December 29, 2025
Consumer Financial Services Bites of the Month - "Cold December Night with the CFPB"
Eric L. Johnson, Justin B. Hosie and Kristen Yarows
In this month's article, we share some of our top "bites" covered during the December 2025 webinar.
Bite 17: FTC Commissioner Holyoak Appointed as Interim U.S. Attorney
On November 17, 2025, U.S. Attorney General Pam Bondi nominated FTC Commissioner Melissa Holyoak to be Interim U.S. Attorney for the District of Utah. Holyoak has served as a Commissioner at the Federal Trade Commission since March 2024, and her final day as Commissioner was November 17, 2025. Before her term at the FTC, she served as Solicitor General with the Utah Attorney General's Office, where she oversaw the civil appeals, criminal appeals, constitutional defense, special litigation, antitrust and data privacy divisions. The FTC currently only has two Commissioners left, Chairman Ferguson and Commissioner Meador, who are both Republicans.
Bite 16: CFPB Tells Congress, President it Needs $279.6 Million
On November 20, 2025, CFPB Acting Director Vought wrote letters to President Trump and members of the Committees on Appropriations of the Senate and of the House of Representatives, notifying them that there are no funds legally available for the CFPB to request from the Federal Reserve. The letter explained that the determination was made based on the conclusion of the Office of Legal Counsel within the Department of Justice. The letters did not actually request funding, but merely informed the recipients of the money the CFPB needs. The letter explained that the CFPB estimates it will run out of funding at some point during the first quarter of Fiscal Year 2026 (possibly by Jan. 15th). The CFPB's funding need for Fiscal Year 2026 is listed as $279.6 million, in order to maintain its activities that are required by law.
Bite 15: CFPB Publishes FDCPA Annual Report
On November 21, 2025, the CFPB published its annual report to Congress which included a summary of the CFPB's activities to administer the Fair Debt Collection Practices Act ("FDCPA"). In 2024, about seven percent of consumer complaints to the the CFPB were debt collection complaints. The most common type of complaint was "attempts to collect debt not owed" which was followed by "written notification about debt." In 2024, the CFPB filed three amicus curiae briefs in cases involving the FDCPA, and one of those briefs has since been withdrawn. The CFPB did not bring any enforcement actions relating to the FDCPA. However, the FTC brought an enforcement action under the FDCPA, suing a Georgia-based debt collector and owner.
Bite 14: CFPB Sued Over Refusal to Request Funding from the Fed
On December 5, 2025, nonprofit groups announced that they had filed a lawsuit against the CFPB and Acting Director Vought over the efforts to shut down the agency. The groups filed the lawsuit in the U.S. District Court for the Northern District of California alleging that the administration erroneously reinterpreted the law establishing the CFPB, turning a statutory provision intended to create a stable funding source into one that will be exhausted shortly. The complaint alleged that federal law requires Acting Director Vought to determine the amount "reasonably necessary" to carry out the CFPB's responsibilities so that the Federal Reserve can transfer that amount to the CFPB, and the statute doesn't give him discretion to refuse to make the request. The nonprofit groups argue that the CFPB's refusal to request funding from the Fed was arbitrary and capricious. The complaint asks the court to declare the CFPB's determination unlawful and to require the CFPB to request funding from the Federal Reserve in an amount reasonably necessary to carry out the authorities of the CFPB.
Bite 13: Top CFPB Official Resigns Over Direction of CFPB
On December 4, 2025, media outlets reported that the CFPB's principal deputy enforcement director resigned over frustrations regarding the agency's current direction. He reportedly told his team that he hoped to be able to lead an enforcement division that would continue the agency's work despite new priorities and reduced staff. The email said that in "the last several weeks, it's become clear to me that, if things proceed as planned, there is no path to an effective future enforcement program at the CFPB." His resignation comes shortly after it was reported that some investigations would restart. The principal deputy enforcement director raised several of the same concerns that his predecessor raised when she resigned in June 2025. The principal deputy enforcement director's last day with the CFPB was on December 12th.
Bite 12: Service Provider for Auto Dealers Suffers Data Breach
On December 3, 2025, a large car dealership service provider announced that it suffered a data breach. The data breach apparently affected nearly 18,000 dealerships and more than 5.6 million customers. The company stated that there is no indication of any identity theft, fraud, or other misuse of information in relation to the data breach. The company has notified the FTC of the breach, and the FTC has approved the company's proposal to file a single consolidated breach notice with the FTC on behalf of its dealer clients affected by the breach. This consolidated breach notice would address reporting obligation under the FTC's Safeguards Rule. The company will also be notifying state attorneys general offices on behalf of the dealers, as well as impacted consumers.
