On March 30, 2025, a set of federal protections took effect that were supposed to stop payday lenders from draining borrowers’ bank accounts through repeated, failed withdrawal attempts. The Consumer Financial Protection Bureau had spent years writing the rules. Lenders had spent months retooling their payment systems to comply. Then, days before the deadline, the CFPB announced it would not prioritize enforcement or supervision of those provisions. Lenders could ignore them without consequence.
That was not a one-off decision. As of June 2026, the CFPB has effectively shelved at least 13 consumer finance rules or provisions finalized between 2023 and 2024. The following is a full accounting of the dormant protections, reconstructed from CFPB announcements, court filings, the Congressional Record, and a Government Accountability Office report published in April 2025:
- Payday Lending Rule payment provisions (the “two strikes” failed-withdrawal limit)
- Payday Lending Rule advance-notice-of-debit requirement
- Small-business lending data collection rule (Section 1071 / Regulation B) for entities beyond the Fifth Circuit stay
- Nonbank Registry rule (12 CFR Part 1092) registration deadlines
- Buy-now-pay-later interpretive rule applying Regulation Z open-end credit provisions to BNPL digital accounts
- Credit card late fee rule ($8 cap), blocked by injunction in Chamber of Commerce v. CFPB
- Overdraft fee rule for institutions with more than $10 billion in assets ($5 benchmark cap), repealed via the Congressional Review Act in May 2025
- Medical debt credit-reporting guidance
- Digital payment app error-resolution guidance
- Data broker oversight guidance under the Fair Credit Reporting Act
- Fee-disclosure interpretive rules for deposit accounts
- Servicing-practice interpretive rules
- Broader supervisory directive halting new examination matters for all rules finalized after 2021 (except fraud, discrimination, or other “pressing threat” conduct)
Only one of those protections, the overdraft fee rule for large banks, was formally repealed through legislation. None of the others were struck down by courts on the merits. They simply stopped being enforced.
How each rule went quiet
The payday lending case is the starkest. The rule’s payment provisions included a “two strikes and you’re out” mechanism that would have blocked lenders from making more than two consecutive failed withdrawal attempts against a borrower’s account without obtaining fresh authorization. Lenders would also have been required to give advance notice before each debit. The CFPB’s pre-deadline announcement gutted both requirements without touching the regulatory text.
In a separate statement, the bureau said it would not pursue enforcement of the small-business lending data collection rule under Section 1071 of the Dodd-Frank Act (codified in Regulation B) for entities beyond the scope of a Fifth Circuit stay already in place. It also declared it would not act against companies that missed registration deadlines under the Nonbank Registry rule (12 CFR Part 1092) and signaled it was considering rescinding or narrowing that rule entirely. A further announcement stated the bureau would not bring enforcement actions based on its May 2024 interpretive rule applying Regulation Z open-end credit provisions to buy-now-pay-later digital accounts.
Two other high-profile rules stalled through different mechanisms. The credit card late fee rule, which would have cut most penalty charges to $8 from the roughly $32 industry average, remains blocked by a federal court injunction in Chamber of Commerce v. CFPB (N.D. Texas, Fort Worth Division) and has never taken effect. The overdraft fee rule for institutions with more than $10 billion in assets, which offered banks compliance paths including a $5 benchmark cap, was overturned by Congress through the Congressional Review Act in May 2025, making it the only one of these protections formally killed by legislation.
Beyond those headline rules, the GAO report documented a broader supervisory stand-down. The report found that CFPB examiners were instructed to halt new supervisory matters involving rules finalized after 2021 unless the underlying conduct involved fraud, discrimination, or other behavior the bureau classified as a “pressing threat.” The GAO further noted that the bureau had reduced its supervisory headcount and closed active investigations tied to the affected provisions. That directive swept in guidance on medical debt reporting, digital payment app error resolution, data broker oversight under the Fair Credit Reporting Act, and several smaller interpretive rules governing fee disclosures and servicing practices.
Technically law, practically dead
Most of these provisions remain part of the Code of Federal Regulations. On paper, lenders are still required to comply with the payday payment restrictions, the nonbank registry requirements, and the BNPL interpretive guidance. But the CFPB holds broad discretion over how it allocates enforcement and examination resources. By publicly announcing that certain provisions will not be priorities, and by disbanding or shrinking the teams responsible for monitoring them, the bureau sent a clear signal to banks, fintechs, and specialty lenders: the risk of being penalized for noncompliance is close to zero.
The industry moved fast. Multiple payday and installment-loan providers paused or reversed the system changes they had been building to meet the March 2025 deadline, based on CFPB non-enforcement announcements that removed the compliance incentive. Banks that had been modeling lower overdraft revenue in anticipation of the now-repealed cap retained their existing fee schedules instead. Credit card issuers, facing no resolution of the stayed late fee rule, kept penalty charges near prior safe-harbor levels established under the CARD Act.
Consumer advocacy groups have argued that this quiet retreat carries the same practical effect as a formal repeal but skips the transparency and public comment process the Administrative Procedure Act requires for rulemaking. The National Consumer Law Center has described the dynamic in its public commentary as treating unenforced rules as mere “suggestions” rather than binding obligations. The payday payment provisions, advocates note, were specifically designed to stop the repeated, failed withdrawal attempts that can drain a borrower’s checking account through stacked overdraft and nonsufficient-funds charges, sometimes totaling hundreds of dollars from a single loan payment cycle.
What borrowers are still paying
For individual consumers, the consequences show up as familiar line items. A $35 overdraft fee triggered by a $7 coffee purchase. A $32 credit card late fee on a $25 minimum payment. Three or four consecutive bank charges after a payday lender’s automated system tries, and fails, to pull money from an account that was already empty.
Some large banks have voluntarily reduced overdraft reliance or introduced grace periods. Bank of America announced in January 2022 that it would cut its overdraft fee to $10, a change that took effect in May 2022, and eliminated nonsufficient-funds fees entirely. Capital One dropped overdraft fees altogether. But those moves are concentrated among the largest institutions competing for digitally savvy depositors. Smaller banks, credit unions under competitive pressure, and nonbank lenders serving subprime borrowers face less reputational incentive to change fee-heavy models when regulators are not watching.
At the market level, the enforcement vacuum may tilt the playing field toward firms that depend most on penalty revenue. Companies that invested early in compliance, retooling payment systems, redesigning disclosures, or voluntarily lowering fees, now compete against rivals who kept legacy practices and avoided those costs. That dynamic risks discouraging future voluntary improvements, as firms calculate that any new consumer protection may not survive beyond a single administration.
Where state attorneys general and courts could fill the gap
Several paths could reactivate some of these protections. The credit card late fee litigation could eventually be resolved in the CFPB’s favor, freeing the bureau to enforce a revised cap, though any renewed effort would face additional legal and political headwinds. A future administration could reinstate enforcement priorities and rebuild the supervisory teams that were cut. Congress could pass standalone legislation codifying specific fee limits, though no bill with bipartisan traction has advanced as of mid-2026.
State-level action offers a partial backstop. California, Colorado, and a handful of other states have enacted or proposed their own caps on overdraft fees, payday lending practices, or credit card penalty charges. But state rules vary widely, and federal preemption questions could limit their reach, particularly for nationally chartered banks. Some state attorneys general have signaled interest in filling the federal enforcement gap, but coordinated state action remains uneven.
The verified record, as of June 2026, points in one direction: rules that once promised concrete limits on some of the most criticized charges in consumer finance are technically alive but practically unenforced. Borrowers continue to pay the fees those rules were written to curb. And for most of them, the only protection left is the hope that their bank decides, on its own, to charge less.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
