CFPB Civil Investigative Demand: A Compliance Guide
Reglith Editorial Team · November 2026
A CFPB civil investigative demand is an investigative subpoena the Consumer Financial Protection Bureau issues under 12 U.S.C. § 5562 to compel documents, written answers, or testimony from a party in a federal consumer financial law investigation. It reaches mortgage lenders, mortgage servicers, and third-party service providers, and it is a pre-enforcement tool, not a finding of liability. The practical question for a compliance team is usually what to do in the days after service, not whether a violation has already occurred.
What is a CFPB civil investigative demand?
A civil investigative demand (CID) is the Bureau's investigative instrument. It is authorized by 12 U.S.C. § 5562, which lets the Bureau issue demands for the production of documents, for written answers to interrogatories, and for oral testimony, in investigations of conduct that may violate federal consumer financial law. It looks like a subpoena, but the statutory scheme is its own: the Bureau may issue CIDs before it files an enforcement action, and the demand itself is not a determination that anything unlawful occurred. That distinguishes a CID from an administrative order, which is the outcome of an adjudicated enforcement proceeding, and from a grand jury subpoena, which issues from a different authority.
The Bureau's investigative authority reaches a range of statutes enforced under Title X of the Dodd-Frank Act. Depending on the facts, a CID may be issued to develop a record on unfair, deceptive, or abusive acts or practices (UDAAP), the Real Estate Settlement Procedures Act (RESPA) and Regulation X, the Truth in Lending Act (TILA) and Regulation Z, the Equal Credit Opportunity Act (ECOA) and Regulation B, or other federal consumer financial law. The mortgage compliance program that covers those statutes for day-to-day operations is the same program a CID will test.
Who receives a CFPB civil investigative demand?
Recipients commonly include mortgage lenders, mortgage servicers, and third-party service providers such as subservicers, document vendors, and marketing or lead-generation firms. The statutory definition of a covered person under Title X is broad, and it extends to entities that are not themselves covered persons when they transact business with, or provide material services to, a covered person. A servicer's vendor, for example, can receive a CID about the work it performs for the servicer.
CIDs often follow an examination. Where an examination raises questions the Bureau wants to develop further, the investigative track and the supervisory track can run in parallel. A company that has just completed an examination cycle, or that is in one now, is frequently the recipient of a CID rather than a company with no prior supervisory contact. That history shapes both the scope of the demand and the documents that exist to answer it.
A request that arrives at a vendor or a subsidiary is not necessarily a vendor problem. The compliance function at the parent, the servicer, or the lender of record often holds the records the Bureau is describing, and coordinating the response is usually a joint effort across legal, compliance, servicing, and information technology.
What must a company do when served with a CID?
The first decision point is timing. The Bureau's rules for investigations include a short window, described in the statute and the Bureau's implementing regulations, for the recipient to meet and confer with Bureau staff and either comply, negotiate, or move to quash. Industry practice treats the ten-day mark after service as the action trigger, and counsel should confirm the operative deadline from the CID's own terms and the rule text rather than assume one.
A workable response sequence usually has these parts:
- Issue a litigation hold covering paper and electronic records, including email, chat, loan origination and servicing system data, and vendor-held data. Preservation obligations attach on receipt.
- Identify custodians and map data sources before negotiating scope; a demand for "all documents concerning" a product line is easier to narrow when the company can describe what actually exists.
- Calendar the meet-and-confer, the response date, and any negotiated extension, and confirm each in writing.
- Collect and review with a defensible process, tracking privilege and confidentiality designations.
- Prepare custodians for interviews or testimony, if the CID calls for oral testimony.
Production is often the long pole. Electronic data from a servicing platform, call recordings, decision logs from an automated underwriting or loss mitigation tool, and vendor correspondence are all within reach. Custodian interviews early in the process routinely surface repositories that no system inventory lists.
The CID is not a stand-alone event. It sits alongside the company's broader federal regulatory posture, and the record the Bureau builds in an investigation is often the same record an examiner reviews later. Teams that treat the investigation as a project with its own governance tend to fare better than teams that fold it into business as usual.
How can a company challenge a CFPB CID?
