If the CFPB’s funding fell, the statutes would still stand

The week

On October 19, 2022, the U.S. Court of Appeals for the Fifth Circuit decided a case called Community Financial Services Association of America v. Consumer Financial Protection Bureau. The court ruled that the way the bureau is funded violated the Constitution’s Appropriations Clause. For anyone running compliance at a mid-sized bank, the headline suggested that the main consumer regulator might not legally exist in its current form.

The Consumer Financial Protection Bureau, usually called the CFPB, writes and enforces many of the rules that govern how banks, lenders and fintechs treat consumers: what loan disclosures must say, how fees work, how complaints are handled. The Appropriations Clause is the part of the Constitution that gives Congress control of the federal purse. Most agencies ask Congress for money every year and receive it through annual spending bills, called appropriations. The CFPB does not. It draws its money from the Federal Reserve System. The Fifth Circuit concluded that this arrangement cut Congress out of a job the Constitution assigns to it.

The bureau’s funding design was deliberate. The Dodd-Frank Act of 2010, which created the CFPB, lets the director request each year the amount judged reasonably necessary, up to a cap. The cap is a share of the Federal Reserve System’s 2009 operating expenses, adjusted for inflation, and the statute set it at 12 percent. Congress chose that route to insulate the bureau from annual budget fights. Supporters saw it as a guarantee of independence. Critics saw an agency that answered to nobody on money.

The bureau had already survived one constitutional challenge. In 2020, in Seila Law v. CFPB, the Supreme Court held that the protection against removal of the bureau’s single director was unconstitutional. The Court cured the problem by making the director removable at will and left the rest of the agency intact. Many observers assumed the structural fights were over. The Fifth Circuit showed they were not.

The case itself was about payday lending, the market for small, short-term, high-cost loans. The court vacated, meaning it threw out, the payment provisions of the bureau’s payday lending rule that were at issue.

Those provisions date from the bureau’s 2017 payday rule. The bureau later rescinded the rule’s underwriting requirements in 2020, but it kept the payment provisions. They limit how often a lender can try to pull money from a borrower’s account after attempts have failed for lack of funds, and require notice before certain withdrawals. Two trade groups representing payday lenders had challenged them on several grounds. The panel rejected most of their arguments, but accepted the funding argument and used it to strike the provisions down. Its reasoning was that a rule written with unconstitutionally drawn money could not stand.

The bigger story was the shadow the ruling cast. If the bureau’s funding was unconstitutional, were its other rules and actions valid? That question hung most heavily over the Fifth Circuit’s own states of Texas, Louisiana and Mississippi, where the ruling was binding, but it rippled out everywhere.

That remedy was what alarmed the industry and the bureau alike. If a rule could be vacated because the money used to write it was drawn unlawfully, the same argument reached nearly every rule and enforcement action the bureau had ever taken. Defendants in pending enforcement cases could raise it at once. Lawyers began to ask what would happen to the mortgage rules the bureau had written after 2010, on which much of the housing finance market relied.

The bureau asked the Supreme Court to review the case, and in February 2023 the Court agreed.

The bureau filed its petition for review on November 14, 2022, asking the Court to hear the case in its current term.

That set the clock for a long wait. Meanwhile the bureau kept working: supervising, enforcing and writing rules. Banks, credit unions and fintechs were left with a practical problem that no court could solve for them in the meantime. They had to decide, rule by rule, how to treat the regulations of an agency whose funding a federal appeals court had just called unconstitutional.

Not every court agreed. In March 2023 the Second Circuit, hearing a different CFPB case, held that the funding structure was constitutional. By then the Supreme Court had already agreed to hear the Fifth Circuit case, and the split showed how open the question was. It did nothing to shorten the wait. The Court heard argument on October 3, 2023, nearly a year after the Fifth Circuit ruled.

For compliance leaders at banks, credit unions and fintechs, the ruling posed an awkward question. If the regulator’s funding was unconstitutional, did its rules still bind? The legal answer stayed open for a year and a half. The practical answer depended on which kind of CFPB action was in question, and most commentary lumped them together.

