This post uses hypothetical scenarios for illustrative purposes only. It does not describe any actual client, transaction, or representation, and is not legal advice.
Download: Fintech M&A Regulatory Diligence Checklist — FMA-017 (.docx) — a companion template for this post. Adapt with counsel before use.
The 2026 fintech M&A story plays out the same way more often than anyone wants to admit. A buyer signs an LOI on a payments or consumer-lending target with a clean CFPB complaint-portal history, a BSA/AML program on paper, and a comfortable sense that the restructured federal CFPB is not going to be the gating item. The regulatory diligence team then pulls the state side: a New York DFS exam cycle with an open MOU, a California DFPI complaint pattern that implicates UCL § 17200, a Texas OCCC subpoena from a multistate AG coalition, and a Florida OFR Chapter 560 renewal filing that is six weeks late. None of those shows up on the federal portal. All of them are the diligence story.
The practical takeaway from the 2025 restructuring of the Consumer Financial Protection Bureau is not that consumer-financial regulation went away — the governing statutes are intact, and enforcement actors have proliferated. It is that the diligence center of gravity moved. Federal supervisory posture has receded; state financial regulators, state attorneys general, and private UDAAP litigation have moved up the priority stack. For buy-side counsel in fintech, payments, and consumer-finance deals, that means the diligence checklist has to look different in 2026 than it did in 2023.
Where Consumer-Finance Regulation Sits in 2026
The CFPB’s posture is reduced but the Bureau is not gone. Dodd-Frank’s UDAAP standard at 12 U.S.C. § 5531 remains the governing federal unfairness, deceptiveness, and abusiveness framework for covered persons. Section 1033 at 12 U.S.C. § 5533 still sits in the statute book. What has changed is the frequency, scope, and intensity of CFPB enforcement, examination, and rule-making — and the slack is being taken up by state financial regulators and state attorneys general.
The 2026 regulatory map therefore has a different shape. For a national fintech, the practical risk inventory now looks less like one federal supervisor and more like a mosaic of state regulators: New York DFS (money transmission and BitLicense), California DFPI (consolidated banking, CFL licensees, CCFPL), Texas OCCC (consumer-finance lending), Florida OFR (Chapter 560 money services businesses), and parallel structures in Illinois, Massachusetts, and Washington. Each of them has independent authority, independent examination rhythms, and independent enforcement history.
State AG Enforcement Gap-Fill
The second big shift is enforcement by state attorneys general, often in multistate coalitions. State AG offices have moved into consumer-financial enforcement territory that was CFPB-dominant two or three years ago. Multistate coalitions have filed consumer-protection actions touching bank-partner lending programs, buy-now-pay-later disclosures, overdraft practices, fee transparency, and crypto-adjacent payments. The posture is familiar from the Dodd-Frank preservation of state enforcement authority at 12 U.S.C. § 5552, which was always there and is now the primary driver.
The diligence consequence is that a target’s state AG subpoena history — including CIDs, investigative demands, and multistate coalition inquiries — is now a diligence priority, not an afterthought. A clean CFPB record does not substitute. Buy-side regulatory diligence has to pull the state AG log in each state where the target holds a license or does meaningful business, and read it like a federal exam report.
UDAAP in 2026: The State Analogues Matter Most
UDAAP cases in 2026 increasingly land under state analogues, not federal § 1031. The Florida FDUTPA framework at Fla. Stat. § 501.201 and the California Unfair Competition Law at Cal. Bus. & Prof. Code § 17200 are the two most-cited state engines, with Massachusetts Chapter 93A, Illinois CFA, and New York GBL § 349 following. Each has its own standard, its own private right of action, and its own damages framework. California’s UCL in particular carries a broad “unlawful, unfair, or fraudulent” standard that reaches conduct the federal § 5531 analysis might not.
Diligence has to look at the state UDAAP history — FDUTPA class filings, UCL private attorney general actions, state AG § 349 letters — and the state consumer-complaint data behind them. The federal CFPB complaint portal is still a useful signal, but it is one data stream among six or seven.
Rule-Rescission Posture and Valuation Implications
Several targets built their 2024-2025 commercial model around specific CFPB rules that have since been rescinded, paused, or stayed. The Payday Lending Rule, the Section 1033 open-banking rule, and portions of the small-business lending data collection rule have each seen that treatment. The diligence question is not just “was the target compliant.” It is whether the historical rule structure that drove the target’s pricing, product mix, or data-access architecture has been removed, and what that does to the valuation.
A target whose unit economics depended on a particular rule structure that no longer exists has a repricing problem, not just a compliance one. The rep framework has to reach historical compliance with rules in effect at the time of the conduct, with a schedule exception for the rescinded provisions and a buyer-friendly knowledge definition. The knowledge-rep definition is the hinge; a tight knowledge group lets the buyer rely on the rep without putting founders in a position of representing what they could not have known.
