could have. When a fintech, its middleware provider and its bank cannot agree on who is owed what, customers wait. The evidence this article describes, from complaint root causes to dated records of what each customer saw and agreed to, is the same kind of evidence that would have shortened that wait.

By 2026, the federal designation route is little used. The evidence it called for, from complaint root causes to change records, is still what sponsor banks, states and investors ask fintechs to show.

Specific regulatory tools rise and fall with administrations and court cases. The underlying expectation, that a company offering financial products to consumers can demonstrate how it treats them, has proven far more durable. Firms that built their compliance evidence in 2022 because of the CFPB did not waste the effort when the CFPB stepped back; the same files now satisfy bank partners, state regulators and investors. Firms that waited for certainty are still waiting, and still exposed to the other parties who ask the same questions.