Three kinds of action faced different risks. Past actions, such as consent orders and examination findings, were already in force against specific institutions. Current rules, many resting on statutes far older than the bureau, governed daily operations. Pending rules, with compliance dates still ahead, required investment in systems that a court might make unnecessary. Each needed its own decision, made with counsel.

A regulator’s authority will be thrown into doubt again, in some form, so the habit of sorting is worth building.

Statutes, rules, orders and guidance

Consumer financial regulation in the United States works in layers, like a house built over several generations.

The foundation is statutes: laws passed by Congress. They set the basic duties, such as telling borrowers the true cost of credit or not discriminating against applicants. Statutes are often broad, so agencies write regulations, also called rules, that spell out the details: which forms, which numbers, which deadlines. Then come supervision and enforcement. Examiners visit institutions to check how they operate, and when they find problems they issue findings. Serious problems can lead to a consent order, which is a formal agreement in which an institution accepts obligations, such as refunding customers or fixing a process, usually without going to trial.

Finally there is guidance: advisory opinions, circulars and bulletins in which the agency explains how it reads the law. Guidance usually does not create new duties.

The CFPB sits across all of these layers. It writes and interprets many of the regulations, supervises larger institutions, enforces the law and publishes guidance. But it is not the only player. Prudential regulators, the agencies that oversee the overall safety and soundness of banks and credit unions, also examine institutions. State attorneys general can enforce many federal consumer protections. And for many laws, customers themselves can sue.

Who answers to whom

The layers apply differently by type of institution, which is why the ruling meant different things to different firms. The CFPB supervises banks and credit unions with more than 10 billion dollars in assets, along with their affiliates. Smaller banks are examined for consumer compliance by their prudential regulator: the Office of the Comptroller of the Currency, the FDIC or the Federal Reserve. Smaller credit unions answer to the National Credit Union Administration and state credit union regulators.

Nonbanks are a different case. The CFPB supervises mortgage lenders and servicers, payday lenders and private student lenders of any size. It also supervises the larger participants in markets it has defined by rule, such as consumer reporting, debt collection, student loan servicing, international money transfers and auto finance. For many of those firms, the CFPB is the only federal consumer examiner. State licensing agencies examine them as well, and many state laws require licensees to comply with federal consumer law.

Fintechs that partner with banks sit in between. The fintech may not be supervised by the CFPB directly, but its bank partner is examined by someone, and that examiner will look at the program. So a community bank, a large bank, a credit union, a mortgage company and a bank-partnered fintech each faced a different picture after October 19. The large bank and the nonbank lender stood to see the most change in their examinations. The community bank and the small credit union saw almost none, because the CFPB had never been their examiner.

Why the remedy mattered more than the holding

The Fifth Circuit’s choice of remedy explains the scale of the worry. A court that finds a funding defect could, in principle, order Congress to fix it, or limit its ruling to future spending. The panel instead treated the rule itself as tainted by the money used to write it. Under that theory, a defendant could argue that any regulation, examination or enforcement action paid for with the bureau’s funds was invalid. Few of those challenges would have succeeded quickly, but each would have needed a response. Compliance teams therefore could not sit out the wait for the Supreme Court and do nothing in between.

That layered structure is the key to the whole story. A ruling that threatened one agency’s funding did not knock out the foundation, or the other people holding the building up.

Past actions: orders already in force

An institution under a CFPB consent order in October 2022 might have wondered whether the ruling offered a way out. In practice it offered little. Consent orders are agreements the institution signed. Challenging one on the funding theory would mean litigation, with uncertain results and a regulator relationship damaged in the meantime. Remediation already under way, such as refunds to customers or changes to fee practices, had value regardless of the order’s fate.

Take a regional bank with a consent order requiring it to refund certain overdraft fees and rebuild how its systems decide when to charge them. Halfway through, the ruling lands. Someone on the executive team asks whether the bank can stop. Stopping would mean pausing a technology project mid-flight, leaving customers half-refunded, and inviting a fight with the bureau that could last years. Even if the bank eventually won, the fee practice that triggered the order would still look unfair to a judge, a state attorney general or a plaintiff’s lawyer. The refunds and system fixes were buying protection from all of them, the CFPB included.

