California DFPI Seeks Comment on Potential Registration and Supervision of Consumer Reporting Agencies

The California Department of Financial Protection and Innovation (DFPI) is sharpening its focus on the credit reporting ecosystem. On January 12, 2026, the DFPI issued a second invitation for public comment, seeking input on whether consumer reporting agencies (CRAs) and related credit reporting market participants should be required to register with, and be supervised by, the DFPI under the California Consumer Financial Protection Law (CCFPL). If a formal rulemaking were to follow, this would represent a material expansion of California’s regulatory oversight of CRAs doing business in California.

At a Glance

• The DFPI is evaluating whether to bring CRAs within the scope of mandatory registration, reporting requirements, and supervision under the CCFPL.
• The inquiry targets the full credit reporting ecosystem, including potentially national and alternative CRAs, as well as certain data furnishers, aggregators, and intermediaries.
• If adopted, CCFPL registration would subject CRAs for the first time to DFPI examination and reporting, providing the DFPI with additional information when pursuing enforcement actions for violations such as alleged unfair, deceptive, or abusive acts or practices (UDAAP) under California law. This would represent a significant expansion of state-level oversight of CRAs, operating alongside existing regulatory frameworks such as federal oversight of CRAs under the federal Fair Credit Reporting Act (FCRA), during a time when the Consumer Financial Protection Bureau (CFPB) appears to be less active on these issues.

Background: DFPI Authority Under the CCFPL

Enacted in 2020, the CCFPL provides the DFPI with broad authority to regulate providers of non-depository financial services that are offering consumer financial products or services to California residents. Modeled in part on the federal Consumer Financial Protection Act, the CCFPL authorizes the DFPI to require registration of covered persons, conduct examinations and investigations, impose recordkeeping and reporting obligations, enforce prohibitions on UDAAPs, and bring administrative and civil enforcement actions for violations of California’s consumer financial laws.

The DFPI has used this authority to expand its oversight beyond traditional financial institutions by bringing a range of newer and nontraditional providers within its supervisory perimeter, including earned wage access providers, income share advance companies, private postsecondary education financing providers, and debt settlement providers, all of which have to register with the DFPI as of February 2026.

DFPI’s Request for Comment: Focus on Credit Reporting

In its latest request for comment, the DFPI seeks input on whether CRAs and related entities should be required to register under the CCFPL as “covered persons.” The invitation broadly contemplates regulation of a broad segment of entities involved in the collection, compilation, analysis, or dissemination of consumer credit information used in credit decisions or similar financial evaluations.

The request reflects the DFPI’s stated interest in enhancing its visibility into credit reporting practices that affect California consumers and expanding its ability to supervise and enforce compliance at the state level.

While the request itself does not impose new requirements, it represents the DFPI’s second solicitation of public input on the next round of CCFPL registration, suggesting a continued and deliberate path toward potential rulemaking. Once formal rulemaking is initiated, the DFPI would be required to complete the process within one year under the California Administrative Procedure Act.

Existing Regulation of Consumer Reporting Agencies

CRAs are already subject to existing federal and state regulatory frameworks, most notably under the federal FCRA. The FCRA imposes a number of nationwide obligations on CRAs relating to, among other things, the accuracy and disclosure of consumer report information and related consumer dispute resolution rights, and is enforced through a combination of federal agency oversight and private litigation. In addition to the FCRA, many states (including California) have enacted state consumer reporting statutes. These state laws may impose additional or more prescriptive requirements related to consumer disclosures, reinvestigation timelines, remedies, and enforcement mechanisms, although the FCRA includes robust state preemption in many respects.

Historically, CRA regulation at the state level has focused on substantive compliance obligations and enforcement, rather than prudential-style supervision involving routine examinations or registration with a state financial regulator, as is being proposed here.

What CCFPL Registration Could Mean for CRAs

If the DFPI proceeds with formal rulemaking, CRAs designated for CCFPL registration would be subject to a new layer of California state supervisory oversight, including:

• Mandatory registration filings and annual renewals;
• DFPI supervision and examinations, potentially focused on data accuracy, dispute resolution processes, governance, vendor management, and consumer-facing disclosures;
• Ongoing reporting and recordkeeping requirements tailored to California regulatory expectations; and
• Enforcement exposure under California’s UDAAP framework, including penalties and remedial obligations for alleged violations.

CRAs that rely on third-party data service providers may also need to assess how DFPI oversight could affect vendor relationships and information flows involving California consumer data.

Key Takeaways and Timing

Although the DFPI’s request for comment is informal, it underscores the agency’s growing interest in regulating the credit reporting ecosystem. CRAs may wish to provide comments and monitor developments in this space and evaluate the impact a potential rulemaking could have on their operations.

Comments on the DFPI’s request are due by February 26, 2026.