CFPB Portal Overhaul Reduces Legal Exposure for Credit Bureaus

The Consumer Financial Protection Bureau is overhauling its consumer complaint portal. The changes reduce the legal exposure of the three major credit bureaus, which had faced a doubling of complaints every year since 2023.

The CFPB announced a 45-day waiting period for consumers, two-factor authentication, and new administrative codes that let lenders flag complaints as frivolous, including those generated by AI. The bureau also began requiring consumers to provide personal information and attest to the truthfulness of each complaint.

The complaint surge was driven by AI-generated and duplicative filings, often promoted by credit repair firms and social media influencers. The CFPB received 6.6 million complaints in 2025, up from 3.2 million in 2024 and 1.6 million in 2023. About 5 million of those were about credit reporting agencies or lenders, a 3,700% increase from 2019.

The volume matters because of the Fair Credit Reporting Act. Under the law, credit bureaus have 30 days to investigate a dispute, with a 15-day extension if new evidence arrives. If they miss the deadline, the negative item drops from the report automatically.

Dan Smith, president and CEO of the Consumer Data Industry Association, a trade group representing the bureaus, said the flood of complaints was an attempt to bog down the system. “If they don't complete the investigation in 30 days, they must remove the trade line from the credit report, and then your score goes up,” he said.

The CFPB's new rules give the bureaus more time to process disputes before a complaint reaches the regulator. The 45-day waiting period requires consumers to file a dispute directly with a credit bureau first, then wait 45 days before escalating to the CFPB. Two-factor authentication and the attestation requirement aim to separate legitimate filers from automated submissions.

The bureau said in a press release that the three nationwide consumer reporting agencies – Equifax, Experian, and TransUnion – are closing complaints faster. In 2025, they closed 2.1 million complaints with non-monetary relief, up from 1.3 million in 2024.

The structural risk remains. The 30-day FCRA clock still applies. Complaint volumes might keep growing even with the new barriers. If they do, the bureaus could still face a wave of forced deletions. The new “frivolous” designation will likely face legal challenges from consumer advocacy groups who argue it gives lenders too much discretion.

For TransUnion (TRU), which trades without an Alpha Score in the Financial Services sector, the portal changes ease the compliance burden. See the TRU stock page for positioning data. The next data point is Q1 2026 complaint volumes. A drop from 2025 levels would confirm the fix is working. Another acceleration would push the bureaus back toward the same regulatory pressure.

“The system is broken and they need to fix the system so that the consumer who needs assistance gets it,” Smith said.