CFPB API: Circulars, Supervisory Guidance, and Enforcement Actions

The Consumer Financial Protection Bureau publishes three things a compliance team reads, and they are not the same kind of document. A circular is the Bureau's stated reading of a statute, addressed to everyone who enforces federal consumer financial law. Supervisory guidance is what the Bureau tells the institutions it supervises, and it does not carry the force of law. An enforcement action is a decided matter against a named respondent. Vaquill AI's US primary law API serves all three, and deliberately splits them across two corpusType tokens so that one query cannot silently mean two different things.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice. The counts of 16 circulars, 95 supervisory-guidance documents and 386 enforcement actions come from our coverage documentation (measured 7 September 2026 for the guidance sources). We re-checked the 16 against the live API on 12 October 2026, and the live API agrees on 185 terminated actions.

TL;DR

• Three source codes, two corpusType values. cfpb_circular (16) and cfpb_supervisory_guidance (95) sit under corpusType=AGENCY_GUIDANCE. cfpb_enforcement_action (386) sits under corpusType=AGENCY_ADJUDICATION.
• The split is the point. A circular addresses the whole market. An enforcement action binds one named respondent. Folding them into one token would make an AGENCY_GUIDANCE search return two incompatible kinds of answer.
• Supervisory guidance does not have the force of law, and the Bureau says so in its own rule: 12 C.F.R. part 1074, whose Appendix A carries the Statement Clarifying the Role of Supervisory Guidance. That text is in the CFR corpus and you can fetch it alongside the guidance it governs.
• Both of the Bureau's forums are held and are separable on the forum field returned with each hit (the search request has no forum filter, so you split on your side): Administrative Proceeding (the Bureau's own Office of Administrative Adjudication under 12 C.F.R. Part 1081) and Civil Action (a suit filed in federal district court). The API reference says one action can carry both labels, joined with ; .
• 185 of the 386 actions are marked terminated, because the Bureau labels them Expired/Terminated/Dismissed. They are returned by default, and actStatus: "terminated" isolates them while excludeRepealed: true drops them.
• No adjudication body here carries a doctrinal-currency verdict. No publisher in that family emits a machine-readable overruling signal, so nothing in this data tells you whether a legal theory in an order has since been rejected. The CFPB slice has a status derived from the Bureau's own lifecycle label, which is a different thing (see below).

The three sources, side by side

The two guidance sources sit inside the wider federal guidance corpus: over 96,000 sections across 53 named sources, each independently filterable with source. The enforcement actions sit inside the adjudication corpus: 100,920 sections across seven bodies. Both are part of the same 5.3M+ section US primary law corpus.

The two branches at the bottom are the honest part of that diagram. A circular and a consent order are both published by the same agency on the same website, and they do completely different legal work.

What each document actually does

A Consumer Financial Protection Circular is the Bureau telling every enforcer of federal consumer financial law how it reads a statute. The audience is deliberately wide: other federal agencies and state enforcers, not only supervised institutions. It is an interpretation, not a regulation. Circular 2022-03, for example, addresses adverse-action notification requirements when a credit decision rests on a complex algorithm.

Supervisory guidance is the bulletin and policy-statement layer aimed at supervised institutions. It does not carry the force of law. The Bureau adopted that position as a rule rather than leaving it as a statement: 12 C.F.R. part 1074, with the Statement Clarifying the Role of Supervisory Guidance attached as Appendix A. The other federal banking agencies published the same statement in their own parts of 12 C.F.R.: Appendix A to Part 262 (Federal Reserve), Appendix A to Part 302 (FDIC), Appendix A to Subpart D of Part 791 (NCUA) and Appendix A to Subpart F of Part 4 (OCC).

An enforcement action binds the named respondent and nobody else. A consent order is not a rule of general application, and it establishes no obligation for a firm that was not a party to it. Compliance teams read them anyway, as evidence of what the Bureau considers a violation, and that is a reasonable thing to do. It is not the same as citing a rule, and any product surfacing these documents should keep the difference visible to the reader.

A short history of CFPB guidance

Congress created the Bureau in the Dodd-Frank Act, approved July 21, 2010. Section 1011 sets it up as an independent bureau in the Federal Reserve System (Public Law 111-203). It began exercising its functions in 2011, according to the Bureau's own 2025 notice, below.

Circulars are the young part of the shelf. The Bureau introduced them in the Federal Register on June 14, 2022, with Circular 2022-01. Its title: "System of Consumer Financial Protection Circulars to agencies enforcing federal consumer financial law." Circular 2022-02 (deceptive claims about FDIC insurance) and Circular 2022-03 (adverse action notices when credit decisions rest on complex algorithms) ran in the same issue. By November 2024 the series had reached Circular 2024-06, on background dossiers and algorithmic scores used in hiring.

Supervisory guidance has a rule behind it. The Bureau's own statement says: "Unlike a law or regulation, supervisory guidance does not have the force and effect of law, and the Bureau does not take enforcement actions based on supervisory guidance." The same statement says supervisory guidance "outlines the Bureau's supervisory expectations or priorities" (12 C.F.R. Part 1074, Appendix A).

