4 October 202010 minute read

California enacts consumer financial protection legislation and establishes the Department of Financial Protection and Innovation

On September 25, 2020, California Governor Gavin Newsom signed into law a triad of consumer financial services legislation: AB 1864 (establishing the Department of Financial Protection and Innovation), AB 376 (establishing a Student Borrower Bill of Rights), and SB 908 (establishing a licensing law that regulate debt collectors).  This new legislation and the creation of California’s new financial services regulator will greatly expand the regulatory burden and scrutiny on consumer financial services providers in California.


AB 1864, the California Consumer Financial Protection Law (CCFPL), expands the authority of the Department of Business Oversight (DBO) and renames it the Department of Financial Protection and Innovation (DFPI).  CCFPL goes into effect on January 1, 2021, replacing California’s current regulator, the Department of Business Oversight (DBO).

DFPI is modeled after the federal Consumer Financial Protection Bureau (CFPB) and has broad subject-matter jurisdiction over the financial services industry, including expanded authority to oversee important sectors such as debt collectors, credit reporting agencies and FinTech companies.

By passing CCFPL and expanding the DFPI, the Legislature intended to strengthen consumer protections by improving accountability and transparency in the California financial system, providing for consumer financial education, protecting consumers from abusive financial practices, and preventing business practices that could harm the most vulnerable populations including military service members, seniors, students, low- and moderate-income individuals, and new Californians.

Prohibited acts and exemptions

Establishing a structure and regulatory powers similar to the federal CFPB, the CCFPL makes it unlawful for Covered Persons or Service Providers to:

  1. Engage, have engaged, or propose to engage in any unlawful, unfair, deceptive, or abusive act or practice (UDAAP) with respect to consumer financial products or services
  2. Offer or provide to a consumer any financial product or service not in conformity with any consumer financial law or otherwise commit any act or omission in violation of a consumer financial law or
  3. Fail or refuse, as required by a consumer financial law or any rule or order issued by the DFPI, to permit DFPI from accessing or copying records, establish or maintain records, or make reports or provide DFPI with information.

The department must interpret "unfair" and "deceptive" consistently with Section 17200, et seq. of the Business and Professions Code and case law thereunder. The term "abusive" must be interpreted consistently with Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (12 U.S.C. Sec. 5481). Any inconsistency shall be resolved in favor of greater protections to the consumer and more expansive coverage. 

CCFPL broadly defines "Covered Persons" as:

  1. Any person that engages in offering or providing a consumer financial product or service to a resident of this state.
  2. Any affiliate of a person described in this subdivision if the affiliate acts as a service provider to the person.
  3. Any service provider to the extent that the person engages in the offering or provision of its own consumer financial product or service.

The term "Service Provider" is also broadly defined as any person that provides a material service to a covered person in connection with the offering or provision by that covered person of a consumer financial product or service, including a person that either:

  1. participates in designing, operating, or maintaining the consumer financial product or service or 
  2. processes transactions relating to the consumer financial product service, other than unknowingly or incidentally transmitting or processing financial data in a manner that the data is undifferentiated from other types of data of the same form as the person transmits or processes.

The DFPI is designed to have far-reaching authority to determine what constitutes a "financial product or service" within its coverage, thereby increasing DFPI’s oversight authority over financial service providers in California.

The statute expressly exempts from its coverage finance lenders, broker-dealers, residential mortgage lenders, mortgage servicers, mortgage originators, check sellers and "a bank, bank holding company, trust company, savings and loan association, savings and loan holding company, credit union, or an organization subject to oversight of the Farm Credit Administration, when acting under the authority of a license, certificate, or charter under federal law or the laws of another state."

Regulatory and enforcement powers and duties

DFPI is permitted to take enforcement actions and issue regulations against covered persons for UDAAP and other consumer financial law violations.

DFPI has the power to bring administrative and civil actions, issue subpoenas, promulgate regulations, hold hearings, issue publications, conduct investigations, and implement outreach and education programs.  It also holds the authority to bring a civil action or other appropriate proceeding pursuant to Dodd-Frank Title X provisions preserving the enforcement powers of states.

Relief includes the rescission or reformation of contracts, refund of moneys or return of real property, restitution, disgorgement or compensation for unjust enrichment, public notification, or monetary damages and penalties.

CCFPL also grants DFPI the authority to "prescribe rules regarding registration requirements applicable to a covered person engaged in the business of offering or providing a consumer financial product or service, including requiring a filing be made under oath, and requiring the payment of registration fees. The department may require registration through the Nationwide Multistate Licensing System and Registry."  The statute, however, enumerates several exemptions.