The prudent course was to keep meeting order requirements, document compliance carefully and ask counsel to monitor whether the litigation opened any realistic avenue. Examination findings were similar. They described practices that other regulators, state attorneys general or private plaintiffs could also pursue. Remediating them protected the institution from those parties too.

Evidence of compliance

Documentation was the practical defense whatever happened in court. An institution under an order needed a remediation tracker showing each required action, its owner, its due date and the evidence it was done. Refund programs needed reconciliations showing who was owed what, who had been paid and how unclaimed amounts were handled. Many orders also required an independent review or a compliance plan approved by the board. Board minutes recording those approvals and the progress reports that followed were the record any later regulator or court would ask to see.

This mattered for a second reason. If the order were ever set aside, the documents would still show that the institution had fixed the problem. That record carries weight with a state attorney general deciding whether to open its own case, and with a judge weighing a class action. A bank that could show it had refunded customers and changed its systems was in a far better position than one that had paused and argued.

Defendants who were still in court

Firms that had not settled were in a different position. A company litigating against the bureau could raise the Fifth Circuit’s reasoning as a defense, and some defendants did. That was a reasonable legal tactic, and counsel would have been negligent not to consider it. It still carried trade-offs. Courts outside the Fifth Circuit were not bound by the ruling, and some stayed cases while waiting for the Supreme Court, which extended the uncertainty. A defense that depended on the Court affirming also left the company exposed if the Court reversed, which it eventually did.

Preserving a legal argument is different from stopping work. Counsel can reserve rights in correspondence and filings while the operational fixes go ahead. Most compliance officers would recognize that combination as the sound default.

Guidance sat in a gray zone. Advisory opinions, circulars and bulletins explained how the bureau read the statutes rather than creating new duties. A court ruling on funding did little to change what those readings implied about a practice. A fee the bureau had called unfair would draw the same objection from a state attorney general or a class action lawyer, so the guidance stayed a useful map of risk.

For a board, the message was steady and slightly unglamorous: commitments made are commitments kept, and the documentation proving it matters more, not less, when the legal ground is shifting.

Current rules: older than the bureau

Most consumer financial rules that institutions follow every day rest on older statutes. They include the Truth in Lending Act, the Equal Credit Opportunity Act, the Electronic Fund Transfer Act, the Real Estate Settlement Procedures Act and the Fair Credit Reporting Act. The CFPB writes and interprets many of the implementing regulations. But the statutes predate the bureau, many of the regulations were carried over from earlier agencies, and several of the statutes give consumers a private right to sue.

In everyday terms, these laws cover things a customer would recognize. The Truth in Lending Act is why a loan comes with a disclosure showing its annual percentage rate. The Equal Credit Opportunity Act prohibits discrimination in lending. The Electronic Fund Transfer Act governs debit cards, transfers and what happens when a customer disputes an unauthorized charge. The Real Estate Settlement Procedures Act covers parts of the mortgage closing process. The Fair Credit Reporting Act governs credit reports and how they are used.

Inside a bank, these rules live in technology as much as in binders on a shelf. The loan origination system, the software that takes an application from first click to signed loan, generates the required disclosures automatically. The deposit platform calculates fees and posts error-resolution credits. Turning a requirement off would mean reconfiguring systems, retraining staff and rewriting customer documents, all to remove a protection customers expect.

Suppose an institution stopped following a disclosure requirement because its regulatory source might be invalid. It would face private litigation, examination by its prudential regulator and possibly state enforcement. It would also face the risk that the Supreme Court would reverse. Prudential regulators examine banks and credit unions with total assets of 10 billion dollars or less for consumer compliance. State attorneys general can enforce many federal consumer financial protections under the Dodd-Frank Act. That enforcement did not depend on how the CFPB was funded.

Rules carried over from older agencies

The history matters here. Before 2011, rules under these statutes were written mainly by the Federal Reserve Board and other banking agencies. Dodd-Frank transferred much of that rulemaking authority to the new bureau, which republished the existing regulations under its own name. Regulation Z, which implements the Truth in Lending Act, and Regulation B, which implements the Equal Credit Opportunity Act, existed in substance long before the CFPB did. Even if every action funded by the bureau had been called into question, the requirements those regulations carried had decades of history and judicial interpretation behind them.

