California’s New Consumer Protection Secretary: What Chopra’s Appointment Signals for the Financial Services Industry

Key Points

• Governor Gavin Newsom appointed former CFPB Director Rohit Chopra as inaugural secretary of California’s new Business and Consumer Services Agency (BCSA) on May 12, 2026, with the agency launching July 1, 2026.
• The BCSA does not expand the DFPI’s statutory authority under the California Consumer Financial Protection Law (CCFPL), but Chopra’s role as secretary enables strategic coordination and enforcement prioritization across California consumer protection agencies.
• Chopra’s federal enforcement record — including UDAAP actions targeting fee structures at the CFPB — signals that California firms with fee-dependent revenue models should expect scrutiny beyond disclosure-based compliance.
• Chopra has consistently applied fair lending, anti-discrimination, and UDAAP frameworks to algorithmic decision-making, signaling that the DFPI is expected to scrutinize AI-driven underwriting, targeted advertising, and credit scoring systems.
• The BCSA has emphasized that serious violations can result in loss of a California operating license, reflecting Chopra’s public position that negotiated penalties alone are insufficient deterrents for repeat offenders.

A former CFPB director now leads California’s new consumer agency. Here is what that likely means for enforcement.

When Governor Gavin Newsom split California’s Business, Consumer Services, and Housing Agency into two focused cabinet-level departments in 2025, it was a bureaucratic reform that few outside Sacramento noticed. But when the governor appointed former Consumer Financial Protection Bureau (CFPB) Director Rohit Chopra to lead the new California Business and Consumer Services Agency (BCSA) on May 12, 2026, and then swore him in as the agency’s inaugural secretary on July 1, he sent a message that every bank, fintech, nonbank lender, debt collector, and payments firm operating in California must take seriously: the state intends to fill the space that federal retrenchment has created, and it has chosen a leader with both the appetite and experience to do it.

More than a month into the BCSA’s life, the thesis is no longer purely predictive. Based on Chopra’s well-documented federal record, the agency’s public launch priorities, and the institutional tools now at his disposal, the California Department of Financial Protection and Innovation (DFPI), operating under the BCSA’s strategic umbrella, is already moving toward a more coordinated and assertive enforcement posture. The industry is no longer preparing for a hypothetical shift; it is now reacting to one already underway.

The First Two Months Have Confirmed the Direction

The BCSA’s first 60 days have been more signal than a fully developed enforcement program, but the signals are concrete. The public record now includes the July 1 launch, a July 6 filing urging the Federal Trade Commission (FTC) not to terminate X’s privacy and data-security order, Chopra-authored posts on small and independent business protection, mortgage servicers’ handling of Los Angeles fire insurance proceeds, and a broader warning that the BCSA will focus audit and inspection resources on the entities posing the greatest risks.

DFPI activity during the same window is consistent with that orientation, even though recent matters were in the pipeline before July 1. On July 1, DFPI announced orders requiring Edward Jones, LPL Financial, RBC Capital Markets, TD Ameritrade, and Stifel to return more than $1.3 million to California customers for excessive commissions on small-dollar transactions. Then, on July 7, DFPI announced more than $7 million in restitution for nearly 3,000 victims of a California land investment scam. Those matters do not mean every post-July 1 action originated with Chopra, but they do show the operating environment into which BCSA has now stepped: restitution, pricing transparency, data privacy, complaint intake, and cross-agency accountability are live public priorities.

Consistent with these priorities, on August 13, 2026, DFPI announced that it ordered Academy Mortgage Corporation to pay $825,000 for alleged cybersecurity failures that exposed the personal information of more than 284,000 individuals, including more than 34,000 California residents, following a March 2023 ransomware attack. The DFPI alleged that the Utah-based company had longstanding security deficiencies, failed to detect the breach until after employee credentials were stolen, and neglected to obtain a written forensic report documenting the incident. Under the consent order, Academy Mortgage must also provide affected California customers with one year of free identity theft insurance coverage and maintain compliance with California cybersecurity and data protection laws going forward.

A Federal Enforcement Record That Travels

Chopra served as the CFPB’s first student loan ombudsman, as an FTC commissioner, and most recently, as CFPB director from 2021 to 2025. Across all three roles, he developed a consistent and well-documented enforcement posture: alleged systemic misconduct demands systemic remedies, alleged repeat offenders deserve escalating consequences, and penalties that companies can price into their business models function as licensing fees for bad behavior, rather than as genuine deterrents.

None of that changes with his arrival in California; if anything, the first month has made the continuity clearer. BCSA does not itself expand DFPI’s statutory authority, but Chopra is setting priorities, coordinating policy, and shaping supervisory approaches across agencies that include the DFPI — a body already described as California’s “mini-CFPB” by many for the broad authority it wields under the California Consumer Financial Protection Law (CCFPL). The combination of his enforcement philosophy, the BCSA’s cross-agency coordination role, and the DFPI’s existing legal toolkit makes for a formidable regulatory pairing.

Fee Structures Will Face Structural Scrutiny

At the CFPB, Chopra did not treat product-related fees as disclosure problems to be corrected with better notices. He treated them as deliberate features of business models — design choices intended to extract revenue that consumers could not anticipate, avoid, or easily understand — and he pursued them accordingly under unfair, deceptive, and abusive acts and practices (UDAAP) authority under federal law.

