Clarifications to CA Consumer Financial Protection Law

On October 6, 2025, California Governor Gavin Newsom signed into law Senate Bill 825, which provides important clarifications to the California Consumer Financial Protection Law (CCFPL).

While the CCFPL was originally designed to grant broad consumer protection authority to the Department of Financial Protection and Innovation (DFPI), it has always included exemptions for entities—such as credit unions—that are already regulated under other state or federal charters.

SB 825 modifies these provisions in a way that may affect how the DFPI exercises its enforcement authority across financial sectors, including credit unions.

Effective Date

SB 825 becomes effective January 1, 2026. From this date forward, DFPI will be able to use its authority under the CCFPL to enforce UDAAP provisions against licensees that were previously shielded from such actions.

Background

The CCFPL, enacted in 2020, expanded the DFPI’s powers to oversee and regulate “covered persons” offering financial products or services to consumers. It granted DFPI authority similar to that of the federal Consumer Financial Protection Bureau (CFPB), including the power to take action against UDAAPs under California Financial Code §90003.

Under §90003, a “covered person” is prohibited from:

• Engaging in any unlawful, unfair, deceptive, or abusive act or practice (UDAAP) with respect to consumer financial products or services; or
• Offering or providing to a consumer any financial product or service not in conformity with consumer financial laws, or otherwise violating those laws.

Prior to SB 825, the CCFPL (§90002) exempted entities already regulated under specific licenses, certificates, or charters—such as credit unions, banks, finance lenders, and escrow agents—from DFPI oversight to prevent duplicative regulation.

Key Provisions of SB 825

• Who Does This Apply To:The provisions of SB 825 apply to all DFPI-licensed or chartered financial institutions, including state-chartered credit unions, state-chartered banks, finance lenders, escrow agents, and other entities operating under DFPI authority. While these entities remain exempt from the broader CCFPL requirements, they are now explicitly subject to DFPI enforcement for unfair, deceptive, or abusive acts or practices (UDAAPs) under California Financial Code §90003.
• Expanded DFPI Enforcement Authority Under SB 825:SB 825 was introduced to clarify DFPI’s enforcement authority under the CCFPL, particularly regarding its ability to pursue deceptive or abusive acts even against entities otherwise exempt from general oversight. The bill amends California Financial Code §90002(b) by adding a new paragraph that explicitly removes the “UDAAP enforcement shield” for licensees otherwise exempt from the CCFPL. Specifically, SB 825 adds paragraph (2) to subdivision (b) of Section 90002, stating: “(2) Nothing in this subdivision shall be deemed to prevent the commissioner from using the authority provided by this division to enforce Section 90003.

In practical terms, the bill clarifies that: 1) The general exemption for DFPI licensees, including state-chartered credit unions, remains in place for most provisions of the CCFPL; and 2) The DFPI Commissioner now has clear authority to investigate and pursue enforcement actions against any DFPI licensee, including state-chartered credit unions, solely for UDAAP-related violations.

What This Means for Credit Unions

For California’s state-chartered credit unions, SB 825 does not impose new compliance obligations or subject credit unions to ongoing DFPI supervision under the CCFPL. However, it confirms that DFPI retains authority to act in cases involving potential consumer harm.

This means the DFPI could invoke its enforcement powers if it believes a credit union—or a third-party service provider acting on its behalf—has engaged in a deceptive or abusive act or practice.

Next Steps for Credit Unions

• Review consumer protection policies. Ensure your credit union’s existing compliance management systems address UDAAP, consistent with both National Credit Union Administration (NCUA) guidance and DFPI expectations.
• Evaluate vendor oversight. Since DFPI’s authority may extend to third-party service providers, verify that vendor contracts and monitoring processes include consumer protection provisions and accountability measures.
• Document compliance controls. Maintain clear records of compliance policies, employee training, and member communication reviews that demonstrate proactive consumer protection efforts.

California’s Credit Unions Monitoring and Support

California’s Credit Unions will continue to closely monitor DFPI’s interpretation and enforcement of SB 825 to ensure that credit unions remain appropriately exempt from duplicative or conflicting regulatory oversight. California’s Credit Unions will provide updates and additional guidance as DFPI implements this clarification.