Overview
I. Introduction
Increasing state scrutiny of consumer protection concerns is prompting providers of consumer finance products and services to take notice. As federal regulators—most notably the Consumer Financial Protection Bureau (CFPB or the Bureau)— adopt a less aggressive enforcement and rule writing posture, state attorneys general and regulators are stepping in to fill the gap. These energized actors have enforcement authority over a patchwork of state laws and rules—some of them new— in addition to existing federal laws and rules. This creates a complex and fragmented network of enforcement and regulatory priorities for market participants.
How will this intensifying state regulatory and enforcement environment develop? Recent actions in New York State are instructive examples: hiring former staff of federal agencies into state-government roles, initiating multi-state lawsuits to enforce consumer protection laws, and increasing state-level rulemaking and legislation. Each state, however, has its own priorities and political landscape, and clients should not expect a one-size-fits-all approach.
Still, there are some anticipated approaches, especially among Democrat-leaning states. Shortly before stepping down, former CFPB Director Rohit Chopra created a blueprint for aggressive state-led enforcement of federal consumer protection laws. That blueprint draws on an expansive interpretation of section 1042 of the Consumer Financial Protection Act (CFPA) to empower state attorneys general.1
This article describes the rising activity in state consumer protection enforcement, situates it in the context of the Biden-era CFPB framework, and describes emerging gaps given a weakened CFPB and key considerations for clients.
II. A Growing Role for State Enforcement
So far, early signs of a more assertive approach are most apparent in blue states: officials in New York have proposed new legislation and rules that would impact consumer finance products, and New York and California are both seeking to hire talent displaced by the Trump administration’s cuts to federal agencies like the CFPB. Interestingly, there is reason to think red-state enforcers may increase their scrutiny of financial institutions, especially given the prevailing populist sentiment.
a. Legislation and Rulemaking
In early March 2025, New York Attorney General Letitia James proposed to expand New York's consumer protection laws through the Fostering Affordability and Integrity through Reasonable Business Practices (FAIR Business Practices) Act.2 The bill would amend Article 22-A of the New York General Business Law, which protects New York consumers against deceptive business acts and practices. Most notably, the proposed changes would introduce an explicit prohibition on "unfair" or "abusive" business practices.3 The bill's definitions of "unfair" and "abusive" closely track those of the CFPA.4 Unfair practices are those that cause, or are likely to cause, "substantial injury which is not reasonably avoidable." Abusive practices are characterized as those that either interfere with a person’s ability to understand the terms of a product or service or that take advantage of a person's lack of knowledge of a product’s risks, a person's inability to protect their own interests, or a person’s reasonable reliance on another to act in their interests.5 These new provisions would significantly expand New York's consumer protection statute beyond its current prohibition of deceptive acts.6 If passed, the law would provide New York regulators with a broader mandate to pursue companies engaging in exploitative or harmful financial practices that may not meet the existing threshold for "deceptive" conduct under state law.
However, it is not clear how state courts would interpret "abusive" under state law. Although the term appears in the CFPA, few states' UDAP statutes cover abusive conduct. In a document summarizing CFPB recommendations for strengthening state-level consumer protections, the Bureau recommended that states incorporating "abusive" into their UDAP statutes include a rule of construction providing that "abusive" should be interpreted in a manner consistent with the CFPB's 2023 Policy Statement on Abusive Acts or Practices.7 State courts might also rely on caselaw interpreting "abusive" in CFPA cases; alternatively, they could adopt broader or narrower definitions of the term. Additionally, the CFPB, under Republican leadership, may opt to replace guidance defining "abusive" conduct, which would further bear on courts' interpretations.
