What Is the California Consumer Financial Protection Law?

The California Consumer Financial Protection Law is a 2020 state statute that gave the Department of Financial Protection and Innovation (DFPI) broad authority to supervise consumer financial companies that previously operated without direct state oversight. Passed as part of AB 1864, the law prohibits unfair, deceptive, and abusive practices across consumer financial products and services, and it carries penalties of up to $1 million per day for the most serious violations.¹

What the Law Does

Before 2020, many financial businesses escaped California supervision simply because they did not hold a traditional lending or banking license. The CCFPL closed that gap. Licensing status became irrelevant: if a company offers financial products or services to California consumers, the DFPI can regulate it.¹

The core prohibition is against unlawful, unfair, deceptive, or abusive acts and practices, known in the industry as UDAAP. Financial service providers cannot mislead consumers, impose unreasonable terms, or exploit a consumer’s lack of understanding about a product’s risks or costs. The statute also includes a catch-all: offering any financial product that does not conform to California’s consumer financial laws is itself a CCFPL violation, even if the conduct is not independently “deceptive” or “abusive.”²

The law also hands the DFPI a wider enforcement toolkit. The department can examine financial companies on its own initiative, issue subpoenas, compel documents, write new rules in response to emerging risks, and bring civil actions seeking injunctions. Courts can order restraining orders, appoint receivers or monitors over a company’s assets, and grant other relief.³

Who the Law Applies To

The CCFPL uses the term “covered person” to describe the businesses it regulates. A covered person is anyone who offers or provides a consumer financial product or service, along with their service providers. Anyone who knowingly or recklessly helps a covered person violate the law can be held liable as if they committed the violation themselves.²

Four industries became directly subject to DFPI oversight for the first time under the law:

Debt settlement and debt relief companies
Credit reporting and credit repair agencies
Private postsecondary education financing providers
Income-based advance (earned wage access) products

Buy-now-pay-later products have also drawn CCFPL enforcement. The DFPI has stated publicly that BNPL products are loans under California lending law, and in at least one enforcement action required a BNPL company to stop making illegal loans and pay refunds to affected consumers.⁴

Cryptocurrency is handled separately. The Digital Financial Assets Law, not the CCFPL, sets the licensing framework for digital asset businesses, with licenses required beginning July 1, 2026.⁵

Registration Requirements

The CCFPL authorizes the DFPI to create registration rules for covered persons, including fees and filings made under oath. Registration can be processed through the Nationwide Multistate Licensing System and Registry.⁶

As of February 15, 2025, companies in the four initially covered industries must hold an approved registration or have a pending application to legally operate in California. Operating without registration exposes a company to the full range of CCFPL enforcement actions.⁷

Not every financial business has to register separately. Companies already licensed by the DFPI under another California law, or licensed by a federal agency for deposit-taking, are exempt from CCFPL registration as long as they stay within the scope of that existing license. If they offer a financial product the current license does not cover, the CCFPL registration requirement applies.⁶

Penalties for Violations

Under California Financial Code Section 90012, CCFPL penalties scale with the violator’s culpability in three tiers:

Standard violations: up to $5,000 per day the violation continues, or $2,500 per act or omission, whichever is greater.
Reckless violations: up to $25,000 per day, or $10,000 per act or omission, whichever is greater.
Knowing violations: the lesser of 1 percent of the violator’s total assets, $1,000,000 per day, or $25,000 per act or omission.

The “lesser of” language in the knowing-violation tier matters. A smaller company will not face the full $1 million daily cap, because the penalty is capped at the lowest of the three measures. For a large institution, 1 percent of total assets could exceed $1 million per day, making the daily cap the binding limit.⁸

Monetary penalties are only part of the picture. The DFPI can also seek contract rescission, restitution, disgorgement of profits, refunds to consumers, public notification of the violation at the company’s expense, and limits on the company’s future activities. In setting a final penalty, the department weighs the company’s financial resources, the severity of consumer harm, good faith, and any history of past violations.⁸

What the Law Means for Consumers

If you have a problem with a financial company covered by the CCFPL, you have two layers of protection. The first is the company itself, which the law requires to maintain complaint procedures. Email and online complaints must be acknowledged within three calendar days. Mailed complaints must be acknowledged within five. Phone complaints must be acknowledged orally with a tracking number during the call. Companies also must tell you that unresolved complaints can be escalated to the DFPI.⁹

The second layer is the DFPI itself. You can file a complaint online, by mail, or by calling 1-866-275-2677. Online filings reach the department within about five minutes; mailed complaints take one to five days. The DFPI reviews each submission, may ask for more documentation, and opens investigations where warranted.¹⁰

The practical effect of the transparency rules is that high-cost products like payday-style loans must disclose interest rates, fees, and repayment schedules clearly. Hidden-fee practices that were common before the CCFPL now expose the company to UDAAP liability.⁹

How the CCFPL Compares to Federal Law

The CCFPL was modeled on the authority Congress gave the federal Consumer Financial Protection Bureau under the Dodd-Frank Act. Both prohibit unfair, deceptive, and abusive practices, and both give their agencies examination, subpoena, and enforcement powers. The two operate independently. A company that complies with federal law can still violate the CCFPL where California’s standards are stricter, and the DFPI does not need CFPB permission to bring an enforcement action.

In 2024, the DFPI opened 699 investigations and issued 202 public enforcement actions under its various authorities, a 12 percent increase over the prior year, and conducted its first examination of a financial services company using CCFPL authority specifically.¹¹ For consumers and companies in California, the law is not a paper framework. It is being actively enforced.

1
Department of Financial Protection and Innovation. California Consumer Financial Protection Law
2
California Legislative Information. California Code Financial Code 90003
3
California Legislative Information. California Code Financial Code 90013
4
Department of Financial Protection and Innovation. Buy Now, Pay Later Company Agrees to Cease Illegal Loans, Pay Refunds in Settlement
5
Department of Financial Protection and Innovation. Digital Financial Assets
6
California Legislative Information. California Code Financial Code 90009
7
Department of Financial Protection and Innovation. Covered Persons
8
California Legislative Information. California Code Financial Code 90012
9
Department of Financial Protection and Innovation. CCFPL Complaint Regulations
10
Department of Financial Protection and Innovation. Submit a Complaint
11
Department of Financial Protection and Innovation. 2024 Annual Report of Activity Under the California Consumer Financial Protection Law