Consumer Protection Is Shifting to the States

Federal pullbacks in consumer protection oversight have not produced the simpler compliance environment some might have expected. In the view of BCG Senior Advisor Brian Hughes, they have prompted something harder to manage: a more fragmented system in which states are building their own consumer protection machinery, expanding their legal authority, and showing a growing willingness to act on it. 

Several developments are driving that change: 

States are not waiting for Washington. State action is falling into three main buckets: building regulatory agencies, passing new laws, and enforcing those laws. California and Pennsylvania are among the clearest examples of the first bucket. Hughes describes their agencies as “essentially mini-CFPBs,” adding, “They’re specifically stepping in and saying, ‘The CFPB is stepping back, and we’re taking charge.’” 

New laws are giving states stronger enforcement tools. New York’s Fair Act is a particularly important example because it effectively brings the CFPB’s unfair, deceptive, or abusive acts or practices standard—known as UDAAP—into state law. “That gives the New York attorney general a full-blown UDAAP toolkit,” Hughes says. “UDAAP requirements are intentionally vague. It gives regulators a lot of discretion, and that’s what makes it such a powerful enforcement tool.” 

Federal settlements do not necessarily end the matter. New York and Pennsylvania recently joined a multistate enforcement action against a nonbank lender even after the company had settled similar allegations with the CFPB. “The response from the states was basically, ‘We don’t care,’” Hughes says. “‘We’ve got our own laws, and federal settlement doesn’t preempt state action.’” 

The pressure is concentrated, not universal. The activity is focused primarily on consumer protection and, to a lesser extent, AML. Hughes does not see states stepping into bank safety and soundness in a major way, and he says they are also unlikely to pick up areas like reputational risk that federal regulators have deemphasized. 

For banks, the result is complexity, not relief. “You now have a fragmentation of regulation,” Hughes says. Once a state acts, banks have to determine whether jurisdiction exists, whether preemption applies, and, if it does not, how to comply. “It makes things harder, not easier,” he adds. 

The takeaway: This looks less like deregulation than redistribution. Oversight may be easing in some federal channels, but it is reappearing through some states—for banks that means compliance strategy still needs to be built for change, uncertainty, and overlap.