Expanding Laws and New State Agencies: Why Credit Unions Should Prepare for Increased Consumer Protection Enforcement at the State-Level

Shifting Consumer Protections

Although federal enforcement actions have declined under the current administration, state-level involvement continues to increase, particularly in California. One recent example is California’s newly formed Business and Consumer Services Agency (“BCSA”), which officially launched on July 1, 2026. Notably, Governor Gavin Newsom recently appointed former Consumer Financial Protection Bureau (“CFPB”) Director Rohit Chopra to lead the agency. The BCSA oversees several consumer protection entities in the state, including the Department of Financial Protection and Innovation (“DFPI”), which licenses and regulates state-chartered credit unions.

Amongst this alphabet soup of acronyms, comes the potential for major impacts to credit unions and their members. At the beginning of the year, California SB 825 went into effect, which granted additional regulatory enforcement powers to the DFPI. Previously, the state agency would coordinate with the CFPB or the Attorney General’s office to enforce Unfair, Deceptive, or Abusive Acts or Practices (“UDAAP”) related violations. The new law gives the DFPI expanded authority and resources to enforce such violations. The implementation of SB 825 combined with the new BCSA led by former CFPB Director Rohit Chopra signals a clear message from the state regarding consumer protection enforcement.

Many of the publicized federal and state enforcement actions in recent years have involved large national banks and mortgage servicers. Proponents of SB 825 argued that the new law was necessary to ensure equal enforcement across the financial sector. According to the Assembly Summary, “The DFPI has different enforcement authority across different licensing frameworks that govern the various exempted persons. This results in different triggering violations and enforcement procedures and outcomes for different licensees who commit the same harm to consumers. Thus, bad actors in the financial sector who commit the same UDAAP violations may enjoy a lower penalty or less rigorous enforcement procedure simply based on the type of business it is, not the act it committed.”[i] Industry groups argued that the law was not only an overstep of power but also an unnecessary expansion that would further stretch already limited financial resources. The state legislature was not convinced. The law passed and went into effect on January 1, 2026.

Maintaining Compliance while Meeting Member Expectations

The legislative history behind SB 825 forewarns that potential enforcement actions are ripe for all types of covered entities. It’s crucial for credit unions to review their Compliance Management System (“CMS”) to ensure they are tailored for all state requirements and expectations. In particular, credit unions must have expansive processes in place to log, review, and respond to complaints from members. CU’s should ensure that all team members and supervised vendors are fully trained in handling complaints and reporting them. There are many resources available to help develop and maintain a CMS. Several years ago, the National Credit Union Administration provided guidance on the core components of a comprehensive CMS[ii], one of which focuses on Member Complaint Response. Some of the key examination questions ask:

• Does the credit union have processes and procedures in place to address consumer complaints and investigations?  Are consumer complaint investigations and responses prompt and thorough?
• Does management monitor consumer complaints to identify risks of potential consumer harm, program deficiencies, and/or customer service issues? If yes, does management take appropriate action?

With states like California continuing to expand their enforcement roles, compliance programs are becoming more and more decentralized. Credit unions are advised to review their CMS and related policies at all levels and where applicable across all states. This includes taking a proactive approach with self-audits and sweeping reviews of existing policies. Published examination procedures offer credit unions a way to prevent or identify and take corrective action before infractions lead to punitive regulatory actions.

Consumer complaint management is especially important when a member goes into default. In-house legal teams should work closely with experienced outside counsel handling collection, foreclosure, bankruptcy, litigation and other contested issues to ensure state processes are being followed and member grievances are being handled accordingly.

[i] https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=202520260SB825

[ii] https://ncua.gov/regulation-supervision/manuals-guides/federal-consumer-financial-protection-guide/compliance-management/compliance-management-systems-and-compliance-risk

The information reported in this document, financial and otherwise, should not be construed as either legal or investment advice, nor does it represent the views of ACUMA, its Board of Directors, its staff or its members. The author presents information current at the time of publication and is designed to educate ACUMA members and others interested in the credit union mortgage lending industry.