On Monday, August 31, the California Legislature passed Assembly Bill 1864, which enacts the California Consumer Financial Protection Law (CCFPL) and changes the name of the Department of Business Oversight (DBO) to the Department of Financial Protection and Innovation (DFPI).
Key takeaways
- Establishes UDAAP authority for the new DFPI, adding “abusive” to “unfair or deceptive” acts or practices prohibited by California law, and authorizing remedies similar to those provided in the Dodd-Frank Act. The DFPI also has authority to define UDAAPs in connection with the offering or provision of commercial financing (e.g., merchant cash advance, lease financing, factoring) and other financial products or services to small business recipients, nonprofits, and family farms.
- Authorizes the DFPI to impose penalties of $2,500 for “each act or omission” in violation of the law without a showing that the violation was willful, which, arguably, represents an enhancement of DBO’s existing enforcement powers in contrast to Dodd-Frank and existing California law. The new law also includes enhanced penalties for “reckless” violations of up to $25,000 per day or $10,000 per violation. For “knowing” violations, the penalty may be up to $1,000,000 per day or 1% of the violator’s net worth (whichever is less) or $25,000 per violation.
- Exempts from the DFPI’s new UDAAP authority, banks, credit unions, federal savings and loan associations, and similar entities, as well as current licensees of the DBO and licensees of other California agencies, “to the extent that licensee or employee is acting under the authority of” the license.
- Creates a “registration” requirement (subject to the DFPI’s implementing regulations) that greatly expands the reach of the DFPI to oversee entities that are not currently subject to licensure/registration. Businesses that could potentially be subject to the new law include service providers (including affiliated entities) that offer their own or integrated financial products or services, and entities that provide payment or other financial data processing products or services to consumers by any technological means, among others. Note that debt collectors may soon become subject to new licensure requirements under separate legislation awaiting the governor’s signature.
- Provides DFPI with broad discretion to determine what constitutes a “financial product or service” within the law’s coverage, including by a regulation finding that the financial product or service is either: “(A) Entered into or conducted as a subterfuge or with a purpose to evade any consumer financial law,” or “(B) Permissible for a bank … to offer or provide … [but] has, or likely will have, a material impact on consumers,” with certain enumerated exclusions.
- Provides that administration of the law will be funded through the fees generated by the new registration process and other funds generated from fines, penalties, settlements, or judgments.
Background
The CCFPL was initially proposed in January as a trailer bill to California Governor Gavin Newsom’s proposed 2020-2021 state budget (previous Buckley coverage here and here). On June 29, Newsom signed SB 74, Budget Act of 2020 (and accompanying budget summary), which allocated $10.2 million in 2020-2021, growing to $19.3 million in 2022-2023, to the Department of Business Oversight, contingent on the enactment of the CCFPL. On September 2, the California legislature passed SB 115, which amended the Budget Act of 2019 and the Budget Act of 2020, to, among other things, update the budget allocated to DFPI. SB 819 and AB 1864 amend the trailer bill introduced in conjunction with the governor’s proposed budget. (Previous Buckley coverage of the trailer bill released on January 31 can be found here).
The stated purpose of the CCFPL is to promote consumer welfare, fair competition, and wealth creation by promoting (i) nondiscriminatory access to responsible, affordable credit on terms that reasonably reflect consumers’ ability to repay and consumer financial products and services that are understandable and not unfair, deceptive, or abusive (UDAAP); (ii) protecting consumers from discrimination and unfair, deceptive, or abusive acts or practices in connection with financial practices and services; and (iii) promoting nondiscriminatory consumer-protective innovation in consumer financial products and services.
Detailed overview
The CCFPL seeks to create a stronger consumer protection authority in California akin to that of the Consumer Financial Protection Bureau (CFPB) through the following:
- DBO’s name change. The CCFPL changes the name of the DBO and transfers all its power, responsibilities, and functions to the newly created DFPI. Notwithstanding the change, all previous actions, proceedings, permits, or other acts of the DBO, and all previous position appointments by the governor to the DBO, will remain in effect under the DFPI.
