Unfair, deceptive, or abusive acts or practices — the compliance shorthand is UDAAP — is not one legal standard but three, drawn from Section 5 of the Federal Trade Commission Act and Sections 1031 and 1036 of the 2010 Dodd-Frank Act. Each test carries its own elements, and federal banking regulators, the Federal Trade Commission, and the Consumer Financial Protection Bureau enforce them against banks and nonbank financial companies alike.
The three tests do not overlap cleanly, and compliance teams that treat UDAAP as a single blanket standard tend to misjudge their exposure. "Unfair" and "deceptive" trace to the FTC Act, a statute nearly a century old; "abusive" is a Dodd-Frank creation specific to consumer financial products and services. Understanding where each test starts and stops is the first step in building a defensible compliance-management program.
What makes a practice "unfair" under the law?
A practice is unfair when it satisfies a three-part test under Section 5 of the FTC Act (15 U.S.C. § 45): the act causes or is likely to cause substantial injury to consumers, the injury is not reasonably avoidable by the consumer, and the injury is not outweighed by countervailing benefits to consumers or competition. All three elements must be present; a practice that only causes minor or speculative harm, or one consumers could reasonably have avoided, does not meet the standard.
The FDIC's Consumer Compliance Examination Manual applies this same three-part test to the institutions it supervises, noting that banking agencies — the FDIC, the Federal Reserve Board, and the Office of the Comptroller of the Currency — enforce the unfairness prohibition against supervised banks and their institution-affiliated parties, while the FTC enforces it against nonbanks outside the CFPB's jurisdiction.
"Substantial injury" ordinarily means monetary harm, though the manual does not require actual loss in every case; a likelihood of harm can suffice. The "not reasonably avoidable" prong turns on whether the consumer had a meaningful opportunity to make a different choice — disclosure alone does not automatically satisfy it if the practice interferes with the consumer's ability to act on the information.
How is "deceptive" different from "unfair"?
A representation, omission, or practice is deceptive when it is likely to mislead a reasonable consumer, the consumer's interpretation is reasonable under the circumstances, and the misleading element is material — meaning it is likely to affect a consumer's decision about a product or service. Deception does not require proof that the company intended to mislead; the test is objective, focused on the effect of the representation on a reasonable consumer.
Materiality is presumed for express claims about central characteristics of a product, such as cost, coverage, or benefits, according to the same FTC Act Section 5 framework that the FDIC's examination manual applies to supervised institutions. Implied claims and omissions require closer analysis of whether a reasonable consumer would have relied on the missing or implied information in making a decision.
Deceptive-practices cases in financial services commonly involve advertising that overstates a product's benefits, disclosures that bury material terms, or omissions about fees, rates, or eligibility requirements. Because the standard predates Dodd-Frank by decades, deception claims can reach conduct well outside consumer-financial products, which is why the FTC retains independent authority over nonbank deception cases that fall outside CFPB jurisdiction.
What does "abusive" add, and why is it harder to define?
"Abusive" is the newest and narrowest of the three tests, created by Dodd-Frank Act Sections 1031 and 1036, codified at 12 U.S.C. §§ 5531 and 5536, and available only to the CFPB and the prudential regulators applying the abusiveness standard to consumer financial products and services — it has no FTC Act counterpart. An act or practice is abusive if it materially interferes with a consumer's ability to understand a term or condition of a product or service, or if it takes unreasonable advantage of a consumer's lack of understanding, a consumer's inability to protect their own interests, or a consumer's reasonable reliance on a covered person to act in the consumer's interest.
Because the statute supplies no numerical thresholds, the standard has shifted with agency guidance. The CFPB issued a Policy Statement on Abusive Acts or Practices in February 2020 emphasizing prosecutorial discretion, then rescinded that statement in a March 2021 notice. The bureau's current policy statement, cited on its abusiveness-guidance page, describes itself as the CFPB's first formal issuance to summarize precedent on abusive acts or practices and to offer an analytical framework — organized around the same two prohibitions written into the statute: material interference with understanding, and taking unreasonable advantage of a consumer's position.
Practitioners have long criticized the abusiveness standard as vague compared with the FTC Act's decades of case law on unfairness and deception; the CFPB's successive policy statements are attempts to narrow that uncertainty through agency interpretation rather than new rulemaking, since Congress wrote the two-part test directly into the statute.
Who enforces UDAAP, and against which institutions?
Enforcement authority splits by institution size and charter type. The CFPB has primary UDAAP examination and enforcement authority over insured depository institutions with more than $10 billion in total assets and their affiliates, as well as over most nonbank covered persons offering consumer financial products or services. For insured depository institutions at or below that $10 billion threshold, the prudential regulator — the FDIC for state nonmember banks, the Federal Reserve for state member banks, the OCC for national banks and federal savings associations, and the NCUA for federally insured credit unions — retains primary examination authority, while the CFPB can still write rules that apply across the market.
The NCUA's compliance guidance for federally insured credit unions ties this back to the same statutory citations, 12 U.S.C. § 5531 and § 5536, and describes the compliance-management elements examiners look for: written policies and procedures addressing UDAAP risk, pre-launch review of new products and advertising, staff training, complaint-monitoring systems that can surface early UDAAP signals, and periodic review of incentive-compensation structures that could encourage the kind of aggressive sales practices that trigger unfairness or abusiveness findings.
| Test | Source | Core elements |
|---|---|---|
| Unfair | FTC Act § 5 (15 U.S.C. § 45) | Substantial injury; not reasonably avoidable; not outweighed by benefits |
| Deceptive | FTC Act § 5 (15 U.S.C. § 45) | Likely to mislead; reasonable consumer interpretation; material |
| Abusive | Dodd-Frank §§ 1031, 1036 (12 U.S.C. §§ 5531, 5536) | Material interference with understanding, or unreasonable advantage-taking |
What this means in practice
Compliance-management programs that map controls to a single undifferentiated "UDAAP" bucket risk missing that each test has distinct proof requirements and distinct enforcers. Four consequences follow from the statutory record above.
- Institutions above and below the CFPB's $10 billion asset threshold face different primary examiners for the same statutory tests, so a bank approaching that threshold should confirm which regulator's exam priorities and guidance currently govern its UDAAP risk assessment.
- Because abusiveness has no FTC Act analog and rests on agency interpretation that has already reversed once — the 2020 policy statement rescinded in 2021 — compliance teams should track current CFPB guidance rather than rely on older abusiveness precedent that the bureau has since superseded.
- Deception claims require no proof of intent, so marketing, disclosure, and product-design reviews should test claims against how a reasonable consumer would interpret them, not against what the company intended to communicate.
- Complaint data and incentive-compensation structures are recurring examiner focus areas across agencies, making them practical, low-cost places to concentrate ongoing monitoring resources.
This article is informational and does not constitute legal advice. Institutions evaluating their own UDAAP exposure should consult qualified counsel familiar with the specific facts of their products, disclosures, and examination history.
For a related compliance perspective, read FinCEN's SAR Rule Explained: The 30-Day Deadline, the $5,000 Threshold, and What Changed in 2025.