CFPB API: Circulars, Supervisory Guidance, and Enforcement Actions

The Consumer Financial Protection Bureau publishes three things a compliance team reads, and they are not the same kind of document. A circular is the Bureau's stated reading of a statute, addressed to everyone who enforces federal consumer financial law. Supervisory guidance is what the Bureau tells the institutions it supervises, and it does not carry the force of law. An enforcement action is a decided matter against a named respondent. Vaquill AI's US primary law API serves all three, and deliberately splits them across two corpusType tokens so that one query cannot silently mean two different things.

TL;DR

• Three source codes, two corpusType values. cfpb_circular (16) and cfpb_supervisory_guidance (95) sit under corpusType=AGENCY_GUIDANCE. cfpb_enforcement_action (386) sits under corpusType=AGENCY_ADJUDICATION.
• The split is the point. A circular addresses the whole market. An enforcement action binds one named respondent. Folding them into one token would make an AGENCY_GUIDANCE search return two incompatible kinds of answer.
• Supervisory guidance does not have the force of law, and the Bureau says so in its own rule: 12 C.F.R. part 1074, whose Appendix A carries the Statement Clarifying the Role of Supervisory Guidance. That text is in the CFR corpus and you can fetch it alongside the guidance it governs.
• Both of the Bureau's forums are held and are separable on the forum field: Administrative Proceeding (the Bureau's own Office of Administrative Adjudication under 12 C.F.R. Part 1081) and Civil Action (a suit filed in federal district court). 225 are administrative, 162 are civil, and one action carries both labels.
• 185 of the 386 actions are outside ordinary search results, because the Bureau marks them Expired/Terminated/Dismissed. Query them explicitly with actStatus: "terminated".
• No adjudication corpus here carries a doctrinal-currency verdict. No publisher in that family emits a machine-readable overruling signal, so nothing in this data tells you whether a legal theory in an order has since been rejected.

The three sources, side by side

The two guidance sources sit inside the wider federal guidance corpus: 81,451 sections across 51 named sources, each independently filterable with source. The enforcement actions sit inside the adjudication corpus: 100,920 sections across seven bodies. Both are part of the same 4.9M+ section US primary law corpus.

The two branches at the bottom are the honest part of that diagram. A circular and a consent order are both published by the same agency on the same website, and they do completely different legal work.

What each document actually does

A Consumer Financial Protection Circular is the Bureau telling every enforcer of federal consumer financial law how it reads a statute. The audience is deliberately wide: other federal agencies and state enforcers, not only supervised institutions. It is an interpretation, not a regulation, and it does not go through notice and comment. Circular 2022-03, for example, addresses adverse-action notification requirements when a credit decision rests on a complex algorithm.

Supervisory guidance is the bulletin and policy-statement layer aimed at supervised institutions. It does not carry the force of law. The Bureau adopted that position as a rule rather than leaving it as a statement: 12 C.F.R. part 1074, with the Statement Clarifying the Role of Supervisory Guidance attached as Appendix A. The other federal banking agencies did the same thing on their own numbering, which is why the identical statement appears at 12 C.F.R. Appendix A to Part 262 and 12 C.F.R. Appendix A to Subpart F of Part 4.

An enforcement action binds the named respondent and nobody else. A consent order is not a rule of general application, and it establishes no obligation for a firm that was not a party to it. Compliance teams read them anyway, as evidence of what the Bureau considers a violation, and that is a reasonable thing to do. It is not the same as citing a rule, and any product surfacing these documents should keep the difference visible to the reader.

The adjudication slice has fields the guidance slice does not

The unit is the action, not the filing. A CFPB enforcement action is one legal event published as two to seventeen PDFs, and a consent order plus the stipulation consenting to it is one record rather than two. Across the 386 actions, relatedDocuments names 993 documents in total, a mean of 2.6 per action. Twelve actions are served with the Bureau's own summary alone, because it posts no document for them.

Currency, stated exactly

This is the part worth reading twice.

No publisher in the AGENCY_ADJUDICATION family ships a machine-readable overruling signal. An adjudication is superseded by another decision, and the document itself never changes when it stops being good law. So goodLawStatus derives as unknown across that corpus by construction, and nothing on this API is a citator verdict for any of it.

The CFPB slice is the one place where a status value is derived rather than left unknown, and it is important to be precise about what that value means. The Bureau assigns every enforcement action one of three published statuses, and we map them:

That enum answers whether ongoing compliance obligations remain for that respondent. It does not say whether a legal proposition inside the order still holds, and it is not a substitute for checking the matter's current posture at the source.

Two consequences to plan for. 185 of the 386 actions carry the dead status and are therefore excluded from ordinary search results, which is close to half the source and is correct behavior for an order that no longer binds anyone. And that single status bundles three different endings: a matter the Bureau lost or withdrew is not the same event as an order that ran its term, and no field separates them. Each record carries the Bureau's own status string verbatim in history so you can see the ambiguity rather than only our reading of it.

Both cfpb_circular and cfpb_supervisory_guidance are goodLawStatus: "unknown". Neither series publishes a structured rescission signal, so we do not assert currency we cannot verify. The status and currency reference sets out the fields in full.

Querying it

Base URL is https://api.vaquill.ai/api/v1. Auth is a bearer key with a vq_key_ prefix. Statutes routes are mounted under /us/statutes/*, and GET /us/statutes/coverage is free.

Both guidance sources at once

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "adverse action notice specific reasons credit decision",
    "corpusType": "AGENCY_GUIDANCE",
    "source": ["cfpb_circular", "cfpb_supervisory_guidance"],
    "matchType": "any",
    "limit": 10
  }'

Each hit carries source, so you can split circulars from bulletins in your own layer without a second call.

