On Sept. 25, 2020, California Gov. Gavin Newsom signed into law the California Consumer Financial Protection Law (CCFPL), which was passed by the California Legislature Aug. 31, 2020. The provisions of the CCFPL become effective Jan. 1, 2021.

The stated intent of the CCFPL is to “strengthen consumer protections by expanding the ability of the State of California to improve accountability and transparency in the California financial system, provide consumer financial education, and protect consumers from abusive practices.” The CCFPL identifies certain “vulnerable populations,” including “military service members, seniors, students, low-and moderate-income individuals, and new Californians.”

Under the CCFPL, California’s Department of Business Oversight (DBO) will be renamed the Department of Financial Protection and Innovation (DFPI) and, in addition to inherited regulatory authority under existing statutory schemes, will have authoritative powers similar to those granted to the federal Consumer Financial Protection Bureau (CFPB) under the Dodd-Frank Act (DFA). Coined by some as California’s “mini-CFPB,” the DFPI has the authority under the CCFPL to enforce California’s laws against “persons offering or providing consumer financial products or services in [the] state.” For financial services firms that do business with California residents but are not presently licensed or regulated by the DBO, this means that the CCFPL grants the DFPI “increased oversight over financial services not currently subject to the department’s regulatory oversight.”

The CCFPL is both broad and detailed. Below is a summary of key provisions.

Scope of Application

Similar to the authority granted to the CFPB under the DFA, the CCFPL grants broad authority to the DFPI to regulate the provision of various consumer financial products or services and to exercise non-exclusive oversight and enforcement authority pursuant to California’s consumer financial laws and, to the extent permitted, pursuant to federal consumer financial laws. The CCFPL makes it unlawful for “covered persons” or “service providers” (see below) to, among other acts, engage in unlawful, unfair, deceptive, or abusive acts or practices (UDAAP) in connection with consumer financial products or services, or offer or provide a consumer a financial product or service that is not compliant with any consumer financial law.

The definition of “consumer financial products and services” under the CCFPL is closely analogous to the broad definition in Title X of the DFA, including financial products and services that are delivered, offered, or provided for use by consumers primarily for personal, family, or household purposes. Additionally, the definition includes brokering the offer or sale of a franchise in the state of California on behalf of another.

The CCFPL broadly defines a “covered person” as: (1) any person that engages in the offering of, or providing, a consumer financial product service to a California resident; (2) any affiliate of a person described in the subdivision if the affiliate acts as a service provider to the person; or (3) any service provider to the extent that the person engages in the offering or provision of its own consumer financial product or service. A “service provider,” subject to certain exceptions, is defined as any person providing a material service to a “covered person” in connection with the offering or provision by that “covered person” of a consumer financial product or service.

The CCFPL expressly excludes from its scope certain financial institutions that are licensed, certified, or chartered under federal or another state law (for example, banks, finance lenders, trust companies, savings and loan associations, credit unions, real estate brokers, broker-dealers, investment advisers, check sellers, and bill payers). While these financial institutions may enjoy some relief from the CCFPL, payday lenders and student loan servicers are not excluded. In addition, debt collectors, credit reporting agencies, and certain fintech firms also may fall within the coverage of the CCFPL. As a result, financial institutions in California potentially are faced with a powerful state financial services regulatory scheme with expansive enforcement authority.

Broad Enforcement Powers

The CCFPL prohibits “covered persons” and “service providers” from engaging in UDAAP and grants the DFPI broad enforcement authority against “covered persons” and “service providers” that engage in UDAAP with respect to consumer financial products or services – parallel to the authority granted to the CFPB through the DFA.

The CCFPL grants authority to the DFPI to promulgate rules defining UDAAP applicable to “covered persons.” The DFPI is required to interpret “unfair” and “deceptive” actions pursuant to the Business & Professions Code section 17200 and case law interpreting such provision. Moreover, the CCFPL defines “abusive” similar to the definition proscribed under the DFA and requires the DFPI to interpret the term in accordance with Title X of the DFA. 

The CCFPL empowers the DFPI to prescribe specific regulations and rules regarding registration requirements applicable to a “covered person” within certain timeframes. For entities required to register, the DFPI has the authority to “facilitate oversight of covered persons and assessment and detection of risks to consumers.” As a result, California state supervision is propagated to entities that had previously not been subject to oversight by a primary regulator, such as, for example, consumer-facing fintech companies, debt collectors, and credit reporting agencies. Like the CFPB, the DFPI can require a “covered person” to generate and retain records and may promulgate rules regarding a “covered person” to ensure that such persons are legitimate entities and can perform their duties to consumers; such requirements may include background checks for officers, directors, or key personnel and other appropriate financial requirements.

In addition to broad authority over UDAAP, the DFPI is empowered to bring administrative and civil actions and proceedings for any violation of the CCFPL, or issue a rule or final order pursuant to the CCFPL. Moreover, like the various relief options afforded to the CFPB under the DFA, the remedial options for UDAAP violations under the CCFPL include rescission or reformation of contracts, refunds of moneys or return of real property, restitution, disgorgement or compensation for unjust enrichment, monetary relief, public notification regarding the violation, limits on the activities or functions of the violator, and certain monetary penalties.

Conclusion

By enacting the CCFPL, California intends to further protect California consumers from UDAAP in the consumer financial products and services industry. Under the CCFPL, the DFPI will be gaining authority over substantially more financial services institutions in California, broad enforcement authority over consumer financial laws which had no primary regulator, and significant rulemaking power in California.