Banks and consumer groups have been locked in a public battle about how the young agency would use that power. Wednesday's action provided the first clear clues about its plans. The CFPB held Capital One responsible for the behavior of a third-party vendor, a rare but not unheard-of decision by federal regulators.
The CFPB's action was also notable for requiring automatic refunds to consumers who allegedly were duped — a simple process compared with the time and paperwork involved in most class-action settlements.
Regulators did allow Capital One to settle the matter without admitting or denying any of the facts that they alleged. Bank critics have complained about the use of similar language by the Securities and Exchange Commission to settle high-profile charges. They say the process lets banks buy their way out of problems and avoid deeper scrutiny.
In addition to the refunds, Capital One agreed to stop selling the products until it can provide a plan that is acceptable to regulators. The response will be monitored by an independent auditor.
Most of the refunds will go to customers who bought add-on card services between August 2010 and January 2012. They will receive the full amount of fees they paid and any other related costs. Capital One customers will receive credit to their accounts; former customers will receive checks.
The CFPB's action solidifies the standing of an agency whose very existence remains a subject of stiff debate on Capitol Hill.
Republicans wanted it to be run by a bipartisan commission instead of an independent director and wanted Congress to have power over the agency's budget. The agency's champions said it needed independence to avoid outside influence.
Republicans delayed some of the agency's powers by holding up the appointment of Cordray, a former Ohio state attorney general. President Barack Obama installed Cordray in January, using his presidential authority to make appointments while the Senate is not in session. Republicans say that appointment was not valid.
Banks and their Republican allies have said the agency's broad powers will prevent banks from issuing new products and will increase costs for customers. Cordray told reporters the agency is sticking to issues that clearly violate the law and hurt consumers.
"We are not going to be bringing enforcement actions on small or technical matters where they're in the gray area," he said.
Capital One blamed the third-party vendor for violating its instructions. Still, Capital One card division president Ryan Schneider apologized to customers in a statement, adding, "We are accountable for actions that vendors take on our behalf."
The consumer bureau, created under the Obama administration's 2010 financial overhaul law, is the first federal regulator focused on protecting consumers rather than on ensuring that banks are stable and profitable.
Among the other card companies that might be in the CFPB's sights, Discover Financial Services said last month that it had been subpoenaed by the CFPB and another federal regulator over its fee-based products, including payment protection.
Discover said it had changed the practices and believes it now complies with regulators' demands.
Capitol One's $25 million penalty will go to the CFPB's civil penalty fund, which is used to refund victims of consumer abuse and pay for financial education programs.
Capital One merged with ING Direct last year over the objections of consumer groups, which said Capital One should not become the fifth-biggest bank because of a poor record with consumers. The National Community Reinvestment Coalition specifically objected to Capital One's use of "payment protection" and asked that it be referred to the CFPB.
When the Federal Reserve allowed the deal, it ordered Capital One to improve internal controls around its lending and debt-collection operations.