January 8 – Read the newsletter below for the latest Mortgage Banking and Consumer Finance industry news, written by Ballard Spahr attorneys. In this issue, our lawyers discuss the CFPB’s regulatory agenda, the veto of the NY Health Privacy Act, FinCEN data suggesting a slight downward trend in ransomware incidents, the CFPB's annual report on the Fair Debt Collection Practices Act, and more.
- Podcast Episode: The CFPB’s Most Ambitious Regulatory Agenda Ever—Part 1
- Podcast Episode: The CFPB’s Most Ambitious Regulatory Agenda Ever—Part 2
- Podcast Episode: Significant 2025 Deregulatory Developments in Banking Law
- District Court Refuses to Modify Preliminary Injunction Against CFPB While Clarifying That CFPB Is Not Precluded From Requesting Operating Funds From Fed Because of Fed’s Losses
- Why Judge Jackson Is Wrong: The CFPB Cannot Be Lawfully Funded When the Federal Reserve Has No Profits
- Former Senator Dodd, Representative Frank, and Current Democratic Members of Congress Ask Court to Reject Trump Administration’s Summary Interpretation of CFPB Funding Mechanism
- State AGs File Suit to Force CFPB to Request Funding From the Federal Reserve
- Circuit Court Grants Union’s Request for En Banc Rehearing in CFPB Employees’ Firing Case
- New York Governor Vetoes NY Health Privacy Act
- Has Ransomware Peaked? FinCEN Data Shows Slight Downward Trend in Incidents
- CFPB Releases Annual Report on Fair Debt Collection Practices Act (FDCPA)
- Colorado ‘Opt-Out’ Litigation—Petition for Rehearing En Banc And Amicus Briefs in Support
Podcast Episode: The CFPB’s Most Ambitious Regulatory Agenda Ever—Part 1
This episode features Part 1 of our November 4 webinar, “The CFPB’s Most Ambitious Regulatory Agenda Ever.” In this packed episode, our expert panel breaks down the Consumer Financial Protection Bureau’s (CFPB) largest and boldest regulatory agenda to date. Discussing an unprecedented lineup of 24 rulemaking items that could reshape the consumer financial services industry.
What’s Included:
- Unprecedented Regulatory Activity: We unpack why this semi-annual agenda stands out, the record number of proposed rules, and what this means for financial institutions, FinTechs, and consumers alike.
- Hot Topics Covered: From sweeping changes in mortgage servicing to open banking (1033 of Dodd-Frank/personal financial data rights), small business lending rules (1071 of Dodd-Frank), and the rollout of the Financial Data Transparency Act, we cover all the major initiatives and legal battles on the horizon.
- Industry Insight: Hear why certain rules are stirring up controversy, what compliance challenges lie ahead, and how litigation and funding woes at the CFPB might impact the pace of change.
- Practical Impact: Learn about technical corrections in remittance transfer rules, new standards for data sharing, and what these changes mean for day-to-day business operations.
Meet Your Speakers From Ballard Spahr:
- Alan Kaplinsky (Host and Moderator): Senior counsel, founder, and former leader of Ballard Spahr’s Consumer Financial Services Group
- Rich Andreano, Jr.: Senior counsel and head of the firm’s Mortgage Banking Group
- John Culhane, Jr.: Senior counsel in the Consumer Financial Services Group
- Greg Szewczyk: Chair of the firm’s Privacy and Data Security Group
- Mudasar Pham-Khan: Associate, Consumer Financial Services Group
- Kristen Larson: Formerly Of Counsel, Consumer Financial Services Group
- Daniel Wilkinson: Associate, Consumer Financial Services Group
- Rob Lieber: Counsel, Consumer Financial Services Group
- Aja Finger: Associate, Consumer Financial Services Group
Tune in for strategic insights and practical tips to help you prepare for the CFPB’s evolving rulebook. Whether you’re a compliance leader, financial executive, or simply interested in how Washington’s boldest moves will impact your world, this episode is your essential guide to what’s next in consumer financial services.
Consumer Finance Monitor is hosted by Alan Kaplinsky, senior counsel at Ballard Spahr, and the founder and former chair of the firm’s Consumer Financial Services Group. We encourage listeners to subscribe to the podcast on their preferred platform for weekly insights into developments in the consumer finance industry.
To listen to this episode, click here.
Consumer Financial Services Group
Podcast Episode: The CFPB’s Most Ambitious Regulatory Agenda Ever—Part 2
This episode features Part 2 of our November 4 webinar, “The CFPB’s Most Ambitious Regulatory Agenda Ever.” (Part 1 of this series was released on December 18. We encourage you to listen to that episode as well). In Part 2, we continue to unpack the far-reaching implications of the Consumer Financial Protection Bureau’s (CFPB) regulatory ambitions. The CFPB has published a sweeping agenda that promises to reshape the landscape for consumer financial services, and our panel of seasoned attorneys offers vital context and actionable insights for industry professionals, regulators, and informed consumers alike.
Key Topics Discussed:
- CFPB’s Pre-Rule and Long-Term Actions – What’s on the regulatory horizon, including advance notices and rulemaking targets that could reshape consumer finance.
- Clarifying “Unfair, Deceptive, and Abusive” Practices – Will the CFPB issue new rules or guidance to define these critical terms? The panel reviews statutory definitions and industry implications.
- Identity Theft and Coerced Debt Regulation – Proposed amendments to Regulation V including new protections for survivors of identity theft and economic abuse.
- Redefining Large Market Participants – Examination of thresholds for CFPB supervision in areas like auto financing, debt collection, consumer reporting, and international money transfers, aiming to target the largest market players.
- Qualified Mortgage Rules and Loan Originator Compensation – What changes might be coming to mortgage rules and compensation methods, especially for small-dollar loans? The industry’s wishlist and regulatory challenges are explored.
