The agencies’ proposal follows a winding regulatory and litigation history to amend CRA regulations. Most recently, the agencies issued final rules amending the CRA in 2023, which subsequently were enjoined by a federal district court in March 2024 in litigation brought by several trade associations. After a July 2025 proposal to simply rescind those rules and revert to the pre-2023 framework, the OCC and FDIC ultimately decided to pursue this new rulemaking instead.

Notably, as we previously discussed, the Federal Reserve did not join the OCC and FDIC in this proposal.

Summary of the OCC and FDIC’s proposal

The proposal would make targeted changes to several key aspects of the CRA regulations.

1. Increased focus on lending, shift away from deposits

The amendments would narrow the scope of “retail banking services” under the CRA to the range and availability of an institution’s credit services and the availability and distribution of its retail banking facilities. As a result, exams would focus on lending and would exclude deposit services.

2. Change to asset-size thresholds

The agencies propose to change the asset-size thresholds that determine whether a bank is treated as a small, intermediate or large bank for CRA purposes to the following:

• The small-bank threshold would rise to less than $1 billion (from $412 million).
• A new “intermediate bank” category would replace the “intermediate small bank” category and apply to institutions between $1 billion and $10 billion (the current intermediate small bank threshold range is between $412 million to $1.649 billion).
• The large bank threshold would rise to more than $10 billion (from $1.649 billion).

As a result of these changes, the proposal states that banks with $10 billion or less in assets would be subject to fewer data collection, maintenance and reporting requirements, and banks below the $1 billion small bank threshold would no longer be subject to the community development test. Specifically, the current requirement to evaluate a small or intermediate bank’s responsiveness to written complaints would be eliminated, and intermediate banks would need only a satisfactory rating on the lending component to achieve an overall satisfactory rating (rather than on both the lending and community development components).

3. Shift to examining institutions’ major product lines

As part of the current lending test, large banks are generally assessed on their retail lending, which includes home mortgage, small business and small farm lending (and, at the bank’s option, or if lending is a substantial majority of its business, certain specific product lines, including motor vehicle, credit card, and other secured and unsecured loans). Small banks are evaluated only with respect to the retail lending product lines considered their “major” product lines. The proposal would extend the major product line approach to all banks, so that examiners would focus on the product lines that make up the majority of a bank’s business rather than evaluating each product line by default.

This shift has also prompted the agencies to reconsider the “limited purpose bank” category, which currently allows for certain consumer lenders (such as credit card or auto lenders) to be evaluated solely on their community development activities. Because consumer lending could now qualify as a major product line for such banks, the agencies are seeking comment as to whether the limited purpose bank designation should be eliminated altogether.

4. Ensuring community development grants benefit communities

The proposal would modify how grants and donations qualify as community development (CD) activities. To qualify for CRA consideration, a grant would need to be directly used by the recipient for the primary purpose of CD, benefit the bank’s assessment area and, for large banks, be directed to a recipient whose administrative overhead costs do not exceed 15% of the grant amount. Large banks would also be required to obtain documentation substantiating compliance, including a written commitment from the recipient regarding use of funds, an attestation confirming the overhead limitation and supporting records, such as tax filings and budget information.

5. Changes to community development definitions

The agencies suggested revisions to the definitions of “CD loan,” “qualifying investment” (renamed “community development investment”) and “CD service” to treat CD activities more consistently across the different performance tests. Notably, the revised CD loan definition would allow certain home mortgage, small business and small farm loans that fall outside a bank’s major product lines to count as CD loans if they otherwise meet the CD definition, effectively giving banks a second path to CRA credit for loans that would no longer be evaluated as retail lending under the major product line approach. The proposal would also add a new umbrella term, “community development activity,” covering CD grants, investments, loans and services collectively.

6. Increased clarity and objectivity

The proposal would codify an optional process allowing a bank to request, in advance, agency confirmation that a specific loan, investment, grant or service would qualify as a CD activity for CRA credit, giving banks upfront certainty rather than waiting until examination to learn whether the activity counted. The agencies also propose to make the strategic plan option more accessible. Banks have previously had the option to be evaluated under a custom “strategic plan” instead of the standard tests, but the agencies acknowledge this option has been underused because the current rules are seen as complex and unclear. The proposal restructures and clarifies the strategic plan rules – including adding a new “prefiling communications” option allowing banks to consult with regulators before submitting a plan.

What the proposal leaves unchanged

Large banks would continue to be subject to lending, investment and service tests that evaluate their retail lending and services and CD activities, while small and intermediate banks would remain subject to a tailored lending test (with a CD test for intermediate banks). Banks would also retain the option to be evaluated as a wholesale or limited purpose bank or under an approved strategic plan. Also, the agencies are not proposing significant changes to the current assessment area framework, which remains largely tied to a bank’s physical location.

