It has been a tumultuous few days for the Consumer Financial Protection Bureau (CFPB), with dueling acting directors and emergency hearings. But while Office of Management and Budget (OMB) Director Mick Mulvaney is now officially the acting director of the CFPB—at least as of this writing—the story does not end there. Many questions remain to be answered regarding the legal framework governing the CFPB’s leadership structure, the future of the CFPB under a permanent director nominated by President Donald Trump, and the prospects for federal and state regulation of consumer financial matters.

This week’s CFPB leadership fight: What happened

On Friday, November 24, 2017, Richard Cordray abruptly resigned as Director of the CFPB. But before his resignation became effective, he promoted CFPB employee Leandra English from Chief of Staff to Deputy Director and said that upon his departure, at midnight Friday, she would take over as Acting Director.

Hours later, President Donald Trump named Mick Mulvaney—an outspoken critic of the CFPB who once called the agency a “sad, sick joke” — as Acting Director of the CFPB, to serve on an interim basis.

While speculation ramped up over the drama that would ensue on Monday morning when two people showed up to CFPB headquarters both claiming to be in charge, English took the matter to court. On Sunday, November 26, she filed a complaint in the U.S. District Court for the District of Columbia, asking the court to recognize her as acting director of the CFPB and to impose a temporary restraining order giving her full authority while the court considered her case. English’s complaint alleged that she is the rightful director because the Dodd-Frank Act of 2010 mandates that the Deputy Director “shall … serve as the acting Director in the absence or unavailability of the Director.” 12 U.S.C. § 5491(b)(5).

On Monday afternoon, November 27, U.S. District Judge Timothy J. Kelly, a Trump appointee confirmed in September, held an emergency hearing and heard arguments, but declined to rule immediately. Kelly said he would wait until attorneys for the Department of Justice (DOJ) supplemented their arguments by filing a formal, written response, which they did shortly before midnight on Monday. In their brief, arguing in support of Mulvaney’s appointment, the DOJ attorneys argued that the Federal Vacancies Reform Act of 1988 (FVRA), which empowers the president to fill a vacancy at an executive agency, gave the president the authority to appoint Mulvaney, echoing a memorandum by the DOJ’s Office of Legal Counsel that was released Saturday.

On the afternoon of Tuesday, November 28, Kelly held another hearing and rejected from the bench English’s motion, siding with President Trump and finding that English had not shown the requisite harm, public interest or likelihood of success needed for the extraordinary relief of a temporary restraining order. On the conflict between the language of the FVRA and Dodd-Frank, Kelly found that while the FVRA may be “more generic” when it comes to the CFPB itself, it is actually “more specific” when it comes to addressing vacancies, since Dodd-Frank specifically discusses absent directors, not vacant seats. And while English had argued that the CFPB was intended to be an independent agency and that appointing a still-serving White House official as head of the CFPB runs contrary to that statutory independence, Kelly said that the agency is still a member of the executive branch, and he could find no statutory authority preventing Mulvaney from heading both the OMB and CFPB at the same time.

While this ruling denying the TRO motion cannot be challenged, Deepak Gupta, English’s lawyer (and a former CFPB employee), said that the matter is not over. Gupta said he anticipates pursuing the case on the merits, and expressed hope that any proceeding would be fast-tracked.

What will happen to PHH v. CFPB?

While the English v. Trump case is understandably drawing significant attention, it is important to remember that a ruling is still pending in a potentially more impactful case: PHH v. CFPB. That case addresses not just a temporary director, but the fundamental issue of whether the CFPB’s single-director structure, and Dodd-Frank’s provisions that the agency’s director can only be terminated with cause, are constitutional.

The PHH case was reheard en banc by the U.S. Court of Appeals for the D.C. Circuit in May 2017, after a three-judge panel found that the CFPB’s structure was unconstitutional because it has a single director who is not removable at will by the President. A ruling in the case could come down any day.

Although the English case did not cite PHH v. CFPB, the cases are naturally intertwined in a number of ways. Kelly said there are key constitutional issues at play in the English case yet to be briefed, likely referring to the issues at play in PHH. And, had Kelly ruled in English’s favor and left her as acting director, the PHH ruling would have either protected her position (until a permanent director was seated, and then that permanent director’s tenure would also be protected) or given President Trump the ability to fire her at will.

But Kelly did not rule for English and, with a Trump appointee at the head of the CFPB, many questions remain as to what will happen to the PHH case when the D.C. Circuit finally hands down its en banc ruling. If the D.C. Circuit sides with PHH and finds the CFPB’s structure to be unconstitutional, will the CFPB appeal that decision to the Supreme Court? Conversely, will the CFPB aggressively defend a favorable ruling should PHH appeal such a ruling to the Supreme Court? Mulvaney’s track record of criticism of the CFPB and its structure makes it unclear how vigorously a Mulvaney-led CFPB would defend that structure.