- The Equal Credit Opportunity Act (ECOA) and Disparate Impact – Is the CFPB shifting its stance on disparate impact liability in lending? Hear the latest on the Trump administration’s influence and evolving regulatory language.
- CFPB’s Withdrawal of Guidance Documents– A look at the Bureau’s move away from guidance toward formal rulemaking and the impact on regulated entities.
- Industry Feedback and Uncertainty – Lively discussion about compliance burdens, regulatory rescissions, and the ongoing uncertainty surrounding the CFPB’s future funding and priorities.
Meet Your Speakers From Ballard Spahr:
- Alan Kaplinsky (Host and Moderator): Senior counsel, founder, and former leader of Ballard Spahr’s Consumer Financial Services Group
- Rich Andreano, Jr.: Senior counsel and head of the firm’s Mortgage Banking Group
- John Culhane, Jr.: Senior counsel in the Consumer Financial Services Group
- Kristen Larson: Formerly Counsel, Consumer Financial Services Group
- Daniel Wilkinson: Associate, Consumer Financial Services Group
- Rob Lieber: Counsel, Consumer Financial Services Group
- Aja Finger: Associate, Consumer Financial Services Group
Tune in as our expert panel breaks down the complexities, anticipated impacts, and the road ahead under the CFPB’s ambitious agenda.
Consumer Finance Monitor is hosted by Alan Kaplinsky, senior counsel at Ballard Spahr, and the founder and former chair of the firm’s Consumer Financial Services Group. We encourage listeners to subscribe to the podcast on their preferred platform for weekly insights into developments in the consumer finance industry.
To listen to this episode, click here.
Consumer Financial Services GroupPodcast Episode: Significant 2025 Deregulatory Developments in Banking Law
Join host Alan Kaplinsky, founder and former longtime leader of Ballard Spahr’s Consumer Financial Services Group and one of the foremost thought leaders in the industry, as he welcomes two special guests for a timely and insightful conversation about the most significant deregulatory developments in banking law during 2025.
Alan is joined by his Ballard Spahr colleague Scott Coleman, a partner with more than 30 years of experience guiding banks and bank holding companies through mergers, acquisitions, and all facets of regulatory compliance, especially in the community banking sector. They’re also joined by Dr. Sean Campbell, Chief Economist and Head of Policy Research at the Financial Services Forum, where he represents the eight U.S. global systemically important banks. Dr. Campbell is a distinguished economist, former senior Federal Reserve official, and published academic.
In this episode, Alan, Scott, and Sean break down the latest developments and ongoing trends in bank regulation and supervision, and digital innovation. You’ll get expert analysis and practical takeaways on:
- The Deregulatory Wave: How the Trump administration’s aggressive deregulatory agenda is streamlining exams, reducing supervisory burdens, and shifting the focus toward core financial risk-while eliminating reputational risk as a part of President Trump’s Debanking executive order.
- Supervision and Stress Testing Reform: Why new Federal Reserve proposals to increase transparency in stress testing mark a turning point for large banks, moving away from a “check-the-box” approach to a laser focus on tangible risks like capital, liquidity, and asset quality.
- Deposit Insurance Debate: The pros, cons, and historical lessons of raising FDIC insurance limits-especially in the wake of recent bank failures and how the right balance can preserve market discipline.
- Community Reinvestment Act in the Digital Age: Why the CRA’s geography-based model is due for an overhaul as banking goes mobile and regulatory priorities shift.
- Crypto, Stablecoins, and Regulatory Parity: What the Bipartisan Enactment of the GENIUS Act (regulating stablecoins) means for banks and Fintechs, and why applying anti-money laundering rules across the board could level the playing field.
- Eliminating Reputational Risk: How regulators are eliminating the use of “reputational risk” as a catch-all supervisory and enforcement tool and what this means for fair access and bank governance.
- Looking to the Future: The group reflects on what’s next for the bank regulatory landscape, Wall Street’s view on the industry, and the practical impacts on banks and consumers.
Whether you’re a banker, regulator, or just want to understand how Washington and Wall Street are shaping the future of finance, this episode delivers the highlights of 2025 and insights you need going into 2026. Tune in for expert opinions, real-world examples, and a roadmap to what’s ahead!
Consumer Finance Monitor is hosted by Alan Kaplinsky, senior counsel at Ballard Spahr, and the founder and former chair of the firm’s Consumer Financial Services Group. We encourage listeners to subscribe to the podcast on their preferred platform for weekly insights into developments in the banking and the consumer finance industry.
To listen to this episode, click here.
Consumer Financial Services Group
In a case of first impression, in clarifying her injunction issued in the lawsuit brought by the National Treasury Employees Union and others challenging the planned reductions in force and other efforts to reduce functions at the CFPB, Judge Amy Berman Jackson of the DC Federal District Court vigorously rejected the opinion of the Office of Legal Counsel of the Department of Justice (OLC) that the CFPB may not be funded by the Fed because (1) the Dodd-Frank Act provides that the CFPB may only be funded by the Fed out of “combined earnings of the Federal Reserve System,” (2) the term ”combined earnings” means combined profits and not combined revenues and (3) the Federal Reserve System has incurred losses since September 2022. Instead, Judge Jackson held that “combined earnings” means simply combined revenues.
As a result of reaching this opinion, Judge Jackson concluded that the preliminary injunction issued by her earlier this year, as slightly modified by the DC Circuit Court of Appeals, remains in full force and effect and that the CFPB may not refuse to request additional funds from the Fed in order to perform statutorily required functions. Judge Jackson also concluded that the preliminary injunction provision precluding the CFPB from instituting an agency-wide mass reduction-in-force (RIF) remains in full force and effect.
