CFPB agenda, credit risk, supervision and insurer solvency – July 24, 2026

July 24, 2026

Change remains a constant in financial services regulation

Read "our take" on the latest developments and what they mean.

Acting CFPB Director testifies before Congress; Nominee has confirmation hearing

What happened? On July 23^rd, Brian Johnson, the nominee to lead the CFPB on a permanent basis, had a confirmation hearing before the Senate Banking Committee. The prior week, on July 15th and 16th, Acting CFPB Director Vought testified before the House Financial Services Committee and Senate Banking Committee regarding the Bureau's activities, priorities, and future direction. The hearings followed the release of the CFPB’s 2026 rulemaking agenda covering planned regulatory actions and reconsiderations across several consumer financial services topics.

What were key themes of the hearings? The hearings covered a range of topics related to the CFPB's current operations, future direction, and statutory authorities:

CFPB existence and accountability. One of the clearest themes across the hearings was disagreement regarding the CFPB's existence, size and structure. Republican lawmakers argued that the CFPB exercises substantial authority with insufficient congressional accountability and supported reforms designed to increase oversight, transparency, and congressional control. Vought advocated for significant reforms to the Bureau, up to and including eliminating it altogether, subjecting it to the appropriations process, reducing its staffing levels, and increasing congressional control over its activities. Democratic lawmakers questioned whether those changes would limit the CFPB's ability to protect consumers and fulfill its statutory responsibilities.
Johnson repeatedly rejected calls to agree that the CFPB should be eliminated, stating that the CFPB is a "creature of statute" with responsibilities assigned by Congress that must be carried out. Johnson also stated that he would independently assess CFPB staffing levels if confirmed, while noting that ongoing workforce reduction plans remain subject to litigation.
Supervision and enforcement. Republican members generally supported efforts to reduce supervisory burden, narrow enforcement activity, and focus the CFPB’s actions on clear statutory violations and measurable consumer harm. Democratic members questioned whether reduced examination activity, withdrawn enforcement cases, and lower staffing levels could weaken oversight and diminish consumer protections. Vought defended the reduced examination volume and enforcement activity as efforts to move away from what he described as "regulation through enforcement." He also stated that the CFPB expects to conduct approximately 70 examinations this year, focused on higher-risk areas, and described efforts to reduce duplication with other regulators.
Regulatory governance. Republican lawmakers repeatedly criticized the use of guidance documents, advisory opinions, examination manuals, interpretive rules, and enforcement actions to establish expectations outside formal rulemaking processes. Several members argued that policy changes should occur through notice-and-comment rulemaking and be grounded in clear statutory authority. UDAAP was a frequent example, with lawmakers criticizing the CFPB's use of supervisory guidance and examination manuals to expand interpretations of unfair, deceptive, and abusive acts or practices beyond what they viewed as Congress's original intent. Democratic lawmakers generally emphasized preserving the CFPB's flexibility to respond to emerging consumer harms and evolving market practices.

What is in the CFPB’s 2026 agenda? Key items on the agenda include:

Rulemaking	Agenda Status	Context
Personal Financial Data Rights (Section 1033 / Open Banking)	Proposed Rule	The CFPB is reconsidering its 2024 open banking rule after it faced litigation. During the hearings, Vought said the CFPB remains supportive of open banking and is "very close" to issuing a revised proposal.
Small Business Lending Data Collection (Section 1071)	Final Rule	The CFPB finalized a revised rule on May 1^st, 2026 that significantly narrowed a framework finalized in 2023, including raising reporting thresholds and reducing required data collection. Vought highlighted these changes during the hearings as a return to the statutory requirements.
Amendments to Dodd-Frank Act Sections 1031 and 1036 (UDAAP)	Prerule	This item follows ongoing debate regarding the prior administration's use of UDAAP to address discrimination and other practices not expressly addressed in statute.
Procedures for Guidance Documents	Proposed Rule	The CFPB rescinded more than 70 guidance documents in 2025 and is considering formal procedures governing the future use and issuance of guidance.
Procedures for Periodic Review of Bureau Regulations	Proposed Rule	The CFPB plans to establish a formal process for reviewing existing regulations to determine whether they should be amended, streamlined, or rescinded.
Legal Standard Applicable to Supervisory Designation Proceedings	Final Rule	The rule would establish the legal standard the CFPB will use when determining whether certain nonbank companies should be designated for supervision.
Larger Participant Rulemakings	Proposed Rule	The CFPB plans to reconsider the definitions used to determine which nonbank firms are subject to CFPB supervision across four markets (Auto Finance, Consumer Reporting, Debt Collection, International Money Transfers). Proposed rules are expected during August and September 2026.
Equal Credit Opportunity Act (Regulation B)	Final Rule	The CFPBalized amendments to Regulation B in April 2026 that removed the effects test, narrowed the discouragement standard, and revised requirements for special purpose credit programs.
Ability-to-Repay / Qualified Mortgage Requirements	Prerule	The CFPB has returned the ATR/QM framework to the prerule stage as part of a broader review of mortgage regulations.
Payday, Vehicle Title, and Certain High-Cost Installment Loans Reconsideration	Proposed Rule	The CFPB continues to reconsider its payday lending framework. During the hearings, Vought indicated that a small-dollar lending rule remains on the Bureau's agenda and is a near-term priority.
Consumer Financial Civil Penalty Fund Rule Amendment	Final Rule	The rule would amend regulations governing administration of the Civil Penalty Fund, which is used to provide compensation to consumers harmed by violations of federal consumer financial laws.

What's next? The Senate Banking Committee will vote on Brian Johnson’s nomination before it is considered by the full Senate.

Our Take

The CFPB's core functions survive

After over a year of uncertainty about whether the CFPB would continue operating in anything close to its historical form, the recent hearings offered the clearest indication yet that a narrower ‒ but still active ‒ CFPB is beginning to emerge. While the final scope of the Bureau's workforce reductions remains uncertain, the hearings suggest that whatever resources ultimately remain will be concentrated on activities that leadership views as core statutory responsibilities. Although Vought's discussion of a supervisory program consisting of roughly 70 examinations this year demonstrates that the CFPB is continuing active supervision, it is a sharp decline from the average 600 examinations per year conducted between 2020 and 2024. The limited exams are likely to focus on priorities articulated throughout the last year, such as fraud, mortgage-related harms, military protections, credit reporting, debt collection, and other matters involving identifiable victims and measurable consumer harm. For financial institutions, a more focused CFPB may create opportunities to reassess controls, governance processes, and compliance activities developed in response to prior priorities. However, firms should not interpret a reduced CFPB footprint as a reduced need for consumer compliance programs. Federal consumer protection statutes remain in effect, and enforcement authority continues to reside not only with the CFPB but also with state attorneys general, state financial regulators, prudential banking agencies, the FTC, and private litigants. In addition, firms should be cautious about assuming today's supervisory priorities will remain fixed, particularly given the CFPB's history of significant policy shifts across leadership transitions.

An agenda focused on constraint and fulfilling statutory obligations

That said, the 2026 rulemaking agenda points to a broader effort to constrain future CFPB leadership from expanding the Bureau's authority without a thorough rulemaking process. Proposed actions addressing guidance documents, periodic review of regulations, supervisory designation proceedings, larger participant supervision, and a potential narrowing of UDAAP authority all point toward an effort to narrow the mechanisms through which future leadership can establish expectations outside of formal rulemaking. At the same time, the agenda makes clear that current leadership is not abandoning major policy initiatives where it sees a clear statutory mandate. Vought's comments on a forthcoming open banking proposal suggest that the CFPB will preserve consumer-directed access to financial data as a requirement. However, it remains to be seen how the new proposal will balance access rights, liability, data security, competitive concerns, and implementation costs among banks, aggregators, fintechs, and consumers.

Banking agencies release credit risk guidance on non-work authorized borrowers

What happened? On July 13^h, as directed by Executive Order 14406, the OCC, FDIC, and NCUA issued guidance to remind supervised financial institutions of their existing obligations with respect to credit risk management, particularly as it relates to borrowers who are not legally authorized to work in the United States (“non-work authorized borrowers”).

