California Continues To Expand DFPI Enforcement Laws Against Financial Institutions

California’s new SB 825 is a 2025–2026 law that took effect January 1, 2026 and expands state enforcement powers to protect consumers from unfair, deceptive, or abusive financial practices.

What SB 825 Does

• SB 825 amends the California Consumer Financial Protection Law (CCFPL) to give the Department of Financial Protection and Innovation (DFPI) clearer authority to take enforcement actions against financial institutions that engage in unfair, deceptive, or abusive acts or practices (often called UDAAP).

• The law narrows or removes prior exemptions for many DFPI‑licensed entities, such as state‑chartered banks, credit unions, mortgage lenders, finance lenders, escrow agents, and some securities firms, so they remain subject to consumer protection oversight even when acting under other state licenses.

Why It Was Passed

• Lawmakers cited federal instability at the Consumer Financial Protection Bureau (CFPB)—including reduced enforcement and staff cuts—as a reason California needed stronger state‑level tools to police harmful financial practices.

• SB 825 is intended to ensure California can independently enforce existing consumer financial protection laws, rather than relying on federal agencies to bring actions first.

What It Means for Consumers

• DFPI can now more readily investigate and sue a broader range of licensed financial institutions if they engage in conduct that is unfair, deceptive, or abusive toward consumers, including seeking restitution, injunctions, and civil penalties.

• For consumers and small businesses, this is expected to mean stronger oversight of loans, bank accounts, credit products, and similar services, with fewer gaps where companies could previously argue they were exempt from CCFPL enforcement.

SB 825 effectively removes (or narrows so much as to neutralize) the main enforcement exemptions that previously protected many DFPI‑regulated and other state‑licensed financial institutions from UDAAP actions under the California Consumer Financial Protection Law (CCFPL).

Key Exemptions Changed

• The bill targets the broad exemptions in California Financial Code section 90002 that:

  • Exempted “licensees of any state agency other than DFPI” when acting under that other agency’s license (for example, entities licensed by another California regulator).

  • Exempted specified categories of DFPI’s own licensees (such as state‑chartered banks, state credit unions, finance lenders, mortgage lenders/brokers, escrow agents, and some money services/Payments providers) from the CCFPL when acting within their license.

• SB 825 clarifies that those exemptions do not shield these entities from DFPI enforcement of section 90003’s prohibitions on unfair, deceptive, or abusive acts or practices (UDAAP) in connection with consumer financial products or services.

What Remains Exempt

• SB 825 does not expand DFPI’s jurisdiction over national banks or other federally chartered institutions; those entities remain outside DFPI’s direct CCFPL authority, subject instead to federal regulators.

• The law also does not eliminate existing cooperative or parallel enforcement structures with other agencies; it mainly ensures that DFPI can independently bring UDAAP actions, even when a state‑licensed entity is operating “within” its legacy license authority.

SB 825 does not create a brand‑new compliance program, but it makes DFPI’s UDAAP standards apply to many licensees that previously treated the CCFPL as largely inapplicable, so they now must ensure their existing compliance programs fully address “unfair, deceptive, or abusive” acts or practices for consumer financial products and services.

Core obligations now clearly apply

• All DFPI licensees that offer or provide consumer financial products or services must comply with the CCFPL’s prohibition on unlawful, unfair, deceptive, or abusive acts or practices (UDAAP), regardless of whether another state license once gave them an exemption.

• These entities must be prepared for DFPI examinations and enforcement actions focused specifically on UDAAP, including potential orders to cease activities, provide restitution, and pay civil penalties.

Practical compliance expectations

• DFPI‑licensed banks, credit unions, mortgage lenders/brokers, finance lenders, escrow agents, debt‑relief providers and similar firms should: review products, marketing, disclosures, fees, and servicing/collections for UDAAP risk; update policies and procedures to address UDAAP; and implement controls to prevent and detect problematic practices.

• DFPI’s description of “covered persons” under the CCFPL makes clear that anyone offering or providing listed consumer financial products or services to California residents (for example, debt settlement, income‑based advances, private postsecondary education financing, student‑debt relief) must treat those activities as subject to CCFPL UDAAP standards and DFPI oversight.

Entity‑specific notes

• For state‑chartered credit unions, one trade summary notes that SB 825 does not add new technical requirements (like new disclosures or forms) but confirms DFPI can pursue UDAAP enforcement against them, so they should ensure their existing consumer‑protection and complaint‑handling frameworks are robust.

• For non‑depository lenders, mortgage lenders, and other nonbank providers, commentators emphasize “heightened” compliance and enforcement risk, recommending UDAAP‑focused training, documentation of fair‑treatment rationales (for pricing, underwriting, and collections), and board‑level oversight of consumer‑protection risk.