In reaching her opinion about the funding issue, it is noteworthy that Judge Jackson based her opinion on the assumption that the Federal Reserve Banks are still losing money even though the plaintiffs argued that they are now turning a profit on a combined basis and that, even if OLC’s interpretation of “combined earnings” is correct, that argument would be moot under existing circumstances. As a result, the court avoided having to conduct a hearing to determine whether the Federal Reserve Banks now are profitable on a combined basis and, if so, whether the Fed would be required to honor certain funding requests from the CFPB.
Judge Jackson addresses in her opinion among other things, prior CFPB and Fed statements regarding interpretations of the funding language in Dodd-Frank.
As recently as 2024, the CFPB took the position in CFPB enforcement litigation that the “plain meaning” of “combined earnings” refers to the System’s income.” Chair Jerome Powell reiterated this position interpretation in testimony before Congress; he explained that the Fed “looked at th[is] question very carefully” and determined that “it’s very clear on the law and legislative history” that the Fed is “required to make those payments” even when the Fed is operating at a loss.
Judge Jackson further relied on dictionary definitions of “earnings” which defined the word as revenues. Judge Jackson noted that the Federal Reserve Act used the term “net earnings” and (and not “earnings) to mean profits. Finally, Judge Jackson argued that Congress could not have intended to subject the CFPB’s survival to the vagaries of the Fed’s financial situation from time to time.
We have previously argued that “combined earnings” means combined profits and won’t belabor our argument in this blog. Suffice it to say, we would expect the CFPB to take an immediate appeal of Judge Jackson’s opinion to the DC Circuit Court of Appeals. There is already pending before the that court en banc an appeal from Judge Jackson’s issuance of the preliminary injunction (A three-judge panel of the circuit court had reversed Judge Jackson’s earlier decision, but that decision was vacated when the circuit court granted a petition for rehearing en banc.) In order to shorten the review time for any appeal of Judge Jackson’s new opinion dealing with the funding issue, it would make sense for that appeal to be combined by the en banc circuit court with the already pending appeal without the new appeal first being heard by a three-judge panel. It seems likely that the funding issue is headed to the Supreme Court. `
Things are further complicated by two other recently filed lawsuits filed by Public Citizen in the Federal District Court for the Northern District of California (see here) and another by 21 state attorneys general in the Federal District Court for the District of Oregon, which raise the same funding questions (see here ).
In the meantime, unless the CFPB is able to obtain a stay of Judge Jackson’s clarification, Acting Director Vought may need to request funds from the Fed since, according to the Acting Director, the CFPB is on the verge of running out of money and would be in violation of the preliminary injunction if he still refuses to request funds from the Fed. Judge Jackson’s opinion may also affect the CFPB’s Regulatory Agenda, which the industry largely supports. That agenda includes, among other things, proposed rules regarding the Equal Credit Opportunity Act, Section 1033 of Dodd-Frank (open banking), and Section 1071(small business loans data collection). Since Vought announced that the CFPB would soon be running out of funds and that he felt legally unable to request funds from the Fed, the industry has been deeply concerned about how the CFPB would be able to accomplish its ambitious regulatory agenda.
There had been rumors, and in some court cases’ status reports filed by the CFPB, indicating that the Bureau would issue one or more Interim Final Rules before it ran out of funds.
In light of Judge Jackson’s opinion, perhaps it will be unnecessary to use interim final rules as its path for accomplishing the Bureau’s Regulatory Agenda. Using interim final rules would have significantly increased the risk those rules would not survive a legal challenge.
Alan S. Kaplinsky, John L. Culhane, Jr., and Richard J. Andreano, Jr.
In her December 30, 2025, opinion in National Treasury Employees Union v. Vought (which we blogged about here), Judge Amy Berman Jackson concluded that the CFPB may continue to draw funding from the Federal Reserve System even when the Federal Reserve, on a combined basis, is losing money. According to the court, the statutory phrase “combined earnings of the Federal Reserve System” in 12 U.S.C. § 5497(a)(1) means all revenue earned by the Federal Reserve, not profits, and therefore permits CFPB funding even during periods when the Federal Reserve’s expenses exceed its income.
That conclusion is wrong—statutorily, structurally, historically, and constitutionally.
Judge Jackson’s interpretation creates a serious and unnecessary constitutional problem under the Appropriations Clause of the Constitution, misreads the statutory text, disregards settled accounting principles governing the Federal Reserve, improperly relies on agency practice to override statutory limits, and conflicts with controlling Supreme Court precedent—including Loper Bright Enterprises v. Raimondo (2024), which forecloses deference to agency interpretations of law.
This article takes no position on whether, as a matter of policy, it is good or bad for the CFPB to be shuttered completely or limited to performing only functions that are statutorily required. As discussed in another blog post and a recent webinar, the CFPB has published a very ambitious regulatory agenda which includes many proposed regulations that are supported in whole or in part by the consumer financial services industry, including regulations under Section 1033 of Dodd-Frank (open banking), Section 1071 of Dodd-Frank (small business loan data collection), and the Equal Credit Opportunity Act. We strongly support the CFPB conducting a careful analysis of the comments it has received, responding to them, and adopting appropriate final regulations covering these and other items on its regulatory agenda. If additional funds are needed to do so, then the CFPB should seek them through lawful means, such as requesting a Congressional appropriation.
The article linked here explains why “combined earnings” must be read to mean profits, not gross revenue, and why the court’s contrary conclusion cannot be sustained.
Alan S. Kaplinsky and Joseph J. Schuster
Current and former Democratic members of Congress have told a federal court that the Trump administration’s interpretation of the CFPB’s funding mechanism is at odds with Congress’ plan to provide the Bureau with a stable, independent source of funding.
