• Key Insight: The five-year consent order that was settled in late 2023 was ended nearly three years early by the Trump administration.
• Supporting Data: TransUnion already paid a $5 million-dollar fine and $3 million in restitution to harmed consumers.
• What's at Stake: The bureau is not filing any enforcement actions or conducting oversight of nonbanks as it seeks to fire up to 90% of the agency's employees.  

Russell Vought, the acting director of the Consumer Financial Protection Bureau, terminated a 2023 consent order three years early against TransUnion by stating that the credit bureau had already paid fines and restitution to harmed consumers. 

Vought waived part of a 2023 consent order that required years of ongoing monitoring of TransUnion. The Chicago-based credit bureau had failed to remove security freezes and locks on consumers' access to their credit reports in a timely manner — even though the company told consumers that freezes or locks had been placed or removed.  

The consent order had been issued under former CFPB Director Rohit Chopra for violations of the Fair Credit Reporting Act and the federal prohibition against unfair, deceptive and abusive acts or practices. The CFPB filed the administrative order on Monday, though Vought signed it Oct. 31.

The early exit is in line with the Trump administration's ongoing efforts to neutralize the CFPB. Vought has withdrawn and dismissed dozens of consent orders, settlements and pending enforcement actions inherited from the Biden administration. Since the Trump administration took over the bureau in February, the agency has halted all enforcement and supervision of nonbanks. The bureau has not filed any enforcement actions or entered into any consent orders in 10 months.

CFPB employees are not working due to the federal government shutdown. But Vought also is locked in a bitter legal battle because he plans to fire more than 1,000 CFPB employees, claiming the agency that oversees 18 consumer protection laws only needs 200 employees to comply with statutory requirements. 

TransUnion said in a statement that it had "fully complied with all aspects of the security freeze consent order and is pleased the CFPB determined that an early termination of the order was warranted."

TransUnion did not admit any wrongdoing but agreed to the settlement to resolve the matter, a company spokesman said. The credit bureau said that it has resolved "systems issues," related to the security freezes and locks, and is monitoring and addressing any issues going forward, the spokesman said. 

Vought said TransUnion had fulfilled some obligations under the consent order by paying a $5 million-dollar fine, making redress payments to consumers and taking steps to implement injunctive relief to prevent future violations.