What’s next?

The agencies are seeking comment on each aspect of the proposal, with comments due 60 days following publication in the Federal Register.

Banks and their compliance teams may begin considering how the proposal would affect their CRA programs, including their retail banking services evaluation, treatment of CD grants and donations, asset-size category and (if applicable) strategic plan. Banks that currently rely on deposit-related services or broader retail service activities for CRA credit should pay particular attention to the proposed narrowing of retail banking services to credit services.

We will continue to monitor this rulemaking and will provide updates as the comment period progresses and as a final rule is issued.

The proposed rule covers licensing and compliance requirements for BNPL providers, including license application requirements, capital requirements, fee restrictions, disclosure mandates, underwriting standards, dispute resolution and data privacy requirements.

Overview of the formal proposed rule

Who’s covered

As in the draft pre-proposal, the formal proposed regulation would apply to a “BNPL lender,” defined as any person who “offers” BNPL loans to residents of New York, including persons that make loans and persons to whom ownership of a BNPL loan is transferred. This definition, therefore, captures not just BNPL direct lenders but also technology intermediaries that operate platforms or systems through which consumers apply for a BNPL loan, which is subsequently sold to a creditor.

A “BNPL loan” means closed-end credit for a consumer’s specific purchase of goods or services (excluding motor vehicles, credit where the creditor is the seller, commercial-purpose credit and purchase money mortgage loans). The proposed rule adds the mortgage loan exclusion.

National banks, federal savings banks, federal credit unions and other federally regulated entities would be exempt from licensing but remain subject to other BNPLA provisions (exempt organizations).

Licensing and category permissions

All BNPL lenders other than an exempt organization would need to obtain a license from NYDFS. Each BNPL lender would also need to obtain a separate “category permission” for each product type it offers: interest-free BNPL loans and/or interest-bearing BNPL loans. Exempt organizations (i.e., banking law entities) would not be required to obtain a license but must obtain written authorization that sets forth their category permissions.

For existing lenders, any BNPL lender that is not an exempt organization or banking law entity would need to apply for a provisional license within 45 days of the effective date. Similarly, existing lenders would need to apply for applicable category permissions within 45 days of the effective date and would be deemed provisionally authorized to offer those categories pending a decision.

Interest rates and fee restrictions

The proposed rule would largely impose the same interest and fee restrictions as described in the pre-proposal:

• Interest cap. Interest may not exceed the 16% interest rate cap imposed by New York law. Interest includes but is not limited to:
  1. Any amount charged as a condition of making or originating a BNPL loan.
  2. Any amount charged for the making of an installment of a BNPL loan.

The proposed rule removes two examples of interest previously included in the pre-proposal: Any finance charge as defined in Regulation Z and any charge included as interest pursuant to statute notwithstanding its characterization as a fee.

• Penalty fee cap. Fees for loan agreement violations (e.g., late payments) are subject to an $8-per-incident safe harbor; fees above $8 require superintendent approval based on costs incurred and annual reevaluation. Aggregate penalty fees on any single loan may not exceed the original amount financed.
• No payment method fees. Lenders may not charge fees based on payment method, except for expedited service by a customer service representative.
• No prepayment penalties. No charges may be imposed for prepayment.
• Failed payment attempts. Lenders may make no more than two attempts to collect via the same payment method for any single due amount, absent new consumer authorization.

Note that the new proposed rule omits the prohibition on soliciting tips previously included in the pre-proposal and adds a requirement that the BNPL lender provide consumers with a reasonably accessible interface through which consumers can make payments on their outstanding BNPL loans.

Disclosures

Similar to the pre-proposal, the proposed rule would impose a Regulation Z-style disclosure framework for BNPL loans, including requirements typically associated with open-end credit products, including pre- and post-transaction disclosures and periodic statements.

Underwriting standards

Under the proposal, before extending a BNPL loan, lenders would need to perform “reasonable risk-based underwriting,” including at minimum an assessment of the consumer’s income and indebtedness. Lenders would need to maintain written underwriting policies and disclose the underwriting factors in a clear and conspicuous manner. Notably, as in the pre-proposal, lenders would not be permitted to use the creditworthiness of any member of a consumer’s social network to determine credit availability or pricing.