The newer rules were a different matter. Some of the most operationally demanding rules the bureau wrote implemented specific Dodd-Frank mandates. Examples include the integrated mortgage disclosures that replaced older closing forms, the ability-to-repay rules for mortgages and the remittance transfer rule. Others, such as the prepaid accounts rule, were the bureau’s own initiative under older statutes. If a court had vacated one of those, the question of what replaced it would have been hard. A statute that requires a disclosure without the rule that specifies the form leaves firms guessing. Counsel would have had to advise on each one separately.

Private enforcement does not wait for regulators

Private lawsuits are the part of the structure that a ruling on agency funding cannot touch. Several of the core statutes give consumers the right to sue and set out what they can recover. The Truth in Lending Act provides for actual damages, statutory damages and attorney’s fees, and it allows class actions. The Fair Credit Reporting Act allows statutory damages for willful violations, which makes class actions over technical errors attractive to plaintiffs’ firms. The Equal Credit Opportunity Act allows actual and punitive damages, with punitive awards in class actions capped by statute. The Electronic Fund Transfer Act has its own damages provisions.

Those suits are brought under the statutes, and they rely on the regulations as the measure of what the statute requires. A plaintiff’s lawyer looking at a lender that had stopped giving a required disclosure would not need the CFPB to do anything. The lawyer would need only a client and a copy of the regulation. For a bank weighing the risk of relaxing a requirement, that private exposure was usually larger than anything the bureau itself could have done.

Customers also have the protections of state law. Many states have their own statutes against unfair or deceptive practices, and some apply them actively to lenders. Those laws were unaffected by the case.

Examiners kept examining

The prudential regulators did not change course after the ruling. The OCC, the FDIC, the Federal Reserve and the NCUA continued to examine smaller institutions for consumer compliance against the same regulations, using the same interagency procedures. State regulators also continued to examine the nonbank lenders and servicers they license, often in coordinated multistate exams. For most community banks and credit unions, the visible effect of the ruling on the next exam was nil.

For current rules, the sound decision was simple: keep complying. The useful planning work was elsewhere, in mapping which obligations rested only on a CFPB rule with no older regulatory or statutory basis. That list was short, and it was the only place the ruling could plausibly change day-to-day requirements.

Building that map is a manageable exercise.

The same exercise looks different by type of firm. For a community bank, almost every consumer obligation traced back to a statute or a carried-over rule, and its examiner was not the CFPB, so the short list was close to empty. For a mortgage company, the short list was longer, because many of the rules governing origination and servicing were written by the bureau after 2010. For a fintech offering payment or lending products through a bank partner, the answer depended on the contract. The bank’s compliance requirements, set out in the program agreement, would stay in force regardless of the ruling.

A compliance team takes its inventory of obligations, which most institutions already keep for exam purposes, and adds one column: where does this duty come from? A statute, a rule carried over from an older agency, or a rule that exists only because the CFPB wrote it. The third group is the one worth watching. Everything else can be set aside from the debate.

Pending rules: building toward a date that might move

The hardest decisions concerned rules not yet in effect. The clearest example was the small business lending data rule under Section 1071 of the Dodd-Frank Act, finalized in March 2023. It required lenders to collect and report detailed data on credit applications from small businesses, which meant changes to application forms, loan systems and reporting pipelines. Trade groups sued in Texas, citing the Fifth Circuit’s reasoning, and in 2023 a federal court stayed the rule’s compliance dates for the plaintiffs and their members pending the Supreme Court’s decision.

A “reporting pipeline” is a chain of steps. Data starts on an application form, online or on paper at a branch. It flows into the loan system, gets checked for errors, is combined with data from other systems, and is finally packaged in the format the regulator requires and submitted. Every step is a piece of technology or a manual process someone has to design, test and maintain. A new data rule touches all of them.