Furthermore, New York's Department of Financial Services has proposed amendments to state regulations governing overdraft fees and insufficient funds charges.8 These amendments would cap the number of such fees an institution could charge, stipulate rules for transaction processing to prevent banks from processing in a manner designed to maximize overdraft fees and limit the circumstances in which an institution may charge overdraft fees.9 These regulations will significantly impact how banks and financial institutions handle deposit account transactions.10
b. Hiring
State regulators are also recruiting newly-available former federal employees to bolster their ranks. New York Governor Kathy Hochul announced new hiring initiatives for federal employees who were recently displaced due to mass federal government layoffs.11 Similarly, the California Department of Financial Protection and Innovation (DFPI) is recruiting to enhance its oversight of banks, fintech firms, and nonbank lenders.12 Former Bureau staff will also likely take jobs at non-government organizations focused on consumer protection and may participate in bringing private litigation to advance policy goals.13 These hiring trends presage an expanded capacity for investigations and enforcement actions against financial institutions that might have previously been pursued by federal agencies. The influx of talent provides more than just additional personnel; it provides states with personnel knowledgeable on federal consumer protection laws, under which states are now more inclined to bring actions.
c. Will This Be a Blue-State Phenomenon?
Blue states are clearly more focused on addressing the Trump Administration's retrenchment from numerous Biden-era CFPB positions. They have taken preliminary steps to strengthen consumer protection, as demonstrated by a coalition of state attorneys general from major markets like California and New York, which has filed an amicus brief in federal court to defend the Bureau.14
Although blue states seem to be gearing up for aggressive enforcement, consumer finance companies should not assume that Republican-led states will stand pat. For example, Arkansas and Utah recently enacted laws regulating earned wage access products. In 2023 and 2024, Florida enacted statutes prohibiting lending licensees from discriminating against customers based on factors such as political opinions, lawful ownership of a firearm, or support for combating illegal immigration, drug trafficking, or human trafficking.15There is also an emerging populist streak within the Republican party, exemplified by Senator Josh Hawley's co-sponsorship of legislation amending the Truth in Lending Act to cap credit card interest rates, a proposal that President Trump has supported on the campaign trail.16 This trend could result in heightened scrutiny by red-state attorneys general of consumer financial products and services.
Moreover, Republican state attorneys general may use enforcement of consumer protection laws as a lever to pressure firms in order to advance other agendas. For example, Texas Attorney General Ken Paxton has pursued investigations into whether pharmaceutical firms deceptively advertised drugs used for gender-affirming treatments and whether another pharmaceutical firm misrepresented the efficacy of its COVID-19 vaccine.17 Therefore, early and consistent engagement across the country and the political spectrum is essential for nationwide financial services firms to identify and respond to diverse concerns at the state level.
III. How Did We Get Here?
Under former Director Chopra, the CFPB took two significant steps to set out a framework for state enforcers to follow.
a. Step One: Interpretive Rule Affirming State Authority to Enforce Federal Law
First, in 2022, the Bureau promulgated an interpretive rule establishing a broad interpretation of section 1042 (codified at 12 U.S.C. § 5552) of the Consumer Financial Protection Act.18 This interpretative rule clarifies that section 1042 empowers state attorneys general to bring civil actions to enforce the statutory provisions of the CFPA and regulations enacted thereunder.19 This interpretation provides a broad sweep of authority: it includes CFPA subsection 1036(a)(1)(A) (codified at 12 U.S.C. § 5536(a)(1)(A)), which broadly prohibits any violation of a Federal consumer financial law.20
This action, in effect, deputizes state attorneys general with authority that exceeds the CFPB’s own—e.g., the CFPB cannot enforce the CFPA with respect to auto dealers.21 The statute also does not require that state agencies obtain permission from the CFPB prior to initiating an action. However, it allows the Bureau to intervene, remove the action to federal court, be heard on all matters in the action, and appeal any order or judgment.22
It’s important to note that section 1042 is not the only tool for state enforcement of federal consumer protection laws. For example, under California's unfair competition laws, officials such as city prosecutors, county counsels, or city attorneys may bring an action under California Business and Professions Code section 17200, which prohibits "any unlawful, unfair, or fraudulent business act or practice."23 California courts have interpreted this statute's scope broadly, allowing it to encompass practices forbidden by federal law, including those prohibited under the CFPA, especially because they are deemed abusive.24 California authorities may be more inclined to exercise this authority if they believe a federal regulator will act to address a potential violation.
b. Step Two: Consumer Protection Resources for Plaintiffs and Legislatures
As a second step, in January 2025, the Bureau and Mr. Chopra published three documents on state enforcement of federal law, described below. This initiative seems aimed at two goals: (1) providing state regulators with easy access to legal arguments justifying their aggressive enforcement of federal consumer protection laws; and (2) reminding participants in the consumer finance industry that, although federal agencies under the Trump administration may be dormant for an extended period of time, state regulators can step in when federal regulators step back.
