On May 15, 2025, the Consumer Financial Protection Bureau (CFPB) issued an interpretive rule that rescinded a Biden-era interpretive rule regarding the extent of states’ enforcement authority under Section 1042 of the Consumer Financial Protection Act (CFPA). While states may continue to bring actions to enforce provisions of the CFPA, the new interpretive rule suggests that states may not bring actions arising under any enumerated …
Rhode Island Enacts New Financial Institutions Cybersecurity Law With Immediate Effect
More states are advancing prescriptive cybersecurity standards and requirements for financial institutions, many of which align with regulations from New York’s Department of Financial Services. Rhode Island’s legislature passed Senate Bill 603, effective immediately, which requires specific cybersecurity controls and notice to the Department of Business Regulation within three business days of determining a security event has occurred. North Dakota’s new law, House Bill 1127, …