The California Department of Financial Protection and Innovation (“DFPI”) has issued a Second Invitation for Comments on a proposed rulemaking that would expand registration and reporting requirements under the California Consumer Financial Protection Law (“CCFPL”) to certain consumer-reporting providers.
This proposed rulemaking follows the DFPI’s inaugural CCFPL registration framework finalized in 2024, which became effective on February 15 of last year and imposed registration and reporting obligations on previously unregistered providers of income-based advances, private postsecondary education financing, debt settlement services, and student debt relief services. Shortly after adopting that initial framework, on October 28, 2024, the Department issued an invitation for comments on requiring registration and reporting from additional categories of covered persons under the CCFPL.
The current invitation indicates that consumer-reporting providers are under consideration due to the central role consumer reports and account information play in decisions regarding the offering and provision of consumer financial products and services, as well as the potential for consumer and market harm if such activities are not adequately supervised. Through this latest invitation, the DFPI signals its continued intent to broaden supervisory oversight of financial services operating in California.
The rulemaking would apply registration and reporting requirements to persons engaged in collecting, analyzing, maintaining, or providing consumer report or account information used, or expected to be used, in connection with decisions regarding the offering or provision of a consumer financial product or service. While the contemplated scope draws from Financial Code section 90005(k)(9), the DFPI is explicitly seeking input on how that definition should be interpreted and whether additional clarification is needed to address gaps or ambiguities. Notably, the DFPI’s inquiry extends beyond traditional consumer reporting agencies and raises questions regarding the potential coverage of data brokers, aggregators, resellers, and furnishers, as well as the interaction between the CCFPL and other regulatory regimes, including the federal Fair Credit Reporting Act, California’s Consumer Credit Reporting Agencies Act, and California’s Data Broker Registration law.
In addition to definitional issues, the DFPI is soliciting feedback on the appropriate scope and structure of registration, reporting, and oversight obligations for consumer-reporting providers. Topics include potential application requirements, annual registration fees, recordkeeping obligations, bonding or other financial requirements, and the scope of information registrants may be required to report, such as dispute metrics, complaint handling, data breach information, and the use of alternative data. The DFPI is also requesting information regarding the economic impact of potential regulation, including effects on competition, job creation, business expansion, and whether reasonable, less burdensome alternatives could achieve the same consumer-protection objectives.
Although no formal proposed regulations have been issued at this stage, the Second Invitation for Comments reflects the DFPI’s ongoing effort to expand its supervisory reach over consumer financial services that influence access to credit and other financial products. Entities involved in consumer reporting, data aggregation, analytics, or related services, particularly those not historically subject to DFPI registration, should closely evaluate whether their activities could fall within the contemplated scope and consider submitting comments to help shape the regulatory framework.
The DFPI has emphasized that this pre-rulemaking process is intended to promote transparency and stakeholder engagement. Comments must be submitted by February 26, 2026, after which the Department may proceed with formal rulemaking under the CCFPL.
