CFPB Opens Debanking Investigation Into Nine Large National Banks

Consumer Financial Protection Bureau building in Washington, D.C.Diego M. Radzinschi/ALMThe Consumer Financial Protection Bureau announced on October 14, 2026 that it will examine whether nine of the largest national banks broke federal consumer financial law when they closed or restricted customer accounts. The announcement followed a report by the Office of the Comptroller of the Currency, which the CFPB said identified policies at those banks denying or restricting access based on customers’ political or religious beliefs or on lawful business activities. Supervisory findings and consumer protection liability are different problems. The second one is now the live one.What The Bureau Said It Will ExamineActing Director Mark Paoletta said the agency would “fully investigate whether the institutions featured in OCC’s report” complied with federal consumer financial laws. The announcement named the Equal Credit Opportunity Act, the Fair Credit Reporting Act’s adverse action notice requirements, and the prohibition on unfair, deceptive, or abusive acts or practices. The CFPB said it is reviewing consumer complaints, supervisory and enforcement data for evidence of unlawful debanking, and has updated its complaint portal to gather more of it.The institutions named were JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC, TD Bank and BMO. The sectors most affected, according to the announcement, were firearms, oil and gas, and tobacco. Each sits above the $10 billion asset threshold at which the CFPB holds primary supervisory and enforcement authority, so the agency needs no referral to reach any of them.The Executive Order Does Not Direct The CFPBExecutive Order 14331, “Guaranteeing Fair Banking for All Americans,” signed August 7, 2025, is the stated basis for the initiative, and its consequences for fintechs were visible when it issued. The order defines politicized or unlawful debanking, states that banking decisions must rest on “individualized, objective, and risk-based analyses,” and gives federal banking regulators 180 days to strip “reputation risk or equivalent concepts” from guidance and examiner materials and 120 days to review institutions for policies that encourage it.The order does not name the CFPB and directs it to do nothing. That distinction carries weight. The initiative rests on ECOA, the FCRA and section 1031 of the Consumer Financial Protection Act, which the order cites as authorities other regulators may invoke rather than powers it confers. An institution waiting for the order to be narrowed or rescinded is watching the wrong instrument, since the statutes the CFPB named predate it and would survive it.MORE FOR YOUWhere The Theories Fit And Where They StrainRegulation B requires a creditor taking adverse action to give reasons, and § 1002.9(b)(2) provides that they “must be specific and indicate the principal reason(s) for the adverse action.” The same paragraph states that reasons citing “the creditor’s internal standards or policies” are insufficient. Closure programs built around reputational categories tend to be documented in exactly that language, which puts the compliance problem in the rule’s own text rather than in the report’s characterizations.The fit is not uniform across the conduct described. ECOA and Regulation B govern credit, so a deposit relationship terminated without any credit decision falls outside the adverse action framework. The FCRA reaches further. Where an institution closed or restricted an account based in whole or in part on a consumer report, the notice obligation attaches whether or not credit was involved, which makes the use of account screening data the question that decides exposure. UDAAP covers the remainder, with the fewest definitional limits and the least settled application to account termination.What Banks And Their Fintech Partners Should Do NowPull the closure files before an examiner does. The question is whether the recorded reason for each action matches the reason actually applied, and whether a consumer report contributed to the decision. A file recording a policy category rather than a fact creates exposure under both notice regimes at once.Plan for remediation rather than penalties. The Small Business Administration has shown the shape of it. In August 2025 the agency directed more than 5,000 lenders to end “politicized or unlawful banking practices,” identify and reinstate former clients denied service, notify each affected party, and report compliance by January 5, 2026. Identification, reinstatement and notification are harder to execute than a fine, and they reach customers an institution may no longer track.Fintechs do not appear in the report, but sponsor banks write the account closure policies that fintech programs operate under, and a partner bank revising its documentation standards will push those revisions into program agreements and the decisioning logic behind them.The CFPB has not opened a public enforcement action, and the OCC’s findings are supervisory rather than adjudicated. What has changed is the audience for closure documentation that banks built for a supervisory conversation. It is now read by an agency with consumer protection authority, beside a complaint portal collecting the customer’s version of the same events and a federal report handing plaintiffs’ counsel and state attorneys general a list of nine names.