This post was originally published on this site.
For years the center of gravity in consumer finance enforcement sat in Washington, D.C. That balance is now shifting. State attorneys general, state banking departments, and state legislatures are asserting more authority over lending, payments, and embedded finance than at any point since the CFPB was founded. The result is a regulatory landscape that moves faster, reaches further, and is increasingly coordinated across multiple jurisdictions.
Recent activity illustrates a clear trend. State AGs are launching joint inquiries into emerging products. Governors and legislatures are creating new enforcement infrastructures. Mortgage and specialty finance companies are finding themselves subject to multistate settlements. And in a significant development for lending models, the Tenth Circuit has given Colorado broad room to apply its own rate caps to loans from out of state institutions. That ruling signals an important recalibration of how preemption works in practice.
This state driven posture is not episodic. It is now a defining feature of the consumer finance market.
Why States Are Moving First
Several forces are converging. The CFPB recently narrowed interpretations that previously had been seen to expand state enforcement powers under federal consumer financial law, but states retain broad authority to enforce their own consumer protection statutes and pursue enforcement independently. Blue state attorneys general have also increased coordination and information sharing. In one notable example, a coalition tapped CFPB Director Rohit Chopra to advise and help direct state level consumer protection strategy.
The political incentives are also aligned. State AGs have begun to frame fintech oversight as a competition issue, a wage protection issue, or a privacy issue. Those frames resonate with broad constituencies and allow regulators to justify expansive theories of jurisdiction. The result is that states now move quickly to fill perceived gaps whenever federal rulemaking slows or litigation creates uncertainty.
AG Coalitions Expand Their Reach
Buy now pay later products continue to attract coordinated attention. A multistate group of AGs recently issued sweeping information demands to major BNPL providers covering underwriting criteria, fee structures, repayment behavior, data monetization, and complaint patterns. The letters were broad enough that smaller BNPL operators, retailers offering private label BNPL, and even data partners are reassessing their risk posture.
Earned wage access programs are on the same radar. AG interest in wage products shows a clear shift toward treating certain models as credit, particularly where fees, expedited access charges, or employer integrations resemble traditional lending. These theories mirror elements raised in litigation and proposed rulemaking. They also foreshadow greater scrutiny of fee funded or paycycle aligned products beyond EWA. That trend is already playing out in New York, where the Attorney General has brought enforcement actions against EWA providers alleging that expedited access fees, tips, and repayment mechanics effectively function as interest on short-term payday loans under existing state law, even in the absence of a standalone EWA statute.
State AG coalitions are extending well beyond BNPL and EWA. For example, a bipartisan group of state attorneys general launched a national task force to evaluate consumer risks from artificial intelligence and develop proactive safeguards in emerging technology, showing how regulators are coordinating on issues that intersect with finance, data, and AI governance. Another 39-state coalition jointly urged federal lawmakers to preserve state authority over AI laws, highlighting collaborative multistate engagement on consumer protection and competition policy.
States Build New Enforcement Architecture
Some states are not only enforcing existing rules but standing up new institutional structures. Pennsylvania created a centralized consumer protection office within its attorney general’s organization to unify enforcement against digital finance companies and platform intermediaries. New York became the latest state to introduce legislation aimed at regulating earned wage access programs, proposing a licensing framework, rate caps that would count tips toward total cost, TILA and APR disclosure requirements, and limits on employer-mandated participation and fee-driven pricing models.
States are also expanding coordination in legacy areas. Financial regulators in Hawaii, Idaho, Oregon, and Texas entered into a multistate Settlement Agreement and Consent Order with a mortgage company to resolve allegations of unlicensed activity, inadequate supervision, and examination noncompliance under each state’s mortgage licensing laws. These matters demonstrate that states remain active in high volume lending channels, not just new economy products.
The DIDMCA Shock To Interest Exportation
The most consequential recent development came from the Tenth Circuit. Colorado has long pursued an opt out under the Depository Institutions Deregulation and Monetary Control Act or DIDMCA. The district court initially blocked enforcement of Colorado’s rate caps against loans made by out of state chartered banks. On appeal, the Tenth Circuit reversed that preliminary injunction and allowed Colorado to apply its Uniform Consumer Credit Code rate limitations whenever either the borrower or the lender is located in Colorado. The panel concluded that loans are made in a state whenever either party is located there, which eliminates preemption that state banks historically relied on.