Lenders faced a classic sequencing problem. Building early risked spending on a rule that might fall. Waiting risked a scramble if the Court upheld the bureau and dates snapped back. Institutions that handled it well separated the work. Data governance, application process mapping and vendor requirements were useful whatever happened, and they went ahead. Rule-specific reporting builds were designed but held. A dated decision point, tied to the expected ruling, triggered the rest.

What the rule asked for

The scale of the Section 1071 rule explains why the sequencing question was so pressing. It applied to lenders that originated at least 100 covered small business loans in each of the two preceding years, which brought in many community banks and credit unions as well as large lenders. Covered lenders had to collect data points such as the type, purpose and amount of credit requested, the action taken and the pricing offered. They also had to ask applicants about the business’s revenue, industry and number of workers, and whether it was owned by women, minorities or LGBTQI+ individuals. On top of that, they had to request the ethnicity, race and sex of its principal owners.

Compliance dates were staged by volume. The largest lenders were due to begin collecting data first, in October 2024, with smaller lenders following in 2025 and 2026. A lender with a few hundred small business loans a year therefore had more time than a large bank, but also far fewer staff to spend it. Many of them depended almost entirely on their software vendors for the build.

“Data governance” means knowing what data you collect, where it lives, who owns it and how good it is. A lender that cannot say how many small business applications it received last quarter, or which ones were withdrawn, will struggle with any reporting rule, this one or the next. That is why it counted as no-regret work.

The decision point had to allow for lead times outside technology. Section 1071 required lenders to ask applicants for demographic information and to limit which staff could see it. That meant new scripts for loan officers, training and changes to how branches handled applications. Those steps take months and cannot be compressed into the weeks after a court ruling, so the hold covered systems but not the process design and training plans.

The firewall problem

One requirement shows why process work could not wait. The rule restricted employees and officers involved in making the credit decision from seeing an applicant’s answers to the demographic questions, unless the lender determined that such access was necessary. Small lenders often have one loan officer who takes the application, gathers documents and makes the recommendation. For them, meeting that restriction or documenting why it could not be met meant redesigning roles as well as screens. That kind of change takes months of planning, consultation with staff and testing, and it cannot be bought from a vendor.

Vendors shaped the timeline. Most lenders depend on loan origination and reporting software providers for rule changes. Asking those providers in writing for their delivery plans under each legal outcome turned an open question into a schedule. Boards needed a short summary as well: which pending rules were affected, what had been spent, what was on hold and when the next decision was due.

The contract is where that conversation starts. Most core banking and loan origination agreements include a clause on regulatory changes. Those clauses differ on whether the vendor must deliver changes by the compliance date, whether the cost is included in the license fee and what happens if a rule is delayed. A compliance officer who reads that clause before asking for a delivery plan knows what the institution can insist on and what it will have to pay for. Where the clause is weak, the next renewal is the moment to strengthen it.

The decision point in practice

A dated decision point works best when it has three parts written down in advance. The first is the trigger: a court ruling, a compliance date notice or a fixed calendar date, whichever comes first. The second is the decision owner, usually the chief compliance officer with the chief information officer and the business line head. The third is the options and their lead times. Those might be: resume the full build, which takes a stated number of months; extend the hold, with the next review date set; or stop and write off spend to date. Writing these down beforehand turns a contentious meeting into a quick confirmation.

Budgeting follows the same logic. A lender can fund the no-regret work in full, reserve the rule-specific build as a contingent line item, and report both to the board. That keeps the money visible without spending it early. It also gives finance a clear signal of when the contingent amount will be needed.

Two lenders, two responses

Consider two hypothetical lenders facing the same uncertainty.

The first, a community bank, treated the ruling as one big question. Some executives wanted to keep everything running; others wanted to stop spending on anything CFPB-related until the Supreme Court spoke. The debate went in circles because people were talking about different things. The Section 1071 project froze entirely, including the training design. When dates later reset, the bank found itself rushing to write loan officer scripts and retrain branch staff at the same moment its vendor was shipping software changes.

The second, a credit union of similar size, split the question into the three categories in a single meeting with counsel. Past commitments: continue. Current rules: continue, and build the short list of CFPB-only obligations. Pending rules: proceed with data clean-up and process design, hold the reporting build, and set a decision date. It asked its loan software vendor in writing for delivery plans under each outcome. The board received a one-page update each quarter. When the legal picture cleared, the credit union already knew what to do next.

