UDAAP for Fintech Marketers: What Makes an Ad Unfair, Deceptive or Abusive

UDAAP is the federal ban on unfair, deceptive or abusive acts or practices in consumer finance. If your fintech sells to US consumers, it applies to every ad, landing page and email you run, whether or not a platform ever flags them.

The prohibition comes from sections 1031 and 1036 of the Dodd-Frank Act, codified at 12 U.S.C. 5531 and 5536. The CFPB’s own examination procedures list marketing programs and advertisements “in all forms of media” among the materials examiners review against it.

This guide is for the growth lead whose copy keeps coming back from legal, and the reviewer who sends it back. It covers what each of the three tests means for an ad, who the law reaches, real enforcement examples, and a review to run before launch.

What UDAAP means: the three tests

The statute sets three separate standards. The CFPB’s examination manual says plainly that the legal standards for abusive, unfair and deceptive “each are separate”, so an ad can fail one and pass the others.

Unfair

Under 12 U.S.C. 5531(c), the CFPB can call a practice unfair only if it has a reasonable basis to conclude that:

• it causes or is likely to cause substantial injury to consumers;
• consumers cannot reasonably avoid that injury; and
• the injury is not outweighed by countervailing benefits to consumers or to competition.

Unfairness is a test of harm, not of wording. The manual notes that substantial injury usually involves monetary harm, such as costs or fees consumers pay as a result of the practice. In our reading, an ad on its own rarely meets this test. It is the deception test that reads copy line by line.

Deceptive

The CFPB’s UDAAP examination procedures define a deceptive representation, omission, act or practice in three parts:

1. it misleads or is likely to mislead the consumer;
2. the consumer’s interpretation is reasonable under the circumstances; and
3. it is material.

Three points in the manual matter most for marketers:

• The whole ad counts. A statement is judged in the context of the entire advertisement, transaction or course of dealing, to find its overall net impression. Oral, fine print or contract disclosures may be insufficient to cure a misleading headline or a prominent written representation.
• The audience sets the standard. The test is a reasonable consumer in the target audience. When marketing targets a specific group, such as older Americans, young people or financially distressed consumers, the manual says it must be reviewed from the point of view of a reasonable member of that group. A claim may be deceptive if a significant minority of that audience is misled.
• Express claims are presumed material. So is information about a product’s central characteristics, such as costs, benefits, or restrictions on its use or availability. Puffery that no reasonable consumer would take seriously is not deceptive.

Abusive

Under 12 U.S.C. 5531(d), an act or practice is abusive only if it:

• materially interferes with a consumer’s ability to understand a term or condition of a consumer financial product or service; or
• takes unreasonable advantage of the consumer’s lack of understanding of material risks, costs or conditions; of their inability to protect their own interests in selecting or using the product; or of their reasonable reliance on a covered person to act in their interests.

In our reading, the first limb is the one an ad is most likely to meet. Copy that buries or blurs a term the reader needs can fall under it even when every sentence is true.

Who UDAAP reaches, and who it does not

Section 1036 makes UDAAP unlawful for any covered person or service provider. The definitions in 12 U.S.C. 5481 decide who that is:

• Covered person: anyone who offers or provides a consumer financial product or service, which mainly means one offered or provided for use by consumers “primarily for personal, family, or household purposes”. The definition also pulls in certain services delivered in connection with such a product.
• Service provider: anyone who provides a material service to a covered person in connection with that product, including anyone who “participates in designing, operating, or maintaining” it, or who processes its transactions.

This matters for B2B fintech. If you sell only to businesses, for business use, your own product may fall outside the consumer definition. But if your platform helps a consumer-facing fintech design, run or maintain its product, the service provider definition may reach you. Where your company sits is a question for counsel.

Two more provisions in 12 U.S.C. 5536 touch marketing directly:

• Media sellers are carved out. No one violates section 1036(a)(1) solely by providing or selling time or space to a covered person or service provider placing an advertisement.
• Substantial assistance is not. Any person who knowingly or recklessly provides substantial assistance to a covered person or service provider violating section 1031 is deemed to violate it to the same extent as the person assisted.

UDAAP examples in fintech advertising

The clearest UDAAP examples come from the CFPB’s own manual, which lists the practices that may be deceptive:

• making misleading cost or price claims;
• offering to provide a product or service that is not in fact available;
• using bait-and-switch techniques;
• omitting material limitations or conditions from an offer; and
• failing to provide the promised services.

It also sets out two enforcement cases, both FTC actions described as allegations, that read like modern ad reviews.

