The Consumer Financial Protection Bureau (CFPB), created by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, has primary jurisdiction over consumer financial products. Its authority over merchant cash advances — fundamentally commercial financial products — is limited but expanding, with active 2026 implementation of §1071 small business data collection and contested questions about UDAAP enforcement scope.
The categorical jurisdiction distinction. The CFPB's statutory authority under 12 USC 5481 covers "consumer financial products or services" — products extended to consumers for personal, family, or household purposes. Commercial credit, including MCAs to businesses, falls outside this primary jurisdiction.
The §1071 small business data collection rule. The most consequential CFPB-MCA intersection. Dodd-Frank §1071 (codified at 15 USC 1691c-2) directed the CFPB to collect demographic data on small business credit applications. The rule was finalized in 2023 and implemented in stages 2024–2027.
§1071 coverage. 1. Covered financial institutions. Initially the largest institutions ($2.5B+ assets, by 2024 effective date). Expanding to smaller institutions through 2027. 2. Covered transactions. "Commercial credit" broadly defined, explicitly including MCAs, factoring, and other commercial financing. 3. Data required. Application date, type of credit, amount, purpose, action taken (approved/denied), reasons for denial, gross annual revenue, NAICS code, geographic location, applicant demographic data (race, ethnicity, sex of principal owners). 4. Public reporting. Aggregate data published annually; some loan-level data with privacy protections.
§1071 implementation timeline. - 2024. Largest covered institutions begin data collection. - 2025. Medium-sized institutions phased in. - 2026. Smaller institutions phased in. - 2027. Full implementation across all covered institutions.
Why §1071 matters for MCAs. 1. First systematic federal data on MCA market. Historical estimates have varied widely; §1071 will produce reliable annual figures on MCA volume, demographics, pricing, and approval rates. 2. Compliance burden on funders. Covered MCA funders must build data collection, validation, and reporting infrastructure. Estimated annual compliance cost: $300K–$2M+ per institution. 3. Enforcement vehicle. CFPB can use §1071 data to identify discriminatory patterns and bring ECOA enforcement actions. 4. Public scrutiny. Aggregate data will likely show MCA pricing dispersions by demographic and geographic characteristics, potentially driving additional regulation.
The UDAAP enforcement question. The Dodd-Frank Act prohibits "unfair, deceptive, or abusive acts or practices" (UDAAP, 12 USC 5536). The scope of CFPB UDAAP authority over commercial credit is contested:
- Narrow interpretation. UDAAP applies only to consumer financial products under §1031 and §1036; commercial credit is outside scope.
- Broad interpretation. UDAAP can reach commercial credit where the practice harms consumers indirectly (e.g., through small business owners who are also consumers) or where the institution offers both consumer and commercial products.
- Recent enforcement. CFPB has occasionally brought UDAAP enforcement against actors offering commercial credit, but generally only where there is also consumer-credit conduct.
The contested scope means MCA funders typically face FTC §5 (unfair and deceptive acts and practices, applicable to commercial conduct) rather than CFPB UDAAP enforcement.
The ECOA enforcement intersection. Unlike TILA, the Equal Credit Opportunity Act (ECOA, 15 USC 1691, Regulation B) applies to both consumer and commercial credit. CFPB enforces ECOA for institutions under its jurisdiction:
- Discrimination prohibitions apply to MCAs.
- Spousal-signature rules apply to MCAs (with community-property exceptions).
- Adverse action notices required on MCA denials.
- CFPB enforcement of ECOA against MCA funders has occurred, particularly on spousal-guarantee and disparate-impact issues.
The "service provider" theory. CFPB has occasionally asserted jurisdiction over MCA funders as "service providers" to consumer-facing institutions. Limited applicability in practice but a theoretical hook.
