Note from the Editor: The Federalist Society takes no positions on particular legal and public policy matters. Any expressions of opinion are those of the author. We welcome responses to the views presented here. To join the debate, please email us at [email protected].

 

Even after Joe Biden became a lame duck and Kamala Harris lost the 2024 election, the bureaucrats in their executive branch agencies were burning the midnight oil. Why was that? To stretch the clock, and impose regulatory power on Americans and commercial industries more broadly, until the bitter end.

One example of that phenomenon was the Consumer Financial Protection Bureau’s (CFPB) attempt to impose certain oversight regulations on nonbank digital payment platforms. But in this instance, the effort was more than mere regulatory overreach. It was also unconstitutional. The CFPB was testing the limits of administrative power, unbounded by congressional authority.

The rule died in May 2025, when Congress and President Trump used a little known tool—the Congressional Review Act (CRA)—to nullify the CFPB’s digital payment supervision rule. It works only in rare circumstances where the party in the White House flips, and where the new president also has the House and Senate in his corner. In other words, we were saved by the bell, and avoided a constitutional reordering of power.

But restoring the status quo ante obscures the danger posed by the would-be regulations. In other words, when the administrative state shows you what it wants, believe it. The CFPB’s rushed and legally dubious regulations, though successfully blocked, expose how federal agencies could try to stretch statutory boundaries in ways that endanger constitutional government.

The Rule That Almost Was

Published in December 2024, the CFPB’s final rule sought to subject large “nonbank digital payment and digital wallet companies” to the same supervisory regime applied to banks and credit unions. Firms processing over 50 million annual transactions—including PayPal, Venmo, and Cash App—would have been subjected to onerous federal laws like the Electronic Fund Transfer Act and the Gramm-Leach-Bliley Act. That kind of oversight could slow down how these platforms innovate, raise their costs, or make it harder for them to offer free or low-cost services to everyone, including the 5.9 million Americans who do not have a traditional bank account.

Under the Dodd-Frank Act, the CFPB may supervise certain nonbanks—but only if they are designated as “larger participants” in specific markets, or if they engage in particular consumer financial services. Like many regulations during the Biden-Harris administration, the agency’s rule relied on broad statutory language without identifying any express congressional authorization to regulate or oversee digital payment platforms in this manner. That is exactly the kind of abuse that Congress rightly targeted using the Congressional Review Act.

A Broader Pattern of Last-Minute Overreach

While promulgating regulations was the most obvious form of overreach, the Biden-Harris administration didn’t stop there. It also brought federal lawsuits to try to impose its priorities as its time in power was waning. For instance, the Department of Justice pursued an antitrust lawsuit against Visa’s debt card operations, which was filed in September 2024, and then aggressively pushed hours before President Trump’s inauguration. Then-Attorney General Merrick Garland, along with several of his deputies, crowed about their lawsuit in a public press release that was geared to justify the suit. But one critic called the suit a “strange use of limited resources.” Another said the suit didn’t account for the “incredible market innovation and disruption that undermine claims of monopolizations by Visa,” as well as existing regulations that already constrain debit networks. In other words, the case seemed to be more about solidifying the political aim of increased government control over the financial industry, than about enforcing U.S. antitrust law.

The Biden-Harris administration also tried to launch lawsuits against employers under an aggressive “disparate impact” theory, meaning that facially neutral job requirements were challenged as having “discriminatory” effects.

These last-minute pushes mirrored the CFPB’s tactic of rushing out major policy actions, attempting to cement sweeping authority right before leadership changed hands. And while the Visa case is still pending for now, the disparate impact lawsuits have generally been dismissed or paused, now that President Trump is in the White House.

A Major Questions Case in Disguise

In a different vein, the CFPB’s 2024 maneuver fit squarely within the Supreme Court’s warning in West Virginia v. EPA, which held that agencies may not regulate issues of vast “economic and political significance” without clear congressional authorization. Given that the rule would have affected platforms processing billions in transactions annually, with even the CFPB acknowledging that 76% of Americans have used at least one of these payment apps, this issue was clearly one of economic significance.

The CRA: A Constitutional Bulwark

Technology trade groups immediately challenged the CFPB rule in federal court, filing suit in the U.S. District Court for the District of Columbia in January 2025. Their complaint raised multiple serious concerns: that the CFPB exceeded its statutory authority, that the rule was “arbitrary and capricious” under the Administrative Procedure Act, that it violated due process by imposing significant compliance costs without justification, and that the agency failed to demonstrate consumer risks or regulatory gaps warranting the rule.

Despite these strong legal arguments, success in federal court was never guaranteed. Though the Supreme Court recently overturned Chevron, federal agencies often prevail in court. That’s where the CRA came in. The CRA gives Congress authority to nullify federal agency rules within 60 legislative days of their finalization, through a simple majority vote in both chambers, requiring only the President’s signature to take effect. It’s an important constitutional mechanism for checking administrative power. Unlike judicial review, which can leave harmful rules in effect during litigation, the CRA provides immediate relief, while ensuring that significant policy decisions remain subject to democratic oversight.

The Ongoing Threat to Our Constitutional Order

While the CRA’s success in blocking the CFPB’s rule represents an important victory, it should serve as a wake-up call rather than cause for complacency.

The complexity of modern regulatory challenges makes it increasingly difficult for courts to police agency overreach effectively. While the Supreme Court’s major questions doctrine as outlined in West Virginia v. EPA provides an important tool for checking administrative power, agencies have tried to narrow the scope of that case’s application.

Agencies will continue pushing boundaries unless consistently checked by Congress and the courts. But the CRA’s success in this case should encourage more aggressive use of this constitutional mechanism.

More broadly, Congress must also be careful about the statutory language it uses when creating or expanding agency authorities. Vague delegations to bureaucrats of the power to fashion new regulations invite the kind of mission creep exemplified by the CFPB’s rule. Clear, specific statutory limits are essential for preventing agencies from transforming themselves into general-purpose regulatory bodies.

The CFPB’s digital payments rule may be dead, but the mindset that produced it is very much alive in the federal bureaucracy. This episode is a reminder that congressional oversight, judicial skepticism, and presidential vigilance must work in tandem to protect the separation of powers. As agencies look to assert control over new sectors of the economy, it’s not enough to stop bad rules after they’re issued. Decisionmakers must restore the constitutional boundaries that prevent them from being written in the first place.