That analytical framework is portable to California under the CCFPL, and early post-launch activity has reinforced the point. On July 1, DFPI announced orders requiring five broker-dealers to return more than $1.3 million to California consumers who were allegedly charged excessive fees on small-dollar transactions. Firms with fee-dependent revenue models should expect the DFPI to move beyond disclosure-based regimes and actively challenge practices where fees allegedly cannot be reasonably anticipated or are disproportionate to the underlying service. The early and logical targets based on his federal record include overdraft and nonsufficient funds (NSF) fees, late and convenience fees, subscription and automatic renewal models allegedly engineered to create cancellation friction, and surveillance-based pricing that adjusts costs using behavioral or personal data.

Whether one believes these business practices are legitimate or not, the enforcement posture Chopra has brought to California is not ambiguous. Firms that have relied on fee-dependent strategies can take no comfort in any perceived shift in federal enforcement when it comes to their activities in California.

Algorithmic Models Will Not Receive Regulatory Deference

Chopra has consistently argued — and acted on that argument — that deploying a complex algorithm does not reduce a company’s legal exposure under fair lending, anti-discrimination, or UDAAP frameworks. It just moves the compliance question from a human decision to one made by machines, and those machines are still subject to the same legal standards.

The DFPI under Chopra’s influence is expected to scrutinize targeted advertising that allegedly uses behavioral or geolocation data to steer vulnerable consumers toward high-cost products; alternative data underwriting models that draw on social media activity or device metadata without adequate transparency; and credit scoring systems that cannot produce clear, explainable reasons for adverse actions. Compliance teams that have not yet pressure-tested their AI governance programs against California law should do so now, because the regulator who will be asking questions has already demonstrated he knows how to build enforcement cases around them.

In the Crosshairs: Data Practices and Fintech Monetization

California already maintains one of the broadest privacy regimes in the U.S. What Chopra’s involvement adds is a regulator who understands, from direct federal experience at the FTC and CFPB, precisely how financial and quasi-financial firms collect, share, and monetize transactional data. He has also demonstrated a consistent willingness to act on that understanding rather than deferring to industry self-regulation.

For instance, while at the CFPB, Chopra used supervisory authority to investigate major technology platforms operating payment services and pushed for open banking rules designed to give consumers meaningful control over their own financial information. He has remained consistently critical of Big Tech’s expansion into retail finance, and particularly of the data-surveillance models that underpin those services. That posture has already surfaced in Sacramento: on July 6, BCSA urged the FTC not to terminate X’s privacy and data-security order, framing mishandling of sensitive data as a source of financial harm, fraud, and stalking risk. The agency has also said it will improve how consumers, businesses, and whistleblowers file complaints and provide law enforcement tips. The DFPI is expected to scrutinize how firms obtain and document consumer consent, restrict cross-contextual profiling for financial marketing, and comply with CCFPL and state privacy law limits on secondary uses of financial data. Firms that have treated privacy compliance as a box-checking exercise should expect harder scrutiny.

Repeating Violations Won’t Be Managed Via Settlements

The clearest predictor of what Chopra will demand of the DFPI is his consistent and public position that penalties absorbed into operating costs are not deterrents. At both the CFPB and FTC, he pushed for structural remedies: product bans, mandatory business model changes, and individual accountability for senior executives and boards. He regarded repeat offenders not as firms with compliance deficiencies but instead as those that had concluded that noncompliance was economically rational — and he adjusted the remedies accordingly.

In California, the DFPI has the legal tools to follow the same blueprint. Financial firms with prior enforcement histories, pending complaint patterns, or recurring conduct concerns should not assume that a corrective action plan with a negotiated penalty will resolve the matter under this new regulatory regime. Chopra has already said the agency will focus audit and inspection resources on entities posing the greatest risks, and BCSA has emphasized that serious violations can have consequences up to and including loss of a license to operate in California. Whether that approach is proportionate in any given case is a separate question, but it is now more than a forecast.

California as a Regulatory Bellwether

The broad significance of Chopra’s appointment is not limited to any individual enforcement action. As federal consumer financial regulation has contracted, California — with an independent DFPI, an independently elected attorney general with overlapping jurisdiction, and now a BCSA secretary with a national enforcement profile — is asserting itself as the primary forum for aggressive consumer protection. New York, under its enacted FAIR Act, has been moving in the same direction. This pattern is not accidental.

Leading states are filling the space that federal retrenchment created, and their experiments tend to become bellwethers. Whether that is the right outcome for the financial services market is a legitimate policy debate. What is not debatable is that firms treating California compliance as a regional afterthought are badly miscalculating their risk now that the BCSA is fully operational. Now is the time to reassess fee structures, audit algorithmic models, tighten data governance, and build genuine accountability into compliance programs to avoid becoming the DFPI’s next headline.

And there is another way that BCSA’s actions may prove to be a bellwether. It is expected that Newsom will run for president in 2028, and Chopra’s role as a member of the governor’s cabinet would be a logical stepping stone into another federal regulatory appointment if Newsom (or another Democrat) wins the White House. The industry can therefore view Chopra’s actions at BCSA as a precursor not only to what may occur in other states, but also to what may occur in a future presidential administration.