What's Next in State Enforcement for Fintechs: Trends and Strategies

Summary

Arnold & Porter partners Meredith Osborn and Michael Johnson recently joined Daniel Chang (General Counsel and Chief Compliance Officer, Thread), Rebecca Kronlund (SVP, Deputy General Counsel, Pathward), and Claudia Quiroz (General Counsel, DFPI) for an American Fintech Council's Fintech Forward webinar on state attorneys general (AG) litigation trends and strategies for financial services companies.

With federal enforcement agencies pulling back from contested regulatory cases, state attorneys general and securities regulators are stepping in through enforcement, rulemaking, and legislation. Key takeaways from the discussion include:

• Federal preemption cuts both ways. Recent Office of the Comptroller of the Currency and Consumer Financial Protection Bureau actions have shielded fintechs from some state regulation, but the same logic removes state-level consumer protections, giving state AGs added motivation to act.
• Depository Institutions Deregulation and Monetary Control Act opt-outs are expanding. Colorado, Oregon, D.C., Minnesota, and Rhode Island have all moved to cap interest rates on loans to in-state borrowers. Tenth Circuit rehearing en banc is pending. Fintechs are relying on bank partnerships to export rates above state caps and should be monitored closely.
• Product classification remains contested. Earned wage access, buy now-pay later, income share agreements, and merchant cash advance products are all facing state enforcement scrutiny. If a product functions like credit, states will argue it should be regulated like credit.
• Multi-state enforcement is the new normal. Multi-state enforcement is increasingly common and consequential. The People v. OneMain Financial action, led by New York alongside 12 co-states, illustrates how coordinated state coalitions can bring significant resources to bear across jurisdictions simultaneously, making these cases far more complex to navigate than single-regulator proceedings.
• New state laws are raising the stakes. New York's FAIR Act (effective February 2026) extends Unfair, Deceptive, or Abusive Acts or Practices-style authority to the AG with a private right of action and treble damages. California's Digital Financial Assets Law (effective July 2026) creates a comprehensive licensing regime for crypto exchanges and custodians.

The regulatory map is being redrawn, but the underlying conduct that creates liability has not changed. The full recording of the discussion is available for viewing.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.