- UDAAP authority. The CCFPL expands the DFPI’s UDAAP authority by adding a prohibition on “abusive” acts or practices to California law, and by authorizing the DFPI to prescribe rules that apply to any covered person or service provider identifying as unlawful, unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The DFPI also has authority to define UDAAPs related to the offering or provision of commercial financing (e.g., merchant cash advance, lease financing, factoring) and other financial products or services to small business recipients, nonprofits, and family farms. DFPI is directed to interpret: (i) “unfair” and “deceptive” consistent with Section 17200 of the Business and Professions Code and the case law thereunder and (ii) “abusive” consistent with Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (12 U.S.C. § 5481), although any inconsistency is to be resolved in favor of greater protections to the consumer and more expansive coverage. The rules must consider the relative harm to the consumer, the frequency of the act or practice in question, and whether the act or practice is unintentional or stems from a technical, clerical, or nonmaterial error. Companies offering financial products and services in California should expect an increase in DFPI oversight and enforcement in the coming years.
If a covered person or service provider is found to have engaged in a UDAAP with respect to a consumer financial product or service, DFPI may request the following relief: (i) rescission or reformation of contracts, (ii) refund of moneys or return of real property, (iii) restitution, (iv) disgorgement or compensation for unjust enrichment, with any disgorged amounts returned to the affected consumers, to the extent practicable, (v) payment of damages or other monetary relief, (vi) public notification regarding the violation, including the costs of notification, (vii) limits on the activities or functions of the person, and (viii) monetary penalties. For civil or administrative actions, the following penalty amounts apply: (i) for any violation, a penalty not to exceed the greater of either $5,000 for each day during which the violation or failure to pay continues, or $2,500 for each act or omission in violation; (ii) for any reckless violation, a penalty not to exceed the greater of $25,000 for each day during which the violation continues, or $10,000 for each act or omission in violation; and (iii) for any knowing violation, a penalty not to exceed the lesser of 1% of the person’s total assets, $1,000,000 for each day during which the violation continues, or $25,000 for each act or omission in violation.
- Enforcement authority. The commissioner has authority to initiate a civil action or other appropriate proceeding against an entity licensed or subject to regulation by DFPI pursuant to 12 U.S.C. § 5552, which preserves the right of any appropriate state regulator to enforce the provisions of the Consumer Financial Protection Act of 2010 (12 U.S.C. § 5481 et. seq.) or applicable regulations issued by the federal CFPB. This revision subjects the DFPI to the notice and consultation requirements of 12 U.S.C. § 5552, when enforcing relevant federal law provisions against covered persons and service providers. This version of the law also removes DFPI’s authority to employ a private attorney to act as the attorney for the commissioner in actions or proceedings, which some viewed as potentially providing authority to attorneys that may not be bound by the same rules as the commissioner.
The law provides that after exhausting administrative review, the commissioner may apply to the appropriate superior court for an order compelling the cited licensee or person to comply with the orders of the commissioner.
- Exemptions. Although the law increases DFPI’s authority over covered persons, it also expands the list of individuals and entities that are exempt from the CCFPL, which now includes: (i) licensees and employees of licensees of any state agency other than DFPI, when acting under the authority of the other state agency’s license, and (ii) persons or employees of persons who are acting under the authority of one of the following licenses, certificates, or charters issued by the DFPI:
- An escrow agent under the Escrow Agents Law
- A finance lender, broker, program administrator, or mortgage loan originator under the California Financing Law
- A broker-dealer or investment adviser under the Corporate Securities Law of 1968
- A residential mortgage lender, servicer, or originator under the Residential Mortgage Lending Act
- A check seller, bill payer, or prorater under the Check Sellers, Bill Payers, and Proraters Law
- A capital access company under the Capital Access Companies Law
- Doing business under a license, charter, or certificate issued under the Financial Institutions law.
- Registration requirements. The CCFPL creates “registration requirements applicable to covered persons engaged in the business of offering or providing a consumer financial product or service, including requiring a filing be made under oath, and requiring the payment of registration fees.” As part of this requirement, the DFPI may prescribe rules requiring covered persons subject to its jurisdiction to register through the Nationwide Multistate Licensing System and Registry (NMLS). However, DFPI may not require registration through NMLS or payment of fees by any of the following:
- A covered person who is licensed by DFPI under another law, who is providing a financial product or service within the scope of that license
- A covered person who is licensed or registered by another agency, unless that person is providing a product or service that is not regulated by the agency licensing the covered person
- A covered person who is licensed by DFPI or a federal agency who engages in deposit-taking activity, unless the covered person is offering or providing a financial product or service that is not regulated by the agency licensing the covered person.
