Notice2025-23612
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
December 22, 2025
Effective
January 21, 2026
Issuing agencies
Consumer Financial Protection Bureau
Abstract
In accordance with the Privacy Act of 1974, the Consumer Financial Protection Bureau (CFPB or Bureau) proposes to modify a current Privacy Act System of Records titled, "CFPB.025 Civil Penalty Fund and Bureau-Administered Redress Program Records." This system of records enables the CFPB to manage the distribution of the Civil Penalty Fund and redress monies to consumers.
Full Text
<html>
<head>
<title>Federal Register, Volume 90 Issue 243 (Monday, December 22, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 243 (Monday, December 22, 2025)]
[Notices]
[Pages 59800-59803]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-23612]
=======================================================================
-----------------------------------------------------------------------
CONSUMER FINANCIAL PROTECTION BUREAU
[Docket No: CFPB-2025-0053]
Privacy Act of 1974; System of Records
AGENCY: Consumer Financial Protection Bureau.
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, the Consumer
Financial Protection Bureau (CFPB or Bureau) proposes to modify a
current Privacy Act System of Records titled, ``CFPB.025 Civil Penalty
Fund and Bureau-Administered Redress Program Records.'' This system of
records enables the CFPB to manage the distribution of the Civil
Penalty Fund and redress monies to consumers.
DATES: Comments must be received no later than January 21, 2026. The
new system of records will be effective January 21, 2026 unless the
comments received result in a contrary determination.
ADDRESSES: You may submit comments, identified by the title and docket
number (see above Docket No. CFPB-2025-0053), by any of the following
methods:
<bullet> Federal eRulemaking Portal: <a href="http://www.regulations.gov">http://www.regulations.gov</a>.
Follow the instructions for submitting comments. A brief summary of
this document will be available at <a href="https://www.regulations.gov/docket/CFPB-2025-0053">https://www.regulations.gov/docket/CFPB-2025-0053</a>.
<bullet> Email: <a href="/cdn-cgi/l/email-protection#1e6e6c77687f7d675e7d786e7c30797168"><span class="__cf_email__" data-cfemail="d0a0a2b9a6b1b3a990b3b6a0b2feb7bfa6">[email protected]</span></a>. Include Docket No. CFPB-2025-0053
in the subject line of the email.
<bullet> Mail/Hand Delivery/Courier: Kathryn Fong, Chief Privacy
Officer, Consumer Financial Protection Bureau, 1700 G Street NW,
Washington, DC 20552, (202) 435-7058. Because paper mail in the
Washington, DC area and at CFPB is subject to delay, commenters are
encouraged to submit comments electronically.
All submissions must include the agency name and docket number for
this notice. In general, all comments received will be posted without
change to <a href="http://www.regulations.gov">http://www.regulations.gov</a>. All comments, including
attachments and other supporting materials, will become part of the
public record and subject to public disclosure. You should submit only
information that you wish to make available publicly. Sensitive
personal information, such as account numbers or Social Security
numbers, should not be included.
FOR FURTHER INFORMATION CONTACT: Kathryn Fong, Chief Privacy Officer,
Consumer Financial Protection Bureau, 1700 G Street NW, Washington, DC
20552; (202) 435-7058. If you require this document in an alternative
electronic format, please contact <a href="/cdn-cgi/l/email-protection#2665607664796745454355554f444f4a4f525f664540564408414950"><span class="__cf_email__" data-cfemail="31727761736e7052525442425853585d58454871525741531f565e47">[email protected]</span></a>. Please
do not submit comments to this email box.
SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974,
5 U.S.C. 552a, the CFPB is modifying a system of records titled,
``CFPB.025 Civil Penalty Fund and Bureau-Administered Redress Program
Records''. This modified system of records includes a new routine use
to
[[Page 59801]]
enable disclosure of records to the Department of Treasury, pursuant to
Executive Order 14249, Protecting America's Bank Account Against Fraud,
Waste, and Abuse and Office of Management and Budget (OMB) Memorandum
M-25-32, Preventing Improper Payments and Protecting Privacy Through Do
Not Pay. Additionally, CFPB is modifying the purpose to clarify that
records may be used to prevent improper payment of funds. Finally, CFPB
is updating the policies and practices for retention and disposal of
records to include the National Archives and Records Administration
(NARA)-approved records retention schedule.
The CFPB is also making non-substantive revisions to this SORN to
align with the Office of Management and Budget's recommended model in
Circular A-108, Appendix II. The report of the revised system of
records has been submitted to the Committee on Oversight and Government
Reform of the House of Representatives, the Committee on Homeland
Security and Governmental Affairs of the Senate, and the Office of
Management and Budget, pursuant to Circular A-108, ``Federal Agency
Responsibilities for Review, Reporting, and Publication under the
Privacy Act'' (Dec. 2016) and the Privacy Act of 1974, 5 U.S.C.
552a(r).
SYSTEM NAME AND NUMBER:
CFPB.025--Civil Penalty and Bureau-Administered Redress Program
Records.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Consumer Financial Protection Bureau, 1700 G Street NW, Washington,
DC 20552.
