California Legislature Passes "Mini-CFPB" Bill

If Governor Newsome signs the bill, effective January 1, 2021, the current California Department of Business Oversight (“DBO”) will be replaced by the DFPI. The DBO is currently responsible for regulations relating to financial institutions and providers of financial services, including banks, trust companies, credit unions, finance lenders, and residential mortgage lenders. After enactment of the CCFPL, the DFPI will assume the DBO’s roles, but will also regulate other California laws relating to debt collectors, credit reporting agencies, merchant cash advance companies, and fintech companies. The CCFPL applies to “covered persons,” which is defined as persons engaged in offering or providing consumer financial products or services, affiliates that act as service providers, and any “service provider” that engages in the offering or provision of its own consumer financial product or service. The CCFPL’s definition of “service provider,” mirroring Title 10 of the Dodd-Frank Act, means any person that provides a material service to a covered person in connection with the covered person’s offering or providing of a consumer financial product or service.

Interestingly, the CCFPL exempts from its coverage national banks, banks chartered by California or any other state, existing DBO licensees (other than payday lenders and student loan servicers), and other employees that are acting under the authority of another California state agency’s license, such as real estate brokers.

Under the CCFPL, the DFPI’s enforcement authority will mirror that of the CFPB’s authority under the Dodd-Frank Act. Title 10 of the Dodd-Frank Act gives the CFPB enforcement authority to prevent unlawful, deceptive, or abusive acts or practices (“UDAAP”). Similarly, the DFPI will have the power to take enforcement action against “covered persons” for UDAAP violations. Enforcement actions may include bringing a civil action, an administrative proceeding for a violation of the CCFPL, or issue a rule or final order under the CCFPL. Like the CFPB, the DFPI may seek broad relief for UDAAP violations, including rescission or reformation of contracts, refunds, restitution, disgorgement, compensation for unjust enrichment, damages, injunctive relief and civil money penalties. The DFPI will also have the authority to issue desist and refrain orders. There is a four-year statute of limitations from the date a violation is discovered for civil actions under the CCFPL, which is one year longer than under Title 10 of the Dodd-Frank Act.

It is important to note that state attorneys general already have authority to enforce (1) UDAAP violations under the Dodd-Frank Act, and (2) existing state law, which also penalizes unfair and deceptive acts or practices. Following adoption of this law, both the DFPI and the California Attorney General’s Office will have co-extensive authority over alleged UDAAP violations.

Whereas the DBO currently has only regulated certain financial transactions and state-licensed financial institutions, under the CCFPL, the DFPI will have broader authority to regulate and bring enforcement actions against a more diverse range of service providers, including fintech companies and debt collectors. The DFPI’s more expansive enforcement authority, coupled with dual-enforcement authority with the California Attorney General may lead to an increase in scrutiny and investigation of business transactions and practices in California.