The regulatory challenge for banks, fintechs, payments networks, and credit providers is shifting from a single federal focal point—the CFPB—to a fragmented map of state attorneys general (AGs), legislatures, and courts. New York’s lawsuit against Zelle’s owner, Early Warning Services, crystallizes the trend: as federal enforcement recedes, aggressive state actions are filling the vacuum. The result is a “many-masters” regime that raises cost, legal risk, and time-to-market; these costs are ultimately borne by consumers through higher prices, fewer products, and slower innovation.
What changed—and why it matters
Federal retrenchment → state surge. With the federal CFPB scaling back and courts green-lighting workforce reductions, states have stepped in with new laws and enforcement priorities. This is not hypothetical: at least 16 states have enacted consumer-finance measures this year alone, especially on “junk fee” transparency and abusive practices. Expect more in 2026–2029.
Case in point—New York v. Zelle. AG Letitia James sued Zelle parent company Early Warning Services alleging inadequate fraud protections in Zelle’s design. Whether or not the claims prevail, the suit signals that high-profile, product-design-oriented enforcement will proceed even if similar federal actions stall.
Statutory muscle upgrade. New York’s legislature passed the FAIR Business Practices Act, expanding the AG’s reach from “deceptive” to also “unfair” and “abusive” acts, bringing state law closer to the CFPB’s UDAAP toolkit and inviting broader theories of liability. At the time of writing, the measure awaited gubernatorial action.
Key federal rule rolled back. A Texas federal judge vacated the CFPB’s medical-debt reporting rule, prompting states to advance their own restrictions on how medical debt shows up in credit reports. Patchwork, not preemption, is now the base case.
The emerging “patchwork” risks
- Payments & fraud reimbursement: State AGs are zeroing in on peer-to-peer (P2P) design choices, KYC/verification, and scam reimbursement frameworks (e.g., Zelle case). Firms face divergent state views on what counts as “adequate” consumer protection and fair error resolution.
- Pricing & “junk fee” transparency: Expect state-by-state rules for all-in pricing, display prominence, and fee descriptions (Illinois and others). It’s costly to retool checkout flows and disclosures per jurisdiction, especially when state standards differ from the FTC’s federal fee rule.
- UDAAP at the state level: With FAIR-style bills, more AGs will bring “unfair” and “abusive” cases in areas where federal attention waned. The evidentiary bar and remedies (civil penalties, restitution, injunctive relief) vary, complicating nationwide product launches.
- Credit reporting & eligibility data: After the medical-debt rule’s vacatur, several states moved to curb how medical debts affect credit files. Compliance teams must reconcile multiple state prohibitions with national bureau workflows under tight deployment timelines.
- Small-business finance (merchant cash advance & sales-based financing): Texas’s HB 700 imposes disclosure, registration, and operational limits (e.g., tight constraints on ACH debits absent a perfected control interest), signaling more oversight of non-consumer credit products that still touch bank rails and payments risk.
- Data, privacy & cross-statute theories: State AGs are testing federal-law-style claims (e.g., COPPA/VPPA) and broad state consumer statutes against tech and finance adjacencies (e.g., Michigan v. Roku; auto telematics cases against GM/OnStar). Financial services firms that ingest, share, or rely on such data can get pulled into multi-state litigation or investigative cooperation burdens.
Why this is bad for consumers
Higher compliance overhead → higher prices. Fifty differing regimes demand engineering customizations, legal reviews, and state-specific workflows. Those fixed costs are spread across consumers, especially harming low- and moderate-income users.
Slower, narrower innovation. Firms will ship the slowest, most restrictive common denominator, or skip certain states entirely. Consumers lose choice, competition, and feature velocity.
Regulatory risk favors incumbents. Large firms can carry overhead; new entrants cannot. Patchwork enforcement entrenches the biggest players and reduces market dynamism, contrary to the stated consumer-protection aims.
