Kim Phan and Michael Yaghi unpack the California Department of Financial Protection and Innovation's (DFPI) latest effort to require registration for the credit reporting industry.
In this episode of FCRA Focus, host Kim Phan is joined by Michael Yaghi, partner in Troutman Pepper Locke's Regulatory Investigations, Strategy, and Enforcement practice group, to unpack the California Department of Financial Protection and Innovation's (DFPI) latest effort to require registration for the credit reporting industry. They discuss DFPI's second request for comment, how it fits into California's broader push to regulate nonbank financial services, and which entities may be swept in beyond the "big three" consumer reporting agencies — such as furnishers, data brokers, specialty credit reporting agencies, resellers, and fintechs. Kim and Michael also explore how narrowly (or broadly) the rules might be drawn, potential overlap and tension with existing FCRA requirements, what registration and reporting could mean in practice for covered entities, and what companies should be doing now as the February 26 comment deadline approaches.
FCRA Focus — California DFPI’s Next Target: Credit Reporting Industry
Host: Kim Phan
Guest: Michael Yaghi
Aired: 2/23/26
Kim Phan (00:05):
Welcome everyone to the Troutman Pepper Locke podcast, FCRA Focus. I'm your host, Kim Phan, and I'm joined today by a special guest, my partner Michael Yaghi, to discuss the California Department of Financial Protection and Innovation efforts to impose registration for the credit reporting industry. Mike handles high-profile interactions with state regulators, including attorneys general, he assists clients through complex government inquiries, assisting them throughout the entire lifecycle of regulatory engagement, including regulatory enforcement and formal litigation. However, before we jump into the topic of today, the California DFPI, let me remind you to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it, head on over to Troutman.com and add yourself to our Consumer Financial Services email list.
Kim Phan (00:58):
That'll allow you to get invitations to our webinars and receive our alerts and advisories that we send out from time to time. And while we make lots of free content available to our listeners, if you cannot get enough FCRA, I would encourage you to explore our subscription-based Tracker service, which provides information on federal and state regulatory and legislative developments, as well as summaries of FCRA federal case law on a weekly basis, as well as monthly roundtable discussions. These tracker services can also cover other topics including debt collection and privacy and data security. Now, jumping right in, Michael, welcome. Why don't you tell our audience a little bit about yourself and then we can jump right into California DFBI.
Michael Yaghi (01:40):
Yes, thanks Kim, and welcome to everybody. Thanks for tuning in. And I appreciate the opportunity to talk to you about this topic. I am a regulatory lawyer. I do a lot of state AG, FTC, CFPB enforcement in the consumer protection space. And that's basically my practice. I've been doing doing it for about 20 years now, and it's a nationwide practice, so it's not specific to just California, although we watch California closely. They're a big state and an important state, obviously, from the regulatory framework. And I think this topic is an interesting one and worth discussing and sort of raising some questions we have about it and flag some things for industry and those entities that are potentially gonna be impacted by these new rules if they go into effect and are adopted. Companies wanna be able to understand what their requirements are going to be. And we're doing this now, I think it's ahead of sort of the comment period closing, but I'll let you, you know, drive us into that direction and we could get into the nuts and bolts of what we're talking about.
Kim Phan (02:47):
Of course, and you're definitely the right person. We're thrilled to have you on with us to talk about this. So tell us, what's California up to now? What's this latest development, and why are you on talking to us about it?
Michael Yaghi (03:00):
Yeah, so California, last month, the California Department of Financial Protection and Innovation, the DFPI, issued a request for comments. And it's their second request for comments about rulemaking and regulations to bring more industries and companies within the DFPI's sort of regulatory oversight at the state level regarding certain consumer financial products and services. The first request was DFPI issued back in the fall of 2024, and this is the second request. And they're really focused on credit reporting type agencies and related services. And that's why I think it's important. Previously, the DFPI extended their registration, reporting, and oversight to various other areas that were not previously regulated by DFPI under California's Consumer Financial Protection Law.
Michael Yaghi (04:02):
They brought in, for example, income-based advance services, private post-secondary education financing, debt settlement services, and student debt relief services. And so now, this new request for comment, like I said, was made last month, and the deadlines for comment is February 26th, later this month. And it's targeting all of the credit reporting agencies and related entities in that space.
Kim Phan (04:32):
So I think it's interesting that California DFPI is looking at this in a way that differs a little bit from what we traditionally think of as FCRA-regulated consumer reporting agencies. So if they do decide to move forward with this registration requirement, who do we think they have in mind? Because again, if they're looking beyond, say, the big three, Experian, Equifax, and TransUnion, they must have some feeling around who they're trying to target.
