Our Take: financial services regulatory update – November 14, 2025

November 14, 2025

Change remains a constant in financial services regulation

Read "our take" on the latest developments and what they mean.

CFPB narrows fair lending, small-business data rules amidst funding uncertainty

What happened? This week, several events concerning the CFPB took place:

On November 10^th, the DOJ filed a notice in a case (NTEU, et al. v. Vought) challenging the CFPB’s workforce reduction plan indicating that the CFPB would no longer be able to draw funding from the Fed.
On November 13^th, the CFPB issued a proposal that would amend Regulation B (Reg B), the implementing regulation for the Equal Credit Opportunity Act (ECOA), which prohibits lenders from discouraging or denying applicants for credit based on certain prohibited characteristics (e.g., race, religion, national origin, sex, marital status, or age). Included in Reg B are restrictions on how lenders advertise, underwrite, and offer credit.
On November 13^th, the CFPB reproposed a modified version of its 2023 small business lending data collection rule, which implements Section 1071 of the Dodd-Frank Act.

What does the funding notice say? The DOJ filing cites a new opinion from the Department’s Office of Legal Counsel (OLC) concluding that the Fed currently has no “combined earnings” available for transfer to the CFPB.¹ In the same filing, the CFPB stated that it expects to have sufficient resources to continue normal operations through December 31^st but anticipates exhausting its remaining funds in early 2026. The notice also states that the Acting Director will be required to submit a report to the President and Congress outlining the CFPB’s funding needs and references the Antideficiency Act, which limits agency operations during any funding lapse to functions necessary to protect life or property.

What would the Reg B proposal do?

Remove the “effects test.” Currently, Reg B prohibits lending practices that have the effect of discriminating – using the “effects test,” a legal theory in which lending criteria that appear to be neutral in fact improperly disadvantage a protected class [MP1] (e.g., minimum loan amount that results in fewer loans to certain groups). The proposal would remove all references to this theory and provide that unequal outcomes alone, without discriminatory intent, do not violate ECOA.
Narrow the definition of what constitutes discouraging an application for credit. Today, Reg B defines discouragement as any “oral or written statement” or “act or practice” in advertising or otherwise that would deter someone from applying. The proposal narrows this by removing acts and practices and limits discouragement to actual statements, either written or visual, made to applicants with intent to discriminate. The proposal also gives examples of actions that, by themselves, would no longer constitute discouragement, such as targeted marketing, audience selection, or geographic focus – including campaigns encouraging a particular group.
Ban protected characteristics in special-purpose credit programs. For-profit lenders would be prohibited from using race, national origin, or sex as eligibility criteria in special-purpose credit programs. Lenders that continue offering them would face new documentation and evidentiary requirements demonstrating the program’s necessity to meet a specific, legally recognized credit gap.

What would the Section 1071 reproposal change? The proposal would make the following changes to streamline requirements and reduce compliance burdens:

Raise the lender coverage threshold. It would increase the threshold for reporting from 100 to 1,000 small-business loans in each of the prior two years.
Narrow the scope of covered lending. Merchant cash advances, agricultural lending, and loans of $1,000 or less would be excluded.
Redefines small business eligibility. The limit for a “small business” would be reduced from $5 million to $1 million in annual revenue, with future inflation adjustments.
Reduce the number of reportable data fields. It would limit reporting to items required by Section 1071 and a few enabling details (e.g., industry code, time in business, number of principal owners). It would eliminate a number of fields included in the 2023 rule including pricing, denial reasons, application method and recipient, number of employees, and LGBTQI+ ownership status.
Simplifies demographic reporting. It would collect sex as a binary male/female field and emphasize an applicant’s right to refuse to provide this data. It would also remove a prior requirement for lenders to monitor “low response rates” to demographic questions as potential evidence of discouragement, but lenders would still need to maintain procedures reasonably designed to obtain a response.
Delays implementation. All covered institutions above the new threshold in both 2026 and 2027 would have a single compliance date of January 1st, 2028.

What’s next? Comments on both the Reg B and Section 1071 proposals are due on December 15^th. The Acting Director’s report on CFPB funding would be due within 90 days of a determination that funds transferred from the Fed are insufficient.