The case for waiting

The community bank’s instinct was not foolish. Small institutions have thin compliance teams and limited budgets. Every hour spent on a rule that might never take effect is an hour not spent on a known exam finding or a fraud problem. Executives who argued for waiting were also right that the Section 1071 build was expensive, and that rules under legal challenge often change before they take effect. For an institution near the 100-loan threshold, there was even a chance it would not be covered at all once the rule settled.

Those arguments justify holding the build. They do not justify stopping the parts of the work that cost little and serve other purposes. Knowing how many small business applications a bank receives, where they are recorded and how they flow through its systems is useful for fair lending reviews, credit risk and marketing. Designing the loan officer process and the training plan in outline costs staff time but no software spend. Waiting on those pieces saved little and created the scramble described above.

A third case: the nonbank lender

A nonbank mortgage company faced a sharper version of the same choice. The CFPB was its federal examiner, and many of the rules governing its daily work, from closing disclosures to servicing procedures, were written by the bureau after 2010. For such a firm, the short list of obligations resting only on a CFPB rule was long, and the ruling looked at first like a larger opening.

On closer inspection, little changed. The firm’s state licenses typically required compliance with federal consumer law. Its loans were sold to investors such as Fannie Mae and Freddie Mac, whose guidelines expected compliant origination. A warehouse lender or loan buyer would reject loans that did not meet the disclosure rules, whatever a court said about the bureau’s funding. The contracts and licenses around the firm enforced the same requirements. A nonbank that mapped those channels alongside its obligations reached the same conclusion as the credit union, by a different route.

Several failures follow from that contrast:

• Treating “the CFPB” as one thing. Orders, rules and guidance carry different risks, and blending them produces muddled decisions.
• Confusing legal uncertainty with operational permission. A rule under a cloud is still a rule until a court says otherwise for your institution, and other enforcers remain in place.
• Freezing everything. Halting all work on a pending rule throws away the no-regret pieces and leaves the slowest human tasks for last.
• Forgetting the vendor. Most institutions do not build their own compliance software. If the vendor’s plan is unknown, the institution’s plan is a guess.
• Leaving the board in the dark. Directors do not need legal briefs. They need to know what has been spent, what is paused and when the next decision is due.

Authority will be challenged again

It would be easy, and wrong, to file this episode under “legal trivia.” Regulators’ authority gets challenged regularly, through courts, through changes in leadership and through shifting political priorities. Each time, institutions face the same temptation to either ignore the noise or overreact to it.

The financial stakes run in both directions. Overreacting can mean refunds stopped, fines from other enforcers and lawsuits from customers. Underreacting can mean millions spent building systems for a rule that is later delayed or rewritten. The reputational stakes are lopsided, though. Few customers will praise a bank for pausing a compliance project; many will notice if the bank appears to drop a protection because a technicality allowed it.

Customers rarely see any of this directly, but they feel it. A small business owner applying for a loan does not care which agency wrote the rule behind a question on the form. They care whether the form is clear, whether the loan officer can explain why the question is being asked, and whether the process is the same next month as it was last month. Institutions that kept a steady course gave their customers a steady experience. Those that switched requirements on and off risked confusing applicants and staff alike, and confusion at the point of sale is where complaints, errors and fair lending questions tend to start.

Different ways authority gets challenged

The Fifth Circuit ruling was one form of challenge among several. Others include a court ruling that a specific rule exceeds the agency’s statutory authority, or a ruling on the procedure used to adopt it. Congress can vote to overturn a rule under the Congressional Review Act. A change of leadership can reverse policy, and a budget law can cut funding. Each touches the three categories differently. A funding or structural challenge, like this one, puts everything an agency did under a cloud at once, but rarely ends with everything struck down. A statutory challenge targets one rule and can remove it cleanly. A policy reversal leaves existing rules in place while enforcement priorities change, which shifts risk toward other enforcers rather than removing it.

The sorting habit carries across all of them. Past commitments are usually safest to keep. Obligations grounded in statutes with private rights of action or state enforcement rarely disappear. Pending rules are where the real choices lie, and where a dated decision point earns its keep.

