In this audio edition of the PerformLine Regulatory Compliance Roundup, Ashley Cianci covers September’s biggest stories: a 40-state coalition’s roughly $700 million settlement with a subprime auto lender, FTC actions against payment processors, new AI disclosure rules for ads, movement on CFPB leadership and New York City’s click-to-cancel rule.
Key Takeaways
- States are filling the federal enforcement gap: The states carried this all the way to a $700 million resolution without a federal regulator.
- Enabler liability reaches the payments chain: Knowing that your partners are deceiving consumers, or willfully looking the other way, can put you back on the hook.
- AI is becoming a regulated part of the ad: Claims about what your AI can do are still just advertising claims.
- CFPB leadership is still unsettled: The Bureau’s direction still hinges on a confirmation that hasn’t happened yet.
- Click-to-cancel moves down to the city level: Your cancellation path has to be as easy as your signup path.
Show Notes:
- For the full article: https://performline.com/blog-post/regulatory-compliance-roundup-09-30-26/
- Connect with Ashley Cianci on LinkedIn: https://www.linkedin.com/in/ashley-cianci/
- Subscribe to PerformLine to stay connected to resources and updates: https://lp.performline.com/subscribe-to-performline
Subscribe to COMPLY: The Marketing Compliance Podcast
About COMPLY: The Marketing Compliance Podcast
The state of marketing compliance and regulation is evolving faster than ever. On the COMPLY Podcast, we sit down with the biggest names in marketing, compliance, regulations, and innovation as they share their playbooks to help you take your compliance practice to the next level.
This podcast is for informational and educational purposes only and does not constitute legal advice; consult your own compliance or legal counsel.
Episode Transcript:
Ashley Cianci:
Hi there, COMPLY Podcast listeners, and welcome back. I’m Ashley Cianci, and this is the audio edition of the PerformLine Regulatory Compliance Roundup, where we pull the regulatory news that actually matters for your marketing, cut the noise, and talk through why each story matters for your compliance program. Today I’m walking you through the September edition. And I’ll be honest, this is one of the bigger months we’ve had. If you’ve been listening the last couple editions, you know the story we keep coming back to: As the CFPB pulls back, the states are stepping in.
Well, this month that theme produced roughly a $700 million settlement. We’ve also got the FTC going after a part of the payments chain it usually doesn’t touch, a brand-new California law about AI and your ads, movement on who’s going to run the CFPB, and a click-to-cancel deadline that’s coming up fast. So grab your coffee, and let’s get into it. As always, everything I cover is in the full written roundup on our blog at performline.com, and I have all the source links I’m going to talk through today, and you can subscribe there to get it the day it drops.
All right, story number one, and this is the marquee one. A 40-state coalition just won roughly $700 million from a subprime auto lender. Here’s what happened. On September 17th, New York Attorney General Letitia James, together with a bipartisan coalition of 39 other states, plus the District of Columbia, secured a settlement worth about $700 million from Credit Acceptance Corporation, a major subprime auto lender.
The states allege that Credit Acceptance deceptively pushed more than 55,000 consumers into unaffordable loans. We’re talking average APRs above 38% and some over 100%, loaded up with hidden costs and unnecessary add-on products. And then the states said the company misrepresented compliance when it packaged those loans into securities. The numbers in the settlement are significant: more than $630 million in debt relief, $16 million in cash restitution for consumers who lost their cars to repossession, and a $15.5 million penalty, plus business reforms, including confirming and letting consumers cancel add-on products outside the high-pressure showroom environment.
But here’s a detail I really want you to sit with, because it’s the whole theme of 2026 in one fact. This case was originally filed jointly back in January of 2023 by the states and the CFPB. And the CFPB is no longer a part of it. The states carried this all the way to a $700 million resolution without a federal regulator. And they weren’t done. On September 14th, Massachusetts Attorney General Andrea Joy Campbell announced a settlement permanently barring a debt buyer and its companies from buying or collecting debt in the state over allegations of aggressive, unlawful tactics, including seizing consumers’ vehicles that had nothing to do with any car loan.
