CFPB Rule Limiting Supervision May Open Door for Nonbank Expansion

When the Consumer Financial Protection Bureau posts a notice in the Federal Register, the language is usually dense, procedural and, at least for some, easy to overlook.

A bulletin published Tuesday (Aug. 26) sets the stage for a new definition of “risks to consumers” in supervisory designation proceedings. It may quietly redraw the lines of who is, and who is not, subject to the CFPB’s oversight.

The Issues on the Table

The proposed rule would bind the CFPB to a consistent standard for designating nonbanks as subject to bureau supervision. The agency has long had the authority to supervise nonbank firms if their conduct posed “risks to consumers.”

Traditionally, the CFPB has decided that question case by case. It now proposes to define that phrase as conduct that both “presents a high likelihood of significant harm to consumers” and is “directly connected to the offering or provision of a consumer financial product or service.”

Beyond the commentary period, which lasts until Sept. 25, this shift matters because it could limit the bureau’s reach. Instead of applying its authority broadly — for instance, to cover small but potentially risky harms — the CFPB said it intends to focus only on “serious conduct.” That means, at least potentially, that fewer firms may find themselves pulled into the bureau’s supervisory orbit.

Key Data Points From the Federal Register

A Population of 154,430 Potentially Covered Firms
According to Census data analyzed by the bureau, roughly 154,430 firms are operating in industries that fall under its potential supervisory umbrella, ranging from nondepository lending to consumer reporting and debt collection. Yet to date, the CFPB has exercised this supervisory authority over fewer than 20 nonbank entities. That gap suggests the new rule may not just clarify the standard, but also signal that the agency intends to use it sparingly.

Lower Likelihood of Supervision Going Forward
The bureau explicitly stated it “expects that under the proposed rule it will be less likely to designate any particular entity for supervision, all other factors being equal.” That expectation matters for platforms, FinTechs and other nonbanks. Fewer designation orders mean lower compliance costs as a pathway toward innovation or to expand into financial services without the shadow of CFPB examinations.

The Cost of Supervision Is $27,000 Per Exam
The CFPB estimates that a typical supervisory exam carries about $27,000 in labor costs for a firm, based on average staffing and preparation requirements. While that sum may seem modest relative to overall compliance budgets, the bureau said the burden can vary by firm size and structure. By narrowing the circumstances under which exams occur, the CFPB could be lowering the tangible cost of entry into financial services for platforms that straddle commerce, data and payments.

Platforms and other companies may feel freer to embed themselves deeper into financial services, from offering wallets and payments to extending credit and managing consumer data. The rule’s narrow focus effectively leaves more room for private litigation, state regulators and existing compliance practices to shape the market.

Why KYC and AML Still Matter

Whether the CFPB is supervising them, platforms cannot afford to relax on know your customer (KYC) and anti-money laundering (AML) obligations. The PYMNTS Intelligence report “Global Money Movement: U.S. Edition” found that 36% of U.S. consumers not using digital wallets would adopt them if they were perceived as more secure. Among small- to medium-sized businesses (SMBs), 31% of non-users cited security as a key concern preventing adoption.

Meanwhile, cryptocurrency has long been a haven for fraudsters. While custody in traditional finance is the boring backbone of asset safety, in crypto, it’s a technological and regulatory minefield.

“As the crypto industry matures, the lines between custody, banking and compliance are blurring,” PYMNTS reported in July. “Custodians are no longer just service providers; they are gatekeepers of financial integrity. And in this new era, the simple-sounding disciplines of KYC and AML are just as much of a must-have for crypto as they are in traditional finance.”