What does the guidance say? The guidance highlights a number of credit risk concerns, including:

Core expectation. Financial institutions should identify, measure, monitor, and control credit risk from non-work-authorized borrowers through safe and sound underwriting practices assessing willingness and capacity to repay.
Source of repayment. Firms should consider elevated risk that income could be disrupted by employment termination due to lack of work authorization, suspension/termination after expired authorization is discovered, inability to become lawfully reemployed, or removal from the U.S. Stress-test repayment capacity against these employment-interruption scenarios.
Collateral. Lenders should recognize added difficulty enforcing security interests — harder to contact borrowers or locate/repossess unaffixed collateral (autos, RVs, boats).
Documentation/verification. Firms should consider requiring/reviewing paystubs, W-2s, tax returns, employer verifications, bank statements, or evidence of continuing work authorization. Consider whether these loans show credit weakness regardless of delinquency status, for classification and allowance (credit loss reserve) purposes.
Portfolio/concentration risk. Financial institutions are advised to watch for concentrated exposure to geographies, employers, or industries vulnerable to immigration enforcement or workforce disruption — this can produce correlated (not just isolated) credit deterioration.
Consumer compliance risk. The guidance notes the CFPB's June 8, 2026 "Statement on Ability to Repay and Immigration Status" and explains connection to consumer protection regulations:
- TILA/Reg Z. Creditors must make a reasonable, good-faith ability-to-repay determination before consummation on dwelling-secured loans; credit card issuers must consider ability to make minimum payments. Firms relying on U.S.-employment income may — and in some circumstances must — factor in the borrower's underlying and continuing ability to earn that income where U.S. residency is required for the job.
- ECOA/Reg B. Creditors may take immigration status into account and may consider status as it bears on the creditor's rights and remedies regarding repayment.

What's next? The EO directs Treasury to issue new rules on customer due diligence (CDD) by August 17th, 2026 and to update requirements for customer information programs (CIP) by November 15, 2026.

Our Take

A portfolio perspective, not an individual screening one.

While the credit risk guidance does not create any new prescriptive obligations, the Administration’s focus on non-work authorized borrowers means that it will likely find its way into examiner expectations quickly. This presents challenges for lenders on multiple fronts: (1) operational questions of data collection, analysis and use across multiple risk assessments; (2) consumer compliance expectations of fair treatment; and (3) potential conflicts with state protections around immigration status and national origin. Deciding which borrowers lack legal status or work authorization is difficult because immigration status is fluid, and all credit applicants – regardless of work authorization – risk some sort of potential work interruption.

The clearest path for financial institutions to address these issues may be to boil the guidance to its actual asks. Assessing income stability and repayment capacity under multiple scenarios, documenting income verification, monitoring portfolio concentration risk are largely status-neutral risk-management practices rather than a call to underwrite on immigration status directly. While firms should certainly revalidate that their underwriting practices are sound and that their customers have the ability to repay, they should largely view the guidance with a portfolio perspective, treating exposure to non-work authorized customers as a variable similar to sector or geographic concentration limits. Managed at the portfolio level, this risk becomes measurable and monitorable without forcing a status determination on any single applicant.

This distinction also addresses potential conflicts with consumer protection and conflicting state laws, with the practical remaining challenge an implementation one: building risk assessment processes that capture legitimate income-stability and repayment-capacity concerns without treating immigration or citizenship status itself as an adverse underwriting factor.

What should banks do now? Steps to consider include:

Assess underwriting documentation and criteria for adequate consideration of ability to repay and collateral management.
Revisit nonbank counterparty due diligence and eligible-loan criteria. Revisit nonbank counterparty due diligence and eligible-loan criteria. Firms that extend credit through nonbank financial institutions (NDFIs) – for example, a mortgage warehouse lender that originates loans to individual customers – should confirm that the NDFI’s underwriting of non-work-authorized borrowers does not quietly concentrate on the bank's own balance sheet. Consider tightening representations and warranties, ineligible-loan buyback triggers, and periodic loan-level file reviews.
Run discrete stress scenarios modelling a labor availability or enforcement shock. This is particularly important for firms with meaningful exposure in agriculture, hospitality, construction, food processing, or other sectors with potentially higher shares of non-work-authorized labor. They should also evaluate whether existing classification and reserve practices adequately capture this risk even for currently performing, non-delinquent loans.
Prepare for examinations. Proactive documentation of steps taken to identify, measure and monitor non-work authorized borrower exposure will be viewed favorably by examiners regardless of how the policy debate evolves.

