Summary. A business does not have to be a bank to be subject to consumer financial protection law. Pulling a credit report on an applicant, collecting a past-due invoice, offering payment plans, or extending trade credit each triggers a federal statute with statutory damages, fee-shifting, and a plaintiffs' bar built around it. This article covers the FCRA's permissible purpose, adverse action, background check, and furnisher rules; the FDCPA and Regulation F; the ECOA and Regulation B; and TILA and Regulation Z — then UDAAP, state analogues, damages, and program design.

A 90-employee equipment dealer does three ordinary things in one week.

It runs a background check on a service technician candidate and, when the report shows a five-year-old theft conviction, declines to hire — sending no letter, because the candidate was never told they were a finalist.

It sends a past-due customer a letter on the letterhead of "Regional Recovery Associates," a name it invented so that customers would take collection seriously.

And it declines a credit application from a small business owner, telling him by phone that "the numbers just didn't work."

Three statutes, three violations.

The hiring decision required a pre-adverse action notice with a copy of the report and a summary of rights, a waiting period, and a final adverse action notice — none of which happened. The collection letter, using a fictitious third-party name, made the dealer a debt collector under the FDCPA with respect to its own debt, subjecting it to a statute it would otherwise have been outside. And the credit denial required a written adverse action notice with the specific reasons under the ECOA, within 30 days.

None of this involved lending money, and none of it required the company to think of itself as a financial institution. The statutes attach to activities, not to industries.

The short answer

Four statutes reach ordinary businesses:

  1. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq. — anyone who obtains a consumer report, or furnishes information to a credit bureau.
  2. The Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq. — third-party debt collectors, plus creditors using a false name.
  3. The Equal Credit Opportunity Act (ECOA), 15 U.S.C. § 1691 et seq., and Regulation B — anyone who regularly extends credit, including trade credit.
  4. The Truth in Lending Act (TILA), 15 U.S.C. § 1601 et seq., and Regulation Z — creditors extending consumer credit subject to a finance charge or payable in more than four installments.

Plus the Electronic Fund Transfer Act and Regulation E for electronic payments and recurring debits, and the CFPB's UDAAP authority, which reaches conduct no specific statute addresses.

Why they matter disproportionately: statutory damages without proof of actual harm, attorney's fees to prevailing plaintiffs, and claims that aggregate into classes easily. The exposure is rarely the individual claim.

The FCRA: obtaining consumer reports

A consumer report is any communication by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, used or expected to be used in whole or in part for a permissible purpose.

Permissible purposes, § 1681b(a), include: a court order or grand jury subpoena; the consumer's written instructions; a credit transaction involving the consumer; employment purposes; insurance underwriting; determining eligibility for a government license or benefit; a legitimate business need in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet its terms; and account review for collection.

What is not a permissible purpose: curiosity about a competitor's principal, checking on a tenant's guarantor without their instruction, screening a business partner, or general due diligence not tied to a transaction the consumer initiated. Obtaining a report without a permissible purpose is a violation, and doing so under false pretenses is a criminal offense, § 1681q.

Employment background checks, § 1681b(b), have their own sequence, and it is where most FCRA class actions against employers arise:

  1. Disclosure — a clear and conspicuous disclosure in a document consisting solely of the disclosure, that a consumer report may be obtained for employment purposes. The standalone requirement is literal. Including a liability release, state law notices, or additional text in the same document violates it, and courts have repeatedly said so.
  2. Written authorization from the consumer.
  3. Certification to the consumer reporting agency of compliance and of non-discriminatory use.
  4. Pre-adverse action notice — before taking adverse action based in whole or in part on the report, provide a copy of the report and the CFPB's Summary of Rights, and allow a reasonable period (commonly five business days) for the consumer to respond.
  5. Adverse action notice — after the waiting period, notice of the action, the agency's name, address, and telephone number, a statement that the agency did not make the decision and cannot give reasons, and notice of the right to a free copy of the report within 60 days and to dispute its accuracy.

Investigative consumer reports — those involving personal interviews about character, general reputation, or mode of living — require additional disclosure within three days and, on request, disclosure of the nature and scope of the investigation.

Criminal history use. Independent of the FCRA, "ban the box" laws in most states and many cities prohibit inquiry before a conditional offer, and Title VII disparate impact principles require an individualized assessment considering the nature of the offense, the time elapsed, and its relationship to the job.

