CFPB Issues Proposed Rule on Standard for "Risks to Consumers"

On August 26, 2025, the Consumer Financial Protection Bureau (CFPB or the Bureau) published a proposed rule that, if finalized, would provide a standard for the term "risks to consumers" as used in Section 1024(a)(1)(C) of the Consumer Financial Protection Act of 2010 (CFPA).¹ The proposed rule could substantially reduce the scope of the CFPB’s authority to supervise nonbank entities.

Background

The CFPA authorizes the Bureau to supervise a nonbank covered person whom the Bureau "has reasonable cause to determine…is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services…."² The proposed rule would provide that "risks to consumers," for purposes of this provision of the CFPA, is conduct that (a) presents a high likelihood of significant harm to consumers; and (b) is directly connected to the offering or provision of a consumer financial product or service as defined in the CFPA.³

Bureau Rationale

The Bureau identified three concerns it seeks to address:

• The potential for the "ad hoc nature of individual orders" to lead to inconsistent application of the term "risks to consumers"
• Uncertainty for firms that must rely on precedent to determine the standard applicable to their conduct
• The risk that without a binding framework, "the Bureau may not conform to the best reading of CFPA section 1024(a)(1)(C) in individual cases."⁴

"Direct Connection" Requirement

The Bureau also proposes to interpret the phrase "with regard to the offering or provision of consumer financial products or services" as requiring "a direct connection" to a consumer financial product or service. This aligns with the Trump administration’s stated position that the CFPB should focus only on the specific products and services Congress charged the CFPB with overseeing. If finalized, this provision could provide an opportunity for some firms to reduce their regulatory burden by arguing that their products or services lack a direct connection to consumer financial products or services. While the Bureau provides no further detail on how it would interpret a "direct connection," firms may begin efforts to inform the Bureau’s thinking on this concept by submitting comments.

Next Steps

Comments on the proposed rule are due to the Bureau by September 25, 2025. Steptoe’s Financial Innovation and Regulation practice stands ready to assist firms interested in providing the Bureau with their feedback.

¹ 90 Fed. Reg. 41,520 (Aug. 26, 2025).

² 12 U.S.C. § 5514(a)(1)(C).

³ See 12 U.S.C. § 5481(5).

⁴ 90 Fed. Reg. 41,520.