California Financial Code: Licensing, Disclosures, and DFPI Penalties

The California Financial Code is the body of state law that licenses, regulates, and disciplines banks, credit unions, nonbank lenders, and money transmitters doing business in California. It sets who needs a license, what must be disclosed to consumers, how customer data must be protected, and what the Department of Financial Protection and Innovation (DFPI) can do when an institution falls out of line. Penalties range from a $500 administrative fine for a missed address notice to loan contracts being voided, six-figure privacy judgments, and up to a year in jail for willful violations of the California Financing Law.

Who the Code Covers

The Financial Code reaches any business that takes deposits, extends credit, or moves money in the state. The rules differ by category.

State-Chartered Banks

The DFPI licenses, regulates, and examines California-chartered commercial banks.¹ Regular examinations look at financial health, consumer compliance, and anti-money laundering controls. Deficiencies can produce fines, operational restrictions, or license revocation.

Credit Unions

California-chartered credit unions are governed by Division 5 of the Financial Code (Sections 14000–16906).² They must hold minimum net worth ratios, follow lending and investment limits, file annual financial reports, and disclose loan terms, fees, and account conditions. Federally chartered credit unions answer to the National Credit Union Administration instead and sit outside this framework.

Nonbank Lenders

Finance lenders and brokers who make or arrange consumer or commercial loans must be licensed under the California Financing Law (CFL) in Division 9.³ The CFL covers mortgage lenders, installment lenders, and similar entities. Payday lenders are regulated separately under the California Deferred Deposit Transaction Law in Division 10.⁴ Both frameworks prohibit misrepresentation and deceptive acts in lending.

Money Transmitters

Businesses that issue money orders, traveler’s checks, or stored value need a money transmitter license under Division 1.2. The application fee is $5,000 and is nonrefundable even if the application is incomplete.⁵ Licensees face ongoing examination, recordkeeping, and disclosure obligations.

Previously Unregulated Providers

The California Consumer Financial Protection Law (CCFPL), codified in Division 24, gave the DFPI authority over categories that had no state-level regulator: debt relief companies, credit repair and consumer credit reporting companies, private education funding providers, earned wage advance companies, and payment services providers.⁶ The CCFPL also lets the DFPI act against any provider of consumer financial products or services, licensed or not, for unlawful, unfair, deceptive, or abusive practices.

Licensing Thresholds That Bind

The CFL sets hard numbers a finance lender or broker must meet before and during licensure. Minimum net worth is $25,000. It jumps to $250,000 for licensees that employ mortgage loan originators and make residential mortgage loans, and $50,000 for a broker that arranges but does not fund residential mortgage loans.⁷ Every CFL licensee must also maintain a surety bond of at least $25,000.⁸

Applicants have to show a clean record free of criminal convictions or regulatory sanctions involving dishonesty, fraud, or deceit, and submit a business plan consistent with the finance lender business.⁸ Applications go through the Nationwide Multistate Licensing System (NMLS).

Mortgage loan originators register individually with the NMLS Registry and receive a unique identifier before originating any residential mortgage loan. Employers cannot let unregistered employees originate. Registration includes a 10-year employment history in financial services and disclosures of criminal convictions involving dishonesty or breach of trust, related civil judicial actions, and regulatory sanctions. Registrants renew annually and must update their information within 30 days of a name change, employment change, or any other change that makes prior data inaccurate.⁹ Fingerprinting is required unless the Registry already has prints less than three years old.

Interest Rate Cap on Consumer Loans

For consumer loans with a principal of at least $2,500 but less than $10,000, a CFL-licensed finance lender cannot charge more than 36% annual simple interest plus the federal funds rate. The applicable federal funds rate is the rate published in the Federal Reserve’s Statistical Release H.15 in effect on the first day of the month before the loan closes.¹⁰

Most fees fold into that ceiling. For loans of $5,000 or more, an administrative fee counts toward the rate calculation. For loans between $2,500 and $5,000, a lender may charge an administrative fee up to $75 on top of the maximum rate.¹⁰ Loans of $10,000 or more are not subject to this cap. Commercial loans between $2,500 and $5,000 fall under the same rate ceiling as consumer loans in that band.

What Must Be Disclosed to Consumers

Mortgages

Under the federal TILA-RESPA Integrated Disclosure (TRID) rule, most mortgage lenders provide a Loan Estimate within three business days of receiving an application. The Loan Estimate combines the older Good Faith Estimate and initial Truth in Lending disclosure and lays out estimated interest rates, monthly payments, closing costs, and other loan terms. A Closing Disclosure must be delivered at least three business days before closing so the borrower can review the final numbers.¹¹

Consumer Loans

CFL licensees keep records on every loan made or brokered: borrower name and address, loan amount, date, terms, total of payments, and annual percentage rate. The CFL bars misrepresentation and deceptive acts in connection with making or brokering loans.³

Electronic Delivery

When an institution wants to send required disclosures electronically instead of on paper, the E-SIGN Act sets the floor. The consumer must affirmatively consent and cannot be defaulted in. Before consent, the institution has to tell the consumer they can receive paper copies, can withdraw consent at any time, and how to do so, plus describe the hardware and software needed to access and retain the records.¹²

Deposit Accounts

Banks and credit unions must spell out fees, overdraft policies, and interest accrual in the account agreement. Advance written notice is required before changes take effect: 21 days for electronic fund transfer accounts, and typically 30 days for deposit accounts under the Truth in Savings Act when a change would reduce earnings or raise fees. Fund availability policies also have to be disclosed.