Michael Yaghi (05:04):
Yeah, that's a great question. And I think it's funny because the obvious involves credit reporting agencies like the big three, for example. Those are the obvious [chuckle] areas, Experian, Equifax, TransUnion. But it really depends on sort of the scope of the rules, what industries or entities are defined that come under the rules. So it would impact potentially furnishers of information, data furnishers, it could impact data brokers who sell information for marketing, but not necessarily FCRA uses, for example, depending on how everything is defined in the new rules. Credit monitoring services would wanna be aware of this.
Michael Yaghi (05:50):
Specialty reporting agencies potentially wanna be aware of these. New potential rules and make sure that if they impact them, sort of how do they impact them and want an opportunity to be heard. Resellers, aggregators, and other companies that deal with consumer data and reporting, fintech companies, banks. It could impact the entire industry. Anyone who's sort of beyond the actual credit reporting agencies, it potentially could impact, like I said, all of these other categories. And I think at the end of the day, it's really gonna depend on what the rules are defined as and what the target of the rules focus on.
Michael Yaghi (06:31):
And I know there were some limitations, I think, in the request for comment where they're trying to focus on consumer products and services, reporting on consumer products and services. But I think the devil's really in the details, right? It's sort of how expansive will these rules be? Who's gonna have to register? Who's gonna have to report and have sort of an added state layer of oversight?
Kim Phan (06:55):
Yeah, and if I may follow up on that, the FTC, the CFPB, the federal agencies that oversee and enforce the Fair Credit Reporting Act, they have pretty broad jurisdiction. And California's DFPI is a little bit more limited. And in reading the request for information, this request for additional public comment, they do narrowly focus on credit information, credit history, and the uses of that information for consumer financial products or services. So things like tenant screening, employment background checks, are we thinking those may be out for purposes of California?
Michael Yaghi (07:33):
Yeah. If you read the comment, like you noted, it seems to be pretty narrow, focusing on, like you said, providing consumer report information. But it asks for areas where companies are collecting, analyzing, maintaining, or providing consumer report information or other account information. So in that sense, it seems like it's limited. I think it does depend on, however, where the final rule definitions and sort of scope lands, right? So if companies could potentially fall into that category where they're providing account information or other sort of consumer information or maintaining, it really comes down to what is gonna be defined as, "collecting, analyzing, maintaining, or providing consumer report information or other account information."
Michael Yaghi (08:28):
And there are some carve-outs in the request for comment to your point. So I think the key is if any of these industries that provide those types of services that you mentioned feel like it could touch potentially on what they do and there's reasons why it shouldn't, then they wanna take advantage of this, I think, comment period to sort of raise those concerns and address those issues. I would be hesitant to just assume from the request for comment alone that you could conclude sort of what the final definitions and scope would be.
Michael Yaghi (09:02):
I do agree with you, there's guidance and those limitations you noted, but I do think because it's sort of a broad approach to sort of bring in the entire consumer reporting ecosystem, I would say, you shouldn't just assume it may not impact areas like tenant screening, employment background checks, insurance reports.. It most likely won't. But again, I just flag as a sort of something for industries to be aware of and monitoring and consider whether they should submit comments to address concerns they might have in those spaces.
Kim Phan (09:38):
Yeah, and certainly, I think we all appreciate this is all speculation at this point. We don't have draft rules, we don't have other indicators of what California DFPI has in mind. But moving on from this conversation about who may be in and who may be out to if you are eventually covered by this future registration requirement, what are we expecting that those covered entities are likely going to be required to do?
Michael Yaghi (10:04):
It's expanding, bringing in credit reporting sort of agencies and providers of similar type services into California's state DFPI registration, reporting, and oversight requirements. So it's essentially companies that are gonna be impacted by these new rules will have to register with the state and have annual or periodic registrations that will include a bunch of disclosure and sort of business details and ownership requirements. It could and would likely include various reporting obligations, submitting routine reports, data, different activities, complaints, other information to help the DFPI essentially monitor those entities.
Michael Yaghi (10:54):
And it creates sort of that supervision and enforcement oversight more formally. Not that companies that may come under the purview of these adopted rules, if they are in fact developed and adopted, they were all sort of under California's UDAAP laws to begin with. But this really gives DFPI sort of an easier way to monitor through supervision and enforcement, right? They could see what complaints, for example, companies are experiencing. They have to submit all of their whatever the requirements are on reporting along those lines, which really just gives the DFPI an easier opportunity to sort of monitor what companies are doing and identify potential areas where there might be alleged violations of state consumer protection laws.
Michael Yaghi (11:42):
And then it makes it a little bit easier for the state to monitor and sort of bring enforcement matters, right? So it just brings these companies into that supervision. There's also costs, right? You have registration fees and costs, and then there's compliance costs. So if those industries or companies that would fall under the purview of newly adopted rules, those companies would have to comply with all of those things I mentioned, right? The registration and the annual renewals and the reporting obligations, whatever to the extent those look like, the supervision and enforcement of the DFPI, and sort of those compliance costs to make sure that they have a compliance policies and procedures and mechanisms in place to ensure they're not violating the new rules if they are in fact adopted.
Kim Phan (12:32):
Got it. It sounds like it'll be quite burdensome on industry if and when this comes to fruition. But again, we're mostly speculating at this point. As we wait to see what California DFPI does next, what should we be looking out for? What should companies be doing in the meantime?
Michael Yaghi (12:53):
Companies should look at the request for comment and they should evaluate whether they think there's any way these new rules could impact them and what does that impact look like. And if they're concerned about any of that, they should consider submitting a comment and explaining why. For example, I think the fact that this is the second request and DFPI seems intent on regulating more non-bank financial services providers in the state, that I think it really comes down to companies looking at the request and evaluating what kinds of new rules or definitions or the scope and burden and benefits that the rule could potentially adopt. How can that impact my business? How can I demonstrate it shouldn't include us, right?
Michael Yaghi (13:44):
To your point earlier about tenant screening or employment background checks, those sorts of things, do I need to, as a company in those spaces, present a comment to DFPI to explain why you think it doesn't apply to you, it's not intended to apply to you, and the reasons why and what the impact would be, especially if there's an adverse impact on consumers, right? If we step back for a second, DFPI, like a lot of state regulators, they're focused on protecting consumers in the consumer financial products and services space.
Michael Yaghi (14:20):
So if there's a way that maybe some of these rules could actually adversely impact consumers, you wanna raise those issues with the DFPI and sort of address it on the front end. I think, it's also important to look at a lot of this is already covered under the FCRA, right? There's a federal framework in place that has adequate supervision and requirements that protect consumers. So you wanna ensure that you're not creating sort of a dual system that could conflict with each other, complicate companies complying with both federal and a new state set of rules. I think that's an important area that companies would wanna focus on if they think it could adversely impact them. So it really, I think they just need to look at the request, what they do in this space. Do they think they're within the ecosystem of where the rules would apply and capture their businesses to fall under these registration, reporting, and supervision requirements? Or does it look like it probably wouldn't? And really look at sort of both sides of that line and address any concerns or issues because the comment period, like I said, it's open until later this month. I think it closes February 26th.
Kim Phan (15:37):
Assuming that some of our clients may be interested in submitting comments and noting some of those points that you mentioned, that this is gonna be burdensome to the industry, that it's duplicative of federal obligations. If companies are keeping an eye out, do we have any feeling on a timeline as to when we think DFPI will move forward with proposed rules or maybe even issue additional requests for information? Do we have any indications or insights on that?
Michael Yaghi (16:10):
There's no obligation or requirement or timeline, I should say, after comments are submitted to DFPI. So DFPI is not under any sort of clock, right, to do anything with those submitted comments. I think the fact that this is a second request and DFPI has been actively trying to bring, like I said, more non-bank financial service providers and services into its regulatory framework and oversight framework, I do get the sense that they'll probably move fairly quickly. If they're gonna bring new rules forward and capture previously uncovered credit reporting agencies and others in that ecosystem, I anticipate it would be spring or summertime that they'll start that process.
Michael Yaghi (16:58):
There's no obligation, like I said, there's no timeline for them to do it. They could sit on it and do nothing. They could wait a year. But I think once they start the formal... If they start the formal rulemaking process, then that will move, I think, within a year of being completed. I anticipate it'll be pretty fast. If there's comments or other things that are raised in this response period, you raised whether or not they could ask for more comments, that's a possibility. I think it just depends on sort of the issues raised by the different industries and different entities that think that believe this could impact them, and especially if they think there's an adverse impact and the reasons why, to help sort of industry and the state make sure they get it right.
Kim Phan (17:45):
So after the public comment period closes on February 26, California DFPI will eventually post all those public comments to be publicly available on the California DFPI website. Michael, I hope you will be willing to come back and talk to us about some of the arguments that are raised from both the industry side and the consumer advocate side with regard to any registration requirement. I hope you're willing to do that.
Michael Yaghi (18:11):
Yes, I am, and I think we will monitor this very closely. As soon as those comments are posted and publicly available, we will absolutely rejoin you on another podcast to talk through sort of what we've read and what comments and issues have been raised, and have another episode where we could talk through some of the impact... Potential impact and where we think things are going. I think that'd be a great idea, and I'd look forward to doing that with you as soon as that information is made public.
Kim Phan (18:40):
Well, thank you so much, Michael, for being here today and being willing to return to a future podcast to talk about the next steps in this California DFPI potential registration rule.
[music]
Kim Phan (18:53):
And thanks, of course, to our audience for tuning in to today's episode. If you've enjoyed today's podcast, please let us know by leaving a review on your podcast platform of choice. And of course, stay tuned for our next episode of this FCRA Focus podcast. Thank you all for listening.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
---------------------------------------------------------------------------
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided “as is,” with no warranty as to the accuracy or reliability. Please listen to the podcast for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.