State Payments Enforcement Trends

Since 2024, the payments enforcement landscape has shifted markedly. As the CFPB has curtailed its enforcement program under the current administration, state attorneys general have increasingly coordinated investigations, settlements, and policy initiatives targeting payment companies. For payment providers, banks, and fintechs, the result is a more fragmented enforcement environment in which the same practices may attract scrutiny from multiple states applying different laws and policy priorities.

State Attorneys General Expand Payments Enforcement

Despite the reduced federal enforcement posture, state attorneys general and other state enforcement agencies continue to pursue payment providers under state consumer-protection, unfair-or-deceptive-practices, anti-fraud, and related authorities. Increasingly, these actions are coordinated through multistate coalitions.

Multistate Coalitions

Multistate coalitions allow participating states to pool investigative resources, coordinate civil investigative demands, negotiate common settlement terms, and seek consistent injunctive relief across jurisdictions. For companies, this model can substantially increase enforcement leverage because a single investigation may involve dozens of sovereign regulators and result in obligations applicable across much of the country.

A significant recent example in the payments context is the July 2026 multistate settlement between Block, Inc. and Texas Attorney General Ken Paxton, together with 45 other state attorneys general.[1] The $45 million settlement resolved allegations that Block misrepresented the safety of Cash App and failed to provide consumers with fraud protections and error-resolution procedures consistent with its representations and applicable law.

The settlement is notable for the detailed operational obligations imposed through the agreed judgment. Block must maintain a compliance management program addressing unauthorized electronic fund transfers, provide appropriate training to personnel responsible for investigating consumer disputes, and maintain procedures designed to ensure prompt, thorough, and reasonable investigations of reported errors. These provisions illustrate how multistate settlements can be used not only to resolve alleged past violations, but also to impose prospective expectations concerning payment-platform governance and operations.

The settlement also demonstrates the continued relevance of Regulation E to state enforcement. Although Regulation E is a federal regulation, alleged deficiencies involving unauthorized-transfer investigations, error resolution, consumer disclosures, and related controls may also support claims under state consumer-protection laws. The prospective requirements imposed on Block—including compliance-management structures, documented fraud controls, training, complaint oversight, and testing of error-resolution procedures—provide a useful indication of the controls state enforcers may expect from other peer-to-peer payment providers, digital wallets, and payment platforms.

Participation in a multistate settlement may not eliminate state-specific enforcement exposure. Although the Washington Attorney General's Office participated in the multistate Block settlement, it separately investigated and resolved allegations involving fraudulent transfers of unemployment benefits into Cash App accounts from the Washington Employment Security Department during the COVID-19 pandemic.[2] The Washington matter demonstrates that a participating state may pursue additional relief based on state-specific conduct, affected consumers, or distinct legal theories notwithstanding its participation in a broader coalition resolution.

Separate state actions reinforce the same broader trend. In December 2025, the Hawaii Department of Commerce and Consumer Affairs Office of Consumer Protection announced a $6 million settlement with PayPal resolving allegations involving fraud protections, access to customer funds, privacy practices, and other aspects of the PayPal and Venmo platforms.[3] On the same day, the New Hampshire Attorney General announced a separate $1.75 million settlement with PayPal concerning alleged unfair and deceptive practices involving the operation and advertising of those platforms.[4] Although resolved independently rather than through a single multistate settlement, the matters illustrate another form of coordinated state risk: substantially similar practices may generate parallel proceedings that must be managed and resolved separately.

Beyond Enforcement Actions: Coordinated State Policy Initiatives

In the payments context, multistate letters and notices increasingly seek to enlist payment networks and platforms in addressing activity that state officials view as unlawful or harmful. Recent examples include:

• E-cigarettes. A coalition of 25 states, territories, and the City of New York sent a joint letter urging major payment networks, card issuers, payment processors, and payment platforms, including Visa, Mastercard, American Express, Capital One, PayPal, Stripe, and others, to prevent their payment networks from being used to facilitate sales of illegal e-cigarette and vaping products.[5]
• Firearms. A coalition of 11 attorneys general issued a letter supporting a decision by Visa, Mastercard, and American Express to adopt a new merchant category code for the sale of firearms and ammunition in an effort to combat gun violence.[6] The initiative illustrates that coordinated efforts to influence payment network policies have become an established tool that for state attorneys general that transcends changes in federal enforcement priorities.
• Deepfake exploitation. A bipartisan coalition of 47 state and territory attorneys general issued formal letters to financial companies, such as Visa, Mastercard, American Express, PayPal, Apple Pay, and Google Pay, "to take more decisive action against the proliferation of computer-generated nonconsensual intimate imagery…."[7] The letter, which was also addressed to search platforms like Google, Microsoft, and Yahoo, specifically requested that payment platforms "outline how they identify and remove payment authorization for deepfake…content and commit to proactive enforcement of their terms of service to prevent monetization of this content."[8]

These initiatives are nonbinding, but they illustrate a broader development: state attorneys general increasingly view payment networks and platforms not merely as regulated financial-services providers, but also as potential control points for addressing unlawful or harmful conduct by third-parties. This creates a distinct compliance challenge because decisions concerning merchant access, transaction monitoring, acceptable-use policies, and enforcement of platform terms may attract scrutiny from state officials with competing policy objectives.

Takeaways

Reduced federal enforcement should not be equated with reduced payments-enforcement risk. Multistate coalitions can investigate national payment platforms, negotiate substantial monetary resolutions, and impose detailed prospective compliance obligations. At the same time, individual states may pursue parallel or supplemental matters based on state-specific conduct or legal theories.

Payments companies therefore should monitor not only statutory and regulatory requirements, but also multistate settlements, attorney general letters, and other state initiatives as indicators of emerging enforcement expectations. This is particularly important at the product-design stage: controls adopted to address one jurisdiction's concerns—whether involving fraud, transaction access, merchant activity, or platform policies—may create different legal, operational, or policy risks in other jurisdictions. State enforcement risk should therefore be considered when designing products and controls, rather than only after a state investigation has begun.

[1] Press Release, Attorney General Ken Paxton Secures $45 Million Settlement with Cash App for Victims Exposed to Fraud and Deceptive Safety Claims, Tex. Off. of the Att’y Gen. (July 8, 2026), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-45-million-settlement-cash-app-victims-exposed-fraud-and.

[2] See Press Release, Block Inc., owner of Cash App, settles two disputes with WA, Wa. State Off. of the Att’y Gen. (July 8, 2026), https://www.atg.wa.gov/news/news-releases/block-inc-owner-cash-app-settles-two-disputes-wa.

[3] DCCA News Release, Hawai’i Office of Consumer Protection Announces $6 Million Settlement with PayPal, Haw. Off. of the Governor (Dec. 22, 2025), https://governor.hawaii.gov/newsroom/dcca-news-release-hawai%CA%BBi-office-of-consumer-protection-announces-6-million-settlement-with-paypal/.

[4] Press Release, Attorney General Formella Announces $1.75 Million and Injunctive Relief Settlement with PayPal, Inc. and PayPal Holdings, Inc. Concerning Unfair and Deceptive Practices, N.H. Dep’t of Justice (Dec. 22, 2025), https://www.doj.nh.gov/news-and-media/attorney-general-formella-announces-175-million-and-injunctive-relief-settlement.

[5] See Press Release, Attorney General Sunday Leads Bipartisan Effort Calling on Credit Card Companies, Payment Apps to Curb Sales of Illegal Vaping Products, Pa. Off. of the Att’y Gen. (Apr. 28, 2026), https://www.attorneygeneral.gov/taking-action/attorney-general-sunday-leads-bipartisan-effort-calling-on-credit-card-companies-payment-apps-to-curb-sales-of-illegal-vaping-products/.

[6] See Press Release, AG Racine Leads 11 State Attorneys General in Backing Decision by Visa, Mastercard, & Amex To Adopt New Credit Card Code for Gun & Ammunition Sales, D.C. Off. of the Att’y, Gen. (Sep. 30, 2022), https://oag.dc.gov/release/ag-racine-leads-11-state-attorneys-general-backing.

[7] Press Release, State and Territory Attorneys General Urge Tech and Payment Platforms to Address Deepfake Exploitation, Nat'l Ass’n of Att’ys Gen. (Aug. 26, 2025), https://www.naag.org/press-releases/state-and-territory-attorneys-general-urge-tech-and-payment-platforms-to-address-deepfake-exploitation/.

[8] Id.