Supervision: Highly sensitive information sharing and finding follow up

What happened? On July 16th, the Fed, OCC, and FDIC issued a joint statement establishing a coordinated approach for identifying and handling highly sensitive information (HSI) collected during examinations of supervised banks. Separately, on July 22nd, the Fed’s Office of Inspector General (OIG) released a report on how examiners followed up on safety-and-soundness findings at large and foreign banking organizations.

What does the information handling statement say? The statement establishes a coordinated interagency approach for handling highly sensitive information (HSI) or information that carries heightened disclosure risks, for example technology and network diagrams, detailed penetration-testing results, technical details of information technology control weaknesses, and succession-planning documents.

Supervisors will consider alternatives to obtaining and storing sensitive information. The agencies said that in order to safely obtain HSI, examiners may rely on onsite reviews, direct review from bank systems, redacted documents, summaries, or other methods that reduce the need to transmit or retain highly sensitive materials.
Institutions have a role in determining how highly sensitive information is handled. Banks may identify requested materials they believe should be treated as HSI, discuss appropriate handling methods with examiners, and escalate concerns regarding HSI treatment to their primary federal regulator.
Agencies committed to faster breach notification. The agencies stated they will notify affected institutions of a potential or confirmed material compromise of confidential supervisory information within 72 hours after determining a compromise occurred and identifying affected institutions, subject to legal consideration

What did the Fed OIG report say? The report highlighted issues with the Fed’s process for validating remediation of supervisory findings and discussed several changes intended to address them:

Validation delays. The OIG found that supervisors often did not complete validation of remediation efforts for horizontal findings until months after institutions submitted remediation materials. In many cases, staff waited for the next annual horizontal review cycle before confirming whether remediation was effective and closing the finding, leaving institutions with open supervisory issues long after having completed corrective actions.
Change to greater reliance on firms’ internal audit. As a step to address the noted delays, the report describes the Fed’s revised supervisory operating principles (SOPs) under which supervisors will generally rely on institutions' internal audit functions to validate remediation efforts rather than conducting separate validation work themselves.
Reduced use of horizontal reviews. The report also highlighted a recent policy change that calls for supervisors to determine that the supervisory benefits of a horizontal review outweigh the associated costs before conducting one.

What's next? The agencies will issue written guidance and training to examiners to implement the HSI approach, and examiners will begin communicating the new identification and escalation processes at the outset of examinations.

Our Take

The agencies are listening ‒ but implementation will be the real test.

Together, the publications signal a willingness to address longstanding bank concerns regarding information security and excessive delays in the administration of supervisory activities. The HSI statement comes more than a year after an OCC data breach prompted many institutions to sharply pull back the types of information shared with supervisors and how it is transmitted. In fact, it describes many of the approaches institutions have already developed independently in response to the breach, including restricted-access environments, onsite reviews of particularly sensitive materials, and differentiated handling of cybersecurity and technology information. The agencies stop short of prescribing specific approaches or handling requirements and continue to leave significant discretion to institutions and examination teams. As a result, the guidance may not fully address banks’ concerns regarding transparency into the changes agencies have made to strengthen their information security practices or consistency in how sensitive information is treated across institutions and supervisory portfolios.

Similarly, the Fed OIG report arrives after years of industry complaints that findings often remain open long after remediation efforts have been completed. While many of the changes highlighted in the report ‒ including greater reliance on internal audit and a more selective approach to horizontal reviews ‒ have already been incorporated into the Fed's revised SOPs, questions remain as to how quickly and consistently those changes will be implemented across examination teams and portfolios. It takes time for policy changes to translate into examination practice, but the revised SOPs notably include an invitation for institutions to escalate supervisory practices that appear inconsistent with the new framework.

More broadly, these developments reflect an agency environment that is increasingly willing to reconsider how supervision is conducted. Institutions may view this period as an opportunity to engage constructively on process improvements, particularly where supervisory activities consume significant resources without materially improving risk management outcomes.

California progresses long-term insurer solvency planning regulation

What happened? On June 12th, the California Department of Insurance proposed its long-term solvency planning rule.