SYSTEM MANAGER(S):
Consumer Financial Protection Bureau, Chief Financial Officer, 1700
G Street NW, Washington, DC 20552.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Public Law 111-203, Title X, Sections 1017(d), 1055(a), codified at
12 U.S.C. 5497(d), 5565(a).
PURPOSE(S) OF THE SYSTEM:
The system enables the CFPB to manage the distribution of Civil
Penalty Fund and redress monies to consumers, including: (1) tracking
the collection, allocation, and distribution of funds in the Civil
Penalty Fund and redress monies; (2) identifying and locating victims
who may receive payments from the Civil Penalty Fund and/or redress
payments; (3) determining the amounts of the Civil Penalty Fund
payments and redress payments that the Bureau will make to victims; (4)
maintaining accounting and financial information associated with such
payments; and (5) developing reports to applicable Federal, State, and
local taxing officials of taxable income, and reports necessary to meet
other reporting requirements. The information will also be used for
administrative purposes to ensure quality control, performance, and
improving management processes, and to prevent improper payment of
funds.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals covered by this system include, without limitation: (1)
Individuals identified as victims or potential victims who may receive
payments from the Civil Penalty Fund or through Bureau-Administered
Redress, including but not limited to current, former, and prospective
consumers who are or have been customers or prospective customers of
entities ordered to pay a civil penalty or redress to the CFPB as a
result of a Bureau enforcement action; (2) individuals associated with
entities and individuals that have been ordered to pay a civil penalty
or redress to the Bureau as a result of a Bureau enforcement action;
and (3) others, including CFPB employees, with information relevant to,
or otherwise associated with, a Bureau enforcement action that has
resulted in an order to pay civil penalties or redress to the CFPB.
CATEGORIES OF RECORDS IN THE SYSTEM:
Records in this system may contain identifiable information about
individuals including, without limitation: (1) Name, address, email
address, phone number and other contact information; (2) Social
Security number (SSN), age, date of birth, marital status, records of
consumer financial transactions, financial account information, and
internal identification number assigned to identified victims; (3)
accounting and financial information relevant to making payment; and
(4) accounting and financial information relevant to determining when
and in what amounts victims have claimed funds.
Additionally, non-identifying information in the system may include
the dates the Bureau authorized, instituted, settled, and/or otherwise
obtained a final judgement in a judicial or administrative action; an
internal case tracking number; the date the judicial or administrative
order was entered; the date the judicial or administrative order became
a ``final order'' as defined by the Consumer Financial Civil Penalty
Fund Rule, 12 CFR part 1075; the amount of civil penalties or redress
ordered; the due date for payments of civil penalties and redress
funds; the date and amount of payments made; the status of debt
collection efforts; and the balances of the Bureau's accounts as
payments are made.
RECORD SOURCE CATEGORIES:
Information in this system is provided by (1) individuals
identified as victims or potential victims who may receive payments
from the Civil Penalty fund or through Bureau-Administered Redress,
including but not limited to current, former, and prospective consumers
who are or have been customers or prospective customers of entities
ordered to pay a civil penalty or redress to the CFPB as a result of a
Bureau enforcement action; (2) entities and individuals associated with
entities and individuals that have been ordered to pay a civil penalty
or redress to the CFPB as a result of a Bureau enforcement action; and
(3) others, including CFPB employees, with information relevant to, or
otherwise associated with, a Bureau enforcement action that has
resulted in an order to pay civil penalties or redress to the CFPB.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, and consistent with the CFPB's Disclosure
of Records and Information Rules, promulgated at 12 CFR part 1070, all
or a portion of the records or information contained in this system may
be disclosed outside the CFPB as a routine use to:
(1) Appropriate agencies, entities, and persons when (a) the Bureau
suspects or has confirmed that there has been a breach of the system of
records; (b) the Bureau has determined that as a result of the
suspected or confirmed breach there is a risk of harm to individuals,
the Bureau (including its information systems, programs, and
operations), the Federal government, or national security; and (c) the
disclosure made to such agencies, entities, and persons is reasonably
necessary to assist in connection with the Bureau's efforts to respond
to the suspected or confirmed breach or to prevent, minimize, or remedy
such harm.
(2) Another Federal agency or entity, when the Bureau determines
that information from this system of records
[[Page 59802]]
is reasonably necessary to assist the recipient agency or entity in (a)
responding to a suspected or confirmed breach or (b) preventing,
minimizing, or remedying the risk of harm to individuals, the recipient
agency or entity (including its information systems, programs, and
operations), the Federal government, or national security, resulting
from a suspected or confirmed breach.
(3) Another Federal or State agency to (a) permit a decision as to
access, amendment, or correction of records to be made in consultation
with or by that agency, or (b) verify the identity of an individual or
the accuracy of information submitted by an individual who has
requested access to or amendment or correction of records.
(4) The Executive Office of the President in response to an inquiry
from that office made at the request of the subject of a record or a
third party on that person's behalf.
(5) Congressional offices in response to an inquiry made at the
request of the individual to whom the record pertains.