Refunds, dispute resolution and unauthorized use

The proposal would establish detailed consumer protection procedures, including:

• Refunds and credits. Sellers must transmit credit statements within seven business days of agreeing to a refund; lenders must credit the consumer’s account within three business days of receipt. Credit balances must be refunded within three business days.
• Billing error disputes. Consumers may submit billing error notices within 60 days of the relevant statement. Lenders must acknowledge receipt within 30 days and resolve disputes within two statement cycles (no later than 90 days). During a dispute, lenders may not collect the disputed amount, make adverse credit reports or accelerate indebtedness. Noncompliance results in forfeiture of the right to collect the disputed amount up to $50.
• Unauthorized use. Consumer liability is capped at the lesser of $50 or the amount obtained before notification, provided the lender has given adequate notice and conducted effective authentication.

Data privacy

Under the proposal, as previously described, BNPL lenders would need affirmative, informed consent to use, sell or share a consumer’s “covered data” – encompassing all nonpublic consumer information, transaction data, account data and consumer metadata – for purposes other than making a particular BNPL loan.

Advertising and marketing

Among other requirements, a lender advertising in New York would be required to include its name and the legend “Licensed to offer BNPL loans by the New York State Department of Financial Services” in all New York advertising. Lenders would also need to prominently display a toll-free telephone number on all consumer interfaces, operative at least 10 hours per day, Monday through Friday (excluding federal holidays), and an email address for customer service matters including billing errors and unauthorized use.

What’s next?

For BNPL lenders and the fintech platforms that support them, the proposal represents one of the most far-reaching state-level compliance undertakings to date. Entities may consider submitting comments ahead of the 60-day public comment period deadline, in particular in response to the significant compliance requirements that would be expected of BNPL lenders.

While not formally confirmed, the OCC and FDIC are set to release a proposal that would raise the threshold for banks subject to the CRA. The new threshold could increase from $1.6 billion to $10 billion in assets and would subsequently reclassify hundreds of banks currently treated as large institutions as no longer subject to the CRA – effectively downgrading CRA compliance obligations. Notably, CRA operating regulations have not been updated since the 1990s.

New qualifying CRA credit activities

The CRA is meant to address historical redlining by requiring US regulators to grade banks for lending and investments in covered communities, with grades ranging from “outstanding” to “substantial noncompliance.” A CRA credit activity is a loan, investment or service provided by a bank that can increase its CRA compliance score.

The OCC and FDIC plan to propose a list of additional qualifying CRA credit activities, such as affordable housing development and small business lending, that would count toward a bank’s CRA score and give covered institutions more opportunities to obtain higher scores.

The Federal Reserve, which is also responsible for implementing the CRA, is reportedly not involved in the current rulemaking process.

Broader deregulatory context

The anticipated proposal reflects the Trump administration’s ongoing efforts to ease CRA and other regulatory compliance requirements for banks. In May, the OCC extended the time between CRA compliance exams for banks meeting certain criteria, and regulators have also directed bank examiners to focus only on material financial risks. Also, earlier this month, the OCC and FDIC dropped their appeal of a March 2024 federal court decision in Texas that blocked a Biden-era CRA rewrite.

Looking ahead

Banks should closely monitor the OCC and FDIC for the formal release of the expected proposed rule changes in the coming weeks. Once the proposal is published, covered institutions should assess its potential impact on their current CRA compliance obligations – particularly whether the revised large-bank asset threshold would change their classification and how the expanded list of qualifying CRA credit activities may affect their existing lending, investment and service strategies. Banks that currently operate near the proposed $10 billion threshold should evaluate whether a reclassification could alter the scope of their CRA programs, while all covered institutions should review whether their community development activities align with the new qualifying criteria. Engaging compliance, legal and community development teams early will be critical to identifying gaps and positioning banks to submit informed comments during the notice-and-comment period.

The guidance follows a recent White House executive order directing financial regulators to address risks “posed by the extension of credit or financial services to the inadmissible and removable alien population.” The order specifically directed the regulators to issue guidance on managing the potential credit risks posed by this population of borrowers.

The Consumer Financial Protection Bureau (CFPB) previously issued its own guidance following the order, reminding creditors that assessing a consumer’s ability to pay debt obligations under the Truth in Lending Act (TILA) may warrant or require consideration of immigration status when assessing an individual’s employment income.

Guidance

In the guidance, the agencies state that lending to non-work-authorized borrowers may pose heightened credit risk given the uncertainty such borrowers may face in generating income and maintaining employment. The agencies urge financial institutions to “identify, measure, monitor, and control these risks through safe and sound underwriting practices” that assess a borrower’s ability to pay the credit obligation. In particular, the agencies encourage financial institutions to review certain key underwriting considerations related to the following:

• Source of repayment. Financial institutions may consider whether borrowers will continue to satisfy their payment obligations under various scenarios, including potential interruptions in employment or income for failure to maintain lawful work authorization.
• Collateral. Enforcing security interests on collateralized loans to non-work-authorized borrowers may be challenging if the borrower becomes difficult to contact or locate.
• Documentation and verification. Financial institutions may consider whether employment income is current, verifiable, stable and likely to continue, and may require paystubs, W-2s or other evidence of continuing work authorization.
• Portfolio and concentration considerations. Financial institutions may face more widespread risk if borrowers are concentrated in geographic markets, employers, or industries that are disproportionately affected by changes in immigration enforcement and resultant workforce disruptions.