Enforcement actions, administrative proceedings only

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "unfair deceptive or abusive acts or practices",
    "corpusType": "AGENCY_ADJUDICATION",
    "source": "cfpb_enforcement_action",
    "limit": 20,
    "fields": ["actId", "title", "citationShort", "forum", "court", "relatedDocuments", "externalUrl"]
  }'

The historical half

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mortgage servicing loss mitigation",
    "corpusType": "AGENCY_ADJUDICATION",
    "source": "cfpb_enforcement_action",
    "actStatus": "terminated",
    "limit": 20
  }'

Take the actId from any response and fetch the whole document with GET /us/statutes/section/{actId} or /section/{actId}/body.

Unknown filter values are rejected with a 422 rather than quietly matching nothing, and the source filter's error message enumerates every valid code, so one bad request returns the whole vocabulary.

Watching for changes

GET /boards is free and lists every watchable corpus with its cadence, lastRetrievedAt and retrievalStatus. The agency_guidance board runs weekly and the agency_adjudication board runs monthly. Both are corpus-wide rather than per-source: scopable is false on each, so a watch covers the whole token and you filter the change events on your side. The mechanics are in the law change webhooks guide.

What is not here

• Regulations. Regulation Z, Regulation E, Regulation B and the rest are codified at 12 C.F.R. and are served under corpusType=CFR. They are not in either CFPB source.
• Circular 2023-03. The Bureau archived it, publishes no text for it, and leaves only a third-party mirror, which we do not source from. That is why the circular count is 16 and not 17.
• A per-document rescission flag on the guidance sources. Neither series publishes one, so we do not invent one.
• Any citator treatment of an enforcement action. See the currency section above.
• State consumer-finance enforcement. Different corpora entirely.

Every record in all three sources carries externalUrl pointing at the Bureau's own page, because the text is fetched from consumerfinance.gov and never from a commercial aggregator. That sourcing rule, and how to verify it yourself, is set out in Legal Data Provenance.

FAQ

What is a Consumer Financial Protection Circular?

It is a document in which the Bureau states how it reads a provision of federal consumer financial law, addressed to every enforcer of that law rather than only to the institutions the Bureau supervises. There are 16 in the corpus, published since 2022, filterable with source=cfpb_circular under corpusType=AGENCY_GUIDANCE. It is an interpretation and not a regulation, and it does not go through notice and comment.

Does CFPB supervisory guidance have the force of law?

No, and the Bureau says so in a rule of its own rather than only in a statement. 12 C.F.R. part 1074 carries the Statement Clarifying the Role of Supervisory Guidance as Appendix A, and that text is in the CFR corpus so you can fetch it beside the guidance it governs. Guidance still shapes how an examination goes, which is why the 95 documents under cfpb_supervisory_guidance are worth holding.

Why are enforcement actions under a different corpusType from circulars?

Because they answer different questions. A circular tells the whole market how the Bureau reads a statute; an enforcement action resolves one matter against one named respondent. If both sat under AGENCY_GUIDANCE, a single search would return general interpretation and party-specific orders in one undifferentiated list, and callers would have no way to keep them apart at the corpus level.

Does a CFPB consent order bind anyone other than the respondent?

No. The order binds the party it names, and it creates no obligation for a firm that was not part of the matter. Compliance teams read consent orders as evidence of what the Bureau treats as a violation, which is reasonable, but that is a risk signal rather than a rule you can cite as controlling.

How many CFPB documents does the API hold?

386 enforcement actions under corpusType=AGENCY_ADJUDICATION, plus 16 circulars and 95 supervisory-guidance documents under corpusType=AGENCY_GUIDANCE. The enforcement set splits into 225 administrative proceedings and 162 civil actions, with one action carrying both labels. GET /us/statutes/coverage is free and returns the live counts.

Why do 185 enforcement actions not show up in ordinary search results?

Because the Bureau marks them Expired/Terminated/Dismissed, which it defines as no longer subject to ongoing compliance obligations, and we serve those with a dead actStatus. That is close to half the source, so it is stated rather than left to be discovered. Pass "actStatus": "terminated" to query them explicitly.

Does the API tell me whether an enforcement action is still good law?

No. No publisher in the AGENCY_ADJUDICATION family emits a machine-readable overruling signal, so this corpus carries no doctrinal-currency verdict for any body in it. The status served on a CFPB action reflects the Bureau's own published lifecycle status for that matter, which is a statement about ongoing compliance obligations rather than about whether a legal theory inside the order survives.

What is the unit of a CFPB enforcement action record?

The action, not the filing. One legal event is published by the Bureau as two to seventeen PDFs, and a consent order plus the stipulation consenting to it is served as a single record, because splitting them would make every search return two half-answers. relatedDocuments names the filings whose text the record carries: 993 documents across 386 actions, a mean of 2.6 each.

How do I cite these three sources?

A circular cites as Circular 2023-01 and a bulletin as CFPB Bulletin 2021-02. An administrative proceeding cites by Bureau File No., in the form CFPB File No. 2014-CFPB-0008. A civil action carries the court's own docket number instead, because that identifier belongs to the court rather than to the Bureau, and it is served in documentNumber with the court named in court.

Where this sits

The CFPB is the consumer-finance entry in a shelf that already carried OCC bulletins and interpretive letters, FDIC Financial Institution Letters, Federal Reserve SR and CA letters and FinCEN guidance, described in Banking and AML Guidance API. The corpus around it, and the source filter that keeps a CFPB query out of the other 49 sources, is in Federal Agency Guidance API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill, from the matter workbench to drafting, document comparison, document matrix, and citation-verified research.