Consumer Financial Enforcement: States to Watch in 2026

Executive Summary

• What’s new: An unprecedented scaling back of consumer financial services enforcement activity at the federal level has coincided with a corresponding increase in state enforcement and regulation focusing on areas such as fintech, fair lending, AI, debanking, anti-DEI and cryptocurrency. 
• Why it matters: In addition to attention on federal issues, there is now an increased focus on state compliance, particularly as states are expanding regulation and enforcement into new areas.

__________

The past year has seen unprecedented change at the federal level, including the dramatic scaling back of consumer financial services enforcement activity at the Consumer Financial Protection Bureau (CFPB).

Against this backdrop, there has been an increase in state enforcement and regulation, with some states making it clear that they intend to continue pressing ahead where the CFPB has pulled back and hiring former CFPB employees. Many states, for instance, have continued their regulation of fintech business models while also pursuing fair lending and unfair, deceptive, and abusive acts and practices actions.

Other states, however, have aligned more closely with the Trump administration’s agenda, focusing on areas such as debanking and anti-DEI initiatives. And across the political spectrum, many states are debating and incrementally regulating the use of AI, a trend that shows no sign of abating.

While numerous states are active in this space, a number stand out for their level of activity and innovation. Below, we list 10 top states to watch (in alphabetical order), as well as a number that earn honorable mentions.

• Cryptocurrency. Recent legislation granted the Department of Financial Protection and Innovation (DFPI) additional enforcement authority over a broader range of industries. In 2025, the DFPI exercised this additional authority through enforcement actions relating to cash-to-crypto kiosks, including those operated by Coin Time LLC and Coinhub, as well as in an action in January 2026 against Nexo Capital Inc., a crypto-backed lending platform. With licensure requirements under the Digital Financial Assets Law taking effect in July 2026 for certain crypto companies operating in California, the DFPI’s focus on crypto is likely to increase.
• EWA. The DFPI has required registration of Earned Wage Access (EWA) providers since February 15, 2025. Registrants were required to file their first annual reports on or before March 15, 2026.

• AI. The Colorado Artificial Intelligence Act (CAIA) is scheduled to go into effect on June 30, 2026, a five-month delay from the initial effective date. The CAIA is the first comprehensive state law relating to the development and deployment of AI systems, and focuses on protecting against “algorithmic discrimination.” The state attorney general (AG) issued a pre-rulemaking request for information in 2024, but to date no proposed rule or official guidance has been issued.

• EWA. Connecticut enacted one of the strictest EWA laws in the nation in July 2025. This law caps fees at $4 per advance and $30 total per month and classifies advances of earned but unpaid wage or salary as “loans.”
• BNPL. Connecticut, along with North Carolina, is leading a multistate coalition of attorneys general seeking information from Buy Now, Pay Later (BNPL) providers.
• Fees and cancellations. Legislation scheduled to take effect on July 1, 2026, imposes restrictions and requirements regarding fee disclosures and subscription cancellations.

• Debanking. Florida’s debanking statute, which was amended in 2024 to cover non-Florida chartered institutions, was one of the first and most aggressive such laws. The law prohibits financial institutions from denying or canceling services based on a person’s political or religious beliefs, opinions, speech or affiliations; any “factor if it is not a quantitative, impartial, and risk-based standard, including any such factor related to the person's business sector;” or a “social credit score.” 
• Anti-DEI. In January 2026, the AG issued a legal opinion classifying “laws that mandate discrimination based on race by giving preferences to certain racial groups, using race-based classification, or employing racial quotas” as unconstitutional. The opinion includes a seven-page appendix of Florida laws deemed unconstitutional, including statutes relating to small and minority business lending.

• Immigration status. Illinois amended its Human Rights Act in 2024 to expressly prohibit discrimination based on immigration or citizenship status in real estate transactions.
• Cryptocurrency. Legislation passed in 2025 authorizes the Department of Financial and Professional Regulation to regulate and supervise digital asset businesses. Further rules and enforcement actions regarding customer disclosures, fraud prevention measures, and money laundering are likely forthcoming.