The agencies also direct supervised financial institutions to the CFPB’s recent “Statement on Ability to Repay and Immigration Status,” which addresses compliance obligations under TILA (implemented by Regulation Z) and the Equal Credit Opportunity Act (implemented by Regulation B). The guidance reminds institutions that TILA requires creditors to assess a borrower’s ability to repay before extending mortgages and credit cards, and that assessment may require consideration of immigration status, while Regulation B expressly permits creditors to consider immigration status and additional information necessary to ascertain rights and remedies regarding repayment.

Looking ahead

While the guidance does not impose new legal prohibitions on lending to non-work-authorized borrowers – federal law does not prohibit banks from serving this population – it signals the agencies’ heightened supervisory expectations around credit risk identification, measurement, monitoring and control. Financial institutions may consider reviewing underwriting policies and procedures to confirm they adequately identify and mitigate credit risk associated with non-work authorized borrowers and monitor further regulatory developments that may impact their supervisory or compliance programs.

Institutional investor purchase ban

A significant federal restriction on institutional investment in single-family housing, the act forbids any “large institutional investor” from purchasing or contracting to directly or indirectly purchase, any single-family home, unless the purchase falls within a defined statutory exception. The prohibition expressly reaches acquisitions through mergers, acquisitions, bulk purchases and construction (whether or not for cash consideration). The institutional investor provisions take effect beginning January 7, 2027, and sunset 15 years after this date.

“Large institutional investor” is defined broadly to include any for-profit entity engaged in investing in, owning, renting, managing or holding single-family homes that, alone or together with affiliated entities, has direct or indirect investment control over 350 or more single-family homes in the aggregate. Notably, the 350-home threshold excludes homes acquired through excepted purchases made after enactment. “Investment control” extends beyond direct ownership of a single-family home to include general partners, managing members, investment managers (i.e., entities that directly or indirectly control the owning entity) and entities owning more than 25% of any class of equity in the owning entity – unless that entity is a passive investor. Note that the act does not require any large institutional investor to divest homes acquired before the date of enactment, nor does it interfere with bankruptcy proceedings.

The act carves out 11 categories of “excepted purchases,” which include the following:

• Build-to-rent: New construction by a large institutional investor to be managed as a rental property.
• Renovate-to-rent: Substantial rehabilitation of homes that do not meet local building code structural or core system standards, with minimum improvements of at least 15% of the purchase price.
• Homeownership programs: Acquisitions pursuant to a program to boost homeownership that provides for positive credit reporting to consumer reporting agencies for renters (if the renter opts in), a right of first refusal and a 30-day ‘‘first look’’ period, and may entail meaningful financial support from the investor toward the purchase.
• Loss mitigation: Acquisitions by mortgage servicers and lenders solely in connection with foreclosure, deed-in-lieu of foreclosure or enforcement of a security interest – for the purpose of loss mitigation or compliance with servicing or investor obligations, and not as a long-term investment strategy.
• Transition period: Purchases from noncovered investors made within two years of the act’s effective date.
• Investor-to-investor transfers: Purchases from another large institutional investor that either owned the home at enactment or acquired it in compliance with the act.

The act also imposes a notification requirement: No later than 180 days after the date of the enactment of the act and not later than December 31 of each following year , a large institutional investor must notify the secretary of the Department of Housing and Urban Development (HUD) that it remains a large institutional investor, along with the number of and city and state of all single-family homes the large institutional investor has direct or indirect investment in, unless such large institutional investor owns 10 or fewer single-family homes in a particular city.

Violations of the purchase prohibition on large institutional investors carry civil penalties, enforced by the secretary of the Treasury or, at the secretary’s request, by the attorney general, of up to $1 million per violation or three times the purchase price of the property involved, whichever is greater.

Community bank deposit reforms

The act makes two significant changes impacting brokered deposits.

1. Reciprocal deposits. The act amends the Federal Deposit Insurance Act to raise the threshold under which reciprocal deposits are treated as core rather than brokered, enabling community banks to accept more reciprocal deposits without triggering brokered deposit classification. Under prior law, reciprocal deposits could be treated as nonbrokered only up to 20% of total liabilities. The act replaces the flat cap on nonbrokered reciprocal deposits with a tiered structure: up to 50% of the first $1 billion in total liabilities; up to 40% of the portion of total liabilities between $1 billion and $10 billion; and up to 30% of the portion between $10 billion and approximately $96.3 billion.