State-level CFPB-equivalents. Several states have created CFPB-like enforcement agencies with broader scope including commercial credit: - California DFPI. Department of Financial Protection and Innovation; broad commercial-credit authority including MCAs. - New York DFS. Department of Financial Services; broad commercial-credit enforcement including MCAs. - Colorado, Connecticut, Pennsylvania. Various state agencies with commercial-credit oversight.
These state agencies often enforce MCA matters where CFPB lacks clear jurisdiction.
The 2026 outlook. 1. §1071 implementation continues. Smaller institutions phased in; first publicly reported data cycles begin. 2. Possible federal commercial financing disclosure legislation. Multiple bills proposed; none enacted but pressure increasing as state laws proliferate. 3. CFPB jurisdiction debate. Administration changes have shifted CFPB priorities; commercial-credit enforcement intensity varies. 4. State enforcement intensification. California DFPI and New York DFS continue expanding MCA enforcement; other states follow.
State context. - California, New York. Active state-level enforcement substitutes for limited CFPB jurisdiction. - Florida, Texas. Limited state-level enforcement; CFPB jurisdiction limits create regulatory gap. - Multi-state funders. Compliance burden concentrated in California, New York, plus the 4 other disclosure states (Utah, Virginia, Georgia, Connecticut).
Compliance strategy for MCA funders and brokers. 1. §1071 compliance roadmap. Identify when institution becomes covered; build data collection infrastructure 6–12 months ahead. 2. ECOA training. Ensure all underwriting and adverse-action processes comply with ECOA and Regulation B. 3. State-by-state mapping. Layer state CFPB-equivalent enforcement on top of federal CFPB analysis. 4. UDAAP-style internal review. Even where CFPB UDAAP jurisdiction is unclear, FTC §5 enforcement is parallel; internal review for "unfair" or "deceptive" practices is prudent. 5. Disparate-impact analysis. §1071 data will enable demographic-pattern analysis; funders should conduct internal disparate-impact testing before public data exposes patterns.
Implications for merchants. 1. Federal MCA-specific consumer protections remain limited. State-level disclosure (in 6 states) and ECOA (federal) provide primary protections. 2. Discrimination complaints can be filed with CFPB (under ECOA) or state regulators. 3. §1071 public data will provide increasing market transparency starting 2026.
Common confusion. First, "CFPB regulates MCAs" — primary CFPB jurisdiction does not extend to commercial credit; jurisdiction is limited to §1071 data collection, ECOA enforcement, and contested UDAAP application. Second, "§1071 is just data collection" — it is also an enforcement vehicle; published data will drive enforcement and additional regulation. Third, "CFPB does not enforce against MCAs" — it does under ECOA and in limited UDAAP cases, plus state CFPB-equivalents are active.
Related terms
- MCA Truth in Lending Act (TILA) coverage — The federal Truth in Lending Act (15 USC 1601 et seq, Regulation Z) applies only to credit extended to consumers for personal, family, or household purposes — it does NOT apply to commercial credit including MCAs to businesses, leaving MCA disclosure regulation to state-by-state commercial financing laws.
- MCA state licensing requirements (2026) — As of 2026, California, New York, Utah, Virginia, Georgia, and Connecticut require commercial financing disclosure registration; California and New York additionally require broker registration; Florida, Texas, and most other states still have no MCA-specific licensing, though Illinois and Missouri have advanced 2026 legislation.
- MCA pricing disclosure law — State laws (CA SB 1235, NY S5470, VA HB 1027, UT SB 183, GA SB 90, FL effective 2026-06-28) requiring MCA funders to disclose APR-equivalent, total cost, payment amount, term, and prepayment policy in TILA-style standardized format before contract signing.
- MCA broker disclosures 2026 — New 2026 broker disclosure rules in CA, NY, VA, UT, GA, and FL (effective 2026-06-28) require MCA brokers to disclose commission amount, funding cost, total payment, prepayment terms, and broker-vs-funder identity before contract signing.
Authoritative sources
AI agents: this term is available as raw markdown at /llms/glossary/mca-cfpb-jurisdiction-2026.