• Key Insight: The Consumer Financial Protection Bureau and other federal regulators are retreating from enforcement and supervision, creating a void that states are actively stepping in to fill.
• What's at Stake: Some state agencies are hiring former CFPB officials from what some refer to as the "CFPB diaspora," bringing the bureau's aggressive tactics to the state level. 
• Forward Look: States wield authority from the Dodd-Frank Act to enforce laws against "unfair, deceptive and abusive acts and practices" against state-chartered banks and non-banks.

State attorneys general and banking agencies are stepping into the void left by the Consumer Financial Protection Bureau by increasing enforcement, hiring former CFPB officials, and issuing regulations furthering the aims of Biden-era CFPB rules rescinded by the Trump administration. 

State attorneys general have broad authority to pursue enforcement actions against financial firms, though state banking regulators tend to have limited budgets and can only take action against state-chartered banks. The Dodd-Frank Act authorized states to enforce the federal prohibition on unfair, deceptive or abusive acts or practices — known as UDAAP — and a handful of states are pushing for aggressive enforcement overall, most notably New York, California, Pennsylvania, Massachusetts and Connecticut. 

Last month, New York Governor Kathy Hochul signed the Fostering Affordability and Integrity through Reasonable Business Practices Act, known as the FAIR Act, which expands the state's authority over "unfair," and "abusive" acts. The bill represents the first major update to New York's consumer protection laws in 45 years. 

"States are absolutely stepping up, but I don't think they can fully fill a breach left by the CFPB without a lot more funding now," said Joe Sanders, a partner at the law firm Hinshaw & Culbertson and a former senior litigation counsel at the CFPB. "You're going to see increased activity by the states — it's just going to look different from the CFPB."

As an example, Sanders cited a recent $425 million settlement in a class action lawsuit against Capital One, in which a coalition of state attorneys general filed an amicus brief opposing the initial proposed settlement, with the judge initially declined to sign off on it. The CFPB under the Trump administration had dismissed a lawsuit based on the same facts. The judge who had rejected the deal, approved it after Capital One agreed to pay more restitution plus provide higher interest rates to current customers. Capital One was sued for misleading consumers about its 360 Savings accounts. 

State AGs have broad jurisdiction and powers, and some agencies are working to scale back Trump's deregulatory plans. 

Toward that end, a working group of the Democratic Attorneys General Association recently hired former CFPB Director Rohit Chopra to advise on consumer protection and affordability issues. Chopra recommended last year that states adopt best practices to enforce under the Trump administration, though the guidance was rescinded by acting CFPB Director Russell Vought, who scaled back nearly all supervision and enforcement of consumer protection laws at the federal level. 

Ian Barlow, of counsel at Wiley Rein LLP and a former senior staff attorney at the Federal Trade Commission, said states are taking a close look at artificial intelligence and discrimination in lending. Because enforcement actions involve non-public investigations, it can take two to three years before a lawsuit or settlement is announced.  

"Every state has a different level of staffing, bandwidth and sophistication, and I do think we're going to see states taking a more active role in how they scrutinize banks," Barlow said. "I think there's also a likelihood that blue state AGs are going to start scrutinizing the use of AI in making lending decisions that may lead to discrimination or have a discriminatory impact."

State lawmakers also are responding.

Last year Colorado passed a law that requires AI developers to take "reasonable care" to protect consumers from the risks of algorithmic discrimination. A handful of states, including California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon, have signed a memorandum of understanding to coordinate investigations and enforcement on AI. 

In another example, New Jersey's Division on Civil Rights finalized revisions to the state's disparate impact regulations — which the CFPB gutted under Trump. New Jersey's Attorney General Matthew Platkin described the civil rights law as the "oldest and strongest state civil rights law in the country," predating the Civil Rights Act by nearly 20 years. The law prohibits discrimination based not only on race, color, national origin, marital status, or sex, but also a host of other factors including ancestry, domestic partnership status, pregnancy and gender identity.

The calculus of states stepping up has been complicated by Federal Reserve Vice Chair Michelle Bowman, who issued a directive for Fed examiners to rely initially on supervisory and examination work performed by states. The retreat from certain supervisory practices comes as the Fed plans to cut its supervision and regulation staff by 30% in 2026. 

The Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. also have issued proposals to redefine unsafe and unsound banking practices, and have already cut back on issues surrounding reputational risk. Currently, there are no Democrats on the five-member board of the FDIC, despite congressional requirements. 

"Everything has come to a grinding halt with no enforcement, no supervision," said Joe Lynyak, a partner at Dorsey & Whitney. 

Some states, but by no means all, are focused on banks or financial products. Recently seven states sent letters to Buy Now, Pay Later lenders asking probing questions about their products and business practices, after a CFPB pullback. 

California Attorney General Rob Bunta has sued President Trump more than 50 times, and while he has challenged the dismantling of the CFPB, the lawsuits range from ice detentions to cutting SNAP benefits to data privacy.. 

David Piper, a defense lawyer at the law firm Stradley Ronon, said anyone doing business in California is aware of California's Privacy Protection Agency moving aggressively with new requirements for data compliance. The CPPA recently fined Tractor Supply, a diversified retailer, $1.35 million for violations of the California Consumer Privacy Act.

"As they get more of these settlements under their belt, they are going to be more aggressive in what they're doing," Piper said. "It shows the level of aggressiveness we can expect from the agency."

Some states are particularly motivated to step into the fray. 

The New York Department of Financial Services recently hired Gabriel O'Malley, a former deputy enforcement director at the CFPB, as its executive deputy superintendent, the top cop at the state banking agency. Meanwhile, Chris D'Angelo, who served as the chief of staff under former CFPB Director Richard Cordray, is New York's chief deputy attorney general for economic justice. 

Pennsylvania also has a former CFPB alumni in Nicholas Smyth, the assistant chief deputy attorney general, who was an enforcement attorney at the CFPB's founding. Last year, Pennsylvania Governor Josh Shapiro launched a new centralized consumer protection hotline, website, and email address to make it easier for state residents to report allegations of scams. 

Generally, large banks have been big beneficiaries of the Trump administration's deregulatory approach. Last year, the CFPB dismissed with prejudice a lawsuit against Zelle, its parent company, Early Warning Services, Wells Fargo, Bank of America and JPMorgan Chase. The dismissal prompted New York Attorney General Letitia James to sue the payment app for failing to protect customers from fraud, but not the individual banks. 

All of this means that banks are likely to scale back their compliance efforts in the near-term, and potentially may ultimately reduce the number of consumer finance attorneys they employ, Lynyak said. 

"States generally don't have the economic resources or the authority to investigate national banks," Lynyak said. "We could end up with a pared-down examination approach where a bank could end up in a situation with a high CAMELS rating, but consumer violations that don't rise to the level of issuing a [citation]."