On December 5, Rise Economy, the National Reinvestment Coalition and the Woodstock Institute filed a lawsuit against the CFPB and its Acting Director Russell Vought in the Federal District Court for the Northern District of California seeking declaratory and injunctive relief related to Vought’s determination not to seek funding from the Federal Reserve Board because of an opinion from the Justice Department’s Office of Legal Counsel (OLC).
The OLC opined that it would be unlawful under Dodd-Frank (which requires that the CFPB may be funded only out of the “combined earnings of the Federal Reserve System”) for the Fed to fund the CFPB because “earnings” means “profits” and the Fed has had no combined profits since September 2022. Shortly after the plaintiffs filed their complaint and before the CFPB even responded to the complaint, the plaintiffs filed a motion for summary judgment.
The current and former members of Congress filed an amicus brief in connection with the motion for summary judgment.
In their amicus brief, the members and former members, including former Sen. Christopher Dodd, (D-CT.), and former Rep. Barney Frank, (D-MA.), said that the Trump administration’s interpretation of the CFPB’s funding source is incorrect. Dodd and Frank were chairs of the Senate and House Committees, respectively, that produced the legislation named for them that created the CFPB.
Joining in the brief are 22 Democrats on the House Financial Services Committee, including ranking Democrat Rep. Maxine Waters, (D-CA.), as well as all Democrats on the Senate Banking, Housing and Urban Affairs Committee, including ranking Democrat Sen. Elizabeth Warren, (D-MA.).
The Trump administration has told Congress that in Fiscal Year 2026, ending September 30, 2026, the CFPB will need $279.6 million just to maintain its activities that are required by law.
As stated above, under Section 1017 of Dodd-Frank, the CFPB is funded from the “combined earnings” of the Federal Reserve. In the past, under the leadership of then-Director Rohit Chopra, the Bureau requested funds from the Fed after September 2022, when the Fed started losing money on a combined basis, and the Fed provided those funds. In making those requests, the CFPB took the position that “earnings” means “revenue” and not “profits.”
In their amicus brief, the former and current lawmakers argued that Vought’s interpretation of Dodd-Frank is at odds with Congress’s plans to provide funding for the Bureau. “Even though the Bureau has long understood those ‘combined earnings’ to include all of the money the various components of the Federal Reserve take in or generate, Vought now adopts the position that the Federal Reserve has ‘earnings’ only when its total revenue exceeds its interest expenses,” they wrote. They added that “under Vought’s interpretation, the Bureau is most likely to be deprived of its funding in times of nationwide economic upheaval, exactly when the need for its regulatory and consumer-protection functions is most urgent.”
The current and former lawmakers said that Vought’s definition of “combined earnings” is a “novel” interpretation and is odds with Congress’s plan to establish the CFPB as an independent agency. It would deprive the bureau of a “continuous and stable” source, they said.
They explain that “Congress structured the Bureau—which it charged with sweeping oversight of the nation’s largest banks and financial institutions in the aftermath of the 2008 financial crisis—to have a stable source of funding that would enable it to carry out its important work without interruption. Vought’s interpretation is wholly at odds with that plan, subjecting the Bureau to intermittent defunding based on unpredictable fluctuations in the Federal Reserve’s balance sheet.” They add that “Vought’s reading of Dodd-Frank is at odds with that statute’s text and history and would prevent the bureau from doing its critical work on behalf of the American people.”
Alan S. Kaplinsky, Richard J. Andreano, Jr., and John L. Culhane, Jr.
State AGs File Suit to Force CFPB to Request Funding From the Federal Reserve
Charging that Acting CFPB Director Russell Vought has been attempting to close down the CFPB by any means necessary, Democratic Attorneys Generals (AGs) from 21 states and the District of Columbia have filed suit, asking a federal court to require Vought to seek State AGs file suit to force CFPB to request funding from the Federal Reserve funds from the Federal Reserve to operate the Bureau.
The AGs filed suit against Vought, in his official capacity, the CFPB, and the Fed.
“Opening another front in his effort to unlawfully close the CFPB, Defendant Vought has now decided to starve the agency of funds based on the implausible proposition that Congress, in enacting the Dodd-Frank Act, intended for the CFPB to periodically shut down whenever the Federal Reserve’s interest expenses exceeded its interest income,” the Plaintiffs said, in the suit, filed in the U.S. District Court for the District of Oregon. “That argument cannot be squared with the text or the structure of the CFPB’s statutory funding provisions and thus neither can the Challenged Decisions,” the Judge wrote.
The AGs are asking for declaratory and injunctive relief related to Vought’s interpretation, which relies on an opinion from the Justice Department’s Office of Legal Counsel (OLC). That legal opinion was filed in a recent and similar lawsuit by the National Treasury Employees Union, which represents CFPB employees.
The OLC opined that it would be unlawful under Dodd-Frank (which requires that the CFPB may be funded only out of the “combined earnings of the Federal Reserve System”) for the Fed to fund the CFPB because “earnings” means “profits” and the Fed has had no combined profits since September 2022. Shortly after the plaintiffs filed their complaint in the Circuit Court for the District of Columbia, and the Defendants even responded to the complaint, the plaintiffs filed a motion for summary judgment for which the court already has established a briefing schedule.
In their lawsuit, the AGs say that OLC’s determination is contrary to the meaning of “combined earnings” in Dodd-Frank. They allege that the Trump administration’s decision not to seek funds from the Federal Reserve is “arbitrary and capricious” because it relies on a “legally erroneous determination.”
