The CFPB's supervisory examination priorities for Q4 2025 carry specific weight for fintech compliance teams. The document signals where bureau examiners are going to spend their attention over the next several months, and for companies operating in digital payments or earned wage access, some of the flagged areas require more than a policy refresh. They require testing whether controls are actually doing what the policy says they do.
We went through the priorities document and mapped each focus area against the control gaps we see most often when compliance teams walk us through their current setups. Seven areas come up repeatedly. This post works through each one and what it actually means for your control library.
Digital Payments and Reg E Coverage Gaps
The bureau reiterated its focus on error resolution practices under Regulation E, specifically within peer-to-peer and app-based payment products. The examination pressure here is on two specific obligations: the timing of provisional credit under the 10-business-day rule, and the documentation of error investigation outcomes.
The control gap we see most often is not that firms have the wrong policy. It is that the policy and the operational procedure have diverged over time. The written policy says provisional credit is issued within five business days. The actual dispute queue is handled by a team that uses a different system, with a different timer, and no one has reconciled the two since the product launched. An examiner reviewing a sample of dispute records will find cases where credit was not issued within the policy window, and the written policy does not help when the evidence shows otherwise.
The fix is a control that actually measures the elapsed time between dispute receipt and provisional credit issuance, generates an exception report when the threshold is approaching, and has a documented escalation path. If that report does not exist, the policy is aspirational rather than operational.
Earned Wage Access: Fee Disclosure and TILA Classification Questions
Earned wage access products sit in contested regulatory territory. The bureau has taken the position that certain EWA arrangements constitute credit under TILA, and its examination staff has been asking pointed questions about whether fee disclosures meet Regulation Z requirements when EWA is accessed through an employer integration. The Q4 priorities document signals continued focus here.
We are not saying all EWA products are credit. The classification depends heavily on product structure, who bears repayment risk, and how the fee is characterized. What we are saying is that if your EWA product has any characteristics that put it in the gray zone on credit classification, your controls should document the legal analysis behind your classification and keep that analysis current as bureau guidance evolves. An examiner asking "is this credit?" should find a documented, dated legal memo in your files, not a verbal understanding from when the product launched.
Consumer Authorization Controls for Recurring Payments
The bureau is looking at how digital payment companies obtain and document consumer authorization for recurring transactions. The specific concern is whether authorization records are adequate to demonstrate consent for the specific amount, frequency, and payee, and whether cancellation requests are processed before the next scheduled transaction.
The authorization control failure pattern we see most often is technical: the authorization record is captured at account opening but not linked to the specific recurring payment setup in a way that lets a reviewer trace the authorization to the transaction. When an examiner asks to see the authorization record for a specific consumer's recurring payment, the team has to manually reconstruct it from multiple systems. That is a process gap even when the authorization actually exists.
Small Dollar Credit and UDAAP Exposure
The CFPB's UDAAP authority is broad, and Q4 priorities specifically note small dollar credit products and how fees are disclosed in the overall cost of credit context. This is less about a specific regulatory citation and more about whether your consumer-facing disclosures are presenting cost information in a way that a reasonable consumer could understand without misleading implication.
For growing fintechs with small dollar lending products, the control gap here often lives in the marketing and product management interface with compliance. Compliance has reviewed the formal disclosure documents. But the in-app copy, the onboarding email sequence, and the push notification that says "money available now" may never have gotten a UDAAP review. The examiner does not distinguish between the disclosure document and the push notification. Both are communications to consumers about the product.
Third-Party Oversight for Customer-Facing Functions
The bureau's Q4 priorities continue an emphasis on how supervised companies oversee the consumer-facing activities of their service providers. For fintech companies built on bank partner arrangements, this has real implications. If your bank partner handles error resolution or dispute management, the CFPB can still examine your oversight of that arrangement.
The control gap here is typically documentation-based. The vendor contract says the bank partner must handle disputes within regulatory timelines. But the fintech compliance team has no control that regularly pulls dispute resolution data from the bank partner and verifies that timelines are being met. The contract is a written commitment, not a control. The control is the monitoring activity that verifies performance against the commitment.
Credit Reporting Accuracy and FCRA Obligations
If your fintech reports to consumer reporting agencies, the Q4 priorities flag accuracy of reported information and the handling of consumer disputes about reported data as examination areas. The bureau is looking at whether the dispute handling process meets the requirements in section 623 of the FCRA and whether the data furnishing process includes adequate pre-reporting accuracy checks.
We see this control gap most commonly at companies that added credit reporting as a feature after the core product was built, without building the FCRA compliance program alongside it. The dispute handling is an afterthought process rather than a designed control. When volume increases, the manual process breaks and dispute response timelines slip.
Collections Practices and FDCPA Compliance for First-Party Creditors
The final area in the Q4 priorities that consistently maps to control gaps is collections. Even first-party creditors collecting their own debt face examination scrutiny around contact frequency, communication channel practices, and settlement offer disclosures. The bureau is not limiting its focus to third-party debt collectors.
For fintech companies that recently started collecting on defaulted accounts as portfolios have seasoned, this is new territory. The collections control environment may have been built from scratch by a team that is more familiar with banking practices than CFPB examination expectations. What constitutes reasonable contact frequency, how settlement offers must be documented, and what records need to be retained for each consumer contact are all specific operational requirements that need to exist as controls, not just as general policy language.
A Note on the Q4 Timeline
Supervisory examination priorities are not a guarantee that every company in scope will receive an exam in Q4. Examination scheduling depends on supervisory risk assessments and bureau capacity. But the priorities document is useful for a different reason: it tells compliance teams where the bureau's analytical frameworks are heading, which means today's exam priority is often next year's rule proposal or supervisory guidance publication.
Using the Q4 document to run a gap assessment against your current control inventory is worth doing regardless of your exam schedule. Identify which of the flagged areas have controls that measure actual operational performance versus controls that simply reference written policy. The ones that only reference policy are the ones that will create exam findings even at firms where the underlying practice is actually sound.