The Compendium of Recent CFPB Guidance assembles documents—including compliance bulletins, advisory opinions, policy guidance, and other materials—published by the Bureau from October 2021 through January 2025.25 The decision to package these documents may stem from concerns that these could be removed from the Bureau's website, or out of a desire to provide resources reflecting the Bureau's "considered judgment, reasoning, knowledge, and expertise" to assist courts in understanding the meaning of consumer protection statutes.26 Regardless of the motivation, the Compendium offers a neatly-packaged resource for state enforcers (and the private bar) to assert consumer protection cases using interpretations of the law that are likely more plaintiff-friendly than those favored by the Bureau under the Trump administration. The CFPB could rescind guidance documents that were included in the Compendium. Users will need to confirm the continued validity of a resource before relying on it.
Additionally, the Bureau published a set of recommendations for strengthening state-level consumer protections.27 These include incorporation of a prohibition of "abusive" conduct in state UDAP statutes— a recommendation that officials in New York, see supra, have already embraced.28 Other recommendations are to revitalize private enforcement by weakening arbitration clauses, providing strong and enforceable consumer data and privacy rights, and creating bright-line prohibitions of junk fees.29 These recommendations could form the basis of a robust consumer protection platform for state-level political leaders. Industry actors should study them to understand how these recommendations might affect their business, and how they can engage with state legislative and executive officials to minimize impact where necessary.
Finally, in January 2025, Mr. Chopra and then-General Counsel of the CFPB Seth Frotman published an article in Harvard Law School's Journal on Legislation titled "State Enforcement as a Federal Legislative Tool."30 The article is a call to arms encouraging state attorneys general to take advantage of their authorities under section 1042. It reiterates the points made in the May 2022 interpretive rule and catalogs enforcement actions taken by state attorneys general under federal law.31 It also describes a "cooperative federalism" model, wherein states are empowered with even broader authority than the Bureau itself to enforce consumer protection laws.32 Chopra and Frotman argue that state enforcement agencies are more closely connected to the sources of potentially abusive behavior that occurs in their backyards.33
Perhaps most importantly, they suggest that the model of private and dual state-federal enforcement of consumer protection laws could serve as a model for other public policy challenges. These challenges, some of which are also of relevance to the consumer financial products industry, include market consolidation, artificial intelligence, and data privacy.34 The development of state enforcement in consumer protection over the next few years may foreshadow developments in other policy areas. Businesses that start adapting now to this new framework will be better positioned to adjust if and when it spreads to other areas.
IV. Potential Barriers to State Enforcement
a. Loper Bright?
After the CFPB issued the 2022 interpretive rule discussed above, the Supreme Court issued its opinion in Loper Bright Enterprises v. Raimondo, holding that courts must exercise independent judgment in determining the meaning of statutory provisions.35 The interpretive rule would not be subject to the Loper Bright standard because it is not a binding legislative rule. Instead, the less deferential Skidmore standard would apply, allowing, but not obligating, a court to consider the "body of experience and informed judgment": (expressed by the Bureau's interpretation) to the extent that the court finds it persuasive.36 There is also a possibility that the current CFPB could also easily withdraw the interpretive rule (which seems likely) and perhaps reissue it with a different gloss on the authority of state actors to enforce the provisions of the CFPA.37
However, a judge confronted with a cramped reading of a statute advanced by the present-day Bureau would be empowered by Loper-Bright to reach an independent determination regarding the statute’s meaning, even drawing on withdrawn Biden-era CFPB guidance as an analytical framework.