Section 1033 and Open Banking
Section 1033’s open-banking framework at 12 U.S.C. § 5533 is still on the books, and the rule-making posture has shifted. For data-aggregation targets, open-banking-access-dependent fintechs, and personal-finance-management platforms, the diligence question is whether the target’s data-partner contracts assume a rule that has been paused and whether the contractual data-access architecture still works without rule-based mandatory access. If the business model relies on screen-scraping fallback, the fallback has to be legally substantiated and operationally viable.
Download: Fintech M&A Regulatory Diligence Checklist — FMA-017 (.docx) — a companion template for this post. Adapt with counsel before use.
Residual Federal Supervisor Exposure
The CFPB’s reduced posture does not mean no federal supervisor. The OCC retains authority over national banks and federal savings associations, including the bank partners that sit behind many fintech programs. The FDIC supervises state non-member banks and has primary posture on bank-fintech partnership guidance. The Federal Reserve supervises state member banks and holding companies, with the full BHCA framework intact. The FTC retains Section 5 unfair-and-deceptive authority over non-bank fintechs under 15 U.S.C. § 45 and has been more active in the 2026 fintech space than many expected.
Where the target’s product sits under a bank partnership, the diligence has to pull the partner bank’s MOUs and consent orders, not just the fintech’s own enforcement history. A bank partner under a formal action often creates program-level restrictions that flow through to the fintech target by contract.
BSA/AML: Unchanged, But Now the Baseline
Bank Secrecy Act obligations under 31 U.S.C. § 5311 are unchanged by the CFPB’s posture. MSB registration, state money transmitter licensing (including Florida OFR Chapter 560 and the parallel change-of-control framework at Fla. Stat. § 560.141), BSA officer continuity, CIP and CDD/EDD files, SAR filing history, and OFAC screening logs are all baseline diligence. In the 2026 posture, they are also more likely to be the primary federal exposure item on the deal, since the other federal supervisory streams have receded.
The change-of-control filing stack is where many fintech deals discover timing exposure. State money-transmitter statutes require pre-closing or contemporaneous change-of-control filings, and NY DFS Part 200 for BitLicense targets runs through its own approval cycle. The Florida consumer-data regime adds another layer where personal consumer information is in scope.
The Priority-Stack Shift
The practical consequence for the diligence checklist is a rotation of priorities. Items that have moved up include: state AG enforcement history (including subpoenas and CIDs), state regulatory exam history and open MOUs, UDAAP state-case review (FDUTPA, UCL § 17200, Chapter 93A, GBL § 349), consumer-complaint data from state portals and BBB, bank-partner supervisory posture, and BSA/AML licensing continuity.
Items that have moved down include: CFPB consent-decree inventory review, CFPB complaint-portal volume as a standalone signal, and CFPB enforcement-pipeline questions. Those items still belong in the diligence file; they are no longer the headline.
The rep architecture tracks the same rotation. The compliance rep should expressly reach the state UDAAP analogues (FDUTPA, UCL § 17200) rather than hiding behind a generic “consumer-financial laws” formulation. The regulatory-MAC definition should capture new state AG enforcement actions between signing and closing, not just federal actions. The specified-indemnity bucket should pull out known state AG investigations and open consent orders into a six-year carve-out, matched to the specified-indemnity architecture that the four-cap framework is designed to support.
What the Diligence File Should Contain at Closing
By closing, the fintech regulatory diligence file should hold the state license stack (money transmitter by jurisdiction, BitLicense, lender licenses, sales-finance licenses), the full BSA/AML package (written program, risk assessment, independent audit, CIP, SAR history, OFAC logs), the state AG enforcement history, the state exam reports and MOUs, the UDAAP litigation history (federal § 1031 and state analogues), the consumer-complaint data across portals, the Section 1033-era compliance posture and data-partner agreements, the consumer-arbitration-agreement review with class-action waiver analysis, the TCPA/FCRA/FDCPA class-action history, and the bank-partner supervisory file where applicable. The companion checklist above is the version of that file we hand to clients to populate.
The posture to carry into the 2026 fintech LOI is also simple. Federal CFPB posture is still relevant but no longer the headline. State regulators and state AGs are. UDAAP cases will come under state statutes more often than under § 1031. BSA/AML has not moved and is now carrying more of the federal exposure. And the diligence file either tells the state story at closing or the deal reprices.
If you are a buy-side counsel evaluating a fintech, payments, or consumer-finance target in the 2026 regulatory environment, feel free to reach out to our firm manager, Magda, at Magda@montague.law, or fill out our contact form. Mention you read this post.