Our Take

De facto shutdown via the purse

The DOJ’s notice on CFPB funding marks a new phase in the administration’s approach to the CFPB: restricting its capacity to operate by cutting off its access to resources rather than challenging its existence directly. In contrast to earlier, more direct efforts to challenge the CFPB’s authority, this approach would constrain its scope without directly contravening existing statutes or the Supreme Court’s recent rulings upholding its constitutionality and funding structure. When the CFPB runs out of funds, it would be limited to “excepted” work under the Antideficiency Act, which would likely only include urgent enforcement and time-critical litigation activities. Notice-and-comment rulemaking is discretionary, so a lapse would stall staff review of comments, economic analysis, drafting and clearance. Comment windows already opened would close on schedule, but the Bureau may be unable to move to a final rule until funding resumes — making it harder to complete the Reg B amendments and the Section 1071 revisions.

Narrower ECOA liability does not lessen responsibility

By recommending both a narrowed legal basis for ECOA liability and discouragement, the CFPB is dialling back fair lending compliance risk, cementing a shift in enforcement tone that has already been felt through the absence of examinations and fair-lending actions over the past several months. However, it is important to note that the proposed amendments maintain the core ECOA prohibition against discrimination in credit transactions. Moreover, they do not impact other key fair lending laws, including the Fair Housing Act (FHA), which defines illegal discrimination for real estate lending. As such, firms should tread carefully before considering any changes to fair lending compliance programs driven by the proposal and related enforcement priorities, as fair lending liability and scrutiny will persist from several directions. State authorities and private plaintiffs are likely to ramp up fair lending actions to fill gaps left by a narrower federal posture, as both ECOA and the FHA contain provisions that allow for private right of action. In addition, as oversight priorities shift over time, institutions should remain mindful that today’s lighter touch may draw retrospective scrutiny when the regulatory pendulum swings back.

Revisions that limit reach while preserving the rule of law

The decision to revise rather than repeal the Section 1071 rule reflects the CFPB’s scaled back interpretation of its authority while maintaining the core data-collection framework required by statute. This approach aligns with the administration’s intent to pare down the Bureau’s discretionary policymaking and restrict it to the minimum statutorily required functions. Coupled with the looming funding constraints, the proposal outlines a blueprint for a leaner CFPB that maintains statutory compliance but operates with less capacity to shape policy or influence market behavior.

What’s the bottom line? These actions advance the administration’s restraint of the CFPB from an expansive policy driver to a constrained statutory agency. While the Bureau’s fair lending enforcement will continue to wane, there are other enforcement mechanisms ready to fill the federal gap.

Digital assets: Congress and SEC take steps toward clarity

What happened? The following notable events took place in digital assets over the past week:

On November 10^th, the Senate Agriculture Committee released a discussion draft of market structure legislation.
On November 12^th, SEC Chair Paul Atkins gave a speech on the SEC’s approach to digital assets and its near-term digital assets agenda.

What does the market structure legislation say? The draft legislation is overall similar to the CLARITY Act, which passed in the House in July 2025.

Like the CLARITY Act, it would define the majority of non-stablecoin digital assets as “commodities” subject to CFTC oversight, while stablecoins would be overseen by bank regulators in accordance with the GENIUS Act. It would also set forth requirements around registration, disclosures, and consumer protection measures such as segregation of customer funds and conflict of interest safeguards.
However, many sections remain empty pending ongoing negotiations with the Senate Banking Committee, which is expected to release its own draft in the coming weeks. These areas include provisions regarding anti-money laundering (AML) and sanctions, the definition of “securities,” rules for decentralized finance and the treatment of software developers.

Our Take

The crypto regulatory framework is taking shape

The draft market structure legislation and Atkins’ speech both point to the same regulatory direction for digital assets: one where the CFTC is given substantial new authority to oversee most non-stablecoin digital assets, while the SEC oversees a narrower set of tokenized securities and investment contracts.

The goal of a more complete regulatory framework may seem far away as (A) the Senate Agriculture draft will need to be reconciled an eventual Senate Banking Committee draft and the House’s CLARITY Act; and (B) the suite of rulemakings foreshadowed by Atkins are not yet at a proposal stage. However, the momentum and sharp focus from this administration on providing crypto clarity and bipartisan support in Congress mean that we expect to see these items come to fruition in the near future.

Although the Senate Agriculture draft leaves key areas unfinished, we expect it to largely align with the GENIUS and CLARITY Acts in several ways:

Directing FinCEN to tailor AML and sanctions rules to the specific risks posed by different asset types and market participants;
Providing safe harbors for software developers, preventing them from being broadly categorized as money transmitters; and
Defining digital asset “securities” consistent with both the CLARITY Act and Atkins’ vision —one that recognizes reclassification and evolving functionality.

What’s the bottom line? Both Atkins’ speech and draft market structure legislation point in the same direction – toward crypto regulatory clarity.

