CFPB and CFTC Self-Reporting Policies: A 2026 Decision Guide

A cooperation policy is not a promise. Treating it like one can turn a defensible self-reporting decision into a bad enforcement memo.

Two federal agencies published materially different signals in 2026. The CFPB’s Enforcement Principles, last modified May 29, say the Bureau wants voluntary remediation and will not “unnecessarily” punish institutions for candid self-reporting. The CFTC Division of Enforcement’s Letter No. 26-15, described in the CFTC’s May 19 announcement, provides a detailed staff framework for declination recommendations and penalty credit.

They are useful. They are not interchangeable, and neither eliminates case-specific judgment.

TL;DR

• CFTC Letter No. 26-15 is staff guidance about Division recommendations; it does not bind the Commission or create an enforceable right.
• The CFTC tiers matter: a nonqualifying good-faith report can support at least 50% credit, aggravating factors can reduce the stated minimum to 25%, and residual Part III credit is generally capped at 25%.
• The CFPB principles support collaboration but do not publish a penalty schedule or self-reporting safe harbor.
• Build the decision around timing, legal duties, harm, preservation, remediation, restitution, privilege, and regulator sequencing—not a generic “always disclose” rule.

CFPB and CFTC self-reporting policies are different tools

That distinction should appear in the first page of any disclosure memo. A firm can use both documents as decision inputs without describing either as a guaranteed outcome.

What CFTC Letter No. 26-15 actually says

The advisory is the Division’s exclusive policy on self-reporting, cooperation, and remediation and supersedes its prior policies on those subjects, including the February 2025 advisory. Its footnote is just as important as its headline: an order can be taken only by the Commission in its sole discretion, and the advisory does not create substantive or procedural rights.

Part I: the path to a declination recommendation

The Division says it will not recommend an enforcement action when all five conditions are met:

1. A qualifying Voluntary Self-Report to the CFTC
2. Full Cooperation during the investigation
3. Timely and Appropriate Remediation
4. Full Restitution and/or Disgorgement, when applicable
5. No aggravating circumstances that preclude eligibility

The aggravating circumstances listed in the advisory are limited to pervasive intentional or reckless misconduct by ownership or senior management, intentional or reckless misconduct over an extended period, recidivist intentional or reckless misconduct, and particularly egregious aggregate harm. Their presence may—but does not automatically—preclude eligibility. The Division retains discretion to balance them against the quality of the report, cooperation, remediation, and restitution.

The careful phrase is declination recommendation, not guaranteed declination.

Part II: the two minimum-credit categories

The percentages are easy to reverse, so use the source language directly:

Part II also requires Full Cooperation, Timely and Appropriate Remediation, and Full Restitution and/or Disgorgement. When multiple disqualifying conditions overlap, do not improvise a percentage. Document the facts and have counsel test them against the advisory.

Part III: residual cooperation credit

When a matter does not qualify under Parts I or II, the Division may still recommend cooperation credit. The advisory requires Timely and Appropriate Remediation and Full Restitution and/or Disgorgement before it will consider that credit. Absent extraordinary circumstances, the recommendation is no more than 25%.

That is different from a general 25%–75% range. The range depends on which part of the policy applies.

A CFTC voluntary self-report has a timing test

Letter No. 26-15 requires more than sending a notice before a subpoena arrives. The report must be voluntary, made in good faith, and delivered within a reasonably prompt time after the party becomes aware of the misconduct. It must precede a known or reasonably anticipated imminent threat that the matter will be disclosed by a whistleblower, the media, another channel, or an investigation by an exchange, self-regulatory organization, or government entity.

The firm bears the burden of showing timeliness. Registrants are not supposed to wait for a routine reporting date.

At the initial stage, the reporting party must provide all material, nonprivileged information then in its possession or control—even when the internal investigation is incomplete. The advisory recognizes that prompt reports can contain inaccuracies and provides a limited safe harbor from specified false-statement recommendations when an inaccuracy was made in good faith and corrected promptly after discovery.

That protection is not permission to speculate. Separate confirmed facts, preliminary findings, and open questions in the disclosure package.

