The Big Fifty: State of Enforcement: Part Two

Welcome to the second half of our two-part blog series, The Big Fifty. Last week, we examined Section 1042 of the Consumer Financial Protection Act, Title X of the Dodd Frank Wall Street Reform and Consumer Protection Act, (CFPA), which grants authority to the states to enforce consumer financial protection laws. Today we're taking a look at how states might exercise those powers under Section 1042. We'll talk about a pending case going through the courts and we'll look at examples of other matters states have brought using Section 1042 and other authorities.

Ramping Up Enforcement

In January 2024, the New York State Attorney General (NYAG) sued Citibank for consumer fraud under the Electronic Fund Transfer Act (EFTA) and its implementing regulation, Reg E. The suit alleged that Citibank (i) lacked sufficient online data security measures; (ii) failed to respond appropriately to red flags; and (iii) failed to limit the theft that the scams caused. Notably, the petition argues that Reg E applies to wire transfers, which would upend existing precedent that section 4A of the Uniform Commercial Code (UCC) exclusively applies and therefore invalidates Reg E's $500 liability limitation.

New York filed its lawsuit in a regulatory-friendly environment, when Director Chopra still headed the CFPB. The CFPB even filed an amicus brief in support of the NYAG's position. However, in March 2025, the CFPB's new leadership submitted a Motion to Withdraw the brief, stating that, "Agencies cannot amend regulations through litigation filings, which do not give fair notice to regulated parties or follow the requirements of the Administrative Procedure Act." (America's Credit Unions also filed an amicus brief that opposed the reclassification of a wire transfer as an electronic transfer under Reg E.)

A Historical Look at State Action Under Section 1042

According to Former CFPB Director Chopra and former CFPB General Counsel Seth Frotman, in this Harvard Law article (the article), approximately 50 enforcement actions have been brought by states since Section 1042 went into effect. Two were multi-state actions that included all 50 states and the District of Columbia. Actions have been brought by 23 individual states and by administrations of both parties. The CFPB joined 15 of these claims. Almost half - 24 - of those suits asserted Unfair, Deceptive, and Abusive Acts or Practices (UDAAP) claims from the CFPA, 13 were brought under the Enumerated Consumer Laws, and 13 alleged both.

Advantages of State Actions

States, generally, can more quickly bring action against localized emerging risks, such as a 2023 suit by Tennessee and Kentucky against a regional, at-home solar company, Solar Titan, USA. The suit claimed Solar Titan violated the CFPA and UDAAP principles by representing to consumers that they would generally be eligible for a substantial tax credit that was not actually available to all homeowners and by incorrectly describing when billing on loans would begin.

Familiarity with local communities is another advantage. In 2017, the Navajo Nation sued Wells Fargo for creating and opening unauthorized bank accounts and debit cards in the name of its customers. The Navajo Nation alleged its people were targeted because Wells Fargo was the only banking choice for many of its people. Although the initial complaint was dismissed, the Navajo Nation appealed and Wells Fargo settled for $6.5 million.

Section 1042 allows states to go after conduct that may not be addressed by state law. Texas utilized Section 1042 to take on a set of land development companies called Colony Ridge that were engaging in deceptive acts or practices by selling land with significant defects to foreign born and Hispanic consumers with little to no access to credit and then repossessing the land for resale when the buyers defaulted.

Exercise of Powers

In the absence of robust federal enforcement, state authorities have the authority to create stronger consumer protection laws that exceed federal regulations. There are many tactics a state can take to enforce consumer protection laws. Credit unions should consider evaluating their risk management plans to ensure they account for the possibility of state enforcement specifically with respect to consumer complaints, which are "low hanging fruit".