Financial crime: US focuses on scams and Mexican cartels

What happened? The following notable events took place this week regarding financial crime:

On November 12^th, the US Attorney, DOJ and FBI announced the creation of the Scam Center Strike Force tasked with investigating and disrupting scam centers through sanctions, seizures and prosecutions, with a focus on Burma, Cambodia and Laos. Alongside the announcement, Treasury’s Office of Foreign Assets Control (OFAC) designated a Burmese armed group, several Thai companies and various individuals that are connected to scam centers. As a result, all property and entities owned by the sanctioned parties in the US or held by US persons are blocked.
On November 13^th, FinCEN issued a proposal to identify transactions involving ten Mexico-based gambling establishments as of “primary money laundering concern” due to links to the Sinaloa Cartel. The proposal would (A) prohibit financial institutions from maintaining a US correspondent account used to process transactions related to the gambling establishments and (B) require firms to apply special due diligence to any correspondent account designed to guard against processing such transactions. Simultaneously, OFAC sanctioned 27 individuals and entities tied to Mexico-based casinos and restaurants with connections to the Sinaloa Cartel.

Our Take

A whole-of-government effort against illicit finance

This week’s actions signal a coordinated escalation of cross-border financial crime enforcement, cementing Southeast Asian scam centers as key areas of focus for this Administration alongside now-familiar priorities such as Mexican cartels. Financial institutions should carefully evaluate and mitigate any potential exposure to scam networks by:

Running sanctions screening against newly-listed parties in Southeast Asia, including ownership structures and affiliates.
Mapping geographic and sectoral risk exposure, particularly in remittance, crypto, and payments channels;
Updating typologies and monitoring scenarios to account for red flags associated with scam centers (e.g., mule account activity, suspicious international transfers, and labor exploitation signals); and
Implementing blockchain analytics and IP-detecting tools for crypto transactions to identify high-risk transactions.

For potential exposure to Mexican gambling entities, firms should consider:

Notifying correspondent account holders that access is prohibited for listed casinos (FinCEN provides model language in their notice).
Reviewing past activity (e.g., wires, trades, cash flows) for potential exposure.
Reevaluating correspondent relationships for any connection or risk of exposure to Mexican gaming entities, even if the accounts are not currently used for that purpose.
Reassessing SARs and alerts tied to Mexican gaming and ensure tagging aligns with FinCEN expectations.
Re-screening historical transactions for OFAC exposure, including under the 50% ownership rule.
Documenting and escalating findings internally and to regulators as appropriate.

What’s the bottom line? Treasury and law enforcement are deploying a broad toolkit against Mexican cartels and Southeast Asian scam centers. For financial institutions, this means elevated expectations for exposure monitoring and sanctions screening.

On our radar

These notable developments hit our radar recently:

European Commission consults on market-risk capital rules. On November 6^th, the European Commission opened a targeted consultation on potential amendments to the EU’s market risk prudential framework under the Capital Requirements Regulation. The Commission is seeking feedback on a policy option introducing temporary measures to mitigate capital impacts from Basel III market risk implementation misalignments. Responses are due by January 6^th, 2026.

Fed’s Waller reveals further details around plan for “skinny” accounts. On November 12^th, Fed Governor Christopher Waller spoke at the Philadelphia Fed’s Fintech Conference on the to-be-proposed “skinny” payments accounts that would grant payments firms with access to the Fed’s payment and settlement infrastructure. He noted that the Fed will soon release a request for information with a 45-day comment period and that he intends to have the accounts operational by the end of 2026. (For more, see Our Take here).

Fed’s Barr outlines AI priorities for central banking and supervision. On November 15^th, Fed Governor Michael Barr emphasized the transformational potential of AI in remarks at the Singapore Fintech Festival. Barr highlighted the need for central banks to accelerate responsible AI adoption internally and flagged key risks in financial services, including bias, model explainability, and market stability.

FDIC updates exam cycle frequency for consumer compliance and CRA evaluations. On November 7^th, the FDIC announced revisions to its Consumer Compliance Examination Manual by extending examination and CRA evaluation cycles for most institutions based on asset size. Institutions will now follow 24–36, 54–66, or 66–78 month cycles, with a new mid-point risk analysis to determine if targeted supervisory activities are warranted. The FDIC has provided a redline document that identifies all changes.

¹ Under the Dodd-Frank Act, the CFPB receives its funding from the Fed’s net income rather than through congressional appropriations; when the Fed reports operating losses, there are no earnings available to draw upon.