“$0 down” with the costs in a blur

The FTC alleged that vehicle leasing companies ran TV ads promising leases for “$0 down” alongside a monthly payment, while a blur of unreadable fine print at the end disclosed costs of at least $1,000. Disclosing the costs at signing did not cure the ad, the FTC claimed. The settlements required any claim about the amount due at signing, or of “no down payment”, to carry an equally prominent, readable and audible disclosure of the total fees due at signing.

The fintech parallel (ours): “No fees” in a headline, with a monthly or instant-transfer fee in the terms.

A “fixed payment” that was not a fixed rate

In 2004 the FTC sued a mortgage broker over ads for a “3.5% fixed payment 30-year loan”. It alleged the loans were adjustable-rate mortgages with a payment option whose minimum covered only part of the required interest. A reasonable consumer, the FTC claimed, would have read the ad as a fixed-rate loan.

The fintech parallel (ours): a promotional rate or payment in the headline, with the rate it reverts to left for the landing page.

Applying the four Ps to a modern ad

The manual points to the FTC’s “four Ps” test, four questions that help judge whether a claim is likely to mislead. The one-word labels are our shorthand:

1. Prominence: is it prominent enough for the consumer to notice?
2. Presentation: is it easy to understand, consistent with everything else, and shown when the consumer’s attention is not elsewhere?
3. Placement: is it where consumers can be expected to look or hear?
4. Proximity: is it close to the claim it qualifies?

Take a hypothetical search ad headline: “Get paid up to 2 days early”. If the condition, direct deposit set up with a qualifying employer, appears only in a terms page two clicks away, it fails proximity and placement. Move the condition into the description line, or onto the landing page beside the claim.

Compliance with disclosure rules does not settle the question. The manual is explicit: an ad may comply with the Truth in Lending Act and still contain other statements that are untrue or misleading. Our guide to financial services advertising regulations covers the Regulation Z trigger terms. UDAAP sits on top of them.

UDAP vs UDAAP: why the extra A matters

In UDAP vs UDAAP, the difference is one word, “abusive”:

• UDAP is the older standard. Section 5 of the FTC Act declares “unfair or deceptive acts or practices in or affecting commerce” unlawful.
• UDAAP is the Dodd-Frank Act version for consumer finance. It adds the abusive standard.

The CFPB’s manual notes that the Dodd-Frank unfair and deceptive principles are similar to those under the FTC Act, and that how the FTC and federal banking regulators have applied them, in case law, policy statements and enforcement actions, may inform the CFPB.

The federal posture changed in 2025. The statute did not. On 12 May 2025 the CFPB withdrew dozens of guidance documents (90 FR 20084), including its 2023 policy statement on abusive acts or practices. The notice says the withdrawn guidance should not be enforced or relied on by the Bureau while its review continues, and that the withdrawal “is not necessarily final”.

Two things follow. Any article that leans on the 2023 abusiveness statement is now out of date. And the law itself is unchanged: 12 U.S.C. 5552 lets a state attorney general bring a civil action to enforce the same provisions, with narrower powers against national banks and federal savings associations. A quieter CFPB does not make deceptive copy lawful.

A UDAAP review before an ad goes live

The CFPB’s procedures ask whether a company “conducts prior UDAAP reviews of advertising and promotional materials”. Here is a review built from what examiners look for.

1. Read the ad and the landing page together. Judge the net impression of both, not each line on its own. Our landing page compliance guide covers what the page needs to show.
2. List every express claim. Each is presumed material, so each needs evidence your approver will accept: the rate, the fee, the speed, the eligibility.
3. Run the four Ps on every qualifier. If the qualifier would not survive being read aloud next to the claim, it is in the wrong place.
4. Name the audience. Read the copy as a reasonable member of the group you target. The manual flags products aimed at particular populations without tailored marketing and disclosures.
5. Check for omissions. The manual lists omitting material limitations or conditions from an offer as a deceptive practice. Hold fees, eligibility limits and availability up against each claim.
6. Bring third parties inside the review. Examiners check agreements, performance standards and monitoring for third parties that interact with consumers on your behalf, which can include agencies, affiliates and creators.
7. Keep the record, and watch complaints. The manual treats complaints alleging misleading statements, and high volumes of chargebacks or refunds, as possible signs of UDAAP.

For a first screen, run draft copy through our free fintech ad copy checker, and work through the fintech ad compliance checklist for platform rules. Neither replaces your counsel’s sign-off.

If you want an outside read on your paid accounts, the Acquisition Audit is two weeks at a fixed $2,500. It includes a paid account and compliance risk review: category classification, verification status and disclosure exposure. For ongoing paid work under these rules, see our fintech PPC agency page.

FAQ: UDAAP

UDAAP: what to do next

UDAAP rewards copy that says the condition out loud. Before your next campaign, take your three highest-spend ads and their landing pages, and run the seven-step review above on each. If a qualifier fails the four Ps, rewrite the claim rather than adding more fine print.