California’s governor is expected to sign into law soon a bill creating a state consumer financial protection agency, the Department of Financial Protection and Innovation (DFPI), which some have called California’s “mini-CFPB.” We reported previously on the importance of this law in January and March.
Effective on January 1, 2021, the new law renames the Department of Business Oversight (DBO) as the DFPI and tasks the agency with responsibility for the newly adopted California Consumer Financial Protection Law (CCFPL). In addition, the law requires that the DFPI establish a Financial Technology Innovation Office.
Under existing law, the DBO is responsible for specified laws relating to various financial institutions and providers of financial services, including banks, trust companies, credit unions, finance lenders, and residential mortgage lenders. Under the new law, the DFPI will continue the DBO’s prior role as to those laws, but will also become the primary regulator as to various other California laws that reach debt collectors, credit reporting agencies, and fintech companies. Notably, the CCPFL expressly exempts from its coverage certain financial institutions that are licensed or chartered under federal or other state law; for example, banks and credit unions.
Importantly, the CCFPL gives the DFPI the option of regulating nonbank small business lenders, many of which are fintech companies. Further, the CCFPL incorporates into California state law a prohibition, reaching covered financial services businesses and their service providers, against engaging in any unlawful, unfair, deceptive, or abusive act or practice (UDAAP). The law also authorizes the DFPI to define UDAAP in connection with the offering or provision of commercial financing, or offering financial products and services to small businesses.
The DFPI’s enforcement authority over UDAAP will mirror that of the Consumer Financial Protection Bureau’s (CFPB’s) authority over similar acts and practices under the Dodd-Frank Act (DFA). The DFPI’s broad jurisdiction over UDAAP will do significant work to expand the new agency’s reach as compared to the DBO’s relatively cabined authority. Whereas the DBO currently only regulates specific financial transactions and oversees certain state-licensed financial institutions, the renamed agency will have greater authority to regulate and bring enforcement actions against a broad range of financial service providers; for example, fintech companies and debt collectors.
Notably, the DFA already provides state attorneys general with concurrent enforcement authority over UDAAP in parallel with the CFPB. And California’s attorney general has the power to enforce existing state law, which has long penalized unfair and deceptive acts or practices. Following adoption of this law, both the DFPI and the California Attorney General’s Office will have co-extensive authority over alleged UDAAP violations. And the DFPI may exercise a more expansive view of UDAAP enforcement than done currently under the DFA—under the CCFPL, the DFPI will not be required to consult with the CFPB on UDAAP actions.
The CCFPL provides that all monies collected by the DFPI, including registration fees and penalties, are to be deposited into a newly created Financial Protection Fund, which will fund the agency’s budget appropriations. Such direct linking of the agency’s funding and its level of “busyness” (including enforcement activity) potentially could result in a greater number of enforcement actions and higher amounts demanded by agency staff attorneys for civil penalties and administrative fines.
TAKEAWAYS
- Potential prosecutorial competition between the DFPI and the California Attorney General’s Office, taken together with the DFPI’s reliance on fees and penalties as its only source of revenue, may spur a greater degree of enforcement activity in the state and potentially higher fees and annual assessments for licensees.
- Other states may follow California’s lead by creating wholly new agencies with broad jurisdiction over consumer financial products and services, effectively supplementing the work currently done by various state attorneys general offices when exercising their UDAAP authority under the DFA. For some states, including Pennsylvania, New Jersey, and Maryland, establishing their own “mini-CFPBs” may be on the agenda in the near future.
- Time will tell what regulatory innovations the DFPI may deploy in the fintech space, but it is clear that now is an important time for fintech leaders to keep abreast of California regulatory initiatives that may impact them.