The statute and the Bureau's rules allow a recipient to petition or move to quash, and the grounds are the ones familiar from administrative subpoena practice: the demand is overbroad or unduly burdensome, it is vague as to what is sought, it seeks information beyond the Bureau's jurisdiction, or it fails to comply with the procedural requirements of the statute. A petition to set aside a CID is typically filed with the Bureau under its rules; a refusal to comply can lead to enforcement in the U.S. District Court.
| Option | Best for | Notes |
|---|---|---|
| Meet and confer, then comply | Narrow disagreements about scope, format, or timing | Fastest path; negotiate custodians, date ranges, and search terms in writing |
| Petition or motion to quash | Colorable jurisdictional, overbreadth, or procedural defects | Treated as a serious step; partial quash is more common than wholesale relief |
| Produce in part, withhold in part | Privileged or irrelevant material within a broader request | Requires a privilege log and a defensible rationale for each withholding |
A challenge does not pause the rest of the Bureau's work. The Bureau can continue to develop the investigation through other sources, and a court or administrative ruling on the CID does not bar a later enforcement action on the same conduct. Coordination between the investigation counsel and the company's regulatory and fair lending functions matters here, because the same facts often appear in more than one proceeding.
Fair lending and UDAAP exposure frequently run through the same data. Where a CID touches ECOA or Regulation B, the analysis tends to overlap with the fair lending review a lender already maintains. Fair Lending Compliance: The Complete Guide for Mortgage Lenders covers the program elements that make that overlap manageable.
Are CFPB civil investigative demands public?
Generally, no. A CID is confidential when issued, and the Bureau's rules restrict disclosure of information obtained in an investigation. That confidentiality is not absolute. A CID can become public when it is filed with a court, when it is described in a public filing, or when the Bureau itself discloses it in connection with an enforcement action or an administrative proceeding.
A motion to quash is a common path to visibility: the petition, the Bureau's response, and the court's ruling become part of the public record, and the CID itself is often attached. Later enforcement litigation can also surface the demand and the documents produced under it.
Compliance and communications teams should plan for that possibility without overreacting to it. The practical steps are to control the internal paper trail, route all external inquiries through a single point of contact, and avoid characterizing the investigation in ways that later filings would contradict. State licensing authorities may separately ask about open investigations in examination or renewal contexts; that is fact-specific and generally worth running through counsel before the question arrives. State mortgage licensing requirements covers the licensing side of that coordination.
What are the consequences of non-compliance with a CID?
Failure to comply carries statutory consequences. The Bureau can seek a court order to enforce the CID, and a court can hold a non-compliant party in contempt. Civil penalties can attach under the Bureau's enforcement authority, and the amount depends on the conduct, the statute at issue, and the court's findings rather than a single fixed figure. The rules do not invite a passive response.
Beyond the direct sanctions, non-compliance tends to escalate the matter. A party that refuses to produce can face an enforcement action seeking injunctive relief, and the scope of the eventual order can be wider than what a negotiated production would have involved. The investigation may also expand: a company that resists on one product line may find the Bureau developing a record on adjacent lines through other sources.
Regulatory standing is the slower cost. A record of resistance can inform how an examiner scopes the next cycle, and a company already managing an open investigation or a public order may face closer supervision and additional reporting obligations. The compliance management system is the mitigating infrastructure in that environment; Building a Mortgage Compliance Management System (CMS): Policies, Monitoring, Audits, and Regulatory Change sets out the core elements, and What Mortgage Lenders Must Understand About Compliance Failures and Regulatory Expectations discusses how those failures are typically evaluated. For the broader federal framework the investigation will be measured against, see The Complete Guide to Federal Mortgage Compliance Regulations. Servicers with default-related questions in parallel with an investigation may also want the loss mitigation and foreclosure compliance context in VA Partial Claim Non-Judicial Foreclosure: A Servicer's Compliance Playbook for Circular 26-26-2.
Frequently asked questions
Is a civil investigative demand the same as a subpoena?
No, though they function similarly. A CID issues under the Bureau's own statutory authority in 12 U.S.C. § 5562, and a subpoena issues under the authority of a court or another body. A CID can compel documents, interrogatory answers, and oral testimony, and it can be enforced in court. The procedural rules and the petition process differ, so the label matters.
Are civil investigative demands public?
Usually not when issued. The Bureau's rules treat investigative material as confidential, and a CID typically stays non-public unless it is filed in court, described in a public filing, or disclosed in an enforcement action. A motion to quash is the most common route to public visibility, because the petition and any ruling enter the public record.
What types of complaints does the CFPB handle?
The Bureau accepts consumer complaints across the products it supervises, including mortgage origination, servicing, escrow, loss mitigation, and debt collection. Complaints are one input the Bureau uses to identify conduct for examination and investigation. A pattern in complaint data can support a CID, though a complaint alone is not a finding of a violation.
Is CFPB still a thing?
Yes. The Consumer Financial Protection Bureau remains the federal agency that administers and enforces the federal consumer financial laws covered in this article, including UDAAP, RESPA, TILA, and ECOA, and it continues to conduct examinations and investigations. Specific supervisory priorities and enforcement postures shift over time, so teams should read the Bureau's current published materials rather than rely on last year's summary.