Adverse action in credit, § 1681m, requires a similar notice when a credit report contributes to a denial or a less favorable term, including the credit score, key factors, and the agency's contact information. The risk-based pricing rule requires notice where a consumer receives materially less favorable terms based on a report.

The FCRA: furnishing information

A business that reports consumer payment information to a credit bureau is a furnisher, and § 1681s-2 imposes distinct duties.

Accuracy, § 1681s-2(a). A furnisher may not report information it knows or has reasonable cause to believe is inaccurate, must correct and update information it determines is incomplete or inaccurate, must notify of a consumer's dispute, must report the date of first delinquency for accounts placed for collection or charged off, and must have reasonable written policies and procedures regarding accuracy and integrity under the Furnisher Rule, 12 C.F.R. part 1022 subpart E. These duties are enforced by regulators, not by private suit — there is no private right of action under subsection (a).

Dispute investigation, § 1681s-2(b), is privately enforceable, and it is the source of most furnisher litigation. On receiving notice of a dispute from a consumer reporting agency (typically through the e-OSCAR system), the furnisher must:

  • Investigate the dispute;
  • Review all relevant information provided by the agency;
  • Report the results to the agency;
  • If the information is found inaccurate or incomplete, report the results to all nationwide agencies to which it furnished; and
  • Modify, delete, or permanently block reporting of information that is inaccurate, incomplete, or cannot be verified.

The recurring failure is a superficial investigation — matching the disputed tradeline against the furnisher's own system, confirming the system says what it says, and reporting "verified." Courts have repeatedly held that a reasonable investigation requires more where the dispute raises a question the internal record cannot answer, such as identity theft, a discharged debt, or a dispute about whether the consumer ever owed the debt at all.

Identity theft provisions add blocking obligations upon receipt of an identity theft report, and prohibit selling or transferring a debt the furnisher has been notified is the product of identity theft.

Credit reporting agency duties — maximum possible accuracy under § 1681e(b) and reinvestigation under § 1681i — are the counterpart, and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), sharply limited who may sue over them by holding that class members whose inaccurate information was never disseminated to a third party lacked concrete injury for Article III standing.

The FDCPA and Regulation F

Who is covered. A debt collector is any person who uses interstate commerce or the mails in a business the principal purpose of which is the collection of debts, or who regularly collects debts owed to another, § 1692a(6).

Creditors collecting their own debts in their own name are generally not covered. But three traps convert an ordinary business into a debt collector:

  1. Using a name other than its own that suggests a third party is collecting — the "false name" exception in § 1692a(6). The equipment dealer's "Regional Recovery Associates" letterhead is the paradigm case.
  2. Acquiring debts in default and collecting them, which the Supreme Court addressed in Henson v. Santander Consumer USA Inc., 581 U.S. 79 (2017), holding that a party purchasing debts and collecting for its own account is not necessarily a debt collector under the "owed to another" prong — leaving the "principal purpose" prong as the operative question.
  3. Being a law firm that regularly collects debts, which is covered.

Note also that the FDCPA applies only to consumer debts — obligations of a natural person arising from a transaction primarily for personal, family, or household purposes. Commercial debt collection is outside it, though state statutes may reach it.

The validation notice, § 1692g and Regulation F, 12 C.F.R. part 1006. Within five days of the initial communication, the collector must provide validation information: the debt collector's name and mailing address; the consumer's name and mailing address; the merchant brand or name associated with the debt; the account number; the itemization date and the amount owed on that date; an itemization of interest, fees, payments, and credits since; the current amount; the consumer's rights to dispute and to request the name and address of the original creditor within 30 days; and information about the CFPB's model validation notice. Using the Model Validation Notice provides a safe harbor.

If the consumer disputes in writing within 30 days, collection must cease until the debt is verified and verification is mailed.

Communication rules, § 1692c and Regulation F:

  • No communication at an unusual time or place, presumptively before 8:00 a.m. or after 9:00 p.m. local time.
  • No communication at the consumer's place of employment if the collector knows the employer prohibits it.
  • No communication if the consumer is represented by an attorney and the collector knows it.
  • Cease communication on written request, except to advise of specified actions.
  • Third-party contacts limited to location information, with strict content limits — no disclosure of the debt, no more than one contact per person absent a request, and no postcards or envelopes indicating debt collection.
  • Regulation F's call frequency presumption: more than seven calls within seven consecutive days regarding a particular debt, or a call within seven days after a telephone conversation about that debt, is presumed to violate the harassment prohibition.
  • Electronic communications — email and text — are permitted with procedures for obtaining consent or using a safe harbor, and each must include a reasonable and simple method to opt out.
  • Limited-content messages permit a voicemail with defined content that does not constitute a communication and therefore does not trigger third-party disclosure.