The act also requires the FDIC, in consultation with the Federal Reserve, to carry out a study on reciprocal deposit performance since 2018 – including usage during periods of stress and an analysis of end-user depositors, such as municipalities, businesses and nonprofits – and report its findings to Congress within six months of enactment.

2. Custodial deposits. The act creates a limited brokered deposit exception for certain custodial deposits held at banks with less than $10 billion in total assets, that are well-capitalized or hold a brokered deposit waiver and carry a composite CAMELS rating of 1, 2 or 3. Under the safe harbor, such deposits are not treated as brokered deposits, provided they are less than 20% of the institution’s total liabilities.

Central bank digital currency (CBDC) ban

Under an unrelated provision that was negotiated into the act, the Federal Reserve Board and any Federal Reserve bank may not issue or create a central bank digital currency (CBDC), or any digital asset substantially similar to one, directly or indirectly, through a financial institution or other intermediary.

A CBDC is defined as a digital asset that is denominated in US dollars, constitutes US currency, represents a direct liability of the Federal Reserve System and is widely available to the general public. The prohibition cross-references the definition of “digital asset” in the Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS) Act. The provision sunsets on December 31, 2030, and does not foreclose future congressional authorization of a CBDC.

While the Federal Reserve was not actively developing a retail CBDC, the provision codifies existing executive policy. Trump’s January 2025 executive order had already directed his administration not to take steps toward a CBDC, which he described as something that would “threaten the stability of the financial system, individual privacy, and the sovereignty of the United States.”

Looking forward

The 21st Century ROAD to Housing Act presents compliance and strategic planning questions across multiple areas of financial services practice.

Institutional investors in the single-family housing market may consider assessing current portfolios against the 350-home threshold, map existing programs against the statutory exceptions and begin compliance planning ahead of Treasury rulemaking. The regulations must minimize market disruptions upon identifying a risk of material negative impact on the housing market, including an impact on the ability of market participants to dispose of single-family homes in an orderly fashion, and mitigate, to the extent possible, negative impacts on consumers and communities. But note that the act expressly prohibits any regulation from altering the statutory definitions, narrowing the excepted purchase categories, expanding the class of covered large institutional investors or adjusting the 350-home threshold.

Community banks may consider revisiting their deposit strategy in light of the new tiered thresholds. Finally, the CBDC ban, while temporary and largely confirmatory of existing policy, is relevant to any institution engaged in digital payments infrastructure or stablecoin-adjacent activities. The sunset date of December 31, 2030, and the accompanying rule of construction signal that the question of a US CBDC is deferred rather than resolved.

The RFI was issued pursuant to Executive Order 14393, “Promoting Access to Mortgage Credit” (March 13, 2026), which states that recent statutory and regulatory changes have limited access to credit for certain creditworthy borrowers. The EO directs the CFPB to consider a series of mortgage-related regulatory and supervisory changes to “improve the availability and affordability of mortgage credit, tailor rules for community banks and “smaller banks” [and] reduce the regulatory burden on community banks.” Specifically, the EO requests that the CFPB consider:

1. Proposing amendments to Regulation Z to tailor ability to repay (ATR)/qualified mortgage (QM) requirements.
2. Replacing TRID timing rules with a materiality-based standard that “preserves consumer clarity and reduces closing delays.”
3. Exempting rate-and-term refinancing (including cash-out refinancing) from rescission rights.

Request for comment

Consistent with the EO’s directive – and the CFPB’s objective to identify and address “outdated, unnecessary, or unduly burdensome regulations” – the RFI specifically solicits input on the Truth in Lending Act-Real Estate Settlement Procedures Act (TILA-RESPA) Integrated Disclosure (TRID) rule, the right of rescission under TILA for certain refinance transactions, and disclosure requirements for reverse mortgages.

TRID timing requirements

A central focus of the RFI is the TRID framework. The CFPB notes that TRID’s timing requirements and tolerance thresholds may introduce operational complexity and delay loan closings, and seeks comment on how these requirements could be reformed.

Among other issues, the CFPB asks whether:

• The three-business-day requirement to deliver the loan estimate after application, the seven-business-day waiting period between loan estimate delivery and consummation, and the requirement that consumers receive the closing disclosure no later than three business days before consummation affect borrowers’ ability to access credit and/or increase costs for lenders and consumers.
• Existing rules requiring revised disclosures upon “changed circumstances” impose undue burdens, particularly if creditors must issue updated disclosures within three business days of receiving information that triggers a revision.
• A materiality-based approach could replace or supplement current timing rules, preserving consumer clarity while reducing administrative delays.
• Disclosures could be provided earlier in the origination process, and whether the TRID forms themselves could be revised to improve consumer comprehension and loan execution.
• Additional guidance on the acceptability of electronic and digital forms and signatures would promote their use and reduce costs for consumers.

