The CFPB is not your typical enforcement agency

Part law enforcement agency, part developer of the regulatory scheme, part supervisory agency, the CFPB and its enabling statute-the Consumer Financial Protection Act (CFPA)-borrow for elements of the agency's structure aspects of the Federal Trade Commission, the Securities and Exchange Commission, and the federal banking regulatory agencies, including the Federal Deposit Insurance Commission and the Office of the Comptroller of the Currency. [...]covered persons are any nonbank that offers or provides a consumer financial product or service and any large bank- one with more than $10 billion İn assets-that offers or provides a consumer financial product or service. [...]İn early 2016, the CFPB moved into data security regulation of consumer financial services companies in its enforcement action against Dwolla, Inc., an online payments platform.5 The CFPB alleged that Dwolla committed deceptive acts relating to its data security practices-in particular, that Dwolla made various representations to consumers about the safety and security of transactions on its platform.6 The CFPB does not allege anywhere in the Dwolla consent order that Dwolla's data security practices led to a data breach or any other specific consumer harm. Rather, İt states that the CFPB: shall have no authority ... to declare an act or practice abusive in connection with the provision of a consumer financial product or services unless the act or practice: (1) materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service; or (2) takes unreasonable advantage of- (A) a lack of...