Previewing Consumer Financial Enforcement in California During the Second Trump Administration

During the first Trump Administration, in response to federal financial agencies adopting a deregulatory approach, several states became more active in the enforcement of consumer financial statutes and regulations to fill the perceived regulatory void. At the start of the second Trump Administration, members of DWT's State Attorneys General practice offer their insights into what consumer financial enforcement might look like in several key states that are expected to once again play a leading role in counterbalancing the hands-off approach by federal agencies.

For this first article, we start with California. We anticipate that California will take the same approach that it did during the first Trump Administration by working ahead of and in the absence of its federal counterparts. Financial services companies that do business in California should pay attention to recent enforcement priorities, including crypto assets, small business financing, and earned wage access, as these priorities will serve as the baseline for the coming years.

Key State Regulators

The California Department of Justice ("DOJ") and California Department of Financial Protection and Innovation ("DFPI") share enforcement authority over the consumer financial services industry. While the DFPI is the primary regulator of providers of consumer financial products and services, the DOJ may also bring civil and criminal actions under California's consumer protection statutes.

California Department of Justice

• California's statewide investigative law enforcement agency and legal department under the leadership of the Attorney General.
• Attorney General elected for a four-year term, with a two-term limit, during the same statewide election as the governor and other state offices.

California Department of Financial Protection and Innovation

• Formerly known as the California Department of Business Oversight ("DBO"), DFPI supervises a wide range of institutions and processes across the financial services industry, including: financial institutions, such as banks and credit unions; nonbank lenders; money transmitters; securities and investment advisers; student loan servicers; and debt collectors.
• Conducts periodic examinations of licensed entities—including banks and credit unions, nonbank lenders, money transmitters, student loan servicers, debt collectors, and securities and investment advisers—and may investigate and bring civil administrative enforcement actions for suspected legal violations.
• DFPI Commissioner appointed by the governor and subject to approval by the California Senate.

Key State Consumer Financial Protection Laws

The DOJ and DPFI have broad authority to investigate and pursue enforcement actions for alleged violations of California's consumer financial protection laws. These actions may result in civil or criminal penalties, injunctions, or other equitable relief.

• Unfair Competition Law. Prohibits companies that do business in California from engaging in unlawful, unfair or fraudulent business acts or practices and unfair, deceptive, untrue or misleading advertising. A business act or practice is unfair if "the gravity of the harm to the alleged victim" outweighs "the utility of the defendant's conduct." The DOJ may bring an action for civil money penalties and injunctive relief for any violation of the UCL.
• California Consumer Financial Protection Law. Prohibits providers of consumer financial products and services to California consumers from (1) engaging in unlawful, unfair, deceptive, or abusive acts or practices with respect to consumer financial products or services; (2) offering or providing to a consumer any financial product or service that is not in conformity with any consumer financial law; or (3) otherwise committing any act or omission in violation of a consumer financial law. The CCFPL authorizes the DFPI to pursue administrative actions for civil money penalties, restitution, and disgorgement, and make referrals to the DOJ for criminal prosecution.
• California Financing Law. Imposes licensing and oversight requirements on persons and entities engaged in making and brokering consumer and commercial loans to California borrowers, and prohibits misrepresentations, and fraudulent and deceptive acts in connection with making and brokering loans. The DFPI enforces the CFL through administrative penalties, license suspensions or revocations, and referrals to the DOJ for criminal prosecution.
• California Consumer Privacy Act. Requires businesses that collect California consumers' personal information to inform consumers about how they collect, use, and retain their personal information and implement reasonable security procedures and practices to protect consumers' personal information from unauthorized or illegal access, use, or disclosure. The DOJ or California Privacy Protection Agency may bring an action for civil money penalties and injunctive relief for any violation of the CCPA. Additionally, consumers injured by a violation of the general breach notification statute may bring civil actions to recover damages.

Enforcement Approach During the First Trump Administration

In response to the actions of the first Trump Administration, California adopted a dual strategy of challenging the Administration in court and stepping up local enforcement. California filed dozens of lawsuits that challenged the Administration over actions that it saw as having the potential to harm California consumers. California also used the enforcement of its laws and regulations to fill perceived voids in consumer financial protection.

During the first Trump Administration, California adopted a multi-pronged enforcement strategy. The DOJ spent $42 million to support 122 lawsuits against the first Trump Administration. In addition, the DBO (the DFPI's predecessor) increased the rate of enforcement actions against financial services companies. For instance, the DBO focused attention on lender avoidance of interest rate limits on small-dollar consumer loans, likely in connection with the CFPB's reconsideration of its small-dollar loan rule. The DBO pursued enforcement actions against several licensed lenders from 2017 to 2019 that accused them of improperly charging borrowers rates and administrative fees greater than those permitted under the CFL.

