There has been much speculation that States will fill the void created by the Trump Administration’s drastic scaling back of the Consumer Financial Protection Bureau. Congress authorized both state attorneys general and state regulators (like New York’s Department of Financial Services and California’s Department of Financial Protection and Innovation) to enforce the Consumer Financial Protection Act (CFPA), except against national banks and federal savings associations.[1] Under that authority, States may enforce the CFPA’s prohibition on engaging in UDAAPs,[2] and they may also have authority to enforce the CFPA’s separate prohibition on violating “Federal consumer financial law,” a term that the statute defines to include “the enumerated consumer laws”: TILA, FCRA, the FDCPA, EFTA, RESPA, and others.[3]
But while States may enforce these laws against state-chartered banks, credit unions, and non-depositories that offer or provide consumer-financial products and services, there is one way in which States could never match what the Bureau might have done. Since its inception, the Bureau has been awarded over $5 billion in civil money penalties.[4] A careful reading of the CFPA suggests that, unlike the Bureau, States may not obtain civil money penalties under the CFPA.
To be sure, the CFPA provides that any person who violates the statute “shall forfeit and pay a civil penalty pursuant to this subsection.”[5] This seems to suggest that any CFPA plaintiff could obtain a penalty. But the same subsection later says that no penalty may be imposed unless “the Bureau gives notice and an opportunity for a hearing” or “the appropriate court has ordered such assessment and entered judgment in favor of the Bureau.”[6] And it also says that “[t]he Bureau may compromise, modify, or remit any penalty.”[7] These requirements suggest that penalty may be imposed in matters only where the Bureau is at least a party.
Other provisions reinforce this reading. For example, the same section that speaks exclusively to the Bureau’s ability to obtain civil money penalties makes clear that “the Bureau, [a] State attorney general, or [a] State regulator may recover its costs” if they prevail in an enforcement action under the CFPA.[8] Conversely, in establishing the Civil Penalty Fund, the CFPA provides only that “[i]f the Bureau obtains a civil penalty against any person in any judicial or administrative action under Federal consumer financial laws, the Bureau shall deposit into the Civil Penalty Fund the amount of the penalty collected.”[9] If Congress had intended for States to obtain civil money penalties, it is not clear why Congress would not have prescribed where those amounts must be deposited, as it did for penalties obtained by the Bureau.
The CFPA does provide that States “may secure remedies under provisions of this title.”[10] But nothing in that provision specifies that States may obtain “any” or “all” remedies available under the CFPA. And Congress has the power to limit the remedies available to certain parties—as it has apparently done here with civil money penalties.
Civil money penalties arise from the relevant statute.[11] And the best reading of the CFPA’s provisions is that civil money penalties may be sought and obtained only by the Bureau.
At least one federal court has awarded a civil money penalty to a state attorney general in a default judgment,[12] and one state regulator has obtained a civil money penalty in a settlement.[13] But neither of these cases squarely considered this question in an adversarial setting and held that a State may obtain a civil money penalty under the CFPA, and a careful reading of the statute suggests that states are not permitted to do so. If and when States ramp up their efforts to enforce the CFPA and other Federal consumer financial laws, defendants should consider resisting demands for any civil money penalties under the CFPA.
McGuireWoods’ consumer financial services regulatory team advises leading financial institutions, fintech companies and nonbank lenders on compliance, enforcement and risk management issues in a rapidly evolving legal landscape. Clients rely on our deep regulatory knowledge and business-focused guidance to navigate complex challenges. Working with our nationally recognized state attorneys general practice, we defend clients in high-stakes investigations and enforcement actions, offering an integrated approach that anticipates regulatory trends, coordinates multi-agency responses and mitigates risk across jurisdictions. For questions about States’ efforts to enforce the Consumer Financial Protection Act, email the authors or your McGuireWoods contact.
[1] 12 U.S.C. § 5552(a).
[2] Id. § 5536(a)(1)(B).
[3] Id. §§ 5536(a)(1)(A), 5481(14) & (12); see also Pa. ex rel Shapiro v. Mariner Fin., LLC, 711 F. Supp.3d 463, 482 (E.D. Pa. 2024) (rejecting the argument that the CFPA prohibits States “from suing to enforce the 18 pre-existing laws that were incorporated into the CFPA as ‘enumerated consumer laws’”); Rohit Chopra & Seth Frotman, State Enforcement as a Federal Legislative Tool, 62 Harv. J. on Legis. 1, 20 (2025) (arguing that because the CFPA makes it unlawful to violate Federal consumer financial law, States may bring actions under the CFPA to address violations of the enumerated consumer laws). But see Authority of States to Enforce the Consumer Financial Protection Act of 2010; Rescission, 90 Fed. Reg. 20,565, 20,566 (May 15, 2025) (arguing that States may not under the CFPA enforce the enumerated consumer laws).
[4] CFPB, Enforcement by the numbers, https://www.consumerfinance.gov/enforcement/enforcement-by-the-numbers/ (last visited May 18, 2025).
[5] 12 U.S.C. § 5565(c)(1).
[6] Id. § 5565(c)(5) (emphasis added).
[7] Id. § 5565(c)(4) (emphasis added).
[8] Id. § 5565(b) (emphasis added).
[9] Id. § 5497(d)(1) (emphasis added).
[10] Id. § 5552(a)(1).
[11] See, e.g., SEC v. Jarkesy, 603 U.S. 109, 123–25 (2024); see also Abercrombie v. Clarke, 920 F.3d 1351, 1357 (7th Cir. 1990) (recognizing that scope of authority to impose civil penalties turns on construction of the statute).
[12] See Off. of Att’y Gen. v. Berger Law Grp., P.A., No. 14-cv-1825, 2015 WL 5922933, at *9 (M.D. Fla. Oct. 9, 2015).
[13] Lawsky v. Condor Cap. Corp., No. 14-cv-01863 (S.D.N.Y. Dec. 22, 2014) (final consent judgment).