UDAAP enforcement actions 2025: what was cited, what was dropped

UDAAP enforcement actions in 2025 went two ways. The CFPB filed nine enforcement actions in the year, eight of them in January, then dismissed its lawsuits against Capital One and against Zelle's operator and three banks, terminated overdraft orders against Navy Federal Credit Union and Regions Bank, and withdrew its UDAAP guidance in May. The prudential regulators and the states did not stop. The FDIC found section 5 unfairness at Discover Bank and ordered at least $1.225 billion in restitution; the OCC's order against a savings bank over deceptive mailers followed in April 2026; and New York's Attorney General sued Capital One and the company behind Zelle after the CFPB walked away. For a compliance team the year's lesson is that the enforcer changed and the risk did not. Botminds' UDAAP Risk Assessment exists to catch the practices these cases turned on, a misleading rate or fee claim, a mislabelled account, a mailer that implies money the customer does not have, before launch, with the evidence and the decision kept for whoever examines the bank.

What UDAAP enforcement actions happened in 2025?

The cases that matter for banks fall into three groups: CFPB actions that ended, prudential-regulator actions that went ahead, and state actions that began where the CFPB stopped. The casebook below lists each with its status as shown on the issuing agency's page in October 2026. Amounts are as the agency states them; lawsuits are allegations, not findings.

Did the CFPB terminate consent orders in 2025?

Yes, including two overdraft orders against large depository institutions. On Navy Federal's November 2024 order, the CFPB's page now reads: "On July 1, 2025, pursuant to its authority under 12 U.S.C. § 5563(b)(3), the Bureau terminated the order and waived any alleged non-compliance therewith" (CFPB, Navy Federal Credit Union). Regions Bank's September 2022 order, issued "with no expiration date", was terminated on July 21, 2025 under the same authority (CFPB, Regions Bank).

Lawsuits ended the same way. The CFPB had sued Capital One on January 14, 2025, alleging violations of "the Consumer Financial Protection Act of 2010's prohibition on deceptive and abusive acts and practices" over its savings accounts; on February 27 it filed a notice "voluntarily dismissing the action against all defendants with prejudice" (CFPB, Capital One). Its December 2024 suit against Early Warning Services, the operator of Zelle, and three banks, which alleged unfair practices and Regulation E violations, was dismissed with prejudice on March 5, 2025 (CFPB, Early Warning Services).

Not every order went. The CFPB's page for its July 2023 order against Bank of America over repeat NSF fees, which the Bureau found unfair, still showed "Post Order/Post Judgment" in October 2026, with no termination (CFPB, Bank of America). And the CFPB's April 2025 priorities, still on its site, put depository institutions back at the centre: "The Bureau's focus will shift back to depository institutions, as opposed to nondepository institutions" (CFPB Supervision and Enforcement Priorities).

"The Bureau will deprioritize supervision where States have and exercise ample regulatory and supervisory authority, unless required by statute (rather than merely permitted)."

CFPB Supervision and Enforcement Priorities, April 2025

What did the FDIC penalize banks for in 2025?

The largest consumer compliance action of the year was a section 5 unfairness case in which the injured parties were merchants. The FDIC found that "For approximately 17 years, the Bank misclassified millions of consumer credit cards as commercial, resulting in higher interchange fees for transactions processed on the Discover network", and that "merchants were overcharged over $1 billion in interchange fees." It ordered a restitution plan of at least $1.225 billion and a $150 million penalty; the Federal Reserve separately fined the parent company $100 million (FDIC, April 18, 2025). The order itself lists the compliance management failures behind it, starting with board and management oversight, "change management", and "third party risk management" (FDIC, Discover Bank orders).

That one case dominates the FDIC's year. Across all supervised banks, the FDIC reported about $1.2 billion in restitution ordered under section 8(b) of the FDI Act in 2025, and civil money penalty orders of about $150 million for flood insurance and section 5 violations; supervised banks also paid $4.7 million in voluntary restitution to 47,902 consumers (FDIC Consumer Compliance Supervisory Highlights, March 2026). The annual totals and the Discover amounts are close enough that the annual figures should not be read as many banks paying large sums.

What the OCC cited: a mailer that implied money customers did not have

The OCC's order against The Federal Savings Bank of Chicago, signed on April 2, 2026 under a 2025 docket number, is a textbook deception case. The bank "sent consumers millions of deceptive advertisements that stated the consumer had 'available funds' and instructed the consumer to contact the Bank. In reality, the advertisement was a solicitation for a VA cash-out refinance loan and a new loan was required to access the funds." Employees also implied a special relationship with the VA and that rates or payments would fall within a set period (OCC, AA-ENF-2025-63).

The remedy is the part a compliance team should read. The bank must engage an independent "Restitution Consultant" to plan and oversee payments, submit written methodologies for identifying eligible consumers and calculating amounts, and have the consultant test its own payments afterwards. Nine directors signed the order, and its general board article begins: "The Board shall ensure that the Bank has timely adopted and implemented all corrective actions required by this Order." Every one of those steps is slower and dearer than changing a headline before the first mailer went out.