In a likely effort to establish standing to bring the lawsuit, the AGs devote a significant portion of their complaint to addressing how the CFPB is critical to the consumer protection efforts of their respective states and to detailing the significant monetary relief that the CFPB has obtained for consumers in their respective states. The AGs state in their lawsuit that the CFPB has been a “critical partner to the States as the States have performed their many consumer-protection functions. The States have relied on the CFPB’s use of its resources and authorities in jointly carrying out consumer protection work, resulting in efficiencies, cost savings, and improved outcomes for consumers.”
State agencies are given access to consumer complaints and any response from a company to the complaint, they said.
“Unlike other complaint systems, the CFPB Consumer Response System requires certain covered persons to respond to the consumer complaints,” the Plaintiffs said. “States make regular use of the company complaint responses, which can include explanations of the companies’ behavior or admissions of wrongdoing.”
“The failure to request funding will cripple or entirely shut down the CFPB’s Consumer Response System to Plaintiffs’ detriment,” the Plaintiffs said. “Much of the damage will be irreversible.”
The AGs also state that they “also rely on Home Mortgage Disclosure Act (HMDA) data maintained by CFPB to support a range of ongoing investigations and enforcement actions.” They add that “[l]osing access to the data will prejudice the Plaintiffs by depriving Plaintiffs of a tool on which they are presently relying,” and note specific efforts by the states of Maryland, Michigan, and New Jersey.
The AGs filing the lawsuit are from Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont, Wisconsin, and the District of Columbia.
Various points made by the AGs in their complaint are consistent with many of the points set forth by Judge Amy Berman Jackson of the DC Federal District Court in her recent ruling clarifying her injunction in the lawsuit brought by the National Treasury Employees Union and others challenging the planned reductions in force and other deregulatory actions at the CFPB. In particular, Judge Jackson determined that “combined earnings” means simply combined revenues and that, as a result, the CFPB may not refuse to request additional funds from the Fed in order to perform statutorily required functions. However, the AGs raise a constitutional separation of powers argument not addressed by Judge Jackson. The AGs state that ”[h]ere, where Congress has created the CFPB, given its statutory mandates, and authorized it without exception to obtain funding by requesting it periodically from the Federal Reserve, the [decisions of the CFPB regarding its funding being challenged by the AGs] have violated constitutional and statutory mandates, contravened Congressional intent, and are unlawful.”
John L. Culhane, Jr., Alan S. Kaplinsky, and Richard J. Andreano, Jr.Circuit Court Grants Union’s Request for En Banc Rehearing in CFPB Employees’ Firing Case
The Court of Appeals for the District of Columbia has granted a request for an en banc rehearing in the National Treasury Employees Union’s (NTEU) and others’ challenge to the firing of more than 1,400 CFPB employees and the taking of certain other actions to curtail the operations of the CFPB.
The Plaintiffs sued the administration, contending that its plan to lay off the employees at the CFPB and to take certain other actions is tantamount to an abolishment of the agency. Only Congress has that power, the Plaintiffs said.
On August 15, 2025, a divided panel of the D.C Circuit held that “the district court lacked jurisdiction to consider the claims predicated on loss of employment, which must proceed through the specialized-review scheme established in the Civil Service Reform Act.” The panel also held that the remaining claims of the plaintiffs did not challenge reviewable final agency action nor unconstitutional action reviewable in equity.
As a result, the panel dissolved a federal district court injunction granted by Judge Amy Berman Jackson blocking the firings and the taking of certain other actions and said the Trump administration could take those actions.
However, when it dissolved the injunction, the panel withheld issuing the mandate in the case until the plaintiffs timely petitioned for a rehearing en banc. The plaintiffs subsequently filed a request for the en banc rehearing. The Plaintiffs argued that the CFPB’s actions constituted a plan to shut down the agency. In light of the granting of a rehearing, the panel’s opinion is vacated.
The circuit court expedited the hearing, which, is scheduled for February 24, 2026, at 2:00 PM, ET. The Defendants’ brief is due January 9, 2026. The Plaintiffs’ brief is due February 2, 2026. The reply brief of the Defendants is due on February 17, 2026. Amicus briefs are due one week after each party’s opening brief is due.
A short while ago, the Defendants filed in the district court a notice and motion to clarify the injunction issued by Judge Jackson based on a legal opinion rendered by the Office of Legal Counsel (OLC) of the Department of Justice. In its opinion, OLC advised CFPB Acting Director Vought that he could not lawfully request operating funds for the CFPB from the Federal Reserve Board because under the Dodd-Frank Act the CFPB receives funding out of “combined earnings” of the Federal Reserve System. OLC then opined that “combined earnings” means combined profits and that since September 2022, and continuing through the date of OLC’s opinion, there have been no combined profits. As a result of the OLC opinion, Acting Director Vought notified the court that he would not be requesting any funds from the Federal Reserve Board and that the CFPB would run out of operating funds by the end of this year or early next year. As a result, according to Vought, it will be impossible for the CFPB to comply with the injunction.
Judge Jackson ordered additional briefing by all parties with respect to whether the district court had jurisdiction to take any action in light of the fact that the case is now on appeal and asked both parties to identify any aspects of the injunction that the district court should clarify.
The plaintiffs argued in their brief that the OLC opinion is wrong because “combined earnings” means “combined revenues”, not “combined profits”, and that there is no lawful reason why the CFPB may not request funds from the Fed. An amicus brief was filed by former Federal Reserve System officials in the district court agreeing with the Plaintiffs’ position, maintaining that the Federal Reserve System is now profitable and arguing that even if OLC’s definition of “combined earnings” means profits, the CFPB may now lawfully request funding from the Fed.
The Department of Justice recently wrote a letter to Jerome Powell, Chairman of the Fed, asking for his opinion about whether the Fed may lawfully honor funding requests from the CFPB. Judge Jackson has ordered the Defendants to file in court any response from Chairman Powell.