That one wiped out roughly $52 million in claimed debt, affecting more than 6,000 consumers. So why does this matter to you? This is a through line of the whole year in a single case. When a federal regulator steps back, state AGs, very often in these big bipartisan coalitions, are ready and able to pick up major enforcement. And notice which theories they’re using: unaffordable product claims, hidden costs, add-on products with murky consent, deceptive marketing. Those are exactly the theories that the CFPB might once have led on. For lenders and the marketing partners who work with them, the takeaways are the ones we keep landing on. Hidden cost and unaffordable product theories are alive and well at the state level. Add-on products draw real scrutiny when consent isn’t crystal clear, and a 40-state coalition can reach you no matter where you operate. So build your marketing and your disclosures to the strictest applicable state standard, and assume multi-state exposure, not single-regulator exposure.
Now, before I move on, here is this edition’s Significant Stat, and it stays on the enforcement dollars theme: $845 million. That’s how much the FTC says it has already returned to consumers under its $2.5 billion 2025 Amazon Prime settlement, the one that resolved allegations that Amazon enrolled people in Prime without their consent and then made it hard to cancel. And on September 17th, a revised order actually raised the maximum per-consumer payment from $51 all the way up to $200, made future payments automatic so consumers don’t have to file a claim, and expanded who’s eligible. I bring it up because it’s a reminder of just how large negative option enforcement, that’s the subscription and auto-renewal world, can scale when it goes wrong.
$845 million and counting.
All right, story number two. The FTC went after a part of the marketing and billing chain that usually flies under the radar: the payment processors that enable deceptive merchants. Two actions here. On September 8th, the FTC announced a $12 million settlement with a payment processor called Humboldt Merchant Services. The allegation: Humboldt knowingly opened and maintained accounts for more than 1,000 shell or pass-through merchants that were fronting for unauthorized billing scams. And it ignored obvious red flags like abnormally high chargeback rates. The order permanently bans Humboldt from processing for high-fraud-risk merchants. And then just a few days earlier, on September 3rd, the FTC reached a $4.85 million settlement with a global processor, Nuvei, over allegations it processed payments for merchants it knew or should have known were running deceptive overseas tech support schemes.
Why it matters: The theme here is what I would call enabler liability. It’s a version of the same “you’re responsible for who you enable” principle we talked about last month with the Doxo case and the FTC’s posture toward marketplaces. If your business sits anywhere in the payments or partner chain, if you’re processing, sponsoring, or facilitating for other companies’ offers, the FTC is sending a very clear signal. Knowing that your partners are deceiving consumers, or willfully looking the other way, can put you back on the hook.
So for banks and contacts with banking-as-a-service, lending partner, or merchant processing relationships, this really reinforces the need for genuine, documented due diligence and ongoing monitoring of the partners and merchants operating under your infrastructure. And yes, watching for red flags like chargeback spike accounts.
Okay, story number three. AI in advertising is officially becoming a regulated element of the ad itself. And it showed up on two fronts this month. First, California. On September 16th, Governor Newsom signed SB 1050, and it requires a clear and conspicuous disclosure on any video or audio ad that uses an AI-generated or synthetic performer to sell a product or service, with that disclosure placed right near the synthetic performer.
The law takes effect on January 1st, 2027, and it makes California the second state after New York to require this kind of disclosure. Now, it was framed around protecting performers and workers. Newsom actually signed it at SAG-AFTRA headquarters, but make no mistake, it applies to any marketer using AI-generated spokespeople or actors in ads, financial services included. Second, at the federal level, on August 27th, the FTC finalized consent orders totaling around $930,000 with a media company and two marketing firms that had advertised an AI-powered “active listening” service. They claimed it could target ads based on consumers’ real-time conversations captured from smart devices with consent. The FTC alleged the service actually just relied on resold email lists gathered without consent, which made the whole AI capability claim deceptive.