What did state attorneys general do in 2025?

They filed the cases the CFPB dropped. New York's Attorney General sued Capital One on May 14, 2025, under the headline "AG James Takes Action After Federal Administration Abandoned Similar Lawsuit", alleging that the bank marketed 360 Savings as "high interest" while "Capital One froze its 360 Savings rate at 0.3 percent and increased its 360 Performance Savings rate to as high as 4.35 percent", and that it "even instructed its employees not to tell 360 Savings customers about the new product unless they explicitly asked" (New York Attorney General, May 14, 2025). A revised class settlement requiring $425 million in restitution and rate matching was preliminarily approved on January 12, 2026; New York said it would dismiss its own case if the settlement takes effect (New York Attorney General, January 12, 2026).

On August 13, 2025 the same office sued Early Warning Services, alleging that Zelle's "advertisements misleadingly promised safe and secure money transfers" and that scammers took "over $1 billion between 2017 and 2023" (New York Attorney General, August 13, 2025). State authority over national banks has limits, set out in the UDAP vs UDAAP chart, but in 2025 a state attorney general took up both of the deposit and payment cases the CFPB had dropped.

Are UDAAP violations still enforced after the 2025 terminations?

Yes. The statutes are unchanged; what changed is who acts. For banks of $10 billion or less, the prudential regulator has always had exclusive UDAAP enforcement relative to the CFPB (the full map of who enforces which law is inthe UDAP vs UDAAP chart), and the FDIC and the OCC enforce section 5 of the FTC Act at every size, as the Discover and Federal Savings Bank orders show. Above $10 billion the CFPB remains the primary UDAAP enforcer; its April 2025 priorities say it will focus "on actual fraud against consumers, where there are identifiable victims with material and measurable consumer damages", and on depository institutions.

Guidance is the layer that thinned. The CFPB withdrew its 2023 abusiveness policy statement, its circulars on overdraft and its bulletin on returned deposited item fees on May 12, 2025 (90 FR 20084); which of those still matter, and what the fee refunds cost before they went, is covered in CFPB junk fees guidance, withdrawn.

What practices are most often cited as unfair or deceptive?

Across the 2025 cases, the same few practices recur: marketing a rate, a fee or a feature that the product does not deliver; misclassifying accounts so that fees run higher than the terms allow; advertising that implies money or safety the customer does not have; and fees on overdrafts customers could not see coming. The FDIC's procedures list the first group among acts with the potential to deceive: "making misleading cost or price claims; using bait-and-switch techniques; offering to provide a product or service that is not in fact available" (FDIC Consumer Compliance Examination Manual, VII-1). Older cases in which the words spoken on calls were the violation are collected in UDAAP violation examples from bank calls.

Where UDAAP Risk Assessment fits after 2025

The cases share a pattern: the practice was visible in what customers saw or were charged long before anyone acted. UDAAP Risk Assessment works at that point. It tests each claim on a new or changed journey against the agreement and the fee schedule, matches fee codes from the core banking system, and after launch maps complaint themes to the screen that caused them; five complaints on one theme in 30 days reopen a journey in the sample bank's settings. In the sample data, 26 complaints in 30 days out of 318 received were mapped to five journeys, and two reviews were reopened.

UDAAP Risk Assessment: complaints point back to the screen that caused them

It is not a litigation tool and does not predict which practice an agency will pursue. Its contribution to an examination or an inquiry is the record: every version's screens, every note with its source, who decided and who signed, and the change requests sent to partners, exported with personal data masked. To see that record built on one of your own journeys, start from UDAAP Risk Assessment.

Questions people ask

Did the CFPB bring any UDAAP case against a bank after January 2025?

Not on its own enforcement list. Of the nine actions the CFPB filed in 2025, eight were filed in January; the ninth, in August, was against Synapse Financial Technologies, a nonbank. Its January suit against Capital One was dismissed with prejudice the next month.

What does "terminated and waived any alleged non-compliance" mean?

It means the CFPB ended the order early and gave up claims that the institution had failed to comply with it. The Navy Federal order was terminated that way on July 1, 2025, and the Regions order on July 21, 2025, both under 12 U.S.C. 5563(b)(3).

Are consent orders from before 2025 still in force?

Some are. Status varies case by case, and the CFPB's action pages show it. Bank of America's July 2023 order on repeat NSF fees still showed "Post Order/Post Judgment" in October 2026, while Regions' and Navy Federal's overdraft orders were terminated.

Which 2025 bank case carried the largest penalty?

Of the cases in this casebook, Discover Bank: a $150 million FDIC civil money penalty, at least $1.225 billion in restitution to merchants under section 5, and a separate $100 million Federal Reserve penalty against its parent.

What happened to the CFPB's Zelle lawsuit?

The CFPB voluntarily dismissed it with prejudice in March 2025. New York's Attorney General filed its own suit against Early Warning Services in state court on August 13, 2025, saying it acted after the CFPB "abandoned a similar lawsuit".