A quick story: the day the guidance was withdrawn

"Published" and "current" are different questions. On May 12, 2025 the Bureau published a Federal Register notice titled "Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal." It withdrew 67 documents issued since 2011. That was 8 policy statements, 7 interpretive rules, 13 advisory opinions and 39 other guidance documents. Those 39 included sixteen circulars (2022-01 through 2024-06) and a long list of bulletins (90 Fed. Reg. 20084).

The notice gave three reasons: the Bureau wanted to issue guidance only where necessary and burden-reducing, it was reducing its own enforcement, and it did not think reliance interests justified keeping documents that are generally non-binding. It also said the withdrawal was not necessarily final, and that the documents "should not be enforced or otherwise relied upon by the Bureau while this review is ongoing."

What did that do to the law? Nothing, for the statutes and regulations. The practical value of the guidance is a fair question. A law firm's note from that week put it this way: "federal and state enforcement activity, supervisory practices, and private lawsuits will continue to serve as ongoing sources of expectations and inputs for risk modeling." (Venable, May 15, 2025). The same note said the guidance's "mere presence in the regulatory ecosystem shaped business practices, risk modeling, and supervision strategies." Its suggestion was that it may be useful to document how policies line up with black-letter law, not with the withdrawn commentary.

Look at what this means for a data model. A circular can be published, correctly cited and then withdrawn by its own author, with no change to its text. So show the document, its date, and a pointer to the publisher's page for current status.

The adjudication slice has fields the guidance slice does not

The unit is the action, not the filing. A CFPB enforcement action is one legal event published as two to seventeen PDFs, and a consent order plus the stipulation consenting to it is one record rather than two. On 12 October 2026 one administrative record (Fay Servicing, LLC, File No. 2017-CFPB-0014) listed fourteen related documents, a consent order and its stipulation plus six modifications each with a stipulation, while a civil action (SunTrust Mortgage, Inc.) listed two.

Currency, stated exactly

This is the part worth reading twice.

No publisher in the AGENCY_ADJUDICATION family ships a machine-readable overruling signal. An adjudication is superseded by another decision, and the document itself never changes when it stops being good law. So goodLawStatus derives as unknown across that corpus by construction, and nothing on this API is a citator verdict for any of it.

The CFPB slice is the one place where a status value is derived rather than left unknown, and it is important to be precise about what that value means. The Bureau assigns every enforcement action a published status, and we map them:

That enum answers whether ongoing compliance obligations remain for that respondent. It does not say whether a legal proposition inside the order still holds, and it is not a substitute for checking the matter's current posture at the source.

Two consequences to plan for. 185 of the 386 actions carry the terminated status, which is close to half the source. A default search still returns them (a search for Fay Servicing, a terminated matter, ranked it first on 12 October 2026), so filter on actStatus or set excludeRepealed: true if you want only live orders. And that single status bundles three different endings: a matter the Bureau lost or withdrew is not the same event as an order that ran its term, and no field separates them. Each record carries the Bureau's own status string verbatim in history so you can see the ambiguity rather than only our reading of it.

Both cfpb_circular and cfpb_supervisory_guidance are goodLawStatus: "unknown". Neither series publishes a structured rescission signal, so we do not assert currency we cannot verify. The status and currency reference sets out the fields in full.

Querying it

Base URL is https://api.vaquill.ai/api/v1. Auth is a bearer key with a vq_key_ prefix. Statutes routes are mounted under /us/statutes/*, and GET /us/statutes/coverage is free. The three requests below need a key, so we did not run them as written. Through our MCP client on 12 October 2026 we ran the enforcement-action queries with the same parameters (they returned the fields described above), and the cfpb_circular filter on its own, which returned 16 records. We did not run the combined two-source query.

Both guidance sources at once

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "adverse action notice specific reasons credit decision",
    "corpusType": "AGENCY_GUIDANCE",
    "source": ["cfpb_circular", "cfpb_supervisory_guidance"],
    "matchType": "any",
    "limit": 10
  }'

Each hit carries source, so you can split circulars from bulletins in your own layer without a second call.

Enforcement actions, with the forum fields

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "unfair deceptive or abusive acts or practices",
    "corpusType": "AGENCY_ADJUDICATION",
    "source": "cfpb_enforcement_action",
    "limit": 20,
    "fields": ["actId", "title", "citationShort", "forum", "court", "relatedDocuments", "externalUrl"]
  }'

The search request has no forum parameter. To keep only administrative proceedings or only civil actions, read forum on each hit and filter in your own layer.

The historical half

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mortgage servicing loss mitigation",
    "corpusType": "AGENCY_ADJUDICATION",
    "source": "cfpb_enforcement_action",
    "actStatus": "terminated",
    "limit": 20
  }'

Take the actId from any response and fetch the whole document with GET /us/statutes/section/{actId} or /section/{actId}/body.

