One Letter, Two Different Regulators
Anyone who has attended a compliance training session has likely heard UDAP and UDAAP referred to as the same, and it is important to correct this error before it costs you money. The difference between UDAP and UDAAP comes down to one added standard, “abusive,” and one added regulator. The CFPB layered on top of state laws that were already in place decades before Dodd-Frank. When a creditor or bank sets up accounts with an outside collector, it is necessary to know which standard applies and when both apply simultaneously, since this affects what ‘compliant’ means.
UDAP vs UDAAP: Where Each One Actually Comes From
The idea of UDAP, short for unfair or deceptive acts or practices, comes from Section 5 of the FTC Act, a provision amended in 1938 to prohibit unfair or deceptive practices in commerce. Eventually, each state passed its own version of the law, typically referred to as a “mini-FTC Act”, which gave the state attorneys general the power to take action against unfair or deceptive behavior within their states. For a long time, unfair and deceptive credit practices were also dealt with at the federal level through the Federal Reserve’s Regulation AA.
UDAAP, which stands for unfair, deceptive, or abusive acts or practices, is a more recent and narrower concept. Title X of the Dodd-Frank Act was set up by the Consumer Financial Protection Bureau in 2010 and gave it authority under Sections 1031 and 103 to address unfair, deceptive or abusive acts connected to consumer financial products and services. After the CFPB repealed Regulation AA in 2016, UDAAP assumed responsibility and applied the former regulation’s provisions to those areas.
What the Extra A Actually Adds
Unfair and deceptive mean roughly the same thing under both standards. An act is unfair when it causes substantial, unavoidable consumer injury not outweighed by any benefit, and deceptive when it’s likely to mislead a reasonable consumer on something material to their decision. Abusive is where UDAAP goes further.
An act is considered abusive under 12 U.S.C. § 5531(d) if it seriously obstructs a consumer’s ability to understand the terms of a financial product or if it unfairly exploits the consumer’s lack of understanding, their inability to protect their own interests, or their reasonable reliance on the provider to act in good faith.
That third prong doesn’t require a lie or a misleading statement. A collector can disclose everything accurately and still commit an abusive act if it exploits a consumer who clearly doesn’t grasp what’s happening or can’t reasonably advocate for themselves on the call.
Who Enforces UDAP vs Who Enforces UDAAP
State attorneys general and state banking regulators enforce UDAP under their own mini-FTC Acts. Each state has such an act, though there are considerable variations in scope, phases, and covered entities. UDAAP is federal law, and the CFPB mainly supervises and enforces it. The FTC still has overlapping jurisdiction in areas the CFPB does not directly supervise. For a creditor, the difference lies in coverage: UDAAP applies to all consumer financial products and services a company offers, while a state’s UDAP law covers only what its legislature includes. This coverage can be narrower or broader than the federal standard.
Why Creditors Can’t Just Pick One to Comply With
It is possible for a collection practice to satisfy the federal UDAAP standard yet still breach a state UDAAP statute, or conversely, to violate the federal standard while complying with a state’s statute. At the same time, state enforcement has grown more vigorous as the federal supervisory focus has shifted, largely because attorneys general now more frequently coordinate multistate investigations into companies believed to be engaging in widespread violations. For a creditor operating in several states, this means that relying on a single compliance program based only on Dodd-Frank’s three-part UDAAP test still leaves them with significant exposure. A more prudent approach is to view UDAP and UDAAP as two overlapping layers rather than two versions of the same rule.
What This Means for a Creditor Choosing a Collection Partner
A few questions help separate a partner that actually tracks both standards from one that only trains to the federal one:
- Does the agency look at trends in the state attorney general’s enforcement activities or only at the CFPB’s guidance and consent orders?
- Can someone show how scripts and escalation procedures are examined for practices that could be abusive under UDAAP rules, rather than just unfair or deceptive under the two standards?
- Do they tailor collection methods by state or follow a single national policy regardless of where the consumer lives?
- How is a consumer’s apparent confusion or vulnerability on a call flagged and handled in real time?
How Kollecta Builds for Both Standards
Kollecta treats UDAP and UDAAP as one issue approached from two angles, rather than as two separate checklists. Kollecta checks each script and escalation procedure against federal unfair, deceptive, and abusive criteria and the state-level standards that apply in the jurisdiction where the consumer is located, and it does this before a call is conducted, not after a complaint is received. Recovery and compliance are not opposing objectives; they share the same foundation.
The Bottom Line
UDAP and UDAAP aren’t the same rule with a typo. One comes from decades of state consumer protection law, the other from a federal standard built specifically for consumer financial products, and the “abusive” prong in UDAAP covers ground that unfair and deceptive never did. A creditor that understands both and picks a collection partner built for both is protected in more places than one that only knows the newer acronym.
Frequently Asked Questions
UDAP is an acronym for unfair or deceptive acts or practices and is rooted in the various state "mini-FTC Acts" that go back to the 1930s. UDAAP adds a third criterion, abusive, and is enforced by the CFPB under the Dodd-Frank Act. The additional "A" gives regulators the power to act against conduct that takes advantage of consumers even when nothing stated was literally false.
No. UDAAP operates alongside state UDAP laws rather than replacing them. A creditor can satisfy federal UDAAP requirements and still face a state UDAP claim, since every state's law has its own scope and enforcement standards.
An act is abusive when it materially interferes with a consumer's ability to understand a financial product's terms, or when it takes unreasonable advantage of a consumer's lack of understanding, their inability to protect their own interests, or their reasonable reliance on the provider.
The state attorneys general and state banking regulators enforce UDAP under their state laws. At the federal level, the CFPB is primarily responsible for enforcing UDAAP, while the FTC has some overlapping jurisdiction.
Yes. Regulators at both the state and federal level generally hold the originating creditor accountable for a third-party collector's conduct, which is why a collection partner's compliance program needs to account for both standards, not just one.
