On Aug. 2, 2023, California’s Department of Financial Protection and Innovation (DFPI) released a new rule expanding its authority to regulate unfair, deceptive, and abusive acts and practices (UDAAP). The rule implements Section 90009(e) of the California Consumer Financial Protection Law (CCFPL), which authorizes the DFPI to issue rules defining UDAAPs for commercial financing. This rule strictly defines UDAAP concerning commercial financing and authorizes the DFPI to include in its UDAAP rulemaking requirements for data collection and reporting on the provision of commercial financing or other financial products and services.
Background
On Sept. 25, 2020, California Gov. Gavin Newsom signed into law the CCFPL. The CCFPL transformed California’s Department of Business Oversight into the DFPI, with the stated goal of strengthening consumer protections and promoting access to responsible credit. The CCFPL expands the powers of the DFPI, granting the department broad authority to regulate financial products and services and is modeled after the Dodd Frank Act (DFA).
Under the CCFPL, the DFPI has expanded authority to oversee financial service and product providers it did not previously regulate. These include but are not limited to credit repair and consumer credit reporting companies, debt relief companies, debt collectors, and private, for-profit school funding.
Key Aspects of the Rule
- Establishment of UDAAP Authority for the DFPI: The rule not only defines and prohibits UDAAP but also grants the DFPI new authority to govern “abusive” acts along with “unfair” or “deceptive” practices, similar to the provisions in the DFA applicable to consumer transactions. It includes the power to define UDAAPs in connection with various commercial financing offerings, such as merchant cash advance, lease financing, factoring, and more, to small business recipients, nonprofits, and family farms.
- Authorization of Enhanced Penalties: The DFPI is authorized to impose penalties of $2,500 for “each act or omission” without proving a willful violation. This enhancement over existing enforcement powers also includes increased penalties for “reckless” violations of up to $25,000 per day or $10,000 per violation, and for “knowing” violations the penalty may go up to $1,000,000 per day or 1% of the violator’s net worth (whichever is less), or $25,000 per violation.
- Exemptions from DFPI’s UDAAP Authority: Notably, banks, credit unions, federal savings and loan associations, and similar entities, along with current licensees of the DFPI and licensees of other California agencies, are exempted “to the extent that licensee or employee is acting under the authority of” the license.
- Registration Requirement: The rule creates a registration requirement subject to the DFPI’s implementing regulations, expanding the DFPI’s oversight reach. Entities that might be affected include service providers offering their financial products or services and businesses involved in payment or financial data processing.
Annual Reporting Requirements
Covered providers that engage in more than five commercial financing transactions to covered entities in 12 months must file an annual report electronically by March 15 of each year, beginning in 2025. The report must include detailed information on the type and amount of commercial financing transactions, contact information, annual percentage rates, and more.
Takeaways
This regulation significantly reshapes the commercial financing sector in California by introducing new reporting requirements and restrictions on unfair and deceptive practices and enhancing enforcement mechanisms. While DFPI’s authority to enact such regulations is granted by statute, several aspects may be concerning for industry stakeholders. Businesses that fall under the category of covered entities or providers should act to comply with these new requirements. Businesses should be aware of this framework to ensure it is incorporated into their compliance management frameworks. Businesses may also wish to confirm terms and conditions of products are accurately represented by reviewing promotional materials, ensure all disclosure and business customer-facing documents use plain language where possible, and implement or enhance customer-complaint handling processes to address customer concerns to mitigate risks.
This regulation becomes effective Oct. 1, 2023