Expectations for the Second Trump Administration

We anticipate that California will use the same playbook again. That means invoking a dual strategy of filing lawsuits against the Trump Administration and aggressively enforcing state consumer financial protection laws. California is arguably more prepared to adopt this approach than it was during the first Trump Administration. California Attorney General Rob Bonta made clear after he took office in 2021 that he views consumer protection as a priority for the DOJ, and the DFPI and its staff now has four more years of experience enforcing the CFL and CCFPL.

Based on recent actions of the DOJ and DFPI, California is likely to wield its consumer financial enforcement authority in the following ways:

• Slowed rollout of federal deregulation. The California legislature has set aside $25 million in a litigation fund to support lawsuits filed by the DOJ against the second Trump Administration. These lawsuits are expected to target deregulation at the federal level alleged to harm California consumers. Financial services companies should plan for lawsuits to be filed based on major deregulatory actions taken by the Administration. Before implementing changes to the business or compliance frameworks based on new guidance or regulations, companies should check whether the guidance or regulation is the subject of pending litigation.
• Intersection of consumer protection and crypto assets. Even if federal cryptocurrency legislation is enacted, the DOJ and DFPI will retain the authority to enforce California's consumer protection laws against crypto asset-related financial services companies. Given the DFPI's unique jurisdiction over securities and consumer financial services, most of the DFPI's enforcement actions in the last two years have related to the crypto assets and services industry. In March 2025, the DFPI and DOJ also jointly announced that they had shut down 42 fake cryptocurrency websites in the previous year. Crypto asset-related financial services companies that conduct business with California consumers must confirm their compliance with California law.
• Increased scrutiny of small business financing. Over the last three years, the DFPI has taken action to more closely examine the small business financing industry. For instance, in 2022, the DFPI approved a final rule that requires non-bank lenders and other finance companies to provide written, consumer-style disclosures for small business financing products. The DFPI also approved a final rule in 2023 that applies the CCFPL's UDAAP protections to small business financing products.
• Concerns related to embedded finance. More recently, the DFPI has paid increased attention to new service delivery methods like embedded finance. In particular, the DFPI has scrutinized white-labelled lending products to assess compliance with disclosure and licensing obligations. Financial services companies that offer embedding lending solutions should be prepared to obtain a license as a finance lender or finance broker, and come under DFPI supervision, or provide an explanation for why a license is not required.
• Supervision of earned wage access. Effective February 2025, the DFPI finalized regulations under the CCFPL that require direct-to-consumer EWA providers to register with the DFPI and comply with the DFPI's supervision and reporting requirements. Failure to register and comply with these requirements may subject a provider to an enforcement action. Notably, the new regulations state that direct-to-consumer EWA products are loans under the CFL. DFPI's regulations were issued after the CFPB issued a proposed interpretive rule in July 2024 holding that many earned wage products are consumer loans subject to the federal Truth in Lending Act. Even if the CFPB never finalizes its proposed interpretive rule, direct-to-consumer EWA providers that conduct business with California consumers must register and ensure compliance with the supervision and reporting requirements in the DFPI's new regulations.
• Role of DFPI Commissioner Khalil Mohseni. On February 7, 2025, Governor Newsom appointed Khalil "KC" Mohseni as the third Commissioner of the DFPI. Mohseni joined the DFPI as Chief Deputy Commissioner in November 2023 after serving in roles at several other California agencies in the prior eight years. Commissioner Mohseni fits the mold set by Commissioners Clothilde Hewlett and Manuel Alvarez before him, as someone who built a built a career in both the public and private sector and spent time focused on consumer protection issues. Financial services companies should anticipate that Commissioner Mohseni will continue the enforcement trends seen at the DFPI since its creation in 2021 and be receptive to similar arguments previously made in defense of an investigation or enforcement action.

How DWT Can Help

DWT's State Attorneys General practice is a multidisciplinary team of subject matter experts in financial services, privacy, data security, healthcare, technology, energy, and other relevant areas. The team regularly helps financial services clients navigate complex regulatory challenges—including enforcement investigations, supervisory examinations, and licensing disputes—involving the California DOJ and DFPI. Representative matters include:

• Assisting multiple fintechs with responding to DFPI subpoenas and negotiating settlements on favorable terms when necessary.
• Defending a leading crypto exchange in an enforcement action brought by DFPI.
• Helping a large non-bank lender respond to supervisory findings from a CFL examination and parallel enforcement requests from the DFPI.

For more information or assistance in complying with California's consumer financial protection laws or defending an investigation by the DOJ or DFPI, please contact any of the authors or your usual DWT contact.