Although it is always hazardous to predict what a court might do, we think that the circuit court might remand the case to Judge Jackson for further fact-finding and a determination of whether the CFPB may lawfully request funds from the Fed.
Further complicating matters is a new lawsuit filed in Federal District Court for the Northern District of California by Public Citizen and others seeking a declaration that the Fed may lawfully fund the CFPB and requiring Vought to request sufficient funds so that the CFPB may perform statutorily required functions.
Alan S. Kaplinsky, Richard J. Andreano, Jr., and John L. Culhane, Jr.New York Governor Vetoes NY Health Privacy Act
On December 19, 2025, New York Governor Kathy Hochul vetoed the New York Health Information Privacy Act (NY HIPA), a health data privacy bill that would have afforded consumer protections to non-HIPAA health data.
Although NY HIPA resembled existing laws, like Washington’s My Health My Data Act, it had several important differences that would have greatly expanded its impact—including by applying to employee data, data held by financial institutions subject to the Gramm-Leach-Bliley Act, and data that had been de-identified in accordance with HIPAA. NY HIPA would have also required regulated entities to maintain a publicly available retention schedule and dispose of an individual’s regulated health information pursuant to that schedule subject to certain regulatory requirements.
Unsurprisingly, NY HIPA was the subject of intense lobbying on both sides of the debate. Ultimately, Governor Hochul stated in her veto memo that the legislation, as written, is too broad, “creating potentially significant uncertainty about the information subject to regulation and compliance challenges.”
NY HIPA could still technically pass into law if two-thirds of the members of each house vote to override the Governor’s veto. While NY HIPA did originally pass with that level of support, the likelihood of overriding a veto is very slim from a historical standpoint.
In many ways, 2025 was a relatively tame year for privacy legislation, and the NY HIPA veto is a fitting conclusion. As we move into 2026, companies should carefully monitor whether states push more aggressively, as well as the emerging fight between the states and federal government over the authority to regulate AI and privacy issues.
Gregory P. SzewczykHas Ransomware Peaked? FinCEN Data Shows Slight Downward Trend in Incidents
The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) released its latest Financial Trend Analysis (FTA) this month, reporting data from banks and other financial institutions showing that, following a recent surge, the number of reported ransomware incidents and payment amounts dipped slightly in 2024. High-profile ransomware attacks frequently appear in the news and the impact can be severe: in just the last month, news broke that an e-tailer company was knocked offline for 45 days following one attack, and cities and towns across the U.S. lost access to their emergency alert systems after another.
Data indicates reality matches the perception—ransomware attacks surged to their highest levels in 2023, with a total of 1,512 reported incidents and $1.1 billion in reported ransom payments, a staggering 77% increase in total payments from the prior year. This continued a trend of increased malicious activity that first appeared in 2021, in which FinCEN received reports of approximately 1,400 incidents and nearly $1 billion in payments, more than double the previous year. Indeed, the three-year review period for the FTA (January 2022–December 2024) saw a total of 7,395 ransomware-related reports, totaling more than $2.1 billion in payments, while during the entire previous nine-year period (2013 through 2021), FinCEN received only 3,075 reports totaling approximately $2.4 billion in ransomware payments.
One year does not make a trend but the latest data show signs for cautious optimism. In 2024, companies reported a total of 1,476 ransomware incidents, and approximately $734 million in ransomware payments. The median ransomware payment also decreased, from $175,000 in 2023 to $155,257 in 2024. FinCEN attributes this decrease in part to U.S. and U.K. law enforcement disrupting high-profile ransomware groups in December 2023 and February 2024.
No industry is immune from the threat of attack, but the FTA identified that financial services, manufacturing, and health care industries reported both the greatest number of incidents and highest amount of aggregate payments sent to ransomware actors during the review period. Retail and legal services reported the next highest amount of overall incidents; meanwhile, science and technology and retail rounded out the highest reported total payments.
Other key findings reported in the FTA include:
- The data revealed 267 distinct ransomware variants used in attacks during 2022 – 2024, the most prevalent being Akira, ALPHV/BlackCat, LockBit, Phobos, and Black Basta.
- Ransomware actors most often used The Onion Router (TOR) to communicate with their victims, reported in 67% of ransomware incidents during the reporting period. TOR uses encryption and layered network infrastructure to allow users to browse the internet anonymously and conceal their identity and point of origin.
- Bitcoin (BTC) remains the prominent payment method of choice for ransomware actors, accounting for 97% of the reported ransomware transactions.
The financial threat to companies posed by ransomware is no secret. Data reported to FinCEN indicates that, although the vast majority of payments demanded by ransomware actors are below $250,000, individual demands can exceed $5 million. But, the risk doesn’t end with the actual ransom payment—companies face increasing legal liability as well. According to one report from 2023, nearly one in five ransomware attacks resulted in a lawsuit against the victim company. Class actions against companies for failure to prevent or disclose ransomware breaches abounded in 2025, after several litigations arising from earlier breaches led to costly settlements.
Therefore, it is as important as ever for companies to take steps to prevent, detect, and respond effectively to ransomware attacks. As FinCEN summarizes, “ransomware is a complex cybersecurity problem requiring a variety of preventive, protective, and preparatory best practices.” The FTA references several resources, including the Cybersecurity and Infrastructure Security Agency’s (CISA) website StopRansomware.gov, the National Security Agency’s (NSA) Ransomware Guide, and the National Institute of Standards and Technology’s (NIST) Data Integrity Project.
FinCEN publishes FTAs pursuant to section 6206 of the Anti-Money Laundering Act of 2020, 31 U.S.C. § 5318(g)(6)(B), which requires periodic reporting of threat pattern and trend information derived from data reported to FinCEN under the Bank Secrecy Act. The AML Blog has posted on previously-issued FTAs here and here.