Other TRID requirements

Tolerance thresholds. The RFI raises questions about the TRID tolerance framework, including the distinction between zero tolerance, 10% tolerance and unlimited tolerance categories. The CFPB seeks comment on whether changes to the tolerance thresholds could improve loan execution and access to credit, and lower costs for consumers.

Changed circumstances. The CFPB is also considering whether clearer guidance on “changed circumstances” could help reduce the frequency of required revised disclosures while maintaining accurate cost estimates for consumers.

Construction loans. The CFPB seeks comment on whether to amend or clarify requirements specific to construction loans, including whether certain requirements should be waived.

Secondary market implications. The CFPB questions how potential TRID changes would impact the pricing, liquidity or demand for mortgages, mortgage-backed securities, mortgage servicing rights and other mortgage-backed capital markets instruments.

Right of rescission

The CFPB is also evaluating whether the current right of rescission framework, which provides a post-consummation rescission period for certain transactions, remains justified in light of TRID’s pre-consummation disclosure requirements.

Currently, under TILA and Regulation Z, the rescission period begins after the last of three events: consummation of the transaction; delivery of all material disclosures; and delivery to the consumer of the required rescission notice. In practice, for borrowers who have not waived their rescission right for a bona fide personal financial emergency, the three-day post-consummation rescission waiting period – coupled with the three-day pre-consummation TRID waiting period – means consumers in rescindable transactions have approximately one week to review the loan’s final terms. The CFPB asks whether this structure unduly delays loan funding – particularly in refinance transactions – and whether adjustments could streamline the process without undermining consumer protections.

Tailored requirements for small banks and credit unions

The CFPB asks for comment on implementing changes to the TRID rule as it relates to small banks and credit unions and whether revisions are structured as exemptions or alternative requirements. The CFPB also asks whether changes exclusive to small banks and credit unions would lower costs for both creditors and consumers alike.

Reverse mortgage disclosures

The CFPB is examining the current disclosure regime for reverse mortgages. Because reverse mortgages are excluded from TRID and are instead subject to overlapping TILA and RESPA requirements – including the good faith estimate and HUD-1 forms that are not tailored for reverse mortgage transactions – the CFPB is considering a more integrated, tailored disclosure framework to better serve consumers and minimize confusion.

Looking ahead

While the RFI does not propose specific rule changes, it signals an openness to revisiting long-standing requirements governing mortgage origination.

Comments must be received by August 10, 2026. Stakeholders across the mortgage industry –including lenders, servicers, community banks, investors, secondary market participants and consumer advocates – may consider engaging in the comment process, particularly given the potential scope of changes to TRID compliance, disclosure timing, rescission practices, construction loan requirements and other regular practices that will affect their operations.

The changes

The CFPB announced seven changes to the system:

1. Clarifying closure definition for consistency

As companies’ definitions for when a complaint is “closed with non-monetary relief” may vary, the CFPB issued a new Company Portal Manual offering guidance on the different response closure categories and answers to frequently asked questions to standardize data.

2. Adding identity protections

The CFPB instituted two-factor authentication for users who create online accounts.  It also added clarifying text and relationship categories to emphasize that third parties must disclose their involvement in the complaint process. Though not yet implemented, the CFPB plans to add address validation so companies can “act on high-quality information.”

3. Reflecting statutory obligations

Based on its understanding that certain credit repair clinics and other individuals may be attempting to circumvent the Fair Credit Reporting Act (FCRA) framework to dispute incorrect or incomplete information, the CFPB added a notice informing consumers that they must first exhaust their dispute rights directly with consumer reporting agencies before filing a complaint. Though not yet finalized, the CFPB may also add an administrative response for credit reporting agencies to use when a consumer has not exhausted those rights before filing.

4. Focusing on substantive complaints

The CFPB noted that companies have applied inconsistent standards for determining when a complaint warrants only an administrative response. The CFPB is working with the nationwide credit reporting agencies to develop guidance on when an administrative-only response is necessary and is considering expanding the available categories.

5. Promoting consumer education

The CFPB is developing educational resources to inform consumers about the risks and costs of credit repair offerings and help them identify related scams.

6. Developing new technology

The CFPB is developing new technology to share complaint data with companies more efficiently and use software, including address validation tools, to confirm that respondents are responding to the correct consumer.