Unknown filter values are rejected with a 422 rather than quietly matching nothing, and the source filter's error message enumerates every valid code, so one bad request returns the whole vocabulary.

Watching for changes

GET /boards is free and lists every watchable corpus with its cadence and lastRetrievedAt. On 12 October 2026 GET /boards showed both the agency_guidance and agency_adjudication boards on a monthly cadence. A watch on either can be narrowed to one named source with scope: {"source": "cfpb_circular"} (or cfpb_supervisory_guidance, or cfpb_enforcement_action), or to the agency with scope: {"agency": "cfpb"}; the pickable values are on each board's sources and agencies arrays. The mechanics are in the law change webhooks guide.

What is not here

• Regulations. Regulation Z, Regulation E, Regulation B and the rest are codified at 12 C.F.R. and are served under corpusType=CFR. They are not in either CFPB source.
• Circular 2023-03. The circular series runs from 2022-01 to 2024-07, 17 numbers, and the corpus holds 16 of them. 2023-03 is the one number not held.
• A per-document rescission flag on the guidance sources. Neither series publishes one, so we do not invent one.
• Any citator treatment of an enforcement action. See the currency section above.
• State consumer-finance enforcement. Different corpora entirely.

Every record in all three sources carries externalUrl pointing at the Bureau's own page, because the text is fetched from consumerfinance.gov and never from a commercial aggregator. That sourcing rule, and how to verify it yourself, is set out in Legal Data Provenance.

FAQ

What is a Consumer Financial Protection Circular?

It is a document in which the Bureau states how it reads a provision of federal consumer financial law, addressed to every enforcer of that law rather than only to the institutions the Bureau supervises. There are 16 in the corpus, published since 2022, filterable with source=cfpb_circular under corpusType=AGENCY_GUIDANCE. It is an interpretation and not a regulation.

Does CFPB supervisory guidance have the force of law?

No, and the Bureau says so in a rule of its own rather than only in a statement. 12 C.F.R. part 1074 carries the Statement Clarifying the Role of Supervisory Guidance as Appendix A, and that text is in the CFR corpus so you can fetch it beside the guidance it governs. Guidance still shapes how an examination goes, which is why the 95 documents under cfpb_supervisory_guidance are worth holding.

Why are enforcement actions under a different corpusType from circulars?

Because they answer different questions. A circular tells the whole market how the Bureau reads a statute; an enforcement action resolves one matter against one named respondent. If both sat under AGENCY_GUIDANCE, a single search would return general interpretation and party-specific orders in one undifferentiated list, and callers would have no way to keep them apart at the corpus level.

Does a CFPB consent order bind anyone other than the respondent?

No. The order binds the party it names, and it creates no obligation for a firm that was not part of the matter. Compliance teams read consent orders as evidence of what the Bureau treats as a violation, which is reasonable, but that is a risk signal rather than a rule you can cite as controlling.

How many CFPB documents does the API hold?

386 enforcement actions under corpusType=AGENCY_ADJUDICATION, plus 16 circulars and 95 supervisory-guidance documents under corpusType=AGENCY_GUIDANCE. The enforcement set holds both administrative proceedings and civil actions, separable on forum. GET /us/statutes/coverage is free and reports what we hold.

Why do 185 enforcement actions not show up in ordinary search results?

They do show up. The Bureau marks them Expired/Terminated/Dismissed, which it describes as no longer subject to ongoing compliance obligations, and we serve those with actStatus: "terminated". That is close to half the source, so it is stated rather than left to be discovered. Pass "actStatus": "terminated" to isolate them, or "excludeRepealed": true to leave them out.

Does the API tell me whether an enforcement action is still good law?

No. No publisher in the AGENCY_ADJUDICATION family emits a machine-readable overruling signal, so this corpus carries no doctrinal-currency verdict for any body in it. The status served on a CFPB action reflects the Bureau's own published lifecycle status for that matter, which is a statement about ongoing compliance obligations rather than about whether a legal theory inside the order survives.

What is the unit of a CFPB enforcement action record?

The action, not the filing. One legal event is published by the Bureau as two to seventeen PDFs, and a consent order plus the stipulation consenting to it is served as a single record, because splitting them would make every search return two half-answers. relatedDocuments names the filings whose text the record carries.

How do I cite these three sources?

A circular cites as Circular 2023-01 and a bulletin as CFPB Bulletin 2021-02. An administrative proceeding cites by Bureau File No., in the form CFPB File No. 2014-CFPB-0008. A civil action carries the court's own docket number instead, because that identifier belongs to the court rather than to the Bureau, and it is served in documentNumber with the court named in court.

Where this sits

The CFPB is the consumer-finance entry in a shelf that already carried OCC bulletins and interpretive letters, FDIC Financial Institution Letters, Federal Reserve SR and CA letters and FinCEN guidance, described in Banking and AML Guidance API. The corpus around it, and the source filter that keeps a CFPB query out of the other named sources, is in Federal Agency Guidance API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.