With the CFPB scaling back rule-making and enforcement under the new regime, state regulators and attorneys general are expected to play a more prominent role in consumer protection and industry oversight.

Here’s how that may unfold:

1. State-level consumer protection laws will gain teeth

• States like California (via the DFPI), New York (DFS), Massachusetts, and Colorado already have strong consumer financial protection frameworks in place.
  
• These agencies may pass or enforce state-specific rules around:
  
  • Debt collection practices
    
  • Fair lending
    
  • Medical debt reporting
    
  • Data privacy and open banking
    
  • “Junk fee” disclosures
    

Example: California’s “Mini-CFPB” model allows it to investigate and penalize financial institutions independently of federal action.

2. More litigation from State Attorneys General

• State AGs may take on a quasi-federal role in pursuing unfair, deceptive, or abusive acts and practices (UDAAPs).
  
• Multi-state investigations could increase, especially when coordinated with class-action lawsuits or consumer advocacy groups.
  

3. Patchwork regulation will create operational complexity

• Without a strong federal baseline, national lenders, debt buyers, and agencies may need to manage compliance on a state-by-state basis.
  
• This will affect:
  
  • Call recording laws
    
  • Statute of limitations on collections
    
  • Required consumer disclosures
    
  • Permissible interest rates and fees
    

The result: regulatory fragmentation, more frequent audits at the state level, and rising compliance overhead for multi-state operators.

Strategic implication

Companies in the collections and lending ecosystem must build compliance resilience at the state level, even as federal pressure eases. That includes:

• Monitoring legislative developments in key states
  
• Investing in compliance automation and audit readiness
  
• Proactively engaging with state regulators where appropriate
  

States cannot fully replace the CFPB but they can fill parts of the void. Here's a breakdown of what they can and can't do:

{{cta-banner}}

What states can do

1. Enforce state-level consumer protection laws

• Many states already have their own versions of UDAAP laws (Unfair, Deceptive, or Abusive Acts and Practices).
  
• States like California, New York, Massachusetts, Illinois, and Colorado have strong consumer financial protection frameworks.
  
• They can prosecute predatory lending, unfair debt collection, privacy violations, and more often mirroring federal standards.
  

Example: California’s Department of Financial Protection and Innovation (DFPI) acts as a “mini-CFPB.”

2. Create their own rules

• States can regulate fees, disclosures, licensing, and communications within their jurisdiction.
  
• They can pass stricter laws than federal standards, for example on:
  
  • Medical debt reporting
    
  • Pay transparency
    
  • Credit card fee disclosures
    
  • Data privacy (like California’s CCPA/CPRA)
    

3. Coordinate multi-state investigations

• State attorneys general (AGs) often collaborate across states or with federal agencies (when active) to investigate bad actors.
  
• In the absence of strong federal enforcement, they may lead joint actions or class-action support.
  

What states cannot do

1. Set nationwide financial rules

• State laws apply only within state borders.
  
• They cannot enforce a uniform national standard like the CFPB can.
  

For national banks, fintechs, or collectors working across 10+ states, this creates a patchwork compliance landscape which is more complex and inconsistent.

2. Regulate federal agencies or pre-empted entities

• Federal banking laws preempt certain state laws, particularly for national banks and credit unions.
  
• The CFPB, as a federal agency, had authority to supervise large banks and non-banks nationwide. States do not.

3. Replace rule-making scope at scale

• The CFPB’s work on open banking, AI use in lending, data brokers, and digital payments involved rule-making, supervision, and enforcement across complex ecosystems.
  
• Most states lack the funding, staffing, or legal authority to take over such federal roles.
  

Bottom line

States can’t replace the CFPB but they can soften its absence.

They can:

• Enforce state laws
  
• Pass new consumer protections
  
• Investigate and litigate abuse
  

But they cannot replicate the national reach, supervisory power, or unified rule-making authority the CFPB provides.

If federal oversight continues to shrink, we can expect:

• A rise in state-level enforcement
  
• Increased litigation risk
  
• More compliance complexity for national firms

{{cta-banner}}