What the CFPB principles add—and what they do not

The CFPB page organizes its posture around four ideas:

• Actual harm: enforcement focuses on real and meaningful consumer harm rather than unwise consumer decisions or theoretical or highly speculative harm.
• Due process: actions should rest on clear statutory authority or notice-and-comment rules rather than novel theories.
• Collaboration: the Bureau seeks voluntary remediation and says self-reporters will not be unnecessarily punished for candor.
• Efficiency: the Bureau says it will avoid duplicative actions where states or other regulators are better positioned.

Those statements can support a narrative of prompt remediation and consumer restitution. They do not say that technical violations without measured loss are immune, that every self-report earns a fixed discount, or that another regulator’s involvement eliminates CFPB risk.

Treat them as enforcement-discretion principles. The controlling statute, regulation, mandatory notice rule, order, and actual facts still govern.

Build a 48-hour self-reporting decision record

The first deliverable should be a short, access-controlled decision record—not an unstructured email chain.

A useful first-day sequence is:

1. Preserve before debating posture. Stop routine deletion and identify the relevant systems and custodians.
2. Separate mandatory notices from discretionary cooperation. A required regulatory filing is not the same decision as seeking cooperation credit.
3. Define the earliest awareness date. This matters directly to CFTC timeliness.
4. Quantify what is known without pretending the investigation is complete. Use ranges and label assumptions.
5. Assign remediation and restitution owners. The CFTC framework makes both central to credit.
6. Set the next decision time. Revisit the memo when a material fact changes rather than allowing “pending investigation” to become indefinite delay.

The same discipline used in a strong regulatory implementation record applies here: owner, decision, evidence, exception, validation, and closure must connect.

The evidence packet should survive hostile review

A regulator should be able to reconstruct the sequence without relying on memory. Preserve:

• the original alert, complaint, exception, or control failure;
• the issue classification and escalation record;
• legal-hold and preservation evidence;
• affected-product, customer, and transaction populations;
• versions of calculations used to estimate harm;
• root-cause analysis with contributing control failures;
• remediation tasks, owners, deadlines, and independent validation;
• restitution or disgorgement calculations and payment evidence;
• copies of every regulator communication and production;
• a privilege log or documented basis for withholding privileged material;
• committee minutes and the approved disclosure rationale.

Do not edit the original record to make the timeline look cleaner. Add a dated correction and preserve both versions. That is consistent with the advisory’s emphasis on prompt supplementation and a defensible remediation trail.

Four traps that destroy cooperation credit

Waiting for perfect facts

The CFTC policy anticipates reports made while investigations are incomplete. Delay can jeopardize timeliness. The answer is a controlled preliminary report with clearly labeled unknowns, not unsupported certainty.

Treating privilege as an excuse for silence

The policy repeatedly refers to nonprivileged information. Coordinate privilege deliberately, but do not assume that asserting privilege substitutes for producing underlying nonprivileged facts.

Ignoring regulator sequencing

One event can trigger CFTC, CFPB, prudential, state, exchange, contractual, and criminal considerations. Build a regulator matrix with the legal basis, deadline, owner, planned message, and information-sharing assumptions. The CFPB’s efficiency principle is not a promise that agencies will coordinate the sequence for you.

Remediating without proving effectiveness

Closing a ticket is not Timely and Appropriate Remediation. Preserve the root cause, design change, implementation evidence, population lookback, validation method, exceptions, and governance sign-off.

So what?

Use the 2026 policies as structured inputs, not slogans. The CFTC advisory rewards a specific combination of timing, candor, cooperation, remediation, and restitution, but its percentages depend on the exact part that applies. The CFPB principles favor collaboration but do not provide a formula.

The practical first step is to prebuild the decision record, regulator matrix, and evidence checklist before an incident. When a real issue appears, the firm can spend the first 48 hours finding facts and protecting consumers—not arguing about which spreadsheet should hold the timeline.

The Issues Management Tracker & Template includes an issues register, remediation planning tools, reporting dashboards, and a closure-validation checklist that can support this record. Have counsel tailor the disclosure decision process to the governing law and facts.