The Consumer Financial Protection Bureau’s (CFPB) latest proposed rule to define risks to consumers may appear technical, but its implications reach far beyond the narrow mechanics of supervisory designation. By binding itself to a clearer standard requiring a high likelihood of significant harm directly tied to financial products and services, the Bureau is signaling a philosophical shift toward narrower, more predictable regulation.

Overview

On its face, the CFPB’s August 2025 notice of proposed rulemaking proposes to clarify the CFPB’s own procedural rules. Specifically, it clarifies whether a non-bank firm is subject to CFPB regulation under the Consumer Financial Protection Act (CFPA). The CPFA, 12 U.S.C. § 5514(a)(1)(C), provides that, in the context of non-bank firms, “covered persons” subject to CFPB regulatory oversight includes any firm that the CFPB determines “is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” To date, the CFPB has not provided criteria for determining when this applies. This proposed rule seeks to change that by defining “risks to consumers” as conduct that (1) poses a high likelihood of significant harm and (2) is directly tied to a consumer financial product or service. For more information on the specifics of this rule, we invite you to read our earlier post unpacking the mechanics of the rule.

While this only would apply to non-bank companies, the rule reflects an emerging deregulatory ethos in Washington — one that emphasizes restraint, predictability, and targeted intervention over expansive agency discretion. In this light, the CFPB’s proposal is not just a procedural clarification, but a bellwether of how federal financial regulation may evolve in the coming years.

Broader Regulatory Shift Toward Deregulation

The CFPB’s proposed supervisory standard is not an isolated initiative; it reflects a clear, administration-wide preference for narrowing federal agency reach and disfavoring expansive whole-of-government enforcement.

For non-banks such as fintech firms, servicing platforms, and “banking-as-a-service” intermediaries, the new definition provides a welcome reprieve: If conduct is neither significantly harmful nor highly likely to cause harm, and it lacks a direct nexus to a covered consumer product, the Bureau cannot compel supervisory exams.

For the market, questions remain as to whether regulatory oversight will vary as between bank and non-bank firms; however, the overall sentiment of providing stability and predictability in regulatory oversight will likely be welcomed.

Lasting Effects

During President Trump’s first administration, the CFPB adopted a more restrained regulatory posture, focusing on supervision through enforcement and comment that it would not pursue expansive interpretations of its authority. The current proposal to define “risks to consumers” signals a next step through formal rulemaking, with a potentially more lasting effect.

The durability of these guardrails will depend on both legal and political dynamics. A future CFPB director could seek to rescind or broaden the definition, but doing so would likely require new rulemaking supported by evidence that the existing standard is either unworkable or inconsistent with consumer protection objectives. Under the Administrative Procedure Act, the Bureau would also need to explain and justify any departure from its prior conclusion that supervisory resources should be reserved for conduct posing a “high likelihood of significant harm.” That obligation, while not insurmountable, creates meaningful procedural hurdles, particularly if industry stakeholders contest a broader standard as arbitrary or capricious.

Notably, the proposal does not include sunset provisions or mandatory review mechanisms. By omitting automatic reconsideration, the Bureau has effectively enhanced the rule’s durability, making future revision contingent on a deliberate agency initiative or an external legislative mandate.

The CFPB is requesting public comments on the August 2025 notice of proposed rulemaking, with submissions due by September 25, 2025. If finalized, this rule would take effect 30 days after publication.