Bite 11: Former CFPB Director to Lead Policy Group
On December 2, 2025, media outlets reported that a group of Democratic Attorneys General have hired former CFPB Director Rohit Chopra to lead the Consumer Protection and Affordability Working Group within the Democratic Attorneys General Association ("DAGA"). Former Director Chopra will oversee a team of researchers and policymakers who will aim to formulate nationwide strategies for health care, technology, and financial services. The attorneys general will then be able to choose whether to implement the recommendations in their states. The move marks another step by Democratic states to fill a purported void created by the administration under President Trump. Sean Rankin, president of the DAGA, said the group has already been working with Rohit Chopra for years, coordinating with him on enforcement strategies when he was with the CFPB and his previous role at the Federal Trade Commission.
Bite 10: FTC Receives Petition for Rulemaking on Negative Option Plans
On December 3, 2025, the FTC published a petition for rulemaking that it received from the Consumer Federation of America and the American Economic Liberties Project. The petition requests to renew the FTC's trade regulation rulemaking concerning the use of negative option plans know as the "Click to Cancel" rule. The U.S. Court of Appeals for the Eighth Circuit vacated the rule on July 8, 2025. The petition argues that the rule "falls comfortably within the FTC's authority to regulate across industries, and is a thoughtful, reasonable, and carefully designed response to an urgent and growing problem." The FTC invited written comments concerning the petition, and the comment period will run for 30 days from publication in the Federal Register. The FTC indicated that it will not consider the petition's merits until after the comment period closes. It may grant or deny the petition in whole or in part, and it may deem the petition insufficient to warrant commencement of a rulemaking proceeding.
Bite 9: State AGs Seek Information from Largest BNPL Providers
On December 1, 2025, the attorneys general from California, Colorado, Connecticut, Illinois, Minnesota, North Carolina, and Wisconsin sent a joint letter to the six largest buy now, pay later ("BNPL") providers. The letter expressed concern that the BNPL companies might not be providing their customers with appropriate protections when they return their purchase, never receive what they ordered, or experience other billing errors. The letter also noted concern that BNPL providers may not adequately assess customer's capacity to repay. The inquiry requests information about several topics, including: (1) pricing and repayment structure; (2) procedures for addressing disputes over purchases or billing; (3) customer service practices; (4) ability to repay assessment; (5) procedures related to credit reporting; (6) delinquencies and defaults; (7) disclosures; (8) relationships and contracts with merchants; and (9) efforts to comply with the federal Truth in Lending Act.
Bite 8: CFPB Requires Supervisors to Take "Humility Pledge"
On November 21, 2025, media outlets reported that the CFPB is now requiring supervisory examiners to take a new "humility pledge," which examiners are required to read out loud to examined institutions before conducting exams. The pledge states that the agency will "avoid, where possible, duplication of supervision, where States or other regulators are already doing that job." The CFPB described supervision under the former CFPB Director Chopra as a "weaponized arm of the CFPB" and indicated that for 2026 examinations, the CFPB will focus its supervision resources on "pressing threats to consumers, particularly service members and their families, and veterans, and in the areas that are clearly within the CFPB's statutory authority." The CFPB also noted that there will be greater transparency regarding the supervisory process and expectations, including advance notice of scheduled examinations. Further, examination "matters requiring attention" will focus on pattern and practice violations of law where there is substantive and identifiable consumer harm or clear violations of the disclosure requirements.
Bite 7: Stuart Levenbach Nominated for CFPB Director
On November 18, 2025, President Trump nominated Stuart Levenbach to become the CFPB Director. Levenbach is currently an associate director at the Office of Management and Budget and previously served senior roles at the National Oceanic and Atmospheric Administration (NOAA). The Vacancies Act generally allows someone to be in the acting temporary role for 210 days or while a nomination is pending with the Senate. Without this nomination, Acting Director Vought could only serve for 210 days from May 12, 2025, the date that Russell McKernan's nomination was officially withdrawn.
Bite 6: CFPB Transfers Enforcement to DOJ
On November 20, 2025, media outlets reported that the CFPB plans to transfer all of its litigation activities to the Department of Justice and expects to furlough all in-house enforcement attorneys, despite a preliminary injunction that prohibits mass firings. Michael Selemi, the CFPB's principal deputy enforcement director, announced the change during an all-hands meeting and instructed enforcement staff that more than 100 people would be furloughed because the CFPB is going to run out of money. Salemi told employees that the enforcement team will likely be furloughed by year-end and that a few top officials may have the opportunity to work for DOJ. All open cases in the enforcement division and work by the legal division will be transferred to the DOJ. CFPB Union President Cat Farman said this decision is the "latest illegal power grab" by Russell Vought. She also noted that enforcement attorneys are concerned that the CFPB will dismiss the thirteen cases that are currently in litigation that are now being transferred. Farman also called for Congress to impeach Vought and remove him from the agency.
