In response to the 2008 financial crisis, a number of financial regulations were implemented including, most notably, the Dodd Frank Wall Street Reform and Consumer Protection Act of 2010. Under Sections 1031 and 1036 of the Dodd Frank Act, providers of financial products or services to consumers are prohibited from engaging in unfair, deceptive, or abusive acts or practices (UDAAP).

The Consumer Financial Protection Bureau (CFPB) and Federal Trade Commission (FTC) are responsible for enforcing the UDAAP rules. The regulators regularly monitor transactions that involve offering financial products and services to consumers for compliance with the UDAAP rules. The Office of the Comptroller of the Currency (OCC), an independent bureau of the U.S. Treasury Department, publishes a booklet providing guidance on interpreting UDAAP provisions.

An act or practice is defined as “unfair” under the Dodd Frank Act if it causes or is likely to cause substantial injury to consumers. A “substantial injury” usually equates to monetary harm. In addition, the injury must not be reasonably avoidable by consumers. Finally, the injury must not be outweighed by countervailing benefits to consumers or competition.

Under the UDAAP rules, it is unlawful for providers of financial products and services to mislead consumers through a lack of clear or full disclosure. Providers are also prohibited from coercing or deceiving consumers into making purchases they would otherwise not make in the presence of accurate information. For example, if a mortgage lender advertises fixed-rate mortgages, but then only effectively offers floating rate mortgages, such deceptive advertising could result in a UDAAP violation. Materials that create unrealistic expectations or that target vulnerable consumers also may be deemed to violate UDAAP.

Common UDAAP violations include using exaggerated statements, making subjective claims, creating a false sense of urgency, and representing that there are no barriers to entry for getting approved for a particular financial product or service. UDAAP violations can result in reputational harm and monetary fines.

The civil money penalties vary under the consumer protection laws of the Dodd Frank Act. The reckless violation of a consumer protection law can result in a civil penalty of up to $25,000 per day. The knowing violation of a consumer protection law can result in a civil penalty of up to $1 million per day. General violations of consumer protection laws that are not deemed reckless or knowing violations can result in penalties of up to $5,000 per day.

An example of a CFPB enforcement action for an alleged UDAAP violation involved Citibank in 2016. The CFPB claimed that Citibank engaged in deceptive and abusive practices in selling credit card debt and overstating the interest rates. Citibank had to pay an $8 million fine for the UDAAP violations.

There have been a number of lawsuits targeting the CFPB’s UDAAP authority. Pursuant to the “major questions doctrine”, these cases argue that Congress does not delegate to federal agencies authority over matters of major economic and political significance unless it is expressly mandated. Many of these lawsuits are pending resolution.

Businesses, organizations, and other financial service providers can avoid UDAAP violations by establishing clear guidelines and compliance monitoring programs. There should be robust processes in place for reviewing marketing materials prior to their release to ensure the wording does not present risk of a UDAAP violation.