On August 31, 2020, the California legislature passed the California Consumer Financial Protection Law (CCFPL). The law reflects Governor Newsom's vision of a much more powerful banking agency with new registration authority, UDAAP authority mirroring the authority of the CFPB, and expanded enforcement authority. But important amendments adopted by the legislature will exempt many regulated entities from the scope of the law and will impose limits on the new Department of Financial Protection and Innovation's (DFPI) exercise of its authority.
We discuss the reorganization and expansion of the banking regulator that accompanies the name change to the DFPI in our companion client alert. We highlight the key provisions of the CCFPL below.
Focus on Consumer Protection
Although most of the CCFPL comes directly from Dodd-Frank Act Title X, the statutory purpose differs from the purpose and objectives of Dodd-Frank. The legislative findings assert that "lack of [a dedicated financial services regulator with broad authority over providers of financial products and services] has left consumers vulnerable to abuse and forced California businesses to compete with unscrupulous providers."1 They refer to UDAAP and to discriminatory practices multiple times. They also refer to technological innovation that "offers great promise," but also "poses risks to consumer and challenges to law enforcement."2
In contrast, the objectives of Dodd-Frank Title X are much more balanced, referring to protecting consumers from UDAAP and discrimination, but also: (a) the need for consumers to have timely and understandable information to make responsible decisions; (b) the need to reduce unwarranted regulatory burdens; (c) consistent enforcement of federal consumer financial law to promote fair competition and transparency; and (d) efficient operation of markets for consumer financial products and services.3
Expanded Jurisdiction Bounded by Significant Exemptions
Since the proposed legislation was introduced, the DBO has consistently explained its view that the CCFPL would not change the regulatory landscape for state-chartered and state-licensed entities. This position is reflected in the version of the CCFPL passed by the legislature, which exempts national banks, banks chartered by California or any other state, and existing DBO licensees other than payday lenders and student loan servicers, from the CCFPL.4 The CCFPL also exempts licensees and their employees of any California state agency other than the DFPIwhere the licensee or employee is acting under the authority of the other state agency's license. For example, this should exempt real estate licensees under the Real Estate Law and their employees acting under those licenses.
The broad jurisdiction in the statute, then, applies almost exclusively to entities that previously were not licensed by the DBO.5 These entities must be "covered persons," which are persons engaging in offering or providing consumer financial products or services, affiliates that act as service providers, and any service provider that engages in the offering or provision of its own consumer financial product or service.6 As in Title X, a "service provider" is any person that provides a material service to a covered person in connection with the covered person's offering or providing of a consumer financial product or service.7
Whether an entity is a "covered person" depends on whether it offers or provides a "consumer financial product or service." The definition of "financial product or service" mirrors the broad definition in Title X, with the addition of brokering the offer or sale of a franchise in the state on behalf of another.8 As in Dodd-Frank, the CCFPL authorizes the DFPI to issue regulations defining any other financial product or service based on specified criteria.9
UDAAP Authority
The CCFPL gives the DFPI the same UDAAP authority that Dodd-Frank Title X gives the CFPB: The DFPI can take enforcement action against covered persons for UDAAP violations and can issue regulations regarding UDAAP.10
The CCFPL also allows the DFPI to bring proceedings pursuant to the Dodd-Frank Title X provisions authorizing state regulators to enforce Title X and any regulations promulgated by the CFPB pursuant to Title X.11 The DFPI can bring these proceedings against both covered persons under the CCFPL as well as existing DBO licensees, including California-licensed banks, savings and loans and credit unions, California Financing Law licensees, and California Residential Lending Act licensees.
The DFPI will have to give advance notice to the CFPB if it relies on this authority to bring actions against existing licensees. There is no similar requirement in the CCFPL for actions brought against covered persons that are not exempted.