Privacy and Data Security

The California Financial Information Privacy Act, at Financial Code Section 4050 and following, restricts how financial institutions share nonpublic personal information with third parties and generally requires express written consent from the consumer before sharing.

Federal law adds a layer. The FTC Safeguards Rule requires covered financial institutions to develop and maintain a written information security program with administrative, technical, and physical safeguards proportional to the institution’s size, complexity, and the sensitivity of the data.¹³

One point often confuses consumers and compliance staff: the California Consumer Privacy Act (CCPA) generally does not cover personal information that financial institutions collect, process, or disclose under the federal Gramm-Leach-Bliley Act. The carve-out has an exception. Consumers can still sue under the CCPA’s private right of action if a data breach results from the institution’s failure to maintain reasonable security procedures.

Reporting to Regulators

Licensed institutions file periodic reports with the DFPI, including financial statements, compliance reports, and consumer protection disclosures. CFL licensees submit an annual report covering loan origination volumes, interest rate structures, and borrower demographics. Late or inaccurate filings can prompt enforcement, closer scrutiny, or fines.

Federal anti-money laundering rules run in parallel. Under the Bank Secrecy Act, institutions file Currency Transaction Reports for cash transactions exceeding $10,000 and Suspicious Activity Reports when they spot potentially illegal conduct. The Financial Crimes Enforcement Network (FinCEN) administers these. Noncompliance draws penalties at both state and federal levels.

How the DFPI Enforces the Code

The DFPI can compel records, interview employees, and issue subpoenas. Examinations may be triggered by consumer complaints, reporting irregularities, or findings from a prior review. When violations surface, the department can issue cease-and-desist orders, seek court injunctions, appoint receivers over a troubled institution, or revoke a license.³

Under the CCFPL, the DFPI can pursue any provider of consumer financial products or services engaged in unlawful, unfair, deceptive, or abusive acts, whether or not the provider holds a DFPI license.⁶

Penalties for Violations

Civil

Privacy violations carry civil penalties up to $2,500 per violation under Financial Code Section 4057. Negligent disclosures affecting multiple individuals are capped at $500,000 in the aggregate, but a knowing and willful violation keeps the per-violation figure without any aggregate cap. Penalties double if the violation results in identity theft.¹⁴

For CFL violations, the loan contract itself can be voided. A lender that loses that fight forfeits the right to collect any principal, interest, or fees on the transaction. The DFPI can also pursue license suspension or revocation and seek restitution for affected borrowers.

Criminal

Willfully violating the CFL, or willfully violating a rule or order issued under it, carries a fine of up to $10,000, up to one year in jail, or both. No one can be imprisoned for violating a rule or order without actual knowledge of it.¹⁵ The DFPI can refer fraud and systemic consumer harm cases to the California Attorney General.

Administrative

Smaller compliance slips draw fixed administrative penalties. A CFL licensee that fails to notify the DFPI of a headquarters address change at least 10 days before the move faces a $500 penalty, and the same $500 applies to branch office address changes.⁸ These add up and often flag broader compliance problems to examiners.

Federal Overlap

DFPI oversight is not exclusive. The Consumer Financial Protection Bureau (CFPB) shares supervisory authority over providers of consumer financial products and services, and the two agencies operate under a coordination framework that sets shared examination schedules, joint operational protocols, and single points of contact for supervised entities. For insured state-chartered banks and credit unions with more than $10 billion in assets, the CFPB coordinates directly with the DFPI on consumer protection supervision. A California-licensed lender can face examinations from both, and the agencies share information to reduce duplication where they can.¹⁶

1
Department of Financial Protection and Innovation. Commercial Banks
2
Justia. California Financial Code Division 5 – Credit Unions
3
Department of Financial Protection and Innovation. California Financing Law
4
Department of Financial Protection and Innovation. California Deferred Deposit Transaction Law (Payday Lenders)
5
Department of Financial Protection and Innovation. Money Transmitters
6
Department of Financial Protection and Innovation. California Consumer Financial Protection Law
7
Department of Financial Protection and Innovation. Requirements After a Finance Lenders License Has Been Issued
8
Department of Financial Protection and Innovation. California Finance Lenders License – Frequently Asked Questions
9
Consumer Financial Protection Bureau. Registration of Mortgage Loan Originators
10
Department of Financial Protection and Innovation. New Requirements for Licensees Making Consumer Loans of $2,500 to $10,000
11
Consumer Financial Protection Bureau. TILA-RESPA Integrated Disclosure FAQs
12
National Credit Union Administration. Electronic Signatures in Global and National Commerce Act (E-Sign Act)
13
Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
14
California Legislative Information. California Financial Code FIN 4057
15
California Legislative Information. California Financial Code FIN 22780
16
Consumer Financial Protection Bureau. CFPB-State Supervisory Coordination Framework