When the Consumer Financial Protection Bureau settles a case without a trial, the result is often a consent order: a public order that the company agrees to, that names what the Bureau says went wrong, and that binds the company to a list of obligations for years. For a fintech, knowing what a CFPB consent order is and what it requires matters long before any investigation, because the obligations reach the board, the compliance team, product marketing and the complaint queue.

This explainer walks through where consent orders come from, what a typical one contains, how long it lasts and what happens if a company breaks it. It uses the May 2025 amended consent order against Wise US Inc., a New York-based remittance provider, as a worked example.

The CFPB can enforce federal consumer financial law in two ways, according to its enforcement actions page: by filing an action in federal district court, or by starting an administrative adjudication proceeding. Administrative proceedings are heard by an administrative law judge, who issues a recommended decision; the Bureau’s life cycle of an enforcement action page says the Director then issues a final decision.

A consent order is how an administrative proceeding ends when the company agrees to settle. The legal basis is 12 U.S.C. 5563, which lets the Bureau issue cease-and-desist orders that can require a company to stop a practice and “take affirmative action to correct the conditions” resulting from a violation. An order issued on consent takes effect at the time it specifies. Cases filed in court end differently: in the Synapse Financial Technologies case, for example, the Bureau filed a complaint together with a proposed stipulated final judgment and order for a court to enter.

Admit nothing, agree to everything

A consent order comes with a stipulation, a document in which the company consents to the order. In the Wise amended consent order, Wise consented “without admitting or denying any of the findings of fact or conclusions of law,” except the facts needed to establish the Bureau’s jurisdiction.

The order still contains a long section of “Bureau Findings and Conclusions.” Those are the Bureau’s account of the facts and its legal conclusions. Readers should treat them as the agency’s findings that the company did not contest, not as admissions.

The Wise order follows a structure that appears across CFPB orders. After jurisdiction, the stipulation, definitions and the findings, the obligations fall into three groups.

Conduct provisions. These include:

  • Prohibited conduct: the practices the company must stop and the specific steps it must take instead.
  • A compliance plan: Wise had 60 days from the effective date to create and implement a comprehensive plan with detailed steps, deadlines and a way to keep the board informed.
  • Role of the board and executives: the board has “ultimate responsibility” for compliance. The CEO, chief compliance officer and board must review every plan and report before it goes to the Bureau, and one year after the effective date the company had to file a board-approved compliance progress report sworn under penalty of perjury.

Monetary provisions. These cover consumer redress, a civil money penalty and rules for paying them, including interest on late payments and a bar on recovering the money. The amounts in the Wise case are logged in our Wise consent order record. The law allows wider relief: 12 U.S.C. 5565 lists rescission or reformation of contracts, refunds, restitution, disgorgement, damages, public notification, limits on a company’s activities and civil money penalties, and rules out punitive damages.

Compliance provisions. These are the obligations that shape daily operations for years:

  • Reporting: notice to the Bureau of a sale, merger, new subsidiary, bankruptcy filing or change of name or address, at least 30 days before the change where practicable and no later than 14 days after.
  • Distribution: copies of the order to board members, executives and staff with related duties within 30 days, and for five years to new ones before they take on those duties, with signed acknowledgments.
  • Recordkeeping: records showing compliance, marketing materials, disclosure templates and consumer complaints.
  • Cooperation and monitoring: responses to Bureau information requests within 14 days, interviews with consenting employees, and the Bureau keeps its power to issue civil investigative demands.
  • Complaints: Wise must stay registered on the Bureau’s company portal and meet the timely-response rules, and must tell consumers in its app and website that they can complain to the CFPB. Our guide to the CFPB complaint process explains what happens on the consumer side.

Duration is set in the order itself. The Wise order says it terminates on the later of five years from the effective date or five years from the most recent date the Bureau starts an action alleging a violation of the order, if that action begins within the first five years. If such an action is dismissed or the company is found not to have violated the order, the clock runs as if the action had never been filed.

Until then, the order stays “effective and enforceable,” except for provisions the Bureau amends, suspends, waives or terminates in writing. The CFPB’s status definitions reflect this: a matter is “Post Order/Post Judgment” while compliance obligations continue, and “Expired/Terminated/Dismissed” once they end.

Changing an order

Orders can change. Section 5563(b) lets the Bureau “modify, terminate, or set aside” an administrative order, and Wise’s original January 30, 2025 order was replaced on May 15, 2025 by an amended consent order agreed under that provision, according to the Bureau’s case page. For small changes, the order lets the company ask the Supervision Director in writing for modifications to non-material requirements, such as reasonable extensions of time or changes to reporting.

What breaking the order means

Two clauses make violations costly. First, the order releases the company only for practices described in the findings that occurred before the effective date and that the Bureau knew about. The Bureau may use those practices in future actions, including to show a pattern of violations or to calculate a penalty. Second, the order says it is a final order under Section 5563 and not a contract.

Under the civil penalty provisions of Section 5565, a violation of a final order of the Bureau is covered by the first penalty tier, set per day of violation, with higher tiers for reckless or knowing violations of federal consumer financial law. The maximum amounts are adjusted for inflation under 12 CFR 1083.1. Starting an action for a violation also restarts the five-year clock in orders written like Wise’s.

For examples of current orders against fintech and crypto companies, including Block’s 2025 Cash App consent order, see our enforcement tracker.

This article explains how CFPB consent orders work. It is not legal advice about any particular company or case.

Sources