Prohibited conduct:

  • Harassment or abuse, § 1692d — threats of violence, obscene language, publishing lists of debtors, repeated calls to annoy.
  • False or misleading representations, § 1692e — misrepresenting the amount or legal status of the debt, falsely implying attorney involvement, threatening action that cannot legally be taken or is not intended, and using a false business name.
  • Unfair practices, § 1692f — collecting amounts not authorized by the agreement or by law, depositing postdated checks early, and communicating by postcard.

Time-barred debt. Suing on, or threatening to sue on, a debt beyond the limitations period violates §§ 1692e and 1692f. Regulation F requires disclosures where a collector knows or should know the debt is time-barred and, separately, prohibits furnishing information about a debt to a credit bureau before making a validation-related communication and waiting a reasonable period.

The least sophisticated consumer standard governs whether a communication is misleading in most circuits, with several using a "least sophisticated" and others an "unsophisticated" formulation. Both are far below the reasonable consumer standard used elsewhere.

Bona fide error defense, § 1692k(c), requires a preponderance showing that the violation was unintentional and resulted from a bona fide error notwithstanding the maintenance of procedures reasonably adapted to avoid it — and Jerman v. Carlisle, McNellie, Rini, Kramer & Ulrich LPA, 559 U.S. 573 (2010), held the defense does not cover mistakes of law.

Limitations: one year, and Rotkiske v. Klemm, 589 U.S. 8 (2019), held the period runs from the date of the violation, not from discovery, absent an equitable tolling doctrine the Court did not address.

The ECOA and Regulation B

Who is covered. Any creditor — a person who regularly extends, renews, or continues credit, or who regularly arranges for it. This includes a business that extends trade credit to customers, and it includes both consumer and business credit.

The prohibition, § 1691(a): discrimination against an applicant with respect to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex (including sexual orientation and gender identity, per CFPB interpretation following Bostock v. Clayton County, 590 U.S. 644 (2020)), marital status, age (provided the applicant has capacity), because all or part of income derives from a public assistance program, or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.

Both disparate treatment and disparate impact theories apply.

Adverse action notices, § 1691(d) and 12 C.F.R. § 1002.9, are the compliance obligation most often missed:

  • Notify the applicant of action taken within 30 days of receiving a completed application.
  • For adverse action, provide either a statement of specific reasons for the action, or a disclosure of the applicant's right to obtain the reasons within 30 days of request.
  • The reasons must be specific and accurate. "Failed to meet our credit standards," "internal policy," and "insufficient information" are inadequate; the model forms list acceptable reasons.
  • Include the ECOA notice identifying the federal agency administering compliance.
  • Where a credit report was used, the FCRA notice requirements apply as well, and the two are usually combined.

Business credit receives modified treatment: for applicants with gross revenues above a threshold, notice may be oral and reasons need only be provided on request, but the notification obligation itself remains.

AI and automated underwriting. The CFPB has stated that creditors using complex algorithms must still provide accurate and specific reasons for adverse action, and that the complexity of a model is not an excuse for a generic notice — a point of direct significance for any lender or trade creditor using a scoring model it cannot explain.

Spousal signatures, 12 C.F.R. § 1002.7(d), generally prohibit requiring a spouse's signature where the applicant qualifies independently, with exceptions for jointly held collateral in community property and entireties states. Personal guaranty practices at small banks have generated substantial ECOA litigation on this provision.

Record retention: 25 months for consumer credit, 12 months for business credit above the revenue threshold, and longer where notified of an investigation or an action.

Small business lending data. Section 1071 of Dodd-Frank and its implementing rule require covered financial institutions to collect and report demographic and other data on applications from small businesses, phased in by institution size, with the compliance dates having been the subject of litigation and extension.