Colorado’s opt out does not affect national banks. Those institutions continue to export rates under the National Bank Act. But the ruling effectively introduces two regulatory universes for similar products depending on charter type. Lenders that rely on state charters must now adjust to the possibility that any borrower located in an opt out state will trigger that state’s rate limits.
The ruling also reopens broader questions for fintech models that depend on state bank lending. Several industry groups warn that treating loans as “made” where the borrower resides will create competitive distortion and limit credit availability. The OCC issued a public statement noting that the decision undermines competitive parity and may require legislative attention to preserve the dual banking system.
The combination of these reactions underscores that the DIDMCA ruling is not a narrow procedural event. It affects marketplace lenders, point of sale programs, bank partnership models, and any enterprise that operates across state lines through state chartered partners. Even absent immediate appeals, companies will need to review rate structures, geographic screens, and compliance controls.
How States Expand Jurisdiction Over Fintech
State regulators are increasingly applying familiar consumer protection statutes to novel fintech models. While some actions rely on traditional unfair or deceptive acts theories, others reach further by invoking licensing and supervisory regimes that were not designed with digital platforms in mind. Recent state actions involving payment and payroll platforms illustrate how money transmission laws remain a primary point of entry, with regulators focusing less on how long funds are held and more on who controls payment flows, disbursement timing, and user relationships. At the same time, loan broker, servicing, and debt collection statutes are being applied more broadly to fintech companies that shape underwriting, repayment, or customer communications, even where those companies do not extend credit themselves.
States are also asserting expectations traditionally associated with bank supervision. Several recent actions emphasize AML controls, monitoring of user behavior, and oversight of payment flows. As part of a multistate consent order, the money transfer firm Wise agreed to reform elements of its AML program, underscoring how state regulators increasingly expect nonbank payment companies to implement risk based controls comparable to those applied to banks.
This widening perimeter suggests that fintech companies should assume bank like scrutiny even if they operate under nonbank licenses.
What Companies Should Do Now
Taken together, these developments suggest that companies can no longer treat state enforcement as episodic risk and should adjust their compliance and product strategies accordingly.
- Map Regulatory Exposure. Strengthen state level compliance mapping to understand which jurisdiction’s caps, fee limits, disclosure rules, and refund obligations apply to each user segment.
- Prepare For Multistate Inquiries. Build internal processes for responding to detailed AG questionnaires covering underwriting, fee practices, delinquency, complaints, and data usage, similar to the BNPL inquiry.
- Reevaluate Bank Partnership Structures. Review bank partnership programs in light of the DIDMCA ruling, including underwriting location, borrower address screening, and how acquisition or recurring charges are structured.
- Assess Product Design And Communications. Revisit platform design and customer communications, given AG willingness to treat tips, expedited access fees, or optional payments as interest or finance charges.
- Elevate Controls To Bank Level Expectations. Implement stronger AML, monitoring, and consumer protection controls that reflect expectations typically applied to banks, especially for payments or wage linked products.
- Engage Regulators Early. Increase direct engagement with state regulators before launching or expanding products to reduce the risk of surprise inquiries and to clarify how the model fits within state law.
- Align Product And Investor Strategy With State Trends. Update product roadmaps and investor communications to reflect that state law and state enforcement now drive operational and pricing decisions more than federal guidance.
State Power Is Reshaping Consumer Finance
The consumer finance market is entering a period where state enforcement and state lawmaking carry more weight than federal rulemaking cycles. AG coalitions are testing new theories. Legislatures are stepping in with product specific statutes. Courts are reassessing long standing preemption principles. And regulators are applying bank like expectations to nonbank entities.
The companies that navigate this environment successfully will be the ones that treat state scrutiny as a core strategic consideration rather than an afterthought. Those that do not will feel the effects of this new regulatory era in very direct ways.