The Great Unwinding: Mapping Two Years of Consumer Compliance Rule Reversals

From 2023 to 2025, the U.S. consumer financial regulatory landscape has undergone a dramatic transformation. What initially appeared as a wave of final rules from the Consumer Financial Protection Bureau and other agencies has rapidly reversed course, leaving compliance teams, fintechs, and community banks navigating a fractured and uncertain environment.

Over 20 major rulemaking actions were tracked during this period. Nearly half are now inactive—either withdrawn by the current administration, stayed by litigation, or vacated by federal courts. This is not random churn. It reflects a deliberate policy shift away from the Biden-era expansion of consumer protections, combined with aggressive legal resistance from industry groups and banking associations. The result is a regulatory pendulum that demands strategic planning rather than reactive compliance.

[IMAGE: A split image showing a stack of new regulations on one side and a shredder or trash bin on the other, symbolizing the rapid creation and destruction of rules]

---

The Rollback Chronology: Which Rules Survived and Which Didn’t

Understanding the current state of consumer compliance requires a clear timeline. The past two years have produced a complex patchwork of active, stayed, withdrawn, and vacated rules across multiple regulatory agencies.

Rules Repealed or Rescinded After Finalization

The most dramatic actions involved rules that had already been finalized, only to be reversed by the current administration. The overdraft fee rule, which would have significantly limited how large banks could charge for overdraft protection under Regulations E and Z, was formally repealed in May 2025. This move restored a significant revenue stream for major financial institutions.

The Community Reinvestment Act modernization rule, finalized in late 2023 after years of work, was withdrawn in July 2025. This rule had expanded geographic assessments and added new evaluation criteria for bank lending in low- and moderate-income communities. Its withdrawal represents a substantial scaling back of the CRA’s scope.

Additionally, the registry of nonbank financial institutions, designed to identify repeat offenders and increase transparency, was rescinded in October 2025. This registry had been a priority for the CFPB’s enforcement division and its removal signals a retreat from aggressive nonbank oversight.

[IMAGE: A timeline infographic with color-coded statuses: green for active rules, red for withdrawn rules, and yellow for stayed rules spanning 2023 through 2025]

Rules Frozen by Litigation

Several major rules remain in legal limbo, stayed by court orders while litigation proceeds. The medical debt underwriting ban, which would have prohibited creditors from considering medical debt in credit decisions, is currently frozen. This rule had implications for Regulation V compliance and fair lending practices.

The personal financial data rights rule implementing Section 1033 of the Dodd-Frank Act is also stayed. This rule is central to the open banking movement, requiring financial institutions to share consumer data with authorized third parties upon request. Its stay has delayed the promised consumer data portability revolution.

The digital payment app larger participant rule, which would have brought major payment platforms under CFPB supervision, similarly remains frozen. These legal battles have created a prolonged period of uncertainty for banks, fintechs, and consumer advocates alike.

Rules Vacated by Courts

One of the most significant blows to the CFPB’s enforcement authority came in April 2025, when a federal court vacated the credit card penalty fee rule under Regulation Z. This rule had capped late fees at $8 and prohibited certain penalty practices. The court found the CFPB had exceeded its statutory authority, a decision that has broader implications for the agency’s rulemaking approach.

Rules Withdrawn Before Finalization

The list of withdrawn proposals is equally extensive. The data broker rule under the Fair Credit Reporting Act was withdrawn, eliminating a proposed expansion of FCRA coverage to data brokers. The Buy Now, Pay Later interpretive rule, which would have subjected BNPL products to credit card-type protections, was also pulled. A fair lending statement regarding noncitizen lending was withdrawn as well, ending a Biden-era effort to expand credit access to immigrant communities.

---

The Hidden Economic Logic: Deregulation as a Response to Inflation and Litigation Risk

Not all regulatory changes are created equal. Some adjustments are routine, non-controversial updates required by law. Others represent deliberate policy choices that reshape the competitive landscape.

Routine Inflation Adjustments

Many of the regulatory updates during this period are CPI-W inflation adjustments. The asset-size exemption thresholds for Regulations Z and CC, appraisal thresholds under Regulation Z, and various fee limits have been updated to reflect inflation. These changes are procedural and generate little controversy. They are part of the normal regulatory machinery that ensures exemptions keep pace with economic reality.

High-Profile Rescissions and Revenue Impacts

The high-profile rescissions follow a different logic entirely. The removal of the overdraft fee rule, the vacation of the credit card penalty fee cap, and the withdrawal of the medical debt underwriting ban all remove constraints on revenue streams for large banks and fintechs. Overdraft fees represent billions in annual revenue. Credit card penalty fees are a major profit center. The medical debt rule would have limited a common collection practice.

These moves are not about regulatory efficiency. They are about preserving industry profitability in an inflationary environment where consumer defaults are rising and interest margins are under pressure.

[IMAGE: Line graph showing major bank fee income trends from 2020 to 2025, with vertical lines marking regulatory changes for overdraft fees and credit card penalties]

The Retreat from ESG Mandates

The withdrawal of climate risk principles and the CRA modernization rule signals a broader retreat from ESG mandates. The climate risk principles would have required large financial institutions to model and disclose climate-related financial risks. The CRA modernization expanded community lending requirements in climate-vulnerable areas. Both have been eliminated.

This reduces compliance costs for major institutions but raises questions about systemic risk management. Climate change remains a real threat to mortgage portfolios and property valuations. Without mandatory disclosure, investors and regulators may lack critical information.

Litigation as a Regulatory Constraint

The court-ordered vacation of the credit card fee cap has sent a clear message to the CFPB: aggressive rulemaking faces severe legal risk. This is not the first time a CFPB rule has been invalidated, but it is the most consequential. The agency is now fundamentally more cautious. Future rulemakings are likely to be narrower, more modest, and more carefully justified.