Bite 5: CFPB Signals Restart of Investigations
On November 25, 2025, the CFPB sent some signals suggesting the restart of investigations. Specifically, media outlets reported that acting Director Vought has greenlit "many investigations" to restart. The CPFB's principal deputy enforcement director, Michael Salemi, sent an email to enforcement staff instructing them that their managers will inform them which investigations will restart in the coming days, and attorneys should take "appropriate measures to move these investigations forward." Salemi confirmed that "several investigations" were closed in September following a review by Vought's staff. Salemi did not indicate which investigations would be reopened or how many the CFPB plans to reopen. The CFPB is set to restart some investigations while the CFPB's litigation is being moved to the Department of Justice.
Bite 4: CFPB Moves to Amend Student Loan Trust Settlement
On December 2, 2025, media outlets reported that the CFPB along with a group of student loan trusts and their main servicer, filed a motion for the court to approve an amendment to a settlement the parties reached last year. The lawsuit alleged that the trusts brought improper debt collection lawsuits. The settlement agreement required the trusts and servicer to pay a combined $2.15 million in fines, adhere to compliance terms, and distribute nearly $2.9 million to affected borrowers. Under the proposed plan filed with the court, the CFPB would keep the fines it collected, but the compliance and redress terms would largely be removed from the settlement, leaving in place only certain redress for a subset of servicemember borrowers. The investment company that manages funds that hold notes in the trusts appealed the court's order entering the judgements to the Third Circuit in late 2024. The court filings requesting the amended settlement describe the plan as a "fair compromise" that aligns with the CFPB's "current enforcement priorities." The proposal to amend the settlement also argues that the investment company holding the notes could win the appeal.
Bite 3: FTC Takes Action Against Education Technology Provider
On December 1, 2025, the FTC announced a proposed settlement with a provider of cloud-based educational software over allegations that the company failed to implement reasonable security measures to protect personal information. According to the FTC, the company claimed that it protects "your data like it's our own" and that it takes "security measures—physical, electronic, and procedural—to help defend against the unauthorized access and disclosure of your information." The complaint alleges that the company stored unencrypted student data, failed to disable former employee credentials, and lacked effective monitoring and breach-response systems, resulting in the exposure of personal information for over 10 million students. According to the FTC, back in December of 2021 a hacker used the credentials of a former employee (who had departed the company three and a half years ago) to breach the company's databases stored on a third-party cloud provider. The complaint alleges that the data breach exposed the personal information of more than 10 million students, and the company waited months to years to notify those impacted, despite contractual requirements to notify within 72 hours. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The proposed order prohibits misrepresentations about privacy or data security, mandates deletion of unnecessary student information, requires a comprehensive information security program and third-party assessments, and imposes detailed reporting and recordkeeping obligations.
Bite 2: FTC Takes Action Against Business Financing Company
On November 17, 2025, the FTC announced that a business financing company and its CEO agreed to a permanent industry ban. The parties settled a lawsuit in which the FTC alleged that the company misrepresented its financing products and terms, and prevented consumers from posting negative reviews. The complaint alleged that the company promised to secure business loans or lines of credit for small businesses with 0% interest and without affecting the owners' credit scores by leveraging special relationships with lenders.However, according to the FTC, the company was actually applying for credit cards on behalf of the business owners, often at rates in excess of 0%. The FTC also alleged that the Company advertised that it would not charge upfront fees, but levied hefty charges when consumers tried to cancel.The FTC claims that the company collected over $37 million in fees from over 5,000 consumers.The final order follows a summary judgment order issued against the company in September 2025, imposing a monetary judgment of $48.2 million on the company and its CEO, with all but $250,000 suspended due to an inability to pay. The company and CEO are permanently banned from, among other things, offering business financing, debt relief, and credit repair services.
Bite 1: FTC Takes Action Against Multi-Family Rental Property Manager
On December 2, 2025, the FTC and state of Colorado settled a case with the nation's largest multi-family rental property manager over allegedly deceptive advertising practices and hidden rental fees. The FTC and Colorado filed a lawsuit in January 2025, alleging that the company's practices violated the FTC Act, the Gramm-Leach-Bliley Act, and the Colorado Consumer Protection Act. The company has agreed to pay $23 million to the FTC and $1 million to the state of Colorado. The settlement agreement also requires the company to refrain from misrepresenting the total monthly rental price, prominently disclose the total monthly leasing price, and clearly and conspicuously provide all fee details before taking any payment. Chairman Ferguson issued a concurring statement that applauded the Commission staff's hard work in investigating and litigating this case, and the work on this case revealed that the problem persists in the rental market industry. Chairman Ferguson directed Commission staff to begin the process of proposing a rule to address unfair or deceptive fees in rental housing.
Still hungry? Please join us for our next Consumer Financial Services Bites of the Month. If you missed any of our prior Bites, request a replay on our website.
Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.
Sign Up for Hudson Cook Insights and Enforcement Alerts here: