What Is UDAAP? How It Applies to Fintechs

UDAAP — Unfair, Deceptive, or Abusive Acts or Practices — is one of the broadest and most frequently invoked consumer protection standards in US financial regulation. The Consumer Financial Protection Bureau (CFPB) has authority under the Dodd-Frank Wall Street Reform and Consumer Protection Act to prohibit covered persons from engaging in UDAAP in connection with consumer financial products or services. For fintechs, UDAAP is not a narrowly defined checklist — it is a flexible standard that regulators apply to virtually any conduct they deem harmful to consumers.

What Does UDAAP Prohibit?

UDAAP covers three distinct but overlapping categories of prohibited conduct:

Unfair Acts or Practices

An act or practice is unfair if it: (1) causes or is likely to cause substantial injury to consumers; (2) the injury is not reasonably avoidable by consumers; and (3) the injury is not outweighed by countervailing benefits to consumers or competition. "Substantial injury" typically means financial harm, but can include non-monetary harm. The key question is whether consumers had a realistic ability to avoid the harm — if the fintech's conduct made it impossible or impractical for consumers to protect themselves, the practice may be unfair.

Deceptive Acts or Practices

An act or practice is deceptive if: (1) it is likely to mislead consumers; (2) the consumer's interpretation is reasonable; and (3) the misleading act or practice is material — meaning it would affect the consumer's decision-making. Deception does not require proof that a consumer was actually misled; the standard is whether a reasonable consumer would be misled. Deceptive practices can arise from affirmative misrepresentations, misleading omissions, or fine print that contradicts prominent claims.

Abusive Acts or Practices

An act or practice is abusive if it: (1) materially interferes with the ability of a consumer to understand a term or condition; or (2) takes unreasonable advantage of a consumer's lack of understanding, inability to protect their own interests, or reasonable reliance on the covered person to act in the consumer's interest. The "abusive" prong is newer and less litigated than "unfair" and "deceptive," but the CFPB has applied it in enforcement actions against payday lenders, credit repair companies, and other financial service providers.

Who Does UDAAP Apply To?

The CFPB's UDAAP authority extends to "covered persons" — defined as any person that engages in offering or providing a consumer financial product or service. This covers virtually all fintechs that serve consumers, including payment apps, neobanks, lending platforms, money transmission services, and consumer-facing compliance tools. The FTC also has UDAP (without the "abusive" prong) authority over non-bank entities under the FTC Act.

UDAAP Risk Areas for Fintechs

UDAAP violations commonly arise in the following areas for fintechs:

• Fee disclosures: Fees that are not clearly disclosed, buried in fine print, or applied in a way that differs from what consumers were led to expect
• Marketing and advertising: Claims about free services, interest rates, or account benefits that are misleading or not accurately qualified
• Account terms: Terms that are changed materially without adequate notice, or that differ significantly from what was communicated at signup
• Account closures: Sudden account freezes or closures without adequate notice or appeal process
• Collections and debt practices: Aggressive collection tactics or misrepresentations about what consumers owe
• Data use: Using consumer data in ways that consumers would not reasonably expect based on privacy disclosures
• Subscription billing: Recurring charges that are difficult to cancel or that are not clearly disclosed at enrollment

Building a UDAAP Compliance Program

Because UDAAP is a principles-based standard rather than a specific checklist, fintechs must build a culture of consumer protection rather than simply checking boxes. A practical UDAAP program includes:

• Pre-launch review: Legal and compliance review of all consumer-facing materials — ads, terms, disclosures — before they go live
• Product design review: Evaluating new products and features for potential consumer harm before launch
• Complaint monitoring: Tracking and analyzing consumer complaints as an early warning system for UDAAP risk
• Training: Training marketing, product, and customer service teams on UDAAP principles
• Third-party oversight: Ensuring that marketing partners, lead generators, and affiliates do not engage in deceptive practices on the fintech's behalf

CFPB UDAAP Enforcement

The CFPB has brought numerous UDAAP enforcement actions resulting in hundreds of millions of dollars in consumer redress and civil money penalties. The CFPB's enforcement actions are published on the CFPB's website at consumerfinance.gov and provide useful guidance on what conduct regulators consider violative. Fintechs subject to CFPB supervision — generally those with $10 billion or more in assets, or those in certain markets — should also be prepared for CFPB examinations that specifically review UDAAP risk.

Frequently Asked Questions

What is the difference between UDAAP and UDAP?

UDAP (Unfair or Deceptive Acts or Practices) is the FTC's standard under Section 5 of the FTC Act, which predates Dodd-Frank and does not include the "abusive" prong. UDAAP is the CFPB's standard under Dodd-Frank, which adds "abusive" to the FTC's framework. Both standards can apply to fintechs simultaneously — the FTC has jurisdiction over non-bank entities, while the CFPB has jurisdiction over covered persons offering consumer financial products.

Can a fintech face UDAAP liability even if it doesn't intend to deceive consumers?

Yes. UDAAP does not require intent. A practice can be deceptive or unfair even if the fintech had no intent to harm consumers. The standard is objective — whether a reasonable consumer would be misled, and whether the harm is one consumers could not reasonably avoid.

What are the penalties for UDAAP violations?

The CFPB can impose civil money penalties of up to several thousand dollars per day per violation, with higher tiers for knowing violations, and require consumer redress. The CFPB publishes penalty amounts and enforcement action details on its website.

How does UDAAP relate to fair lending?

UDAAP and fair lending (ECOA, Fair Housing Act) are related but distinct bodies of law. UDAAP applies to all consumer financial products and practices. Fair lending specifically prohibits discrimination in credit decisions. A discriminatory credit practice can violate both UDAAP and fair lending laws simultaneously.

This article is for educational purposes only and does not constitute legal or compliance advice. Regulatory standards and enforcement priorities are subject to change. Consult qualified legal counsel for guidance specific to your fintech's products and practices.

Talk to the ComplyOne team to get started.