This litigation risk has already changed behavior. The CFPB has not replaced the vacated credit card rule with a revised version. It has not proposed alternative limits. Instead, it appears to be waiting for the legal environment to clarify.

---

The Open Banking Pivot: Why Section 1033 and Small Business Lending Remain Active

Amidst the widespread rollback, two areas show surprising continuity: open banking and small business lending data collection.

Section 1033 and the Data Portability Regime

The personal financial data rights rule under Section 1033 is stayed but not withdrawn. More importantly, the CFPB issued an Advanced Notice of Proposed Rulemaking in August 2025, signaling its intent to continue developing the open banking framework. This is a pivot, not a retreat.

The CFPB appears to view open banking as a bipartisan priority. Both Democratic and Republican administrations have supported increased consumer data access. Industry groups like the Financial Data Exchange have developed technical standards that align with the rule’s goals. The legal stay may be temporary, and the CFPB is using the time to refine its approach.

Section 1071 and Small Business Lending Data

The small business lending data collection rule under Section 1071 of the Dodd-Frank Act was extended in October 2025. Compliance deadlines were pushed back, but the rule itself remains in force. This requires financial institutions to collect and report data on small business credit applications, including information on the race, gender, and ethnicity of principal owners.

The Section 1071 rule is more controversial than open banking. Banking associations have filed lawsuits challenging its scope and constitutionality. However, the rule has not been stayed, and the CFPB has not withdrawn it. Compliance obligations remain, even as deadlines shift.

[IMAGE: A flowchart showing the regulatory path for Section 1033 and Section 1071 rules, with different outcomes for each]

---

The Unfinished Regulatory Agenda: What Comes Next

While the rollback has dominated headlines, several important regulatory initiatives remain in progress. These represent the unfinished business of the current regulatory cycle.

The Fair Lending Landscape

The withdrawn fair lending statement on noncitizen lending may return in revised form. The CFPB has not abandoned fair lending enforcement. It continues to pursue discrimination cases under the Equal Credit Opportunity Act and Regulation B. What has changed is the scope of regulatory guidance, not enforcement priorities.

The BNPL Puzzle

The withdrawn interpretive rule on Buy Now, Pay Later products leaves a regulatory gap. BNPL providers currently operate without clear consumer protection standards under Regulation Z. Industry groups have advocated for tailored regulation rather than full credit card-style requirements. The CFPB may revisit this issue through a formal rulemaking, but no timeline has been announced.

Privacy and Data Security

The withdrawn data broker FCRA proposal leaves a significant gap in consumer data protection. Data brokers operate largely outside the FCRA framework for most purposes. State privacy laws like the California Consumer Privacy Act partially fill this void, but there is no federal standard. This issue is likely to return, particularly as artificial intelligence tools increase demand for consumer data.

[IMAGE: A calendar-style graphic with highlighted dates showing upcoming regulatory deadlines and expected actions, with question marks for uncertain timelines]

---

Strategic Implications for Compliance Teams, Fintechs, and Community Banks

The current regulatory environment creates distinct challenges for different market participants. Understanding these implications is essential for strategic planning.

For Large Banks: Relief and New Risks

Large banks are the primary beneficiaries of the regulatory rollback. The rescission of the overdraft rule, the vacation of the credit card fee cap, and the withdrawal of the CRA modernization reduce compliance costs and protect revenue streams. However, the litigation around Section 1033 and Section 1071 creates uncertainty. Large banks must invest in technology for open banking compliance while waiting for the legal landscape to settle.

For Community Banks: Mixed Signals

Community banks benefit from inflation-adjusted asset-size exemptions that reduce their regulatory burden. However, they are also exposed to the same market pressures as larger institutions. The removal of the overdraft fee rule gives community banks flexibility to maintain fee income. But the ongoing legal challenges to Section 1071 create uncertainty about their compliance obligations.

For Fintechs: Opportunity and Uncertainty

Fintechs face the most ambiguous environment. The rollback of the overdraft rule and the credit card fee cap may reduce regulatory barriers to entry. However, the stay on Section 1033 delays the open banking data access that many fintechs rely on for their business models. The withdrawn BNPL interpretive rule eliminates immediate compliance pressure but leaves the sector without clear legal guidance.

For Compliance Teams: The New Normal

Compliance professionals must now operate in a highly dynamic environment. The traditional approach of implementing final rules and then moving to the next regulatory deadline no longer works. Instead, teams must monitor litigation outcomes, agency announcements, and Congressional actions in real-time.

[IMAGE: Three different pressure gauges or dashboards representing the compliance burden for large banks, community banks, and fintechs, with different readings for each]

---

Conclusion: A New Era of Strategic Planning

The regulatory calendar for 2023–2025 tells a story of deliberate and consequential change. This is not merely a review or reconsideration of existing rules. It is a systematic unwinding of the consumer protection framework built over the preceding four years.

The practical reality for compliance teams, fintechs, and community banks is that the era of predictable regulatory evolution is over. The legal challenges to Section 1033 and Section 1071 will not be resolved quickly. The rescinded rules on overdraft fees and credit card penalties are unlikely to return in their original form. The withdrawn proposals on data brokers and BNPL may resurface, but in unpredictable ways.

The key insight for strategic planners is that the current regulatory equilibrium reflects neither Democratic nor Republican priorities alone. It reflects a three-way tension between agency ambition, judicial skepticism, and industry resistance. This tension will not resolve quickly. The result is a fragmented regulatory landscape that requires careful monitoring, flexible compliance systems, and contingency planning for multiple possible futures.

The regulatory pendulum has swung, but it has not stopped. The question for every market participant is not whether the pendulum will swing again—but how to prepare for its next movement.