(6) Contractors, agents, or other authorized individuals performing
work on a contract, service, cooperative agreement, job, or other
activity on behalf of the Bureau or the U.S. Government and who have a
need to access the information in the performance of their mission,
including duties or activities.
(7) The Department of Justice (DOJ) for its use in providing legal
advice to the Bureau or in representing the Bureau in a proceeding
before a court, adjudicative body, or other administrative body, where
the use of such information by the DOJ is deemed by the Bureau to be
relevant and necessary to the advice or proceeding, and such proceeding
names as a party in interest:
(a) The CFPB;
(b) Any employee of the Bureau in their official capacity;
(c) Any employee of the Bureau in their individual capacity where
DOJ has agreed to represent the employee; or
(d) The United States, where the CFPB determines that litigation is
likely to affect the Bureau or any of its components.
(8) Appropriate Federal, State, local, foreign, Tribal, or self-
regulatory organizations or agencies responsible for investigating,
prosecuting, enforcing, implementing, issuing, or carrying out a
statute, rule, regulation, order, policy, or license if the information
may be relevant to a potential violation of civil or criminal law,
rule, regulation, order, policy, or license.
(9) To the National Archives and Records Administration (NARA) or
other Federal Government agencies pursuant to records management
inspections being conducted under the authority of 44 U.S.C. 2904 and
2906.
(10) An entity or person that is the subject of a judicial or
administrative action resulting in an order to pay civil penalties or
redress to the Bureau, and the attorney or non-attorney representative
for that entity or person.
(11) To the Department of the Treasury, Internal Revenue Service,
or other governmental entities, including State and local taxing
officials, to comply with tax-reporting obligations.
(12) A financial institution holding Civil Penalty Fund or redress
monies on behalf of the Bureau in order to issue payments to identified
victims.
(13) The Office of Inspector General, or other governmental
entities as necessary to comply with reporting obligations regarding
the disbursement of Civil Penalty Fund or redress monies.
(14) The Federal Deposit Insurance Corporation (FDIC) in order to
make claims under the FDIC's deposit insurance claims process, in the
event a financial institution holding Civil Penalty Fund or redress
monies on behalf of the Bureau fails.
(15) The U.S. Department of the Treasury when disclosure of the
information is relevant to review payment and award eligibility through
the Do Not Pay Working System for the purpose of identifying,
preventing, or recouping improper payments to an applicant for, or
recipient of, Federal funds, including funds disbursed by a State
(meaning a State of the United States, the District of Columbia, a
territory or possession of the United States, or a federally recognized
Indian tribe) in a state-administered, federally funded program.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records maintained in this system are stored electronically and in
paper files.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrievable by a variety of fields including, but not
limited to, the individual's name, address, financial account number,
internal identification number assigned to identified victims, or by
some combination thereof.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
The CFPB maintains electronic and paper records in accordance with
the following National Archives and Records Administration (NARA)-
approved records retention schedule:
(1) Civil Penalties Program Working Files; DAA-0587-2014-0001-0001.
Disposition: Cut off when project is complete. Maintain in office until
no longer needed.
(2) Civil Penalties Closed Case Files; DAA-0587-2014-0001-0002.
Disposition: Cut-off closed cases files at the end of fiscal year in
which the activity is completed. Destroy 5 year(s) after penalty
payment or Office of General Counsel authorization.
(3) Civil Penalty Guidelines; DAA-0587-2014-0001-0003. Disposition:
Destroy/delete when superseded, obsolete, or no longer needed for
business purposes, whichever is later. Destroy when no longer needed.
(4) Civil Penalty Fund Administrator; DAA-0587-2014-0001-0004.
Disposition: Cut-off files at the end of the fiscal year in which the
activity is completed. Destroy/delete 3 years after cut-off.
(5) Financial Management Files; DAA-0587-2014-0001-0005.
Disposition: Cut-off files at the end of the fiscal year in which the
activity is completed. Destroy/delete when no longer needed for
reference, not to exceed discontinuance of program.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Access to electronic records is restricted to authorized personnel
who have been issued non-transferrable access codes and passwords.
Other records are maintained in locked file cabinets or rooms with
access limited to those personnel whose official duties require access.
RECORD ACCESS PROCEDURES:
Individuals seeking notification and access to any record contained
in this system of records may inquire in writing in accordance with
instructions in 12 CFR 1070.50 et seq. Address such requests to: Chief
Privacy Officer, Consumer Financial Protection Bureau, 1700 G Street
NW, Washington, DC 20552. Instructions are also provided on the CFPB
website: <a href="https://www.consumerfinance.gov/foia-requests/submit-request/">https://www.consumerfinance.gov/foia-requests/submit-request/</a>.
CONTESTING RECORD PROCEDURES:
See ``Access Procedures'' above.
NOTIFICATION PROCEDURES:
See ``Record Access Procedures'' above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
[[Page 59803]]
HISTORY:
78 FR 34991; 83 FR 23435.
Kathryn Fong,
Chief Privacy Officer, Consumer Financial Protection Bureau.
[FR Doc. 2025-23612 Filed 12-19-25; 8:45 am]
BILLING CODE 4810-AM-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on December 22, 2025.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.