Key Takeaways: 

• Federal bank regulators plan for vigorous review of safety and soundness and consumer compliance functions.
• BSA/AML, fair lending and mapping compliance to controls are expected to be the focus of examiners’ review.
• State regulators are expected to fill the void if the Trump Administration restrains federal supervision.

In the final months of 2024, federal regulators were outlining their respective supervisory priorities for 2025, in terms of personnel allocation, budget needs and examination priorities. As in the past several years, these regulatory previews served as potent prognosticators of supervisory surveillance to come. The agencies’ own predictions of their supervisory priorities serve as helpful aides for financial institutions in how to allocate their own legal and compliance resources. Then, Donald J. Trump was re-elected as the 47th President of the United States.

With sweeping power to appoint agency heads of pivotal federal financial regulators such as the Federal Deposit Insurance Corporation (“FDIC”), the Office of the Comptroller of the Currency (“OCC”) and the Consumer Financial Protection Bureau (“CFPB”), President Trump has broad authority to shape the future of federal regulatory examinations and enforcement. However, if the regulatory environment of the previous Trump Administration is any indication, this is no time for financial institutions to give their compliance functions a sabbatical.

What are the Agencies Predicting?

In the past few months, the federal bank regulatory agencies have offered their expectations for supervisory priorities. For the OCC, the regulator for most large banks, the agency has indicated that it will focus its 2025 resources on, among other things, compliance. The OCC has indicated that it will focus on BSA/AML/OFAC compliance, assessing whether “operations and systems are reasonably designed and implemented to mitigate and manage money laundering, terrorist financing and other illicit financial activity risks from business activities, including products and services offered and customers and geographies served.” In the area of consumer compliance, the OCC has indicated that it will focus on “banks’ risk management processes to determine compliance with consumer protection laws and statutory requirements, including those prohibiting unfair, deceptive or abusive acts or practices that aim to address potential instances of fraud tied to consumer accounts.” Moreover, the OCC notes: “Examiners also evaluate whether banks can identify and manage in a timely manner compliance risks presented by person-to-person and real-time payment product offerings, including dispute and error resolution.”

However, merely knowing what the relevant laws are is not enough, according to the OCC. Rather, the OCC will expect institutions to map these varying statutes and regulations to internal controls: “Examiners should consider banks’ systems and controls to ensure that relevant aspects of products or services, including those offered through third-party relationships, are communicated to consumers in a clear, consistent manner with accurate, complete information.”

The OCC has also indicated that it will heavily scrutinize banks’ fair lending compliance programs. According to the OCC: “Examiners focus on assessing fair lending risk and whether banks are ensuring adequate risk management and equal access to products and services. Risk assessments consider all factors affecting a bank’s fair lending risk, including changes to strategy, personnel, products, services, credit underwriting, CRA assessment areas or market areas, and operating environments since the previous risk assessment. Examiners will use data-driven, risk profile-based approaches to identify focal points for fair lending examinations.” In conducting fair lending risk assessments, the OCC examiners are likely to look for deficiencies in linking compliance requirements to internal controls. Examiners tend to allege that such deficiencies have led to compliance lapses, and such lapses must be remedied through severe and public enforcement actions.

The CFPB’s Supervisory Highlights for Winter 2024 similarly predicted a robust supervisory posture for 2025, focusing on such topics as unanticipated overdraft fees and representment NSF fees, core processor practices, improper representment processing practices, stop payment services, obligations of furnishers of credit report information, short-term small dollar lending, among others.

More recently, FDIC Acting Chairman Travis Hill, a Republican, offered his insights on the new direction that the agency may take following President Trump’s inauguration. In a speech before the American Bar Association on January 10, 2025, Mr. Hill noted that “the agency needs a new direction,” and called for reorienting bank supervision away from what he described as a misplaced focus on “process-related issues that have little bearing on a bank’s core financial condition or solvency.” Mr. Hill noted that despite what other changes will come with the FDIC, “basic controls and risk management infrastructure still matter.”

How Might the Trump Administration Respond?

With the incoming administration and the new agency appointments that are likely to quickly follow, the degree to which the federal agencies may be willing to implement the above policies remains uncertain. President Trump is likely to appoint at least acting leadership at the OCC and CFPB within the first few weeks of the new administration.

Once these acting leaders assume their roles, we are likely to see the rescission of informal agency guidance, bulletins, advisory notices, etc. These are informal agency guidance that did not have to go through notice-and-comment rulemaking.

One example of this may be CFPB Circular 2024-05, which clarified that consumers must affirmatively opt into overdraft protection services before a financial institution charges overdraft fees. In that informal agency guidance, the CFPB declared that charging such fees without consent may constitute a violation of the Electronic Funds Transfer Act (“EFTA”). Moreover, proposed rulemakings that have not yet been promulgated in final form are likely to stall and die without further action.

Resurgence in State Enforcement Actions

If the notion of state enforcement activities surging in response to the Trump Administration sounds familiar, it should—the same thing happened four years ago. Under the first Trump Administration, President Trump’s first appointed CFPB leader was Acting Director Mick Mulvaney, who had been an outspoken critic of the CFPB. Mr. Mulvaney issued a letter on Jan. 23, 2018, detailing how his administration of the agency would differ from Richard Cordray's. Mr. Mulvaney believed that Mr. Cordray had promoted enforcement actions that far exceeded the agency’s statutory authority.

Mr. Mulvaney’s attempt to refocus and restrain the CFPB did not result in lessened focus on compliance. It just shifted the direction from where the scrutiny came. On December 12, 2017, a coalition of state attorneys general, led by then-New York Attorney General Eric Schneiderman, vigorously opposed the Trump Administration’s attempts to, in the AGs’ view, restrain the CFPB’s consumer compliance enforcement function. The AGs offered the following warning against lessening federal consumer compliance enforcement:

As you know, state attorneys general have express statutory authority to enforce federal consumer protection laws, as well as the consumer protection laws of our respective states. We will continue to enforce those laws vigorously regardless of changes to CFPB’s leadership or agenda. As attorneys general, we retain broad authority to investigate and prosecute those individuals or companies that deceive, scam, or otherwise harm consumers. If incoming CFPB leadership prevents the agency’s professional staff from aggressively pursuing consumer abuse and financial misconduct, we will redouble our efforts at the state level to root out such misconduct and hold those responsible to account.

The above warning from state attorneys general to “redouble” their efforts is not without foundation. Under the Dodd-Frank Act, state attorneys general are empowered to enforce various federal consumer financial protection statutes, including the Truth-in-Lending Act, the Fair Credit Reporting Act, the Equal Credit Opportunity Act and prohibitions on unfair, deceptive or abusive acts or practices under 12 U.S.C. § 5531 and regulations promulgated by the CFPB under 12 U.S.C. § 5552. As a result of this, state attorneys general have established “mini-CFPBs” to enforce consumer protection laws—both state and federal laws.

Summary and Recommendations

As discussed above, although the change in administrations will undoubtedly bring some measure of uncertainty, what is certain is that if the federal regulators in Washington attempt to dilute the vigilance of federal superintendence, the states are waiting in the wings to fill the void. In fact, with the changing political environment and zealous and ambitious state prosecutors and regulators, there is no shortage of state actors eager to make an example of a financial institution.

Moreover, although financial institutions serve an important public function—providing depository and lending services to a broad cross-section of Americans—they also draw bipartisan criticism in Washington and among the states. The likely result is that now more than ever, financial institutions, both banks and non-bank providers, must work toward being as pristine as possible in their compliance efforts and results. This will require thorough knowledge of the applicable statutes, regulations and agency guidance, the ability to map those requirements to institutions’ compliance functions, the ability to review and implement changes in laws as they change and to engage outside counsel with the knowledge and experience to defend the institutions’ position when challenged by the regulators—and those challenges will undoubtedly come.