There is also a staff dimension. Compliance, technology and branch teams can burn out when projects lurch between full speed and full stop. A clear framework, with a dated decision point and a stated reason for each pause, lets people plan their work and keeps institutional knowledge from walking out the door.

Before the next challenge to a regulator

• Which of our obligations come from statutes or older regulations, and which exist only because one regulator wrote a rule?
• Are we on track with every consent order and examination finding, and could we prove it with documents tomorrow?
• For each pending rule, what work is useful no matter how the legal fight ends, and is that work actually moving?
• Have our loan and reporting vendors told us, in writing, what they will deliver and when under each possible outcome?
• What has the board been told about spend to date, work on hold and the risks of moving too early or too late?

With hindsight

The Supreme Court reversed the Fifth Circuit in May 2024, holding by seven to two that the CFPB’s funding mechanism satisfies the Appropriations Clause. That removed the constitutional cloud over the bureau’s past actions, and compliance dates for the small business lending rule were reset.

Justice Clarence Thomas wrote for the majority. The Court held that the Appropriations Clause requires only that a law authorize the drawing of money from identified sources for designated purposes, and that the bureau’s statute did so. Justice Samuel Alito, joined by Justice Neil Gorsuch, dissented. The decision came more than eighteen months after the Fifth Circuit ruling and about seven months after oral argument. After it, the bureau issued an interim final rule in June 2024 extending the small business lending rule’s compliance dates, as earlier court orders had anticipated.

For institutions that had kept their commitments, that outcome was undramatic. Their consent orders were on track, their disclosures had never stopped, and their pending-rule work could resume from where it had been paused rather than from scratch.

The same years brought a wider set of challenges to agency authority, from a different direction. In June 2024 the Supreme Court overruled the Chevron doctrine in Loper Bright Enterprises v. Raimondo, so courts no longer defer to an agency’s reasonable reading of an ambiguous statute. In SEC v. Jarkesy, decided the same month, the Court held that the SEC must bring certain fraud claims for civil penalties before a jury. And in Corner Post v. Board of Governors, decided days later, it held that the clock for challenging a rule can start when a plaintiff is first harmed. Taken together, those rulings made rules across financial regulation easier to contest, even as the CFPB’s funding was settled.

The CFPB’s credit card late fee rule showed what that looked like in practice. Finalized in March 2024, it was stayed by a federal court in Texas before taking effect and was later vacated in 2025, after the bureau’s new leadership stopped defending it.

Within a year the bureau’s position changed for a different reason. After the change of administration in 2025, new leadership sharply reduced enforcement and supervision and dropped a number of cases. It reconsidered several rules, including the small business lending rule, and sought large staff reductions, much of it contested in court. Several states moved to strengthen their own consumer financial enforcement.

Congress also acted directly. In 2025 it used the Congressional Review Act to overturn two late-term CFPB rules, one on overdraft fees at large institutions and one bringing large digital payment apps under bureau supervision. Later that year, the budget reconciliation law lowered the cap on the bureau’s funding from the Federal Reserve. The small business lending rule’s compliance dates were pushed back again, and the bureau moved to revise the rule. Lenders that had kept their data governance and process design work going found that it still served fair lending and credit purposes, whatever became of the reporting build.

That second shock is the more instructive one. The threat to the bureau’s rules came not from a court ruling on how it was funded, but from a change in policy. Yet the logic of sorting held up just as well. Statutes still stood. Customers could still sue under them. Prudential regulators still examined. And state enforcers, if anything, became more active.

By 2026, institutions have seen CFPB rules threatened twice, once by a court and once by policy. Those that sorted past, current and pending obligations separately, and kept building on statutory duties, have had the least to unwind.

The habit outlasts the agency. When a regulator’s authority wobbles, sort three things before anything else: what the institution has already committed to, what rests on older law that someone else will still enforce, and what is genuinely new, where it makes sense to prepare carefully and decide at a set date. Organizations that do that sorting calmly tend to spend less, confuse their staff less and explain themselves more easily to whoever ends up enforcing the rules next.