Enforcement Actions Roundup: March 2025

Welcome to the April edition of our Enforcement Actions Roundup, a monthly summary where our regulatory experts break down recent enforcement actions from the previous month, highlight what went wrong, and offer insights to help your institution stay ahead of similar risks. 

The Enforcement Actions Roundup includes two key elements:   

• The Enforcement Actions Tracker is a running total of enforcement actions by agency – keeping a tally of enforcement actions broken down by overall category and individual topics addressed by each action. This makes it easy to pick out enforcement trends and hot topics.  

• The Enforcement Deep Dive reviews each enforcement action to understand what happened, key takeaways, and controls you should review at your institution to avoid making the same mistake.  

Let’s get into it. 

2025 Enforcement Action Tracker

Please note that a single enforcement action may be included under multiple topics.

Enforcement Actions Deep Dive: March 2025

CFPB Enforcement Actions

CFPB Continues Prosecution of Lender for Military Lending Act and UDAAP Violations 

There were no new institutional enforcement actions by the CFPB in March 2025. However, the CFPB decided to continue to prosecute a lender for violations of the Military Lending Act and UDAAP. To ensure an accurate portrayal of the CFPB’s priorities, this enforcement action has been added. 

• Category: Lending Compliance; Governance, Risk, and Compliance 
• Topic: UDAAP; Military Lending 
• Date: February 28, 2025  
• Products and Services: Consumer Lending 
• Institution Type: FinTech 
• Regulation: 32 CFR 232 
• Enforcement Action  
• Related Guidance: Military Lending Act – Applicability Flowchart; Military Lending Act – Interagency Examination Procedures 

The lender allegedly violated the Military Lending Act (MLA) by charging military borrowers membership fees that resulted in loan costs exceeding the 36% rate cap, including mandatory arbitration clauses in loan agreements, and failing to provide required disclosures such as the Military Annual Percentage Rate. Additionally, the lender is accused of deceptive practices under the Consumer Financial Protection Act by misleading consumers about their ability to cancel memberships while restricting cancellations for those with unpaid balances. 

Takeaways 

The protection of veterans and service members will be a top priority for the new administration and agency leadership. At a time when the CFPB has been dropping enforcement actions and lawsuits left and right, it made a statement by authorizing the continued prosecution of this lender. 

Pay close attention to the CFPB’s use of its UDAAP authority in this case. The CFPB has repeatedly stated that it is going to end regulation by enforcement and focus on specific violations of law or regulation. Those statements created questions of whether UDAAP would be used against financial institutions. It looks like the CFPB answered that question here, opting to continue using UDAAP in its enforcement toolbelt.  

If your institution has a heavy concentration of veterans or active service members, you should have a sound compliance management system to protect against consumer protection violations. Now is the time to ensure that your policies, procedures, and practices guarantee compliance with the Military Lending Act and the Servicemembers Civil Relief Act. 

Controls to Evaluate  

1. Thorough Service Members Relief Act (SCRA)/MLA Policy and Procedures: SCRA/MLA policy and procedures are comprehensive, documented, reviewed and approved, including: defining a "covered borrower," the process of ensuring/verifying that a customer/member is not an active duty servicemember, properly identifying/tracking servicemembers on the system by coding them accordingly, ensuring adequate disclosures, interest rate limitations, adjusting rates/payments as required, interest forgiveness as appliable, protections against judgments/civil cases, foreclosure, repossession, eviction, security deposits, rental agreements, termination of leases, and waiver of rights. 
2. Automated Loan Origination System: The loan origination system automatically calculates the APR, MAPR, amount financed, and other disclosure requirements, as well as identifies compliance exceptions or violations. 
3. Comprehensive Loan Operations Procedures: Loan Operations procedures include a pre-closing and post-closing review of all loan documentation related to military borrowers to ensure a mandatory arbitration clause is not included in loan agreements and that the agreements are clear and accurate. 

Related Ncontracts Content in Your Platform

• Ncomply Sample Policies: Military Lending Act (MLA) Policy 
• Nrisk Risk Assessments: SCRA - Servicemembers Civil Relief Act and MLA - Military Lending Act 
• Nverify Audits: Servicemembers Civil Relief Act (“SCRA”)/ Military Lending Act (“MLA”) 

OCC Enforcement Actions

See additional enforcement actions below. 

FRB Enforcement Actions

FRB Issues Bank $15K Penalty for Flood Insurance Violations

• Category: Lending Compliance 
• Topic: Flood Insurance 
• Date: March 20, 2025 
• Products and Services: Real Estate Lending 
• Regulation: 42 U.S.C. 50; 12 CFR 208 
• Enforcement Action  
• Related Guidance: Flood Disaster Protection Act: 2022 Interagency Questions and Answers Regarding Flood Insurance (2022-16) 

The FRB issued a civil monetary penalty of $15,500 against a bank for flood insurance violations. The bank had a pattern or practice of violations regarding loans in special flood hazard areas. 

Takeaways

Flood insurance continues to be an area of heightened regulatory attention. One of the most common violations is failing to ensure flood insurance is obtained at the time of making, increasing, renewing, or extending a loan.  

Policies, procedures, and controls to verify insurance coverage and monitor for proper coverage at renewal are required for your institution. Additionally, third-party vendors used to track flood map changes should be monitored, as they might not be as attentive to changes as they should be. Remember that civil monetary penalties are based on the number of violations, with up to $2,000 for each flood insurance violation. 

Remember that civil monetary penalties are based on the number of violations, with up to $2,000 for each flood insurance violation.

Controls to Evaluate 

1. Up-to-date Flood Insurance Policies and Procedures. Flood insurance policies and procedures are in place and are reviewed periodically. Roles and responsibilities are clearly defined, and policies and procedures are communicated to all staff. Procedures include: (a) pulling flood determinations for loans that will be secured by real estate; (b) requiring flood insurance for real estate secured loans in a designated flood zone before loan closing; (c) notification to customers of flood insurance requirements; (d) review process to ensure proper flood insurance is in place before loan closing and for the duration of the loan (e)  monitoring loans to ensure that flood insurance coverage is maintained for the entire duration of the loan; (f) flood insurance renewal monitoring and tracking; (g) force placement insurance requirements and customer notification processes; (h) maintaining documentation of flood insurance policies in the loan file including proof of coverage and policy details. 
2. Trained Employees: All staff involved in flood insurance processes receive ongoing training to stay abreast of changes in requirements. 
3. Compliance Reviews: The Compliance department periodically performs a review to ensure compliance with Flood Insurance requirements. 
4. TPSP Reviews: Personnel responsible for vendor management ensure that periodic audits of third-party service providers are performed. 

Related Ncontracts Content in Your Platform

• Ncomply Sample Policies: Flood Disaster Protection Act (FDPA) Policy 
• Nrisk Risk Assessments: Flood Disaster Protection Act 
• Nverify Audits: Flood Disaster Protection Act (FDPA) 

FDIC Enforcement Actions

There were no institutional enforcement actions released by the FDIC in March. 

NCUA Enforcement Actions

There were no institutional enforcement actions by the NCUA in March. 

Additional Enforcement Actions 

OCC 

• AA-ENF-2024-110 (March 20, 2025) - For unsafe or unsound practices, including those related to interest rate risk, strategic planning, capital, liquidity, and earnings. 

FRB  

• FRB 24-036-B-HC (March 20, 2025) - For deficiencies with respect to operations and failing to serve as a source of strength for an institution it had ownership and control over. 

Want more regulatory news and updates?  

Watch our 2025 Regulatory Expectations & Enforcement Webinar on demand.