7. Redefining the ‘backlog’

The CFPB released a new definition for complaint backlogs. Previously, any complaint awaiting action – whether just received or dormant for weeks – was included in the CFPB’s “backlog.” Under the revised definition, complaints awaiting action for more than 30 calendar days after submission will be considered part of the backlog, while those pending for fewer than 30 days will be treated as routine works in progress.

What’s next?

Companies should continue to closely monitor their regulatory complaint intake systems and follow “Finsights” for additional updates to portal procedures, guidance and other modifications to the CFPB’s system.

Background

The OCC issued the interpretive letter in response to a request from a New York-chartered limited liability trust company that received OCC approval to convert to an uninsured national bank with operations limited to those of a trust company.

Before becoming a national bank, the company held money transmitter licenses in multiple states, but subsequently surrendered the licenses. The Iowa Division of Banking questioned the license surrender, noting that Iowa law requires that entities engaged in money transmission obtain a license unless subject to an exemption, and that the company did not satisfy a license exemption applicable to national banks because it did not maintain federally insured deposits. The Iowa Division of Banking requested that the company provide a legal basis for the surrender of the license, and the company sought confirmation from the OCC that it could continue its operations without being subject to state licensing regimes.

OCC analysis

The OCC agreed with the company that, as a national bank, it was no longer required to maintain an Iowa money transmitter license even if its activities were considered money transmission under Iowa law. The OCC noted its conclusion was “clear and unambiguous under applicable law and longstanding precedent,” and grounded its analysis in two legal principles:

1. National Bank Act preemption

Federal law authorizes national banks to engage in a range of activities on a nationwide basis. Under the governing standard, a state law is preempted where it “prevents or significantly interferes” with the exercise of those powers.

The OCC reasoned that a state money transmitter licensing requirement operates as a condition on the exercise of federally authorized banking activities. Even if framed as a threshold or procedural requirement, such a regime would subject a national bank’s ability to operate to state approval. The OCC emphasized that this type of condition is inconsistent with the structure of the NBA, which allows national banks to exercise their powers without obtaining additional state permission – and which precludes outcomes where a state could effectively block or curtail those powers through licensing decisions.

2. Exclusive visitorial authority

The OCC separately relied on the NBA’s allocation of supervisory authority. Under 12 USC § 484, national banks are subject to federal “visitorial” powers – such as examination, reporting and enforcement – except in limited circumstances.

The OCC observed that state licensing regimes typically entail ongoing supervisory features, including reporting obligations, examination authority and enforcement tools. Applying such a framework to a national bank would, in the OCC’s view, transfer oversight authority that federal law assigns exclusively to the OCC. That conflict provides an independent basis for rejecting the application of state licensing requirements.

Taken together, the OCC concluded that a national bank may conduct its federally authorized activities nationwide without obtaining a state money transmitter license, regardless of whether it satisfies any state-law exemption.

What’s next?

While the interpretive letter does not break new doctrinal ground, it reiterates preemption principles and applies the doctrine to an increasingly popular compliance approach/business model: digital asset businesses and other fintechs seeking and securing national trust bank charters in place of state money transmission licenses. Note also that the letter’s preemption reasoning extends beyond Iowa, as the OCC expressly confirmed that the analysis applies to similar state money transmitter licensing requirements across all states, regardless of whether the state limits its express licensing exemptions to a subset of national banks.

Businesses considering engaging in payments-related activities, or that already do, may consider the possibilities of obtaining or converting to a national bank charter and the implications for a state money transmitter license compliance strategy. For state regulators, the letter highlights the limits of state oversight where national banks are acting within their federally authorized powers (as interpreted by the federal authority) and clarifies states cannot use money transmitter licensing regimes as an indirect mechanism to regulate or supervise national banks.

Comments on the proposed rule are due by August 21, 2026.

Background

Enacted in July 2025, the GENIUS Act established the first federal regulatory framework for payment stablecoins and their issuers. Among other things, the GENIUS Act directs that PPSIs be treated as financial institutions under the Bank Secrecy Act (BSA) and required to maintain an “effective customer identification program, including identification and verification of account holders.” This NPRM implements that CIP directive and should be read alongside the separate April 2026 FinCEN/Office of Foreign Assets Control NPRM addressing broader anti-money laundering and counter-terrorism financing (AML/CFT) and sanctions compliance program requirements for PPSIs, which addressed AML program obligations but expressly left CIP requirements to a stand-alone rulemaking.

The NPRM imposes a CIP obligation for all accounts maintained by PPSIs, whether the PPSI is supervised by a federal banking agency or operating under a state supervision pathway. In many respects, the proposed requirements mirror the familiar CIP framework applicable to banks, broker-dealers and other financial institutions, but adapted for the stablecoin context.