Scenario outlook
Baseline: More AG coalitions, more FAIR-style laws, more suits targeting product design and data flows; continued litigation over federal rollbacks and agency downsizing.
Upside (for clarity): A handful of states adopt harmonized templates (e.g., model disclosures), or Congress establishes lean, preemptive baselines with safe harbors.
Downside: Escalating conflicts among states (e.g., contradictory fee-display mandates vs federal rules), forum-shopping, and parallel class actions piggybacking on AG theories.
What companies should do
- Map your “hardest five” states (e.g., NY, CA, IL, TX, PA/MD) by exposure: complaints, fee rules, UDAAP scope, and AG posture. Build to the strictest set only where essential; otherwise compartmentalize features by state.
- Harden fraud & reimbursement policies in P2P and card-not-present flows. Document controls that state AGs expect (identity/authentication, scam-interdiction, recovery pathways) and publish clear, consumer-friendly policies.
- Adopt a unified, all-in pricing chassis that can toggle state-required labels, prominence rules, and display ordering. Treat FTC and state requirements as configuration, not code rewrites.
- Segment credit-data logic by state (especially medical debt handling) and capture audit trails showing how bureau pulls, decisioning, and adverse-action notices adapt per jurisdiction.
- For small-business finance, re-paper Texas now. Build broker registration, control-agreement workflows, and ACH guardrails to comply with HB 700—and assume other states will follow.
- Stand up a “State AG playbook.” Pre-assign outside counsel by region, centralize CID/subpoena intake, set SLA-based response protocols, and rehearse multi-state settlement strategies.
- Invest in consumer education (scam typologies, fee explanations, dispute timelines). Transparent, proactive comms reduce complaint volume—the fuel for AG investigations.
What policymakers should do
- Prefer clear, minimal federal baselines to conflicting state mandates. Congress should set narrow, preemptive standards (e.g., fee-display guardrails, data-sharing consent) with safe harbors for good-faith compliance.
- Reject price controls; embrace transparency. Mandate honest math (total-price disclosure) but avoid rules that micromanage business models and choke market entry.
- Encourage industry codes of conduct. Let firms earn safe-harbor status by meeting auditable standards for fraud prevention, disclosures, and complaint resolution—market discipline over command-and-control.
- Prioritize outcomes, not checklists. Measure consumer harm reduction (e.g., successful scam reimbursements, reduced complaint rates) rather than prescriptive, state-specific design dictates.
Brass tacks
For more than a decade, financial services companies could at least count on a single federal regulator, the CFPB, as the primary arbiter of consumer financial protection. Firms might not have liked the Bureau’s expansive interpretation of its mandate, but they could at least direct resources toward one playbook, one set of rules, and one enforcement posture.
That era is over. What we are witnessing today is a transformation from one regulator into many: a fragmented landscape in which up to fifty state attorneys general, empowered by new statutes and emboldened by federal retreat, are stepping in as mini-CFPBs. Each is writing its own rules of the road, testing novel theories of liability, and seeking headline-grabbing settlements. For national firms, this means the same product or service could be deemed lawful in Texas, unlawful in New York, and subject to entirely different disclosure mandates in Illinois.
This patchwork of enforcement doesn’t just create headaches for compliance officers: it carries real costs for consumers. Higher legal risks and compliance burdens get baked into the price of credit, payments, and financial products. New entrants are discouraged, innovation slows, and families already living on the margins are left with fewer choices.
At the Southwest Public Policy Institute, we believe consumer protection works best when it is clear, predictable, and limited to addressing true fraud or abuse—not when it is splintered into fifty different experiments in regulation. The replacement of one centralized bureaucracy with dozens of decentralized ones undermines both efficiency and liberty. Unless policymakers restore a coherent, minimal federal baseline with room for markets to innovate, the next four years will be defined by confusion, higher costs, and diminished financial access.
From one, many may be a fitting motto for the American republic, but when it comes to consumer financial regulation, multiplying bureaucracies only means multiplying burdens.