What would be required? The proposal is largely consistent with a draft rule released last fall and would require California-domiciled insurers to document and maintain analyses supporting their long-term capital resilience and solvency planning efforts. Key requirements would include:

A portfolio of risk-mitigation technologies. All California-domiciled insurers would be required to maintain a portfolio of technologies used by policyholders to reduce losses, together with analysis of the past performance and anticipated long-term effectiveness of those technologies and strategies.
A materiality assessment of emerging risks. California-domiciled insurers writing more than $50 million in direct annual U.S. premium would be required to assess risks and opportunities that could affect underwriting, investments, or operations, including:
- o Technology-driven risks such as data complexity, quality, and security
- o Climate-related physical risks, including acute risks from extreme weather and chronic risks such as sea-level rise, land-use changes, water availability, agricultural productivity, and temperature extremes
- o Transition risks arising from economic and technological change, including technological shifts, future government actions, and disruptions in access to capital.
- o Other risks expected to become more volatile over the next twenty years, including regional and global economic trends and litigation risks
Analysis of material risks and mitigation strategies. California-domiciled insurers writing more than $50 million in direct annual U.S. premium would need to document how identified material risks will be managed through 2030, 2040, and 2050, including:
- o Disruption risks related to technology and innovation
- o Climate scenario analysis and stress testing
- o Resilience assessments, scenario selection rationale, sensitivity analysis and areas of uncertainty
- o Investment concentration and exposure to catastrophic events
- o Long-term investment strategy targets, performance metrics and methods of measuring progress
- o Opportunities for new insurance products and the technical capabilities needed to support long-term climate and technology risk analysis

What has changed from the draft rule? Following public meetings and input last fall, the proposal makes several changes:

New compliance deadline. The June proposal would require insurers to make the required analyses available to examiners by January 1, 2028.
A specific transition risk stress-testing requirement. The proposal now explicitly requires stress testing of transition-risk scenarios alongside climate-risk scenarios and places greater emphasis on how economic, technological, and policy transitions could affect future solvency and access to capital. Beyond the new transition-risk stress testing requirement, the proposal incorporates transition risk more broadly into long-term planning expectations, including how insurers assess future investment strategies and capital resilience.
Expanded analysis of other material risks. The October draft required insurers to identify "other material risks" but did not clearly require further analysis. The proposal would require insurers to further document and analyze those risks.

What’s next? The Department of Insurance will hold a virtual public hearing on the Long-Term Solvency Planning Regulation on July 28th.

Our Take

California is redefining what it means to be solvent, long-term

By requiring insurers to analyze how climate, technology, transition, cybersecurity, and other emerging risks, the proposal expands solvency oversight beyond traditional capital measures and toward the quality of an insurer's forward-looking risk management, governance, and resilience planning. The proposal also places greater weight on an insurer's ability to identify, assess, and adapt to risks that may emerge gradually over decades rather than over a typical planning cycle. While many of the potential requirements (e.g., climate risk assessments, scenario analysis, cybersecurity planning, technology risk governance, and identification of emerging risks) are not new, the proposal intentionally brings these elements together under a solvency-focused framework that directly links emerging risks to future capital planning and regulatory examination readiness. By linking long-term solvency planning to formal supervisory expectations, finalization of this proposal would raise the bar for data, modeling, and analytical capabilities needed to support these assessments. Evaluating risks across 2030, 2040, and 2050 time horizons may require insurers to rely on external datasets, assumptions, and projections that are difficult to obtain or validate, not yet available at the necessary level of granularity, or inherently subject to significant uncertainty.

The proposal reflects an important trade-off that policymakers increasingly face.

More rigorous long-term solvency expectations may increase pressure for risk-based pricing and stronger capital positions, contributing to higher premiums in some markets over the near term. However, those same measures may reduce the risk of insurers continuing to write business at prices or concentrations that later prove unsustainable, leading to sudden non-renewals, market withdrawals, or sharp contractions in underwriting capacity. From a policy perspective, the objective is not simply lower prices today, but a market in which insurers remain financially able, and willing, to provide coverage over the long run.

Whether other U.S. jurisdictions adopt similar approaches remains to be seen, but insurers outside of California should monitor this rulemaking process and consider possible implications. It is worth noting that similar requirements have long been in place internationally, with supervisory regimes such as the EU's Solvency II framework and the UK's Solvency UK regime placing greater emphasis on forward-looking solvency and capital resilience, rather than a narrower focus on current financial condition alone.