Notwithstanding the above, the CFPB still has authority to interpret federal consumer financial law and issue regulations. Firms and their counsel will have to be prepared to help courts sift through guidance issued by the CFPB (including guidance issued before the current administration that has not been rescinded) and determine whether it can be reconciled with varied interpretations advanced by state agencies. A deep understanding of federal consumer financial laws and close attention to enforcement of these laws nationwide at both federal and state levels will be essential to defending suits under those laws successfully.
b. Preemption
Although federal preemption may limit, to some extent, the states' ability to enforce consumer protection laws against national banks, it does not serve as a wholesale bar against state consumer protection actions.38
Under Cuomo v. Clearing House Ass'n, a state attorney general may sue a bank to enforce state law. So long as the attorney general acts pursuant to their authority to enforce the law, rather than to supervise the bank, such lawsuit is not preempted by the National Bank Act.39 Therefore, while a state attorney general's ability to serve in a visitorial role is limited by federal preemption,40 Cuomo likely precludes the argument that federal law prohibits the enforcement of state laws. The Office of the Comptroller of the Currency could expand the preemption of state law as applied to national banks through the notice-and-comment process, but it is not yet clear that the agency would do so. Even if it did, issuance of a reinterpretation of federal rules would be highly time-consuming, as an array of interested parties on both sides would likely submit detailed comments, allowing state actors to act under the prior ruleset.
V. Remaining Gaps and Possible Future State Action
The CFPB retains exclusive supervisory authority over insured depository institutions and credit unions with over $10 billion in total assets, limiting the ability of state attorneys general to examine or supervise them directly.41 Nonetheless, the CFPB's current withdrawal from supervision and enforcement leaves states with the burden of policing such financial institutions as well as overseeing state-chartered banks and many nonbank entities, both tech and non-tech enabled.
As a result, state regulators will likely increase scrutiny of entities they do examine to offset the decreased CFPB oversight, potentially leading to inconsistencies in regulatory expectations. Financial institutions should expect increased state-led audits and compliance reviews, particularly in jurisdictions like California and New York, where regulators have signaled a more aggressive enforcement posture.
In November 2024, the CFPB issued a final rule providing it with supervisory authority over large nonbank digital payments companies that meet certain size criteria (so-called "Larger Participants" of a market).42 This rule subjects major general-use consumer payment apps, as Larger Participants, to the CFPB's oversight. However, on April 9, 2025, the House of Representatives voted along party lines to approve a Senate-passed joint resolution under the Congressional Review Act (CRA) overturning the Larger Participants rule.43 President Trump is expected to sign the measure into law. Under the terms of the CRA, once the joint resolution is enacted, the Bureau may not reissue the disapproved rule in "substantially the same form," or issue a new rule that is "substantially the same."44 This restriction could hinder any future Bureau attempt to regulate this market. States may then perceive pressure to step in to address a perceived gap in supervision. State licensing regimes for other innovative financial products, such as earned wage access, buy now-pay later, and merchant cash advances, may also proliferate as states perceive the need to fill the regulatory gap left by the current CFPB’s oversight approach, or changes to the Bureau’s ability to regulate certain markets.
The federal pull-back from regulation means greater refraction in the regulatory prisms through which financial institutions view compliance. Firms should be shoring up strong relationships with state regulators and attorneys general. This is an opportune time to engage and educate on policy matters and to work through trade associations and organizations like the Conference of State Bank Supervisors to advance common-sense and more uniform approaches to state regulation. Firms should also consider reviewing regulatory obligations under state and federal law and ensuring change management processes track state law developments accurately and in real time. Although the retrenchment of the CFPB from federal consumer finance enforcement brings some relief to financial services firms, the increasing scrutiny by states — coupled with the risk that the pendulum swings back toward more aggressive federal enforcement in four years— makes it essential for institutions to keep a firm grip on compliance reins.
1 Authority of States to Enforce the Consumer Financial Protection Act of 2010, 87 Fed. Reg. 31940 (May 26, 2022) (interpreting 12 U.S.C. § 5552).
