The Consumer Financial Protection Bureau (CFPB) announced that it has filed suit against four online lenders owned by the federally recognized Habematolel Pomo of Upper Lake Indian Tribe based on alleged violations of state licensing and usury laws.

The factual allegations in this lawsuit, filed in the US District Court for the Northern District of Illinois, are unremarkable. The CFPB charges that the online lenders at issue make small-dollar loans at very high interest rates and that the entities’ tribal ownership is both legally irrelevant and factually dubious. The CFPB also alleges relatively modest violations of Regulation Z’s requirement to disclose the annual percentage rate in an oral response to a consumer inquiry about the cost of credit. The CFPB, however, alleges that the defendants engaged in unfair, deceptive, and abusive acts and practices (UDAAP) in violation of federal law through their efforts to collect on loans that were usurious under state law, or for which other state-law violations vitiated or limited the borrowers’ obligation to repay.

This action reflects another step in the CFPB’s continuing efforts to substantively enforce state laws under the guise of its federal UDAAP authority. As we have previously reported, this is not the first time that the CFPB has advanced an enforcement strategy of predicating federal UDAAP violations on alleged violations of state usury or lending licensing laws. In the prior case, a tribal entity originated the loans but was found to have no further interest once the loans were sold to its non-tribal payday lender partner. In the current lawsuit, the lenders are themselves tribal-owned entities.

The core of the CFPB’s legal theory, stated on the face of the Complaint, is that the lenders “misled” borrowers into believing that the loans were enforceable when—in the CFPB’s view—the loans were not valid debts, because they were usurious or made in violation of state law. These are matters that any of the relevant states’ financial regulators or attorneys general could have addressed, and it bears emphasis that none of the 17 states whose laws the CFPB is attempting to enforce joined as plaintiffs.

Takeaways

Title X of the Dodd-Frank Act plainly gives the CFPB the authority to enforce federal consumer financial laws, but does not confer the same authority to enforce state laws. If the CFPB sees it as within its mandate to use its UDAAP authority to enforce state usury laws, a subject that is statutorily excluded from the agency’s legal authority (and an authority it all but disclaimed in 2013), then there is almost no logical limit on how far the agency could attempt to expand the reach of that power and every reason to expect that the CFPB will continue attempting to expand its UDAAP authority to more widely target violations of state law. This approach risks effectively arrogating to the CFPB the authority to usurp the states’ enforcement discretion over their own laws.

Businesses that may not be directly subject to the CFPB’s broad federal consumer financial authority should consider whether their conduct risks being construed as in violation of parallel state laws—potentially bringing them, at least in the agency’s view, under the CFPB UDAAP umbrella.

The lenders have not yet filed a response to the CFPB’s lawsuit.