Three Quiet Policy Shifts That Will Reshape Your Compliance Stack

The Iran war, the CPI print, and the Upstart lawsuit dominated the financial press this week. Underneath that noise, three slower-moving policy developments landed that will shape the compliance and operating environment for consumer lenders well beyond the current news cycle. They deserve more attention than they received.

1. The CFPB just filed a plan to cut 68% of its staff — and the injunction is the only thing stopping it

On March 31, Acting CFPB Director Russell Vought filed a Workforce Restructuring Plan (WRP) in the DC Circuit Court of Appeals in National Treasury Employees Union v. Vought (Case No. 25-5091). The plan is detailed, formally adopted, and represents the most complete picture yet of what the CFPB intends to become — if the courts allow it.

The numbers are stark. The plan would reduce total CFPB headcount from 1,723 authorized FY2025 positions to 556 retained employees — a 68% reduction. Current onboard staff sits at 1,174 following attrition, so the effective reduction from current levels is approximately 53%. Every division takes significant cuts:

The Supervision Division — which examines banks and nonbanks — falls from 523 authorized positions to 77 retained. The Enforcement Division falls from 254 to 50. The External Affairs Division falls from 45 to just 5. The Office of Fair Lending and Equal Opportunity is reduced to 4 people — a number that University of Maryland Law School professor Jeff Sovern described as insufficient to fulfill its statutory mandate under Dodd-Frank by any reasonable standard.

The operational shift is equally significant. The WRP states that total exams will fall from 107 in 2024 to 64 in 2026 — with nonbank exams dropping from 61 to just 22 out of approximately 5,000 nonbank institutions subject to supervision. That is coverage of less than half of one percent of the nonbank universe. Exams that do occur are expected to shift to virtual rather than in-person format. The stated enforcement philosophy moves from “number of cases filed” to “issues resolved” through voluntary remediation — with civil money penalties described as a rare outcome.

Three arguments support the motion to modify the injunction. First, Vought argues the plan does not shut down the Bureau — the action the District Court’s original injunction was designed to prevent. Second, the One Big Beautiful Bill Act reduced the Fed transfer cap from 12% to 6.5%, limiting FY2026 funding to $466.8 million against $677.5 million needed to comply with the injunction — making current staffing levels financially unsustainable by Q4 2026. Third, the Supreme Court’s June 2025 ruling in Trump v. CASA limits universal injunctions to providing relief only to named plaintiffs, which Vought argues narrows the injunction’s proper scope.

Plaintiffs’ reply is due April 17. The injunction remains in place for now — none of the cuts have taken effect. But Ballard Spahr attorneys who analyzed the filing called the revised plan a “huge improvement” over prior RIF attempts and noted it will be considerably harder for plaintiffs to sustain injunctive relief than it was a year ago.

What it means for your institution: If the WRP takes effect, the supervisory and enforcement environment for consumer lenders — particularly nonbanks — changes fundamentally. With fewer than 22 nonbank exams annually, the probability of a given institution facing federal examination approaches zero. That shifts the primary compliance risk vector to state attorneys general, state banking regulators, and private litigation. Institutions that have calibrated their compliance programs around CFPB exam readiness should begin building parallel readiness for state-level scrutiny, which is likely to fill the vacuum.

2. The national debt crossed $39 trillion — and interest payments just hit $1 trillion a year

The Congressional Budget Office’s latest monthly budget statement confirmed the US government ran a deficit of $1.17 trillion for the first six months of fiscal year 2026 — October 2025 through March 2026. Total national debt now exceeds $39 trillion. Net interest payments on that debt are on track to exceed $1 trillion in fiscal year 2026 alone — nearly triple the $345 billion in interest paid in 2020.

Peter G. Peterson Foundation CEO Michael Peterson, in an exclusive interview with Fortune this week, offered the framing that matters: the bond market’s current calm is not a signal that no problem exists. It is a signal that markets are not pricing an imminent crisis. The structural damage accumulates regardless. Over the next 30 years, the government is projected to spend nearly $100 trillion on interest payments alone. For individual Americans, the Peterson Foundation puts the interest burden at an average of at least $47,000 per person over the next decade.

The debate among economists is not whether the debt burden will eventually be felt — it is who bears it first. Retirees face the risk through financial repression if the government holds rates artificially low to reduce debt service costs. Mortgage holders and aspiring homeowners face the risk if markets force rates higher. Peterson’s assessment: the pain will be widespread, significant, and long-standing, with the most disadvantaged likely bearing the sharpest end.

What it means for your institution: The direct transmission mechanism for consumer lenders is Treasury yields. Interest payments exceeding $1 trillion annually create structural upward pressure on the long end of the yield curve — meaning the rate environment consumer lenders are operating in today is not a temporary post-pandemic artifact. It is increasingly the permanent backdrop. Product pricing, capital allocation, and funding strategy all need to be built around a sustained higher-for-longer rate environment, not a return to the 2019 baseline.

3. Oklahoma became the 20th state with a consumer data privacy law

Oklahoma Governor Kevin Stitt signed Senate Bill 546 into law last month. Effective January 1, 2027, the Oklahoma Consumer Privacy Act gives residents the right to access, correct, delete, and obtain copies of their personal data, opt out of data sales and targeted advertising, and requires covered businesses to provide transparent privacy notices and obtain consent before processing sensitive personal information.

The law covers businesses that process personal data of more than 100,000 Oklahoma consumers, or process data of 25,000 consumers while deriving a majority of revenue from selling that data. It is modeled on Virginia’s consumer data privacy law — which privacy advocates have characterized as business-friendly — and includes a 30-day cure period before penalties apply and no private right of action allowing consumers to sue directly.

Troutman Pepper Locke attorney Roshni Patel described it as a “middle of the road” approach: narrower in some definitions than California and Colorado, without some of California’s more stringent requirements, but providing Oklahoma residents with a baseline set of rights that residents of 19 other states now have. Notably, the Oklahoma law defines data “sale” more narrowly than California — limited to exchanges for money, rather than California’s broader “any valuable consideration” standard.

The more significant trend is the one Patel identified: with 20 state privacy laws now in effect or taking effect, many larger companies are abandoning state-by-state compliance calibration and simply extending privacy rights to all US users. The patchwork is becoming dense enough that uniform national treatment is operationally simpler than state-specific carve-outs.

What it means for your institution: If you originate, service, or market to Oklahoma consumers, SB 546 is a compliance deadline — January 1, 2027 — that belongs in your regulatory calendar now. More broadly, the state privacy law patchwork has reached a threshold where a unified consumer data rights framework across all states is likely the most practical long-term compliance posture. If your privacy program is still built around only California and a handful of other states, the 20-state reality requires a reassessment.