What the proposed rule would require

Under the proposal, each PPSI would be required to maintain a written, risk-based CIP appropriate for the PPSI’s size and business as part of its broader AML/CFT program.

Scope of obligation

The NPRM proposes three new definitions – “account,” “customer” and “digital asset service provider” – which are intended to clarify that the CIP obligation extends only to direct relationships and not to activity where a user’s only interaction with the PPSI is through a smart contract. CIP obligations would therefore attach only in the “primary” market, such as when a customer opens an account directly with the PPSI to issue, redeem or custody stablecoins. “Secondary” market participants (i.e., those who later transact in tokens without a direct relationship with the issuer) would not be considered the PPSI’s “customer” for CIP purposes, a scoping decision on which the agencies are seeking comment.

Customer information and identify verification

Before opening an account, a PPSI would be required to collect standard identifying information (name, date of birth or formation, address and government identification number) and verify customer identity through risk-based procedures that “enable the PPSI to form a reasonable belief that it knows the identity of each customer.” PPSIs must verify identity “to the extent reasonable and practicable,” and, where a PPSI cannot form a reasonable belief that it knows the true identity of a customer, the CIP must describe: when not to open an account; the conditions under which a customer may use an account while verification is pending; when to close an account after failed verification attempts; and when to file a Suspicious Activity Report.

Notice and comparison with government lists

PPSIs also would be required to screen customers against government lists of known or suspected terrorists or terrorist organizations and provide customers with adequate notice that the PPSI is requesting information to verify their identities.

Reliance on another institution

A PPSI’s CIP may include procedures for relying on another federally regulated financial institution to perform CIP procedures on its behalf, provided the reliance is reasonable, the other institution is subject to its own AML/CFT and CIP requirements and is regulated by a Federal functional regulator,[1] and there is a contract in place requiring that institution to certify annually that it has implemented its program and will perform the specified CIP procedures. The PPSI would remain responsible for its own compliance regardless of any such reliance arrangement.

Records

The proposed rule creates two distinct records retention periods: (1) Identifying information collected prior to account opening must be retained for five years after account closure; but (2) verification records (descriptions of documents reviewed, nondocumentary methods used and resolution of discrepancies) must be retained for five years after the record is made.

Comments sought

The agencies are soliciting comment on a range of issues. On the substantive rule design, the agencies ask whether CIP requirements should extend to secondary market activity and, if so, under what circumstances. They seek feedback on whether the proposed definitions of “account,” “customer” and “digital asset service provider” are sufficiently clear and whether “formal relationship” is the right conceptual anchor for the definition of “account“, or whether alternative concepts – such as a “contractual” or “business” relationship” – would be more appropriate. The agencies also ask whether the rule should be clarified for the specific scenario where a customer’s only desired interaction with a PPSI is to redeem a payment stablecoin.

On verification and technology, the agencies invite comment on whether the regulatory text should explicitly address digital identity solutions and verifiable credentials, and what the benefits and risks of those tools are for customer identity verification.

On reliance, the agencies ask how likely it is that PPSIs would rely on another PPSI’s CIP or the CIP of another Federal functionally regulated financial institution. Finally, the agencies broadly invite input on what changes would make the rule more conducive to industry innovation.

Looking ahead

The CIP rulemaking is one of several GENIUS Act rulemakings underway, with additional rules still to come. For example, the Federal Reserve and the US Department of the Treasury are expected to propose new rules covering licensing, substantive GENIUS Act obligations and foreign issuers, among other matters. We will continue to monitor developments as the GENIUS Act regulatory framework takes shape.

[1] Under section 509 of the Gramm-Leach-Bliley Act, the term “Federal functional regulator” means (A) the Board of Governors of the Federal Reserve System; (B) the Office of the Comptroller of the Currency; (C) the Board of Directors of the Federal Deposit Insurance Corporation; (D) the Director of the Office of Thrift Supervision; (E) the National Credit Union Administration Board; and (F) the Securities and Exchange Commission. 15 U.S.C. 6809(2)

The rescission is consistent with the CFPB’s final rule published in April 2026, which implements revisions to Regulation B, including revising certain standards for SPCPs. Pursuant to the final rule, a for-profit SPCP may no longer use race, color, national origin or sex (or any combination of these characteristics) as eligibility criteria to participate in the program. The final rule also requires written plans to include evidence of the need for the program and an explanation of why the targeted class would not receive such credit absent the program. Finally, it adds a requirement that if a for-profit SPCP uses common characteristics beyond race, color, national origin or sex, it must provide evidence for each individual participant that, absent the program, the participant would not receive the credit as a result of those specific characteristics. The CFPB noted that it rescinded the 2020 advisory opinion “as it is now outdated and inconsistent with the[se] recent amendments to Regulation B.”