• EWA. Legislation that took effect on October 1, 2025, classifies EWA as a credit product, caps fees, and requires lenders to offer at least one reasonable, free method to access earned wages.
• Fair housing. In 2025, Maryland settled “source of income” fair housing enforcement cases against Habitat America, LLC and The Commons of Avalon TH, LLLP. In addition, legislation has been introduced in both 2025 and 2026 to prohibit disparate impact in housing practices.

• Junk fees. Massachusetts regulations governing “junk fees” went into effect in September 2025. These regulations impose heightened disclosure obligations for: total costs and fees, whether charges are optional, and automatic renewals or recurring subscriptions.
• AI and disparate impact. In April 2024, the AG issued guidance expansively applying the Commonwealth’s Anti-Discrimination Law to “algorithmic decision-making,” including where an algorithm’s results have an “effect of disfavoring or disadvantaging a person or group of people based on a legally protected characteristic.” 

• Disparate impact. In December 2025, the AG finalized revised disparate impact regulations. These regulations specify that a “less discriminatory alternative” can support disparate impact liability even if that alternative is not as “equally effective” as the challenged practice.
• Cash advances. In March 2025, the AG announced a Finding of Probable Cause against cash advance company Advance Funding Partners/Same Day Funding. In this matter, the AG alleged that the company refused to lend to prospective clients based on race, national origin and nationality.

• BNPL. In May 2025, New York enacted legislation that will require certain providers of BNPL loans to be licensed and supervised by the New York Department of Financial Services (NYDFS). The NYDFS also published proposed rules for BNPL financing in February 2026. These rules would establish a licensing and supervision framework, limit fees and charges, and require lenders to disclose whether they will report loans to consumer reporting agencies.
• FAIR Act. In December 2025, the Fostering Affordability and Integrity Through Reasonable Business Practices Act was signed into law. This law expands the AG’s enforcement authority to bring an action against “deceptive” practices to actions against “unfair, deceptive, or abusive” practices. Moreover, it expands the AG’s enforcement authority beyond consumer-oriented practices, to include practices aimed at small businesses and nonprofits. 

• Lawsuits mirroring Trump administration priorities. In 2025, the AG filed or threatened a number of consumer protection lawsuits on various topics. This activity has continued with the AG settling a lawsuit in January 2026 that alleged that VA Claims Insider, LLC had deceptively charged fees to disabled veterans for services purporting to assist with Department of Veterans Affairs benefits and claims.
• Anti-DEI. The AG issued a legal opinion in January 2026 finding that DEI policies and programs reflected in more than 100 state laws are unconstitutional. The opinion also states that private DEI practices could expose companies to “significant legal liability under state and federal law.”

Honorable Mentions 

• In May 2025, Pennsylvania implemented a new consumer protection hotline and website. The state’s press release indicated that this initiative was a direct response to “fill the void left by weakened federal consumer protections … as federal oversight and efforts to protect consumers – especially from the CFPB – decline.” Additionally, in July 2025, legislation was proposed in the state House pertaining to affirmative consent, disclosures and cancellation requirements for negative option products.

• Tennessee enacted a debanking law in April 2024 and has launched multiple anti-DEI investigations. The debanking law prohibits denying or canceling services based on a person’s religious beliefs or political opinions; factors that are not “quantitative, impartial, and risk-based;” or through the use of a “social credit score” that considers subjects such as engagement in firearms or fossil fuel industries as well as support for combating illegal immigration.

• Legislation was proposed in the state Senate in December 2025 that would address annual percentage rate caps and potentially expand licensure requirements in connection with consumer loans offered through bank partnerships. Among other things, the proposed legislation provides that a party is subject to the law if it “holds, acquires, or maintains the predominant economic interest” in the loan, or if it “markets, brokers, arranges, or facilitates” the loan and holds the right or first right of refusal to purchase the loan. 

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.