The Consumer Financial Protection Bureau has been quiet since the early days of the second Trump presidency, when the administration stopped work at the agency and told staffers to stay home. But recently, under Acting Director Russ Vought, the bureau introduced a laudable proposal to limit its own regulatory power and thus cut back on the “shadow regulatory state.”
A relatively obscure provision of the Consumer Financial Protection Act of 2010 allows the CFPB to supervise nonbank entities that it has “reasonable cause” to believe are engaging in “conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” To initiate this supervisory process, the CFPB does not have to establish any actual violations of laws or rules. Often, the bureau’s “reasonable cause” consists of nothing more than unverified consumer complaints.
Finally, a reason to check your email.
Sign up for our free newsletter today.
This nonbank supervisory power was largely forgotten for the first decade-plus of the CFPB’s existence, leading some to call it the bureau’s “dormant authority.” But in 2022, the Biden administration announced plans to activate the authority, allowing the bureau to conduct comprehensive examinations and insert itself into companies’ internal machinations.
These investigations entail a lengthy process. They can include on-site visits and review of everything from organizational charts and training protocols to internal reports and compensation practices. The bureau itself estimates that examinations cost around $27,000 in labor alone, a figure that some in the industry view as a substantial underestimate. Still-active Biden-era rules require firms to wait two years before petitioning the CFPB to terminate supervision, and they cannot re-petition more than once annually if their initial plea is denied.
In another Biden-era rule change, the bureau empowered itself to publish supervisory authority designations on its website. This step allowed the CFPB to deploy a carrot-and-stick approach. If a targeted company accepts the bureau’s supervisory designation, the bureau will keep the proceedings quiet; if the firm pushes back, the bureau will publish the proceedings on its website. Being publicly identified as the subject of CFPB supervision imposes significant reputational damage on businesses, even if the bureau has demonstrated no proof of harm to consumers.
During the Biden administration, for example, both Google Pay and the installment lender World Acceptance Corp. tried to push back on the CFPB’s use of its supervisory designation authority against them. In both cases, the bureau publicized the proceedings, apparently in retaliation. Notably, in the Google Pay case, the allegation involved a product that the company had already taken off the market.
The bureau’s supervisory authority is an example of what Manhattan Institute senior fellow Jim Copland has called the “shadow regulatory state”—entities working within federal agencies and using an array of administrative powers, guidance, and agreements to shape the behavior of individuals and businesses. They use informal powers that reside outside formal agency adjudication or the normal notice-and-comment rulemaking process, forming a “shadow” state that exerts enormous influence.
Copland has highlighted federal prosecutors’ use of deferred prosecution agreements (DPAs) and non-prosecution agreements (NPAs) as classic examples of the shadow regulatory state. These are settlements between prosecutors and corporations that, while theoretically “voluntary,” rest on the implied threat of criminal prosecution. As Copland notes, these agreements allow the government to “modify, control, and oversee corporate behavior in ways they never could by taking the companies to court.”
The CFPB’s supervisory authority is analogous to DPAs and NPAs. Its use of this authority entails the government inserting itself into a company’s internal workings to influence and shape behavior, all without initiating formal proceedings that would require a higher burden of proof and empower a company to more effectively to resist.
With the change in administration, the CFPB has introduced a proposal to cabin its supervisory authority powers. The proposal would define “risks to consumers”—the statutory hook for the bureau’s exercise of its supervisory authority—as conduct that “presents a high likelihood of significant harm” to consumers and is “directly connected to the offering or provision of a consumer financial product or service.”
True, this is not a massive defanging of agency powers. Instead, it is narrowly tailored to focus the bureau on its core mission: protecting consumers from real, substantial harm caused by consumer financial products and services. Still, it’s an effort to claw back the shadow regulatory state, and one worth celebrating.
Photo by SAUL LOEB/AFP via Getty Images