The CCFPL authorizes the DFPI to prescribe rules defining UDAAP, which will apply to covered persons. The DFPI must interpret "unfair" and "deceptive" in accordance with Business & Professions Code section 17200 and cases interpreting that provision. The CCFPL defines "abusive" in the same way that it is defined under Dodd-Frank, and requires the DFPI to interpret the term consistently with Title X. Any inconsistency, though, is to be resolved in favor of greater protections and more expansive coverage.12
In the only provision in the law that does not concern consumers, the CCFPL authorizes the DFPI to define UDAAP in connection with the offering of commercial financing or other financial products and services to small businesses, nonprofits, and family farms.13
Registration and Reporting Requirements for Covered Persons
The DFPI can issue rules for registration of covered persons engaged in the business of offering or providing a consumer financial product or service, including requiring payment of registration fees.14 Registered covered persons, as well as those determined to be covered persons that are offering or providing financial products and services, are subject to reporting and examination.15
The DFPI, like the CFPB, may require a covered person to "generate, provide, or retain records" and to respond to written questions to facilitate supervision.16 The CCFPL also gives the DFPI the same authority as the CFPB to collect information from covered persons and service providers in conducting monitoring, regulatory, and assessment activity.17
Enforcement Authority
In addition to UDAAP, the CCFPL gives the DFPI authority to enforce consumer financial laws and recordkeeping and reporting violations with respect to covered persons, service providers, and aiders and abettors.18 This authority applies only to acts or practices engaged in after the operative date of the law.19
The CCFPL grants the DFPI investigatory and subpoena power. It authorizes the DFPI to bring a civil action or an administrative proceeding for violation of the CCFPL, rule or final order, or condition imposed in writing by the DFPI.20 The DFPI also has the option to issue desist and refrain orders for these violations, which are deemed final if the respondent does not request a hearing within 30 days.21
The DFPI also has the right to seek to revoke the license or registration of a covered person or service provider for violation of any law, rule, order, or any condition imposed by the DFPI. The DFPI also can file suit to enforce its orders.22
The DFPI may not outsource or delegate its enforcement authority to private attorneys.23
Statute of Limitations. The DFPI cannot bring a civil action under the CCFPL more than four years after discovering the violation. Historically, the DBO has taken the position that it is not bound by any statute of limitations, so the CCFPL provides some helpful guardrails. That said, the CCFPL provides one year more than Dodd-Frank Title X.24 Claims brought under a consumer financial law are covered by the applicable statute of limitations for that law.25
Remedies. Like the CFPB, the DFPI may seek broad relief for violation of UDAAP, including rescission or reformation of contracts, refunds, restitution, disgorgement or compensation for unjust enrichment, payment of damages, public notification of the violation, including the costs of notice, injunctive relief, and civil money penalties. Authorized relief does not include exemplary or punitive damages.26
The CCFPL authorizes very significant penalties for violation of its provisions and lists factors that the DFPI must take into account when determining the amount of any penalty.27
New Complaint Response Obligations
In provisions that mirror those in Dodd-Frank Title X, the CCFPL requires the DFPI to establish procedures for covered persons to provide a timely response to consumer complaints and specifies information covered persons must include in the response.28 This section does not apply to consumer reporting agencies, and the DFPI must promulgate regulations implementing the complaint response process before it can bring enforcement actions for failing to comply with the complaint response requirements.29
Transparency and Limits on Authority
The CCFPL requires the DFPI to prepare and post on its website an annual report discussing actions taken pursuant to the law, including rulemaking, enforcement, oversight, complaints, education, and research. The report also must discuss the activities of the Financial Technology Innovation Office. The commissioner must appear and report annually to the appropriate legislative committees regarding all activities pursuant to the CCFPL in the prior year.30
The CCFPL also includes several provisions that seem aimed at curbing the DBO's preference for regulating by enforcement and questions raised by the Legislative Analyst Office and others regarding the broad delegation of registration authority to the DFPI. The CCFPL requires the DFPI to issue regulations before it can bring enforcement proceedings regarding compliance with the complaint response procedures, the registration requirements, the recordkeeping requirements, and disclosures of the features of consumer financial products and services.31 The DFPI must promulgate rules regarding registration requirements no later than three years after initiating the second enforcement action to enforce a violation of the CCFPL by a person providing substantially similar consumer financial products or services. Those regulations in turn must be ratified by the legislature.32
Next Steps and Timing
Governor Newsom has until September 30, 2020 to sign the CCFPL into law. If he does, it will become effective on January 1, 2021.