Why this matters: Two lessons. First, if you’re using AI-generated voices or personas in your ad creative, and that’s getting more and more common in financial services marketing, California now requires you to disclose it. And other states are building similar AI transparency rules, so this is going to spread. Second, claims about what your AI can do are still just advertising claims. That active listening case shows the FTC will treat an exaggerated or unsubstantiated AI capability claim as deceptive, same as any other. So my advice is to take an inventory of where AI shows up, both in your creative and in your product claims, and make sure the disclosures and the substantiation are both there.
Story number four, and we finally got some movement on who’s going to run the CFPB, though not a final answer. On September 17th, the Senate Banking Committee voted 13 to 11, straight down party lines, to advance Brian Johnson, that’s Trump’s nominee for permanent director and a former Capital One executive, to the full Senate. Important: He has not yet been confirmed. His nomination now waits on a full Senate floor vote that, as of this recording, has not yet been scheduled. And in the meantime, Mark Pelot has been serving as acting director.
The Bureau’s reduction-in-force litigation, the mass firing case, is still frozen under that summer stay, which is tied to the Senate acting on Johnson. And on the rulemaking side, the revised Section 1033 open banking proposal we flagged last month is still sitting under White House review at OIRA and has not been published for public comment by the end of the month. So the specifics, including the big one, whether banks will be allowed to charge for data access, are still officially under wraps.
Why this all matters: The Bureau’s direction still hinges on a confirmation that hasn’t happened yet. So keep planning for continued federal uncertainty, which, as our lead story shows, is exactly the vacuum the states are filling. So I would watch for two things. One, the timing of Johnson’s floor vote, because that sets the CFPB’s leadership and posture for the next stretch. And two, that open banking proposal. It could publish very soon. And when it does, the comment window is going to matter to nearly every financial institution and fintech, especially on data access fees and who counts as an authorized third party. So be ready to weigh in.
And that brings me to our On the Radar item, the thing to get ahead of. And so this month, it’s a hard deadline. New York City’s click-to-cancel rule takes effect October 1st. This is the first municipal click-to-cancel mandate in the country. It requires that any auto-renewal or continuous service subscription offered to New York City consumers be cancelable through the same method the consumer used to sign up.
Penalties start at $525 per violation and escalate from there for repeat violations, plus potential refunds to consumers. And separately, quick callback: Remember the FTC’s proposed personalized pricing policy statement from the last edition? That public comment window, which got a short extension, closed on September 25th, so the agency could start moving toward finalizing its position from here. Why this matters: Subscription and auto-renewal compliance keeps fragmenting down to the state and now even down to the city level. And the standards are not uniform. So if you run any recurring billing offer with New York City subscribers, October 1st is a hard deadline. And the rule is simple to state: Your cancellation path has to be as easy as your signup path. So map your enrollment and cancellation flows against every jurisdiction where you have subscribers, design to the strictest standard, and honestly, just treat “as easy to cancel as it is to sign up” as your baseline everywhere. It’s where all of this is heading, anyways.
And that is this edition of the Regulatory Roundup. So, very quick recap: A 40-state coalition won about $700 million from Credit Acceptance, states filling that federal gap in the biggest way we’ve seen to date. The FTC went after the payment processors enabling deceptive merchants, so enabler liability is real. AI in advertising is now a regulated element of the ad, between California’s SB 1050 and the FTC’s active listening orders. Brian Johnson cleared committee but still needs a floor vote to run the CFPB, and the open banking rule is still pending. And New York City’s click-to-cancel rule hits October 1st. If any of these hit home for your program, the full written roundup with every source link is on our blog at performline.com. I would really encourage you to subscribe so you never miss an edition.
You can also follow PerformLine on LinkedIn for news and content between editions. And if there’s any story you think we should cover, or you’ve got feedback on this audio format, I would absolutely love to hear it. So reach out to performline.com, or you can connect with me personally on LinkedIn. Thank you so much for listening, and I will see you next time.
PerformLine