UDAAP (Unfair, Deceptive, or Abusive Acts or Practices)

UDAAP is an abbreviation for unfair, deceptive, or abusive acts or practices. It refers to a general prohibition in United States federal law that applies to anyone offering financial products or services to consumers, including banks, lenders, payment companies, debt collectors and the firms that provide services to them. Unlike most financial regulation, it does not list specific requirements. It sets a standard of conduct against which any practice can be judged.

The prohibition comes from the Dodd-Frank Act of 2010, which also created the Consumer Financial Protection Bureau and gave it authority to enforce the standard and write rules under it. It builds on the older ban on unfair or deceptive acts or practices in the Federal Trade Commission Act, known as UDAP, and adds a third element, abusiveness.

Each word has its own legal test, and a practice needs to meet only one to be unlawful.

• Unfair. An act or practice is unfair if it causes or is likely to cause substantial injury to consumers, the injury is not reasonably avoidable by them, and it is not outweighed by benefits to consumers or to competition. Injury is usually financial, and a small harm to a large number of people can be substantial.
• Deceptive. A representation, omission or practice is deceptive if it misleads or is likely to mislead a consumer, the consumer's interpretation is reasonable in the circumstances, and the matter is material, meaning it is likely to affect the consumer's decision. Intent to deceive is not required.
• Abusive. A practice is abusive if it materially interferes with a consumer's ability to understand a term or condition, or takes unreasonable advantage of the consumer's lack of understanding of risks and costs, inability to protect their own interests, or reasonable reliance on the provider to act in their interests.

The abusive standard is the newest and least settled. The Bureau has issued policy statements on how it reads the term, and these have been revised under different leadership.

The law applies to covered persons, meaning those who offer or provide a consumer financial product or service, and to their service providers. A technology company that designs a bank's sign-up flow, or a processor that handles its payments, can be liable alongside the bank. It is also unlawful to give substantial assistance to a violation knowingly or recklessly.

Enforcement is shared. The Bureau supervises large banks and many non-bank firms. The federal banking agencies, including the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation, apply the unfair and deceptive standards to the institutions they oversee. State attorneys general and state regulators may bring actions under the federal law, and most states have their own statutes on unfair and deceptive practices. The level of federal activity has varied considerably between administrations, and state enforcement tends to increase when federal enforcement declines.

Enforcement cases and examination findings have concentrated on a number of recurring themes.

• Fees. Charging fees that were not clearly disclosed, or that consumers could not reasonably anticipate, including certain practices around the overdraft fee.
• Marketing claims. Advertising products as free, instant or guaranteed when material conditions apply, or overstating savings and rewards.
• Deposit insurance statements. Non-bank fintech companies implying that customer funds are protected by FDIC insurance without explaining that coverage depends on a partner bank and does not protect against the fintech company's own failure.
• Enrollment and cancellation. Opening accounts or adding products without consent, and making subscriptions hard to cancel.
• Payment handling. Delaying access to funds, freezing accounts without explanation, processing payments in an order that increases fees, or failing to investigate errors.
• Remittances and currency conversion. Advertising no fees while earning an undisclosed margin on the exchange rate.
• Debt collection and servicing. False threats, misapplied payments and misleading statements about amounts owed.

UDAAP operates alongside detailed rules such as Regulation E on electronic transfers and Regulation Z on credit. A firm can comply with the letter of those rules and still commit a violation if the overall effect on consumers is misleading or harmful. Conversely, a breach of a specific rule is often pleaded as a UDAAP violation as well. Regulators have used the standard to address new products before tailored rules exist, which critics describe as regulation by enforcement and supporters regard as necessary flexibility.

Because there is no checklist, firms manage the risk through process. Common elements are review of marketing, disclosures and product terms by compliance staff before launch, monitoring of customer complaints for patterns, testing of fees and account servicing against what customers were told, and training of sales and support staff.

In a bank-fintech partnership, the sponsor bank remains responsible for products offered under its charter and is expected to approve the fintech company's marketing and oversee its complaint handling as part of managing third-party risk.

A violation can lead to an enforcement action resolved by a consent order, with requirements to refund consumers, pay civil money penalties and change practices. Penalties are tiered by the degree of fault and accrue per day of violation. Findings in supervisory examinations that do not reach public enforcement still require corrective action and can affect a bank's ratings and its willingness to continue a partner program.

• Consumer Financial Protection Bureau
• Federal Trade Commission