The CFPB has issued a policy statement describing its plan to address criminally liable regulatory offenses. President Donald Trump previously issued an executive order on May 9, 2025, requiring each federal agency to publish guidance "describing its plan to address criminally liable regulatory offenses." The policy statement, published in the Federal Register on June 27, 2025, constitutes the CFPB's plan to address violations of federal regulations punishable by a criminal penalty.
The CFPB administers and civilly enforces a variety of federal consumer financial laws, including the Consumer Financial Protection Act (CFPA), Truth in Lending Act (TILA), Real Estate Settlement Procedures Act (RESPA) and Electronic Fund Transfer Act (EFTA). Regulations have been issued under each of these laws, some of which may be enforceable by a criminal penalty. Beyond stated criminal penalties within the regulations, the CFPB also has the discretion to refer alleged violations of criminal regulatory offenses to the U.S. Department of Justice (DOJ) for further investigation and action. When making these referrals, the CFPB presently considers:
- the harm or risk of harm, pecuniary or otherwise, caused by the alleged offense
- the potential gain to the putative defendant that could result from the offense
- whether the putative defendant held specialized knowledge or expertise, or was licensed in an industry related to the rule or regulation at issue
- evidence, if any is available, of the putative defendant's general awareness of the unlawfulness of his conduct, as well as his knowledge or lack thereof of the regulation at issue
Typically, when asked about potential penalties for violating TILA, EFTA and similar laws and regulations, the usual response is that willful violations may constitute criminal offenses. While there have been very few actual criminal prosecutions for violations of federal consumer finance laws, greater clarity about when regulators consider violations to be criminal is certainly beneficial. Accordingly, and in line with President Trump's executive order, the CFPB has outlined additional steps the agency will handing criminal penalties. Specifically, the CFPB will:
- Provide a report to the director of the Office of Management and Budget (OMB) within 365 days of the executive order, in consultation with the U.S. attorney general, including: "(i) a list of all criminal regulatory offenses enforceable by the Bureau or the Department of Justice; and (ii) for each such criminal regulatory offense, the range of potential criminal penalties for a violation and the applicable mens rea standard for the criminal regulatory offense." This report will also be published on the CFPB website at least once a year, with periodic updates as necessary.
- Consider whether a criminally regulatory offense is included in the aforementioned report when making the determination of referring certain criminal matters to the DOJ or the CFPB's inspector general.
- In consultation with the attorney general, examine the CFPB's statutory authorities and determine whether there is authority to adopt a background mens rea standard for criminal regulatory offenses that applies unless a specific regulation states an alternative mens rea. Within 30 days of the submission of the aforementioned report, the CFPB, in consultation with the attorney general, will submit a report to the OMB director summarizing the submitted information and assessing whether the applicable mens rea standards for criminal regulatory offenses enforced by the CFPB are appropriate. If necessary, the CFPB will also present a plan for changing the applicable mens rea standard, including a justification for all criminal regulatory offenses where the CFPB deviates from the default standard.
For all future proposed and final rules published in the Federal Register – the violation of which may constitute criminal regulatory offenses – the CFPB will include a statement, drafted in consultation with the DOJ, identifying that the rule or proposed rule is a criminal regulatory offense and the authorizing statute. The CFPB will also include a statement describing the mens rea for each element of a criminal regulatory offense with citations to the relevant provisions of the authorizing statute for each proposed or final rule with consequences that is published in the Federal Register. While this policy statement has no legally binding effect and does not impose any new or revise any disclosure requirements by the CFPB, it does "[articulate] considerations relevant to the Bureau's exercise of its authorities," a policy initiative that has been central to the Trump Administration's agenda for the CFPB.
Visit Holland & Knight's resource center, CFPB Dispatch: Legal Updates and Insights, to stay on top of the latest CFPB developments.