CCFPL requires that DFPI take specific actions.  First, DFPI must establish the procedures for covered persons to provide a timely response to the DFPI, in writing where appropriate, to consumer complaints against, or inquiries concerning, a covered person.  CCFPL prohibits DFPI, however, from enforcing such requirements before DFPI has promulgated implementing regulations.  Consumer credit reporting agencies subject to section 1785.10 of the California Civil Code are also exempt from this requirement.

Second, DFPI must establish the Financial Technology Innovation Office, which may (i) investigate, research, analyze, and report on markets for consumer financial products or services; (ii) develop and implement outreach and education programs to underserved consumers and communities; and (iii) develop and implement initiatives to promote innovation, competition, and consumer access within financial services.


Although banks and most other current DBO licensees are exempt from the CCFPL, providers of financial products and services to Californians must be on alert and monitor how DFPI chooses to exercise its authority when the CCFPL becomes effective on January 1, 2021. The broad UDAAP and enforcement provisions may influence DFPI to adopt an aggressive posture to both covered and exempt entities and could result in "rule making by enforcement" in some instances.  The DBO, soon to be DFPI, will be gaining authority over significantly more California financial service providers, the ability to enforce consumer finance laws, and a substantially increased rulemaking authority.  Furthermore, regulated financial services providers in California may also see coordinated regulatory investigations involving the DFPI and regulators of other states or federal regulators.  These developments may also spur an increase in litigation.


The California Student Borrower Bill of Rights imposes new requirements on a student loan servicer, including the timely posting, processing, and crediting of student loan payments within certain timeframes, applying overpayments consistent with the best financial interest of a student loan borrower, as defined, applying partial payments to minimize late fees and negative credit reporting, maintaining records, timely processing of paperwork, and diligently overseeing service providers.

It also requires a student loan servicer to provide specialized training for customer service personnel that advises military borrowers, borrowers in public service, borrowers with disabilities, and older borrowers.

Under AB 376, a student loan servicer is prohibited from engaging in unfair or deceptive practices, or abusive acts or practices in connection with the servicing of a student loan, as specified. Consumers who suffers damages as a result of a person’s failure to comply with these provisions as well as all applicable federal laws relating to student loan servicing are authorized to bring an action for actual damages, injunctive relief, restitution, punitive damages, attorney’s fees, and other relief, including treble damages in certain circumstances.

Under AB 376, beginning on July 1, 2021, a Borrower Ombudsman shall be designated to  review complaints, gather data, and issue reports to the Legislature.


Under the Debt Collection Licensing Act (DCLA), a debt collector must first obtain a license before engaging in debt collection.  A "debt collector" is defined as any person who, in the ordinary course of business, regularly, on the person’s own behalf or on behalf of others, engages in debt collection. The term includes any person who composes and sells, or offers to compose and sell, forms, letters and other collection media used or intended to be used for debt collection. The term "debt collector" includes "debt buyer" as defined in Section 1788.50 of the California Civil Code.

When applying for a license, applicants must undergo mandatory California Department of Justice background checks.

SB 908 also amended the Rosenthal Fair Debt Collection Act by prohibiting debt collectors from placing telephone calls without disclosing their identity.  The debt collector must also provide its California debt collector license number upon the consumer’s request.  In written communications, the license number must be in at least 12-point type.  Debt collectors are also prohibited from using obscene or profane language, causing a telephone to ring repeatedly or continuously to annoy the person called, communicating in an unreasonable frequency to constitute harassment.  A debt buyer must also not make any written statement to a debtor in an attempt to collect a consumer debt unless the debt buyer possesses a certain information related to the debt and debtor.

Licensees will also need a surety bond, file mandatory reports on their communications, comply with the DCLA, and develop policies and procedures reasonably intended to promote compliance with the statute.

The Department of Financial Protection and Innovation (DFPI), would oversee the new regulations and licenses and would also be in charge of enforcement.  The functions, powers, and duties of the DFPI Commissioner includes: (i) issue or refuse to issue a license; (ii) allow affiliated companies to be under a single license; (iii) revoke or suspend any license; (iv) keep records of licenses; (v) receive, consider investigate or act upon a complaint made in connection with a license; (vi) prescribe the form of and receive applications for licenses, and reports, books and records required to be made or retained by a licensee; (vii) subpoena documents and witnesses, compel attendance and production, administer oaths and to require production of materials relevant to inquiries; (viii) require information with regard to an applicant; (ix) enforce by order; and (x) levy fines, fees, and charges.

DCLA also calls for the creation of the Debt Collection Advisory Committee.  The committee shall consist of seven appointed members and advise the commissioner on matters relating to debt collection or debt collection business, including proposed fee schedules and the mechanics and feasibility of implementing requirements proposed in regulation.   

The licensing requirement will be enforced beginning on January 1, 2022.

Learn more about the implications of these new laws by contacting any of the authors or your DLA Piper relationship lawyer.