It is also unclear how members of Congress will approach any legislation affecting the CFPB and its structure. Congress—which created the CFPB—has always had the power to restructure, change the funding source for, or even abolish the CFPB, with sufficient votes. And numerous Republican legislators have expressed a desire to do just that – whether to replace the single-director structure with a bipartisan board, to make the CFPB’s funding subject to appropriations, or to make other changes. But now that a Republican is at the agency’s helm (and now that some predictions foresee the potential for Democratic gains in the 2018 elections), it is unclear whether such changes will remain a priority.

What will happen to consumer protection if the CFPB scales back?

Regardless of how English’s lawsuit plays out, President Trump has the power to nominate a permanent CFPB director, so it seems only a matter of time before his choice takes office. In a tweet on Saturday, November 25, Trump said that the CFPB has been a “total disaster,” and it is possible that the next director will share that view.

For his part, Mulvaney has wasted no time in putting the brakes on CFPB actions. On Monday, shortly after taking office, he announced a 30-day freeze on hiring and new rulemaking, as well as a freeze on payment from the CFPB’s civil penalties fund for at least 30 days, telling reporters, “Anything that is discretionary we’re putting a 30-day hold on.” While Mulvaney did say that statutory or legal guidelines (if any) would continue to be met, it is unclear what he plans to do regarding the roughly 100 lawsuits that the CFPB is involved in. He reportedly was to be briefed on the status of lawsuits and enforcement actions on Tuesday, November 28.

As to new rulemaking actions, as of November 27, 2017, the CFPB’s website listed only 10 currently outstanding proposed rules and one advanced notice of proposed rulemaking. Of those 11 items, five are from 2017 and two are from 2016, and the others are all from 2013 or earlier. Of those proposed rules from 2016 and 2017, four relate to the mortgage industry (proposals relating to mortgage servicing rules and federal mortgage disclosure requirements under Regulation Z, and home mortgage disclosures and technical amendments under Regulation C) and the others relate to prepaid accounts under Regulations E and Z, amendments to the procedures used by the public to obtain information from the CFPB under the Freedom of Information Act, and amendments to Regulation P relating the annual privacy notice requirement. Of these pending rule proposals, there is nothing nearly as controversial as the CFPB’s recent arbitration rule, and it is unclear what will happen to them beyond the 30-day freeze, or what industry pressure Mulvaney or his successor will feel to shelve any of these rules.

While supporters of the CFPB fear that a rollback of the CFPB could cause consumer harm—to date, the CFPB has returned about $12 billion to consumers—several state agencies and attorneys general seem prepared to step up their activity if the CFPB ramps down its own. For example, both California and New York have a history of aggressively pursuing consumer protection issues. In light of Congress nullifying the CFPB’s arbitration rule, California passed its own law to prevent California courts from enforcing arbitration clauses if consumers are suing banks or credit unions over accounts that were opened fraudulently. The New York Department of Financial Services sought to tighten licensing regulations for online lenders this year via a provision in a budget bill submitted to the state Legislature (although the Legislature ultimately rejected the proposal).

And other states may step into the gap as well. Pennsylvania recently unveiled a new Consumer Financial Protection Unit and tapped Nicholas Smyth, a CFPB veteran, to head that office, while Maryland has formed a Financial Consumer Protection Commission with former Commodity Futures Trading Commission Chairman Gary Gensler at the helm. Washington state Attorney General Bob Ferguson has steadily increased his office’s focus on consumer protection, tripling the number of lawyers in that division over his four-plus years in office. Other states to watch include Massachusetts, Illinois, and North Carolina, whose authorities are also active in these issues, and wield significant resources in this space. Texas and Florida may step up enforcement as well due to the sheer volume of consumers—and cases involving consumer financial matters—in those states.

While it may be hard for state bank supervisors or agencies focused on consumer financial protection to match the CFPB’s ability to oversee and make nationwide rules for financial institutions, many state attorneys general have the tools in hand to substitute for CFPB enforcement in the form of state consumer protection laws, since a violation of a federal consumer financial law is frequently also deemed to be a violation of a state consumer law. For decades, states have also cooperated on financial-services enforcement. Even before the creation of the CFPB, there were several multistate settlements over predatory lending; for example, in 2002, 46 states reached a $486 million settlement with Household Finance.

Going forward, states may coordinate particularly on matters that do not cut along political lines, such as those concerning data breaches and student loan servicing practices. Earlier this year, Target reached an agreement with 47 states and the District of Columbia to pay $18.5 million in a case centering on a data breach involving customer payment cards. In another example, state attorneys general from 34 states, including Illinois, New York, Pennsylvania, Georgia, Florida, Connecticut, and New Jersey, recently contacted Equifax in response to its announcement of the hack that exposed the personal data of 143 million consumers. All in all, potential liability from actions by state attorneys general—as well as from class actions and other private suits—could be significant for defendants, possibly even surpassing fines that would have been assessed by the CFPB.