Takeaways
Providers of financial products and services to California consumers should buckle their seatbelts. Through the reorganization, the DFPI will have increased funding to expand supervision and enforcement for California state-chartered banks and existing licensees. The CCFPL will expand the DFPI's jurisdiction to cover previously unlicensed entities. Although banks and most other current DBO licensees are exempt from the CCFPL, the DFPI may be influenced by the broad UDAAP and enforcement provisions of the CCFPL to adopt a more aggressive posture to these exempt institutions as well.
The dual focus on consumer protection and innovation will draw the DFPI's focus to FinTechs and bank partnerships. The DFPI will have the opportunity to create clear rules that will allow FinTechs and established financial institutions to compete on a level playing field, to partner in providing new products, and to expand access to credit.
Footnotes
1 Cal. Fin. Code § 90000. The CCFPL adds Division 24, commencing with Section 90000 to the Financial Code.
2 Cal. Fin. Code § 90000(a).
3 12 U.S.C. § 5511(b).
4 Cal. Fin. Code § 90002. The exemptions include licensees such as lenders, brokers, mortgage loan originators and program administrators under the California Financing Law, mortgage lenders, mortgage servicers, and mortgage loan originators under the California Residential Mortgage Lending Act, and money transmitters under the California Money Transmission Act.
5 Although supporters of the CCFPL repeatedly identified debt collectors as previously unlicensed entities that warranted the expanded authority provided by the proposed legislation, the legislature passed a separate law (SB 908) that requires licensing of debt collectors and grants the DFPI licensing, examination, investigatory, and enforcement authority over debt collectors.
6 Cal. Fin. Code § 90005(f).
7 Cal. Fin. Code § 90005(n); 12 U.S.C. § 5481(26)(A).
8 Cal. Fin. Code § 90005(k); 12 U.S.C. § 5481(15)(A), (B)(i).
9 Cal. Fin. Code § 90005(k)(12).
10 Cal. Fin. Code §§ 90012(a); 90009(c); 12 U.S.C. § 5531(a), (b).
11 Sec. 4 of the CCFPL, amending Cal. Fin. Code § 326(b).
12 Cal. Fin. Code § 90005(p).
13 Cal. Fin. Code § 90009(e). Thus, the California Legislature continues to expand consumer protections to certain providers of smaller commercial loans. See, e.g., Cal. Fin. Code § 22800, which governs commercial financing disclosures.
14 Cal. Fin. Code § 90009(a).
15 Cal. Fin. Code § 90010.
16 Cal. Fin. Code § 90009(b); 12 U.S.C. § 5514(b)(7)(B).
17 Cal. Fin. Code § 90009(f); 12 U.S.C. § 5512(c)(4).
18 Cal. Fin. Code §§ 90003, 90012(a); 12 U.S.C. § 5536. Note that the original version of the CCFPL would have given the DFPI jurisdiction to enforce a list of over 50 state and 20 federal "enumerated consumer financial laws." This lengthy list and the express grant of jurisdiction were deleted by amendment and are not included in the final version.
19 CCFPL Section 9.
20 Cal. Fin. Code §§ 90011(a), 90012, 90013.
21 Cal. Fin. Code § 90015(d).
22 Cal. Fin. Code § 90015(f), (g).
23 Cal. Fin. Code § 90016.
24 Compare Cal. Fin. Code § 90014(a) and 12 U.S.C. § 5564(g)(1).
25 Cal. Fin. Code § 90014.
26 Cal. Fin. Code §§ 90012(b), 90013(d).
27 Cal. Fin. Code § 90012(c)(1).
28 Cal. Fin. Code § 90008; 12 U.S.C. § 5534.
29 Cal. Fin. Code §§ 90008(c), (d)(3), (e).
30 Cal. Fin. Code §§ 90018, 90009.5(d).
31 Cal. Fin. Code §§ 90008(e); 90009(d).
32 Cal. Fin. Code § 90009.5.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Morrison & Foerster LLP. All rights reserved