TILA, Regulation Z, and the payment statutes

Scope. TILA applies to consumer credit — for personal, family, or household purposes — extended by a creditor who regularly extends credit subject to a finance charge or payable by written agreement in more than four installments, to a natural person, where the credit is primarily for personal, family, or household purposes. Business and agricultural credit is exempt, as is credit above a threshold amount unless secured by real property or a dwelling.

The four-installment rule is what catches ordinary businesses: offering to let a consumer pay in five monthly installments, even with no interest, can make the seller a creditor subject to Regulation Z disclosure requirements.

Core requirements:

  • Closed-end credit, 12 C.F.R. § 1026.18 — disclosure of the amount financed, finance charge, annual percentage rate, total of payments, payment schedule, security interest, late charges, and prepayment terms, before consummation.
  • Open-end credit — account-opening disclosures, periodic statements, and the credit card rules of the CARD Act, including limits on rate increases, fees, and marketing to those under 21.
  • Right of rescission, § 1026.23 — for credit secured by the consumer's principal dwelling other than a purchase-money mortgage, three business days, extended to three years if material disclosures or the notice of the right were not delivered. Jesinoski v. Countrywide Home Loans, Inc., 574 U.S. 259 (2015), held that the consumer need only notify the creditor within three years; filing suit is not required.
  • Advertising rules — triggering terms in an advertisement require additional disclosures.
  • Mortgage rules — TRID integrated disclosures, ability-to-repay and qualified mortgage standards, servicing rules, and loan originator compensation rules.

Damages. Actual damages, statutory damages within a defined range for individual actions, class damages capped by statute, and attorney's fees, § 1640. Rescission liability can be substantial.

The Electronic Fund Transfer Act and Regulation E govern electronic payments from consumer asset accounts: preauthorized recurring debits require written authorization with a copy to the consumer and the right to stop payment up to three business days before the transfer; error resolution procedures apply on notice; and unauthorized transfer liability is limited on a tiered schedule keyed to how quickly the consumer reports. A business that debits customers' bank accounts on a subscription is subject to it, and the authorization and stop-payment mechanics are where violations occur.

UDAAP, state analogues, and enforcement

UDAAP. The CFPB has authority under Dodd-Frank §§ 1031 and 1036, 12 U.S.C. §§ 5531, 5536, over unfair, deceptive, or abusive acts and practices by covered persons and service providers in connection with consumer financial products and services. The FTC has parallel authority over unfair or deceptive practices under FTC Act § 5 for entities outside the Bureau's jurisdiction.

  • Unfair — causes or is likely to cause substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits.
  • Deceptive — a representation, omission, or practice likely to mislead a consumer acting reasonably, and material.
  • Abusive — materially interferes with a consumer's ability to understand a term or condition, or takes unreasonable advantage of a consumer's lack of understanding, inability to protect their interests, or reasonable reliance on the covered person to act in their interests. This is the standard unique to the Bureau, and its contours continue to develop.

UDAAP fills gaps: junk fees, misleading fee disclosures, practices that make cancellation difficult, servicing failures, and conduct that no specific statute addresses.

State analogues are frequently broader:

  • Mini-FDCPA statutes that reach creditors collecting their own debts, which the federal statute does not — a critical difference for ordinary businesses.
  • State fair credit reporting statutes with additional restrictions on the use of criminal and credit history.
  • State UDAP statutes, most with private rights of action, minimum statutory damages, multiple damages, and fee-shifting.
  • State usury statutes, which cap rates and can void obligations, and which produce disputes about the "true lender" in bank partnership arrangements.
  • State licensing for lenders, brokers, servicers, and collection agencies, with penalties including unenforceability of the underlying obligation.

Enforcement. The CFPB supervises larger participants and enforces against covered persons; the FTC enforces § 5; state attorneys general enforce state statutes and, under Dodd-Frank § 1042, may enforce certain federal provisions; and private plaintiffs bring the majority of actions.

Damages exposure, in outline:

  • FCRA: actual damages and, for willful violations, statutory damages of $100 to $1,000 per violation plus punitive damages; negligent violations recover actual damages only; fees in both. Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), defined willfulness to include reckless disregard, while providing that a reading of the statute is not reckless if it is not objectively unreasonable.
  • FDCPA: actual damages, statutory damages up to $1,000 per action (not per violation) for individuals, class statutory damages capped at the lesser of $500,000 or one percent of net worth, plus fees.
  • ECOA: actual damages, punitive damages up to $10,000 individually and the lesser of $500,000 or one percent of net worth in class actions, plus fees.
  • TILA: actual and statutory damages, class caps, rescission, and fees.