If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.
Michael R. McDonaldCFPB Releases Annual Report on Fair Debt Collection Practices Act (FDCPA)
As required by amendments to the FDCPA made by Section 1089 of Dodd-Frank, the CFPB recently released its annual report to Congress on FDCPA compliance. We note below information provided by the Bureau about the complaints it received in 2024, the results of examinations publicly reported in 2024, and enforcement actions by other agencies.
The CFPB received approximately 207,800 debt collection complaints last year, the Bureau reported. While that number was almost twice the number of complaints it received in 2023, when it reported receiving approximately 109,900 complaints, the Bureau did not comment on the increase. It did note that those complaints comprise 7% of all complaints received last year.
As it has in previous years, the CFPB provided information about the nature of the complaints as identified by the consumers who complained. Complaints about a debt that the consumer says they do not owe once again was the predominant issue selected by consumers, as has been the case. since the Bureau began collecting complaints in 2013. The CFPB said that 45% of the complaints filed last year were concerning debts that a consumer said they do not owe.
The CFPB also reported that:
- Of the 207,800 complaints filed with the Bureau, it sent 77% (or 159,700) to companies for review, referred 18% to other regulatory agencies and found 5% not be actionable.
- Companies responded to about 97% of the debt collection complaints sent to them.
- Companies closed 67% of the complaints with an explanation, 27% with non-monetary relief and 0.2% with monetary relief.
- As of March 3, 2025, 2% of the complaints were pending review by companies.
- Companies failed to provide a timely response for 2% of the complaints.
With regard to its supervisory examinations, the Bureau reported that examiners found that:
- Student loan debt collectors failed to provide validation notices as required, when the initial communication with a consumer occurred in writing.
- Student loan debt collectors violated the prohibition on the use of false or misleading representations. As a result of these violations, the borrowers may have reasonably believed that the FDCPA did not apply and may have been misled about their rights under the FDCPA.
- Certain debt collectors communicated with consumers at times and places known to be inconvenient or unusual.
- Certain debt collectors engaged in harassing, oppressive, or abusive conduct in connection with the collection of debt.
- Some debt collectors communicated, or attempted to communicate, through a particular medium, after the consumer had requested that they not do so.
- Service providers for debt collectors failed to disclose, when communicating by telephone or text message on behalf of debt collectors, and when responding to a request for confirmation of receipt of an electronic payment, that the communication was from a debt collector.
- Certain credit card issuers engaged in unfair practices when they failed to properly calculate and document the applicable state statute of limitations for debts and then misrepresented the statute of limitations when they sold those debts to debt collectors.
All examined entities were reported to be responding appropriately to examination findings.
The Bureau also noted that, although several other agencies have enforcement powers under the FDCPA, in 2024, the FTC was the only agency to announce public enforcement actions addressing harmful debt collection activities in violation of the FDCPA.
While the CFPB issued the annual FDCPA report, Sen. Elizabeth Warren, (D-MA.), the ranking Democrat on the Banking, Housing, and Urban Affairs Committee, has sent bureau Acting Director Russell Vought a letter asking him to send the panel its semi-annual report on all of its activities. She noted that the report is required by law.
“Like the requirement that the Director testify on a regular basis, the mandatory report is a critical way Congress fulfills its own constitutional obligation to conduct oversight of the agency,” Warren wrote.
She also said that the Bureau has not issued its reports on fair lending, student loans, college credit card agreements, financial literacy, and credit card markets. “These reports are a crucial tool for Congress, state law enforcement, and the public to monitor potential consumer financial harms,” she wrote. She added, “These failures are only the latest indication that you are attempting to illegally dismantle the CFPB and sideline the financial cop that has returned more than $21 billion to families cheated by big banks and giant corporations.” In addition to the Warren letter to Vought, Banking Committee Democrats sent panel Chairman Sen. Tim Scott, (R-SC.), a letter asking him to schedule a CFPB oversight hearing during which Vought would testify. They noted that the CFPB Director is required to testify before the committee twice a year.
John L. Culhane, Jr. and Richard J. Andreano, Jr.Colorado ‘Opt-Out’ Litigation—Petition for Rehearing En Banc And Amicus Briefs in Support
As we previously reported, on November 10, 2025, the 10th Circuit rendered its 2-1 decision in National Association of Industrial Bankers v. Weiser. It held that a loan is “made” for purposes of the opt-out provision in Section 525 of the Depository Institutions Deregulation and Monetary Control Act (DIDMCA) in both the state where the bank is located and the borrower’s state, meaning that Colorado’s usury limits will apply to interstate loans made to Colorado residents by out-of-state state-chartered depository institutions. This ruling will not affect national banks’ exportation rights under Section 85 of the National Bank Act and the Supreme Court’s Marquette decision, leaving state banks at a competitive disadvantage. Ballard Spahr held a webinar on December 16 to discuss the latest developments in this litigation and the likely ramifications of the 10th Circuit decision if it is left undisturbed.
The plaintiff banking associations filed a Petition for Rehearing En Banc on December 9, 2016. They argued that the majority ruling creates a circuit split with the decision in Jessup v. Pulaski Bank, 327 F.3d 682 (8th Cir. 2003) concerning where loans by state banks are “made” for purposes of federal interest-rate preemption. In Jessup, the Eighth Circuit interpreted a statute passed as part of the Gramm-Leach-Bliley Act. That statute (12 U.S.C. § 1831u(f)) permitted Arkansas-chartered state banks to charge the same interest rates permitted by the home state of any non-Arkansas bank with an Arkansas branch, preempting the low Arkansas interest rate cap. The statute contained a carve-out from preemption for “any loan made in any state other than [Arkansas].” 12 U.S.C. § 1831u(f)(2). The Eighth Circuit held that, for purposes of this statute, “a loan is made at the location of the branch that approves the loan, extends credit, and disburses the funds.” Jessup, 327 F.3d at 685.