- Discretion to define what constitutes a financial product or service. The CCFPL not only augments the DFPI’s enforcement authority over any violations of the law, but also grants DFPI broad discretion to determine what constitutes a “financial product or service” within its coverage, by determining that a financial product or service is either: “(A) Entered into or conducted as a subterfuge or with a purpose to evade any consumer financial law,” or “(B) Permissible for a bank … to offer or provide … [but] has, or likely will have, a material impact on consumers,” with certain enumerated exclusions. This increase in authority and rulemaking power gives DFPI greater oversight over financial service providers in California.
- Consumer complaint responses. The law requires the DFPI to establish by rule procedures for covered persons to provide a timely response to the DFPI, in writing where appropriate, to consumer complaints or inquiries. The DFPI is prohibited from enforcing such requirements against any covered person or service provider until the DFPI has promulgated implementing regulations. However, the CCFPL exempts consumer reporting agencies, as defined by the Fair Credit Reporting Act, that also meet the definition of “Covered Persons” under the CCFPL, from this requirement.
- Establishing a new Financial Technology Innovation Office in San Francisco (Innovation Office): DFPI is tasked with establishing a Financial Technology Office and: (i) “investigat[ing], research[ing], analyz[ing], and report[ing] on markets for consumer financial products or services”; (ii) “develop[ing] and implement[ing] outreach and education programs to underserved consumers and communities;” and (iii) “develop[ing] and implement[ing] initiatives to promote innovation, competition, and consumer access within financial services.”
- Joint authority/cooperation with other agencies. The amended text maintains that DFPI must consult with another agency that has joint authority before promulgating regulations and clarifies that DFPI is prohibited from amending or rescinding any regulation promulgated by another department or agency.
With respect to coordination with the California attorney general, the amended text provides that the provisions of the division, any regulation or order, or any agreement must not limit: (i) the powers or authorities of the AG including, but not limited to, the AG’s ability to prosecute violations of civil or criminal laws; or (ii) the rights of any consumer or the obligation of any covered person or service provider, under the Unfair Competition Law, the False Advertising Law, or any consumer financial law. However, these provisions are not to be construed to limit the authority of DFPI to cooperate with any regulatory or law enforcement body and DFPI must notify other regulatory agencies that will be impacted by DFPI’s actions.
The law also does not limit the ability of the district attorney or any city attorney lawfully permitted to bring actions under the Unfair Competition Law.
- Rules that apply to covered persons. The amendments require DFPI to enact rules regarding the registration of covered persons no later than three years following the initiation of its second action to enforce a violation by persons providing the same or substantially similar consumer financial products or services as covered persons. Additionally, the regulation requiring a covered person to register with DFPI will become inoperative on January 1 of the calendar year that is four years following the initial year of required registration, unless the legislature extends the registration requirements or incorporates the scope of the activity in which the covered person is authorized to engage into a new or existing licensing law.
- Funding the DFPI. The CCFPL provides that all money collected or received by the commissioner under the law will be deposited in the Financial Protection Fund for the purpose of administering the CCFPL. This includes funds obtained through the enforcement of any law administered by the DFPI, whether through fines, penalties, settlements, or judgments. The DFPI also will have the authority to set and collect an annual registration fee for entities requiring registration and to collect the cost of every inspection and examination of a covered person.
- Reporting by the commissioner. The DFPI commissioner at least annually must present to appropriate legislative committees, among other things (i) a review of activities it conducted to implement the CCFPL; (ii) a summary of enforcement actions; (iii) a summary of the business models used among covered persons; (iv) a review of proposed or finalized regulations; (v) a review of all activities it engaged in the past year under its authority under specific sections; (vi) a summary of outreach efforts; and (vii) information on any other topic the commissioner or legislative committee deems relevant.
If you have any questions regarding the California Consumer Financial Protection Law or other related issues, please contact an Orrick attorney with whom you have worked in the past.