The Consumer Financial Protection Bureau is urging the U.S. Supreme Court to deny review of a Ninth Circuit decision that upheld a $134 million restitution award against CashCall, Inc. and its affiliates for collecting on tribal-model consumer loans that were void under state law.¹ The case, CashCall, Inc. v. CFPB (No. 25-343), centers on whether CashCall knowingly waived its Seventh Amendment jury trial right by agreeing to a bench trial—but the real story is the $167 million combined hit ($134 million restitution plus $33 million civil penalty) for running a tribal lending arrangement that courts systematically dismantled.²³

The immediate implication: even with CFPB enforcement capacity at historic lows, this case's precedent on "true lender" doctrine, state law loan validity, and restitution exposure remains fully operative—and state attorneys general are actively using this exact playbook.

Here's the short answer: because the legal architecture that took down CashCall—"true lender" doctrine, state law loan validity, and UDAAP-based restitution—applies to any origination model where a partner entity is making loans and a separate entity is funding, purchasing, or servicing them. That includes bank-fintech partnerships, marketplace lending arrangements, and structures that alternative business lenders use every day to operate across state lines.

CashCall used a tribal entity, Western Sky Financial, to originate consumer installment loans at rates from 90% to 343% APR.⁶ But Western Sky was a storefront. CashCall funded every loan through WS Funding, bore all default and regulatory risk, processed applications through its own California servers, and indemnified Western Sky broadly.⁴ The court looked past the loan documents and applied a "totality of the circumstances" test to conclude CashCall was the true lender. Once that determination was made, the tribal choice-of-law provision collapsed, state usury and licensing laws applied, and the loans were void in 16 states.⁵

The mechanic is devastatingly simple: if you're the true lender and you don't have the right license or your rates exceed the cap, the loans aren't just in violation—they're void. You're collecting on air. And collecting on void loans is a UDAAP violation under Dodd-Frank. That's how a licensing issue becomes a nine-figure restitution award.

The CashCall "true lender" analysis was originally applied to a tribal lending scheme, but states are rapidly codifying and expanding this doctrine to cover bank-fintech partnerships and other multi-party origination models.¹⁶ Hawaii, Maine, Minnesota, New Mexico, and Washington have all revised their consumer lending statutes to require licenses for a broader range of participants in the lending chain.¹⁷ Colorado has opted out of DIDMCA, requiring out-of-state state-chartered banks to follow Colorado's usury caps when lending to Colorado residents.¹⁸

The key question for alternative business lenders: does this true lender exposure exist in your origination channel? If you're purchasing receivables from a platform that originates on someone else's license, or if you're using a bank partner to export rates while bearing the economic risk, you're in the CashCall zone. The factors courts examine—who bears default risk, who funds the loans, who controls underwriting, who marketed to the borrower—are the same ones your auditors should be stress-testing now.

The Trump administration has spent the past year systematically dismantling the CFPB. Acting Director Russell Vought ordered a work stoppage in February 2025, attempted mass layoffs of over 1,000 staff, and publicly stated his intention to "close down" the agency.¹⁰ Of 36 pending enforcement suits at the time of the administration change, only 24 remain open, and the Bureau has indicated intent to continue litigating only six.²² The nonbank registry rule has been rescinded.¹⁹ Congress cut the Bureau's budget cap from 12% to 6.5% of the Fed's 2009 operating expenses through the One Big Beautiful Bill.²¹

But here's what matters for risk management: the CashCall precedent doesn't require the CFPB to be operational. The legal holdings on true lender doctrine, state law loan validity, and UDAAP-based restitution are baked into case law. Any plaintiff's attorney, state AG, or successor federal regulator can use them.

Aggressively. State attorneys general are explicitly positioning themselves as the primary enforcers of consumer financial protection in the absence of meaningful CFPB activity.¹⁴ Section 1042 of Dodd-Frank independently authorizes state AGs and state financial regulators to enforce federal consumer protection laws, including UDAAP, without CFPB involvement.²³ The CFPB itself issued a 2022 interpretive rule and a January 2025 report encouraging states to carry this authority forward.¹⁵

Specific actions are already in motion. In April 2025, the New York AG brought cases against earned wage access providers under state usury laws, characterizing them as loans.¹⁴ New York DFS hired former CFPB employees and Superintendent Adrienne Harris declared "we're hiring" in direct response to federal enforcement gaps. Pennsylvania launched a centralized consumer protection hotline. Twenty-two state AGs filed suit in January 2026 to force the CFPB to maintain operations.¹⁸ The enforcement vacuum is being filled—it's just moving from one regulator to fifty.

