CA Businesses Will Face New Era of Financial Scrutiny in 2026

As federal authorities have deprioritized certain consumer financial protection enforcement efforts, the California’s Department of Financial Protection and Innovation appears primed to play a more active role in 2026 as it builds momentum from its recent enforcement successes, leverages its expanded regulatory authority, and draws on the expertise of new hires.

Enforcement

DFPI emerged in 2020 as a modernized and revamped version of its predecessor, the Department of Business Oversight. The agency’s mandate is to protect California consumers by regulating a broad range of providers of financial products and services, including banks, credit unions, mortgage lenders, and the offer and sale of securities.

Since 2020, the agency has rapidly scaled its enforcement programs. In 2021, DFPI opened 106 investigations pursuant to its primary governing statute, the California Consumer Financial Protection Law, resulting in $547,000 in penalties. In 2024, DFPI opened 699 CCFPL-related investigations—more than a six-fold increase—and collected $2.7 million in penalties, part of the $24.5 million in total penalties that the agency’s enforcement division imposed.

DFPI’s continued, robust enforcement in 2025 spanned a range of conduct across the financial services market and beyond. Notable penalties that the agency imposed in 2025 included a $1 million penalty for lender Apoyo Financiero, Inc. for allegedly charging excessive interest and fees to customers; a $2.3 million settlement with former mortgage lender and servicer Caliber Home Loans, Inc. for allegedly overcharging thousands of California borrowers; and (in conjunction with the federal Commodity Futures Trading Commission and other state regulators) $51 million in restitution and penalties against California-based Safeguard Metals LLC for allegedly defrauding hundreds of elderly people into spending their retirement savings to purchase overpriced commodities, including metals and coins.

DFPI also actively pursued enforcement in the cryptocurrency industry in 2025, with a particular emphasis on crypto kiosk operators that allegedly overcharge consumers and conduct transactions without collecting sufficient identifying information.

In October 2025, for example, DFPI ordered Coinhub to pay $675,000 in penalties, including $105,000 in restitution to California consumers. The Coinhub resolution followed a string of DFPI sanctions against other crypto kiosk operators, beginning in June 2025 with the first-ever enforcement action under California’s Digital Financial Assets Law against Coinme, Inc., and followed by additional actions against Coin Time, LLC and Ahn Management, LLC.

Increased Authority

California continues to clarify and broaden the scope of DFPI’s mandate, reinforcing the agency’s role in consumer protection and equipping DFPI with new statutory tools that increase the scope of its oversight of financial products and services. Building on the recent enforcement results, California enacted legislation that expands the agency’s statutory authority and oversight, including:

• SB 825. The law strengthens DFPI’s enforcement authority by making clear that the agency can take action against entities even when licensed under California statute, rather than only enforcing against unlicensed actors.
• SB 362. The new law adds protections for small businesses seeking financing and broadens DFPI’s regulatory reach, allowing enforcement under the existing California Financing Law or under the CCFPL as an unfair, deceptive, or abusive act or practice, depending on whether the transaction at issue is subject to the CFL.
• SB 164. The law, which requires venture capital firms to collect and report demographic data of the founding team members of portfolio companies, shifts oversight of compliance with the statute from the California Civil Rights Department to DFPI. Covered entities must register with DFPI by March 1, 2026, and provide reports by April 1, 2026.
  

In addition to these developments, California Gov. Newsom announced the appointment of Claudia Quiroz as general counsel for DFPI on Nov. 21, 2025.

Quiroz held senior roles at the US Department of Justice, including director of the National Cryptocurrency Enforcement Team, and participated in DOJ’s largest seizure of Bitcoin—$1 billion linked to former online marketplace Silk Road—and major prosecutions involving one of the world’s largest cryptocurrency exchanges. Quiroz’s prosecutorial background, as well as her substantive experience in cryptocurrency-related crimes, suggests that DFPI’s focus on crypto will continue into 2026 and beyond.

Practical Implications

Financial services companies operating in California would be well served by ensuring that their compliance programs adequately account for DFPI’s expanded mandate and more assertive enforcement posture.

Compliance departments of entities regulated by DFPI should be mindful of these developments, remain proactive in monitoring emerging trends, and, if necessary, implement enhancements to policies and procedures to address any identified gaps.

Conclusion

Following a year of significant enforcement activity and legislative developments, and with the recent addition to its leadership ranks, DFPI appears poised to sustain its momentum and drive continued activity into 2026.

As the agency’s toehold in financial protection enforcement landscape solidifies, stakeholders should be prepared for heightened scrutiny, even if federal oversight remains limited.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Addison Thompson is a partner in Covington’s San Francisco office and vice-chair of the firm’s white collar defense and investigations practice.

Doug Sprague is a partner in Covington’s San Francisco office and a member of the firm’s white collar defense and investigations practice.

Tian Kisch is an associate in Covington’s San Francisco office and a member of the firm’s white collar defense and investigations and data privacy and cybersecurity practices.

Write for Us: Author Guidelines