While the regulation is not yet final, California insurers should consider:

Evaluating whether current Enterprise Risk Management (ERM) and Own Risk and Solvency Assessment (ORSA) processes adequately identify and assess risks that can emerge over a long time horizon, as well as their capital implications.
Assessing the maturity of scenario analysis and stress testing capabilities, including the ability to evaluate impacts across 2030, 2040, and 2050 time horizons.
Determining data availability and analytical capabilities needed to support long-term risk assessments.
Reviewing governance structures supporting climate, technology, cybersecurity, and other emerging risk oversight.

On our radar

CFTC sunsets routine large trader reporting for physical commodity swaps. On July 17th, the CFTC issued a final order sunsetting the routine position-reporting requirements of Part 20, ending the daily and event-based large trader reports that clearing organizations, clearing members, and swap dealers have filed for physical commodity swaps since 2011. The Commission is retaining related recordkeeping and special-call provisions as a transitional measure (parts 43, 45, and 150).

GENIUS Act implementation continues at state and federal levels. On July 17th, the FDIC requested comment on reporting forms for FDIC-supervised Permitted Payment Stablecoin Issuers. Separately, NYDFS proposed 23 NYCRR Part 202, aligning its stablecoin framework with the GENIUS Act and establishing reserve, capital, redemption, deposit, and cybersecurity requirements. The OCC stablecoin licensing information-collection notice was placed on public inspection and is scheduled for publication July 27. Banks and applicants should expect application forms to require detailed information about governance, financial resources, business plans, risk management, compliance and ownership.

Fed Vice Chair for Supervision speaks. On July 13th, Fed Vice Chair for Supervision Bowman outlined principles for modernizing financial regulation and supervision across material financial risk, tailoring, transparency, accountability, and emerging risks.

Fed, FDIC, and OCC publish 2026 regulatory agendas. In early July, The FDIC, Fed, and OCC published their portions of the 2026 Unified Agenda of Regulatory and Deregulatory Actions.

CFPB issues credit card late-fee RFI. On July 6th, the CFPB submitted a request for information (RFI) to OIRA regarding credit card late fees and late-payment practices. The item remains in the prerule stage and joins broader agendas published by the CFPB, Federal Reserve, FDIC, and OCC.

SEC proposes Reg E delivery. On July 16^th, the SEC proposed Regulation E-Delivery, a rule that would allow issuers, broker-dealers, investment advisers, and other market intermediaries to use electronic delivery to satisfy information delivery requirements under federal securities laws. Comments are due by September 21st, 2026.

NYDFS proposes formal rule on BNPL lenders. On July 15th, the New York Department of Financial Services published a formal proposed regulation implementing the state's BNPL Act, which would require BNPL lenders and qualifying platforms doing business in New York to obtain state authorization or licensure and comply with credit-card-style disclosure, fee, underwriting, and dispute-resolution requirements. Comments must be received by September 14th, 2026.

House passes Main Street Capital Access Act. On July 21st, the House of Representatives passed the Main Street Capital Access Act, which aims to restore tailoring to community and mid-sized bank regulation, ease new bank formation through phased-in capital requirements, add predictability to merger/acquisition approvals, and expand small and mid-sized banks' access to funding and liquidity.

Senate committee advances nomination to NCUA board. On July 23rd, the Senate Banking Committee voted to advance the nomination of John Crews to serve on the National Credit Union Administration (NCUA) board. If confirmed, Crews could lead the agency as the sole board member.

Our Take: Financial services regulatory update – July 24, 2026

(PDF of 336.76KB)

© 2017 - 2026 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details.

CFPB agenda, credit risk, supervision and insurer solvency – July 24, 2026

Change remains a constant in financial services regulation

Acting CFPB Director testifies before Congress; Nominee has confirmation hearing

Our Take

Banking agencies release credit risk guidance on non-work authorized borrowers

Our Take

Supervision: Highly sensitive information sharing and finding follow up

Our Take

California progresses long-term insurer solvency planning regulation

Our Take

On our radar

Our Take: Financial services regulatory update – July 24, 2026

{{filterContent.facetedTitle}}

{{item.title}}

{{item.title}}