The Petition for Rehearing also argued that the majority improperly applied a presumption against preemption, which ignored the express preemption provision in Section 521 of DIDMCA. Finally, the Petition argued that the majority incorrectly decided an issue of exceptional importance that is critical to consumer lending in the United States, and deprives all state banks in the 48 non-opt-out states of the interest-rate parity with national banks that Congress created in DIDMCA.
On December 16, 2025, four amicus briefs were filed in support of the Petition for Rehearing. Ballard Spahr filed a brief for the American Bankers Association, Bank Policy Institute, and 52 State Bankers Associations; the FDIC and OCC each filed an amicus brief; and an amicus brief was filed by Utah and 19 other States.
The Ballard Spahr amicus brief for the bank trade groups first argued that the majority erred by relying on a Black’s Law Dictionary definition of “made” as including “executed.” We pointed out that just three months before enactment of DIDMCA, the same Congress (the 96th Congress) passed an amendment to the National Housing Act that preempted state usury laws but allowed states to override preemption as to certain FHA loans “made or executed” in such State. 12 U.S.C. § 1735f-7 (emphasis added). Its choice three months later to use only the term “made” in Section 525, without also saying “or executed,” is significant. The Supreme Court has emphasized that differences in language convey differences in meaning, and that is particularly true when the different language appears in two statutes passed by the same Congress that relate to the same subject – here, preemption of state usury laws and potential overrides of preemption. Also, numerous Supreme Court precedents hold that the use of the word “or” between two words in a statute reflects Congress’s understanding that the words have different meanings.
Our amicus brief also argued that the legislative history of DIDMCA shows that Congress was focused entirely on creating interest rate parity between state and national banks in the same state in connection with intrastate lending, and there was no discussion of interest rates charged on interstate loans by out-of-state state banks. Indeed, the lack of any such discussion is hardly surprising, because state bank credit card and other interstate lending did not take off until after enactment of DIDMCA in 1980. Finally, we argued that determining where a borrower is located whenever credit is extended in a credit card or online transaction will create an unworkable morass, particularly when borrowers travel from opt-out states to non-opt-out states or vice versa.
The FDIC amicus brief in support of rehearing en banc is particularly notable because it previously filed amicus briefs in support of Colorado at both the district court level and again in the 10th Circuit. However, after President Trump took office (but before the 10th Circuit’s decision), the FDIC withdrew its amicus brief. The new FDIC amicus brief in support of rehearing argues that Colorado’s opt-out only limits the interest rates that can be charged by Colorado state-chartered banks, and cannot apply to out-of-state state banks. This position is fully consistent with an amicus brief the FDIC filed in 1992 in the First Circuit Court of Appeals in Greenwood Trust Company v. Massachusetts, where Alan Kaplinsky and Burt Rublin argued successfully for Greenwood Trust. In its amicus brief in Greenwood Trust, the FDIC argued that “Section 525 [of DIDMCA] clearly does not confer on states that elect to opt out of Section 521 extraterritorial authority to apply their own lending laws to loans made in other states by banks chartered in other states, merely because the borrower happens to be a resident.”
The FDIC’s new amicus brief in the 10th Circuit argues that the panel decision “has radically altered the interest rate parity approach established by Congress in Section 521 of [DIDMCA]. In doing so, the majority’s opinion imposes significant financial and operational burdens on state-chartered institutions that do not apply to national banks.” The FDIC brief also asserts that “[t]his is a question of exceptional importance to state-chartered banks,” and allowing the majority ruling to stand “may encourage more states to opt out, resulting in the opt-out exception swallowing the general rule of parity and threatening the ability of state-chartered banks to offer loans to consumers in other states and the integrity of the dual banking system.”
The OCC amicus brief argues that the panel’s decision:
[F]undamentally alters the application of this federal interest-rate [parity] framework for state banks. Such an outcome would inject uncertainty into the framework, undermine the benefits that Congress has sought to provide to state banks in DIDMCA, and create significant challenges for state banks that wish to lend across state lines. This outcome would also advantage national banks over state banks, which is inconsistent with Congress’s expressly codified competitive-equity goals. As a result, the panel decision threatens to diminish the vibrancy of the dual banking system and to harm consumers by reducing their access to credit across the country. For these reasons, the panel decision involves a question of exceptional importance…
* * *
Without the clarity and certainty that this interest-rate framework provides, interstate lending would be significantly more difficult to administer. In some cases, it may be commercially unfeasible, leading to a reduction in available credit.
The amicus brief filed by Utah and 19 other States argues that the majority’s ruling is erroneous because it:
Effectively allows one state – like Colorado here – to impose its interest rate regulations on every other state-chartered bank across the nation that loans money to a Colorado resident. That’s wrong and if allowed to stand will interfere with state objectives to preserve equality and competition between state and federally-chartered institutions, preserve the dual banking system, and protect the interests of shareholders, depositors, and customers of the financial institutions in these states.
Colorado’s response to the Petition for Rehearing is due on January 21, 2026. Amicus briefs in support of Colorado will be due one week after Colorado’s brief.
Rehearing requires the affirmative vote of at least seven of the 12 active (i.e., non-senior) judges on the court, and is therefore very uncommon. As we discussed in our prior blog post, the district court’s injunction against enforcement of the Colorado opt-out statute will remain in effect notwithstanding the 10th Circuit’s decision at least until after the Petition for Rehearing is decided, and likely until an anticipated cert petition by either side is decided.
Burt M. Rublin and Alan S. KaplinskySubscribe to Ballard Spahr Mailing Lists
Copyright © 2026 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.
This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.