Standing. TransUnion requires a concrete injury, and it has become the defense's principal tool against no-injury statutory claims — particularly in FCRA cases where inaccurate information was never disseminated, and in claims premised on receiving a defective notice with no downstream consequence. It has not eliminated these claims, but it has reshaped class definitions and settlement values.

Arbitration. Class waivers in consumer arbitration agreements are enforceable under AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), subject to the mass arbitration dynamics discussed elsewhere in this library. TILA prohibits mandatory arbitration for mortgages secured by a dwelling, and the Military Lending Act prohibits it for covered borrowers.

The Military Lending Act, 10 U.S.C. § 987, deserves separate mention: a 36 percent Military Annual Percentage Rate cap inclusive of most fees, mandatory oral and written disclosures, a prohibition on mandatory arbitration and on certain security interests, and safe harbor identification through the MLA database. It applies to consumer credit extended to active duty servicemembers and dependents, and violations can render the contract void.

Program design

For any business that touches consumer credit information or receivables:

  1. Map the activities. Do you pull consumer reports? For employment, credit, or another purpose? Do you furnish to bureaus? Do you extend credit or offer installment terms? Do you collect from consumers? Do you debit consumer bank accounts?
  2. Fix the FCRA employment sequence. A truly standalone disclosure with nothing else on the page; a separate authorization; pre-adverse action with the report and Summary of Rights; a waiting period; and a final notice. Audit the vendor's templates — the violation is usually in a form the background check provider supplied.
  3. Build adverse action notices for both credit and employment, with specific and accurate reasons, and never use a generic catch-all.
  4. Never collect under a name other than your own. The false name exception converts an ordinary creditor into a debt collector.
  5. If you use a collection agency, remember you can face vicarious and direct exposure through your instructions and through state statutes reaching creditors. Vet the agency, review its letters, and audit its call practices.
  6. Adopt written accuracy and dispute procedures if you furnish, and require investigations to go beyond confirming the internal system.
  7. Review installment offers against TILA's four-installment trigger before marketing them.
  8. Review recurring debit authorizations against Regulation E's written authorization and stop-payment requirements.
  9. Audit any automated decisioning for explainability sufficient to support a specific adverse action reason, and for disparate impact.
  10. Check state law — mini-FDCPA statutes reaching creditors, licensing requirements, usury caps, and UDAP statutes with fee-shifting.
  11. Retain records for the statutory periods, and preserve the underlying data an investigation would require.
  12. Train the people who actually make these decisions: recruiters, credit managers, and accounts receivable staff, none of whom are usually told any of this.

A worked example

Return to the equipment dealer, after counsel is engaged.

The background check. The company's disclosure form combined the FCRA notice with a liability release and four state-specific notices — a standalone violation, and the kind that supports a class action across every applicant screened in the limitations period. Remediation: a single-purpose disclosure page, a separate authorization, and a two-step adverse action process with a five-business-day window and templates. The company also adopts an individualized assessment procedure for criminal history and confirms compliance with its state's ban-the-box statute.

The collection letter. "Regional Recovery Associates" is discontinued immediately. Collection letters go out on the company's own letterhead, in its own name. Because the company collects only its own debts, in its own name, the FDCPA no longer applies — but counsel checks the state statute and finds that it reaches creditors, so the company adopts FDCPA-equivalent practices anyway: no calls outside 8:00 a.m. to 9:00 p.m., no workplace calls after notice, no third-party disclosure, cease-communication honored, and a written itemization on first contact.

The credit denial. The company adopts a written adverse action notice with reasons drawn from the Regulation B model form, issued within 30 days, combined with the FCRA notice where a report was used. It documents the underwriting criteria and reviews them for disparate impact, and it stops the practice of requiring a spouse's signature where the applicant qualifies alone.

Cost of remediation: a few days of counsel time and new templates. Exposure avoided: an FCRA class action across several hundred applicants, an FDCPA claim with fee-shifting, a state UDAP claim with multiple damages, and an ECOA claim on the spousal signature practice.

Frequently asked questions

We are not a lender. Does any of this apply? Yes, if you pull consumer reports, furnish to bureaus, extend trade credit or installment terms, or collect consumer debts.

