Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 14 NOVEMBER 2025

CFPB Inspector General Says Bureau's Information Security Program Is Ineffective

Ballard Spahr LLP
Ballard Spahr LLP
Contributor
Ballard Spahr LLP

Ballard Spahr LLP

Ballard Spahr LLP, an AmLaw 100 law firm with 19 US offices, serves clients in more than 50...

View firm profile
Explore more from Ballard Spahr LLP

The quality of the CFPB's information security program "has decreased since last year, leading us to conclude the program no longer is effective," the bureau's Inspector General (IG), said in a report.

United StatesFinance and Banking
Gregory Szewczyk
Gregory Szewczyk
Author LinkedIn connections

The quality of the CFPB's information security program "has decreased since last year, leading us to conclude the program no longer is effective," the bureau's Inspector General (IG), said in a report.

The bureau's overall security program has decreased from "manageable and measurable" to "defined," the IG said in an annual audit conducted between April 2025 and October 2025, which is only one step above the lowest security rating. This is significant, as data maintained by the CFPB includes personally identifiable information on consumers and confidential supervisory information on companies.

"The CFPB is unable to maintain an effective level of awareness of security vulnerabilities in its environment," according to the report.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SEC Advances “Responsible Retailization” Through A Potential Accredited Investor Exam And Potential Regulated Fund Reforms

On September 30, 2026, the Securities and Exchange Commission (SEC) issued two rule proposals and five notices aimed at expanding investors’ access to private markets. The package would add ways to qualify as an accredited investor, including passing a new exam administered by the Financial Industry Regulatory Authority (FINRA), broaden performance-based compensation and modernize regulated funds, including interval funds and business development companies (BDCs).
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

SEC Proposes Rule Amendments To Expand Retail Access To Private Markets

The SEC has proposed sweeping amendments to expand retail investor access to private market strategies, including changes to performance-based compensation rules for registered investment advisers and modernization of the interval fund framework. The proposals also explore new credential-based pathways for individuals to qualify as accredited investors, potentially opening private offerings to a broader pool of eligible participants.
United StatesFinance and Banking
Duane Morris LLP
Duane Morris LLP
Article

SEC Approves FINRA’s New “Outside Activities” Rule

The Securities and Exchange Commission has approved FINRA Rule 3290, which will replace existing rules governing outside business activities and private securities transactions for registered persons. This new rule narrows the scope to focus on investment-related activities while maintaining similar supervisory obligations for member firms. Understanding the key changes and implementation requirements will be critical for broker-dealers as they update their compliance policies and procedures.
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

OCC Issues Examiner Framework For Banks’ Use Of Artificial Intelligence

The Office of the Comptroller of the Currency has released a new framework for evaluating banks' deployment of artificial intelligence and agentic AI systems in their business operations. This guidance establishes how examiners will assess AI through existing risk management disciplines rather than creating separate regulatory requirements, with review intensity scaled to each use case's potential consequences and level of human oversight.
United StatesFinance and Banking
Sheppard
Sheppard
Article

SEC Charges WhatsApp-Driven Crypto Fraud Schemes Totaling Over $15 Million

The SEC has charged two offshore entities with orchestrating sophisticated investment confidence scams that defrauded over 2,000 retail investors of at least $15.3 million through fake AI-powered crypto trading platforms. Using WhatsApp group chats, impersonated investment professionals, and fabricated regulatory filings, the defendants created elaborate schemes that promised guaranteed returns while stealing investor funds through shell companies and blocking withdrawal attempts with demands for additional
United StatesCriminal Law
Ballard Spahr LLP
Ballard Spahr LLP
Article

New York City’s Proposed POWER Act Would Create An Expansive Municipal Private Right Of Action For Unfair And Abusive Business Practices, Unfair Methods Of Competition, And Unlawful Acts

New York City's proposed POWER Act would create one of the most expansive municipal consumer-protection regimes in the country, introducing a sweeping private right of action that permits injured persons and nonprofit organizations to sue businesses for unfair, deceptive, abusive, or unlawful practices. The legislation has sparked intense debate between business groups warning of litigation exposure and consumer advocates arguing it fills critical enforcement gaps left by resource-constrained agencies. The
United StatesConsumer Protection
Ballard Spahr LLP
Ballard Spahr LLP
Article

FinCEN Proposes To Designate Banque Misr UAE As A Primary Money Laundering Concern And Revoke Correspondent Banking Access

The Financial Crimes Enforcement Network has proposed revoking Banque Misr UAE's correspondent banking access to U.S. financial institutions, designating it as a financial institution of primary money laundering concern. This action stems from Treasury's Operation Economic Outcast, which aims to sever financial channels Iran uses to evade sanctions and fund terrorist activities through shadow banking networks.
GlobalGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

Senate Banking Committee Advances Brian Johnson’s Nomination To Lead CFPB

The Senate Banking Committee has advanced Brian Johnson's nomination to lead the Consumer Financial Protection Bureau in a party-line vote, setting the stage for a full Senate confirmation. With the Senate's pre-election recess looming and Mark Paoletta currently serving as Acting Director, the timing of Johnson's potential confirmation could determine whether the CFPB has Senate-confirmed leadership before the November midterm elections.
United StatesGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

AI Learning Or AI Copying? Ninth Circuit Weighs In

The Ninth Circuit held that GitHub Copilot's AI-generated code did not violate DMCA's copyright management information (CMI) removal provisions, even when output resembled source code, because the system generated new works through probabilistic patterns rather than retrieving and stripping information from existing copies. This decision establishes a critical distinction between AI systems that learn and generate versus those that retrieve and reproduce, with significant implications for how courts evaluat
United StatesIntellectual Property
Ballard Spahr LLP
Ballard Spahr LLP
Article

Colorado Sues EarnIn, Alleging Its “Earned Wage Access” Product Is Really A High-Cost Loan

Colorado Attorney General Philip Weiser has filed a lawsuit against EarnIn, challenging whether its direct-to-consumer earned wage access product constitutes a high-cost loan subject to state lending laws. The case examines EarnIn's Cash Out product, which advanced approximately $300 million to Colorado consumers between January 2023 and July 2025, and questions whether the company's tips and expedited-transfer fees should be classified as interest charges.
United StatesConsumer Protection
Ballard Spahr LLP
Ballard Spahr LLP