2 Press Release, New York Attorney General Letitia James, Attorney General James Takes Action to Protect New York Consumers and Small Businesses (Mar. 13, 2025) https://ag.ny.gov/press-release/2025/attorney-general-james-takes-action-protect-new-york-consumers-and-small. Bill text available at: https://ag.ny.gov/sites/default/files/2025-03/fostering-affordability-and-legislative-bill-drafting-commission-integrity-through-reasonable-business-practices-fair-business-practices-act-2025.pdf.
3 See N.Y Gen. Bus. Law FAIR Business Practices Act at § 349.
4 See 12 U.S.C. § 5531(c) and (d).
5 Id. at § 349(1) (unfair); (3) (abusive) (proposed).
6 N.Y. Gen. Bus. Law § 349. There is also a bill pending in California’s state legislature that would expand the scope of the UDAAP authority of California’s Department of Financial Protection and Innovation. See S.B. 825 (2025) https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB825.
7 Strengthening State-Level Consumer Protections: Promoting Consumer Protection Federalism. https://www.consumerfinance.gov/data-research/research-reports/strengthening-state-level-consumer-protections/ (referring to Policy Statement on Abusive Acts or Practices (Apr. 3, 2023) https://files.consumerfinance.gov/f/documents/cfpb_policy-statement-of-abusiveness_2023-03.pdf.
8 New York State Department of Financial Services, Amendments to 3 NYCRR Parts 32 and 6: Deposit Account Transactions and Associated Charges (Jan. 22, 2025) https://www.dfs.ny.gov/system/files/documents/2025/01/rppo-banking-3nycrr32and6.pdf.
9 See N.Y. Reg., Jan. 29, 2025, at 3 NYCRR § 32.3(b) (proposed) (limit on insufficient-funds fees); N.Y. Reg., Jan. 29, 2025, at 3 NYCRR § 32.2(a) (proposed) (transaction processing); N.Y. Reg., Jan. 29, 2025, at 3 NYCRR § 32.3(c) (proposed) (treatment of overdraft fees).
10 See also Stephen Aschettino, Benjamin Saul, Andrew Owens, and Tarrian Ellis, How Banks Can Prepare for NYDFS Overdraft Overhaul (Mar. 19, 2025) Law360 https://www.law360.com/fintech/articles/2300913/how-banks-can-prepare-for-nydfs-overdraft-overhaul.
11 Press Release, Office of Gov. Hochul, Governor Hochul: Federal Workers, Here in New York We Say You’re Hired (Feb. 2025), https://www.governor.ny.gov/news/governor-hochul-federal-workers-here-new-york-we-say-youre-hired.
12 See DFPI, Careers, https://dfpi.ca.gov/about/careers/.
13 See Katryna Perera, More CFPB Attys Departing Amid Agency Uncertainty, Law360 (Feb. 27, 2025) https://www.law360.com/articles/2303994/more-cfpb-attys-departing-amid-agency-uncertainty; The CFPB Under Threat: What’s Next for Colorado, Towards Justice https://towardsjustice.org/cfpb/ (last visited Apr. 2, 2025) (stating that Seth Frotman, former CFPB General Counsel, joined Towards Justice as a Senior Fellow).
14 Brief of Amici Curiae States of N.Y. et. al., Mayor and City Council of Baltimore v. CFPB, No. 25-cv-00458 (D. Md. Feb. 19, 2025) ECF No. 28.
15 Earned Wage Access Services Act, H.B. 1517 https://arkleg.state.ar.us/Home/FTPDocument?path=%2FACTS%2F2025R%2FPublic%2FACT347.pdf (the Arkansas law, signed into law on March 20, 2025) Earned Wage Access Services Act, H.B. 279 https://le.utah.gov/~2025/bills/static/HB0279.html (the Utah law, signed into law on March 25, 2025); Fla. Stat. § 516.037(2)(d).
16 S.381, 119th Congress (2025). See also Rob Copeland, Trump Promised a Cap on Credit Card Interest Rates. Here’s His Chance, New York Times (Feb. 4, 2025) https://www.nytimes.com/2025/02/04/business/credit-card-interest-cap.html.
