This report discusses the regulations commonly applicable to delivery of services and products of a financial nature to consumers by financial technology firms (“Fintechs”).  We note that additional regulations will apply to insurance, securities and health care products and services.

The principal federal agencies that oversee consumer protection in the context of financial products are the Consumer Financial Protection Bureau (CFPB) and the Federal Trade Commission (FTC).  The regulations issued by the CFPB and FTC are supplemented, in certain cases, by state regulations.  

CFPB Regulations

The CFPB implements and enforces federal consumer financial laws to ensure that all consumers have access to markets for consumer financial products and services that are fair, transparent, and competitive. 

The following regulations are applicable to all consumer lending transactions:

If the Fintech offers mortgages to consumers, the following additional regulations will apply:

Although extensive, the good news with respect to the CFPB regulations is that the CFPB publishes sample forms with respect to a majority of the CFPB regulations.  Use of the sample forms is deemed compliance with the related consumer regulation.

FTC Regulations

The Credit Practices Trade Regulation Rule (16 CFR Chapter 1, Subchapter D, Part 444) sets forth many of the FTC regulations applicable to Fintechs that provide financial services to consumers, such as (i) prohibited contract provisions (confession of judgment, and waiver of exemption from attachment of certain properties), (ii) required notices to co-signers (the form of which is specified in the rule) and (iii) prohibition of late charges under certain circumstances.  The FTC and the CFPB have concurrent jurisdiction with respect to the enforcement of Regulation B (Equal Credit Opportunity), Regulation F (Fair Debt Collection Practices), Regulation V (Fair Credit Reporting) and Regulation N (Mortgage Acts and Practices).

Section 5 of the Federal Trade Commission Act empowers the FTC to prevent unfair or deceptive practices and seek monetary penalties for violations: 

• “unfair” is generally construed to mean an act or practice which (i) causes or is likely to cause substantial injury to consumers, (ii) cannot be reasonably avoided by consumers, and (iii) is not outweighed by countervailing benefits to consumers. 
• “deceptive” is generally construed to mean (i) acts or practices where a representation or omission misleads the consumer in a material way, and (ii) the consumer’s interpretation of the misleading representation or omission is reasonable.

Unlike the CFPB regulations, the FTC does not publish standard forms.  However, the FTC regularly publishes the targeted areas for enforcement.  The focus of the FTC’s enforcement actions in 2022 and 2023 has been (i) payday lending (undisclosed and/or improper withdrawals from consumer checking accounts), (ii) credit repair and debt relief (deceptive claims and illegal fees), (iii) robocalls (illegal telemarketing practices), and (iv) student loan debt relief (deceptive claims and failure to disclose).

State Regulation

The consumer regulations applicable to Fintechs that have been adopted in most states address state level licensing of such Fintechs, as well as various limitations on permissible interest rates.  In addition, certain states have promulgated regulations with respect to installment loans made in connection with retail purchases.  In so far as other state-level regulations are not “inconsistent” with the corresponding CFB regulations, the state regulations are applicable (in addition to the corresponding CFPB regulations (12 C.F.R. Part 1002.11). 

As of now, California, Virginia, Connecticut, Colorado, Utah, Iowa, Indiana, Tennessee, Oregon, Montana, Texas, and Delaware have adopted comprehensive consumer data privacy and various related disclosure and notice requirements.  An additional 16 states have introduced comparable bills that have yet to be enacted.  If not superseded, the state regulations must be complied with in the relevant jurisdiction.  Where businesses operate in multiple jurisdictions, multiple state regulations may apply.