Can we include a liability release in our background check disclosure? No. The disclosure must be in a document consisting solely of the disclosure. This is the most litigated FCRA employer provision.

Do we have to tell an applicant why we did not hire them? Under the FCRA, yes, if the decision was based in whole or in part on a consumer report — with a pre-adverse action notice, a copy of the report, the Summary of Rights, a waiting period, and a final notice.

Are we a debt collector if we collect our own invoices? Generally not under the FDCPA — unless you use a name suggesting a third party. Many state statutes reach creditors regardless.

We offer customers four monthly payments with no interest. Is that regulated? Four installments generally falls outside TILA's trigger; five brings you within it even with no finance charge. Count carefully.

Do we need a written reason for denying business credit? Under Regulation B, the notification obligation applies to business credit, with modified content and timing depending on the applicant's revenues. Provide notice, and reasons on request at minimum.

A consumer disputed a tradeline we reported. What do we have to do? Conduct a reasonable investigation of the dispute the bureau forwards, review all relevant information, report the results, and correct across all bureaus. Confirming your own system says what it says is not an investigation.

Can we require a spouse to sign? Only where necessary to reach jointly held collateral under state law. Requiring it where the applicant qualifies independently violates Regulation B.

Conclusion

Consumer financial protection statutes are unusual in that they attach to conduct anyone might engage in — hiring, collecting, extending terms — and they carry statutory damages that make small technical failures worth suing over.

The compliance work is almost entirely template work. A standalone FCRA disclosure. A two-step adverse action process. A credit denial letter with real reasons. Collection correspondence in the company's own name. A recurring-debit authorization that meets Regulation E. Each is a one-time drafting exercise, and each prevents a claim that scales across every consumer the company touched.

What makes these statutes dangerous is not their difficulty. It is that the people performing the regulated activity — a recruiter, a credit manager, a collections clerk — have usually never been told that a federal statute governs what they are doing.

Servicers, vendors, and the third-party problem

Most consumer-facing businesses do not perform these functions themselves. They use a background check vendor, a collection agency, a payment processor, a billing platform, and a lending partner. Liability does not stop at the contract.

Service provider liability. Dodd-Frank § 1002(26), 12 U.S.C. § 5481(26), defines a service provider to include any person providing a material service to a covered person in connection with the offering of a consumer financial product or service — and service providers are themselves covered persons subject to UDAAP. The Bureau has repeatedly stated that a business is responsible for the consumer-facing conduct of its vendors, and that a contractual disclaimer does not transfer the obligation.

Vendor management that actually reduces exposure:

  • Diligence before engagement — licensing in every state where the vendor will operate, complaint history, regulatory actions, and a review of the vendor's own compliance program.
  • Review the vendor's consumer-facing materials, not just its contract. The background check provider's disclosure form and the collection agency's letter templates are where the violation lives, and both are usually adopted without anyone reading them against the statute.
  • Contract terms: compliance representations, adherence to your policies, audit rights, prompt notice of complaints and regulatory contacts, indemnity, insurance, data security obligations, and termination for compliance failure.
  • Ongoing monitoring — call recordings and letter samples for collection agencies, dispute handling metrics for furnishers, and complaint tracking across channels including the CFPB's public complaint database.
  • Complaint analysis, which is the single best early warning system. A pattern of complaints about a specific practice is what precedes an examination.

Bank partnership and "true lender" arrangements. A non-bank that markets, underwrites, and services loans originated by a partner bank relies on federal preemption of state usury caps. State regulators and private plaintiffs challenge these arrangements on a true lender theory, asking who holds the predominant economic interest. Outcomes vary by state, several states have legislated on the question, and the Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015), line on the validity of a rate after assignment continues to generate litigation notwithstanding regulatory efforts to address it. Any business building a lending product on a bank partnership should have a current, jurisdiction-specific analysis rather than a memo written when the program launched.

Debt sales. Selling charged-off receivables transfers the collection activity but not the reputational or regulatory exposure. Contract for accurate account documentation, prohibit resale to unvetted purchasers, require compliance with the FDCPA and state analogues, obtain audit rights, and retain the records the buyer will need to validate the debt — because an inability to validate is what generates the claims.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. These statutes are amended frequently, implementing regulations change, and state analogues are often broader. Consult qualified consumer financial services counsel before adopting background check, credit, or collection practices.