Several structural elements of the CashCall case translate directly to risk factors in commercial lending:

Partner origination risk. If you're purchasing merchant cash advances, receivables, or loans originated by a separate entity, courts may apply the true lender test to determine whether you're the actual lender. The factors are economic: who bears the risk, who funds the advance, who controls the underwriting decision. If you pre-commit to purchase, fund immediately, or guarantee the originator's economics, you're exposed.

State licensing gaps. CashCall's $134 million award stems from collecting loans in states where it wasn't licensed or exceeded rate caps. Business lending has fewer licensing requirements than consumer lending in many states, but the patchwork is growing. California's SB 1235 disclosure requirements, New York's MCA disclosure rules, Virginia's Commercial Financing Disclosure Act, and Utah's expanded lending statutes all create new compliance obligations. Operating without proper licensing in states with "void" remedy provisions is the specific mechanism that generated CashCall's exposure.

Restitution as a damages theory. The Ninth Circuit upheld legal restitution exceeding CashCall's net profits—the $134 million award represents the total interest and fees collected on void loans, not CashCall's profit margin. Under this theory, restitution isn't capped by what you made; it's measured by what you collected. For any lender operating near the edge of state law compliance, this transforms a regulatory issue into an existential financial threat.

Waiver traps. The procedural lesson is equally important. CashCall agreed to a bench trial, participated fully, never moved to withdraw, then tried to claim it should have had a jury when restitution ballooned to $134 million. The court held the waiver was "express, knowing, and voluntary."² For any lender in litigation with a federal agency, the message is unambiguous: preserve every procedural right in writing. Failing to timely object to characterizations of relief, trial format, or damages theories is a permanent concession.

Audit your origination chain. Map every entity that touches a loan from origination to collection. For each link, document who bears economic risk, who controls underwriting, and who funds the advance. If the true lender analysis points to your entity, ensure you hold all required state licenses and operate within all applicable rate and fee caps.

Stress-test against state law. Don't rely on federal preemption arguments or bank partner charter protections without confirming they survive a true lender challenge in your specific states. Colorado, Minnesota, New York, and California are the most aggressive jurisdictions. If you're operating in 20+ states, assume at least 5-8 present material compliance risk.

Preserve procedural rights. If you're subject to any regulatory investigation, enforcement action, or litigation, instruct counsel to preserve jury trial rights and object in writing to any characterization of relief sought by the plaintiff. CashCall lost a $134 million argument because it participated without objection.

Monitor state AG activity. Federal enforcement is effectively paused. State enforcement is not. Track multi-state investigation announcements, new UDAP interpretations, and true lender legislation in real time. The enforcement risk hasn't decreased—it's decentralized.

Manual verification processes are becoming competitively unsustainable.

Cobalt Intelligence offers a solution that both reduces risk and increases funding speed - giving alternative lenders both safety and competitive advantage in their market.

Schedule a FREE demo call

Great American Holdings, LLC, based in Westlake Village, California, acquired Risk Solutions International and launched Great American Capital Corporation, LLC (GACC), a direct lending platform for middle market companies. GACC, led by Eran Cohen, aims to handle $20 million to $100 million transactions and will work with the traditional ABL community, utilizing GA Group's asset valuation expertise and network.

The U.S. Small Business Administration announced that its 7(a) Working Capital Pilot Program has surpassed $150 million in total lending approvals since inception—with more than $125 million of that volume approved since January 2025—driven largely by small manufacturers, which comprise 98% of all U.S. manufacturers and represent over 25% of the program's portfolio. The pilot, scheduled to run through July 2027, complements the SBA's core 7(a) and 504 loan programs by offering both asset-based lines of credit—allowing borrowers to draw against inventory or receivables—and transaction-based financing that can fund up to 100% of direct costs on specific projects or orders, with individual loans reaching up to $5 million for domestic and international transactions under a single facility.

The U.S. International Development Finance Corporation, the $205 billion government development lending agency led by CEO Ben Black—son of billionaire Leon Black—is opening its first New York City office at 100 Pearl Street in Manhattan's Financial District, following a congressional tripling of the agency's financing capacity from $60 billion under legislation signed late last year. The Wall Street outpost, expected to open this month, is designed to recruit private-sector talent from major banks and attract institutional co-investors as DFC expands its mandate to pursue deals in Latin America, critical minerals—including a $5 billion consortium with Orion Resource Partners and Abu Dhabi's ADQ sovereign wealth fund—and wealthier allied nations such as Canada and Australia that had previously been outside its purview.