17 Press Release, AG Paxton Investigates Potential Violations of State Law by Puberty-Blocking Drug Manufacturers (Mar. 24, 2022) https://www.texasattorneygeneral.gov/news/releases/ag-paxton-investigates-potential-violations-state-law-puberty-blocking-drug-manufacturers; Press Release, Attorney General Ken Paxton Sues Pfizer for Misrepresenting COVID-19 Vaccine Efficacy and Conspiring to Censor Public Discourse (Nov. 30, 2023) https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-pfizer-misrepresenting-covid-19-vaccine-efficacy-and-conspiring.
18 Authority of States to Enforce the Consumer Financial Protection Act of 2010, 87 Fed. Reg. 31940 (May 26, 2022).
19 87 Fed. Reg. 31940, 941 (citing 12 U.S.C. § 5552(a)(1)).
20 87 Fed. Reg. 31940, 41.
21 12 U.S.C. § 5519.
22 12 U.S.C. § 5552(b). There is even a provision at (b)(1)(B) allowing a state to provide notice after filing if prior notice is “not practicable.”
23 Cal. Bus. & Prof. Code § 17200 (prohibiting unfair acts and practices); Id. at 17204 (authorizing actions for relief by attorney general, district attorney, county counsel, and city attorneys).
24 See, e.g., Saunders v. Superior Court, 33 Cal. Rptr. 2d 438, 441 (Cal. Ct. App. 2d Dist., Div. 7, Aug. 16, 1994) ("Section 17200 defines unfair competition as 'any unlawful, unfair or fraudulent business act or practice....' The “unlawful" practices prohibited by section 17200 are any practices forbidden by law, be it civil or criminal, federal, state, or municipal, statutory, regulatory, or court-made.") (citation omitted).
25 Compendium of Recent CFPB Guidance, Jan. 14, 2025 https://www.consumerfinance.gov/compliance/compliance-resources/compendium-of-recent-cfpb-guidance/.
26 The cover letter to the Compendium notes that under Loper Bright Enterprises v. Raimondo, 603 U.S. 3689 (2024), courts may turn to agency interpretations to understand the meaning of statutes. Compendium at 2.
27 Strengthening State-Level Consumer Protections: Promoting Consumer Protection Federalism. https://www.consumerfinance.gov/data-research/research-reports/strengthening-state-level-consumer-protections/
28 Id. at 22.
29 Id. at 21-33.
30 Rohit Chopra & Seth Frotman, State Enforcement As A Federal Legislative Tool, 62 Harvard Law School J. on Legislation 1 (Jan. 15, 2025) https://journals.law.harvard.edu/jol/2025/01/15/state-enforcement-as-a-federal-legislative-tool/.
31 Id. at 21-22.
32 Id. at 20.
33 Id.at 26.
34 Id. at 37.
35 603 U.S. 369, 394.
36 Christensen v. Harris County, 529 U.S. 576, 587 (2000) (citing Skidmore v. Swift & Co., 323 U.S. 134, 140 (1944)).
37 See Perez v. Mortgage Bankers Ass’n, 575 U.S. 92, 101 (2015) (“Because an agency is not required to use notice-and-comment procedures to issue an initial interpretive rule, it is also not required to use those procedures when it amends or repeals that interpretive rule”).
38 See generally 12 C.F.R. §§ 7.4000-4010.
39 557 U.S. 519, 535-536 (2009).
40 12 C.F.R. §7.4000.
41 See 12 U.S.C. § 5515(b)(1).
42 See 89 Fed. Reg. 99582 (Dec. 10, 2024). See also Benjamin Saul, Tarrian Ellis, and Nathaniel Sans, CFPB Finalizes Federal Oversight of Digital Payment Apps (Nov. 25, 2024) https://www.steptoe.com/en/news-publications/cfpb-finalizes-federal-oversight-of-digital-payment-apps.html?tab=overview.
43 See S.J.Res. 28, 119th Congress (2025)
44 5 U.S.C. § 801(b)(2).
