UDAAP violations are unfair, deceptive or abusive acts or practices in consumer financial services, and some of the clearest examples come from bank call centers, where the violation was what a representative said or did on the phone. Capital One's call-center vendors led customers to believe add-on products would raise their credit scores (2012). Bank of America's telemarketers went off script with misleading pitches for payment protection (2014). Santander's telemarketer told customers "this is not a sales call" and enrolled people in overdraft coverage they had not agreed to (2016). Bank of America impeded cardholders trying to file notices of error (2022). In each case the evidence was in the calls, and so was the pattern. Botminds' Call Compliance Monitoring reviews every call and chat for misstatements like these and traces repeats to their cause, so a compliance officer sees them in weeks, not years.
The cases below are real and quoted from the regulators' own releases. Where the page shows how monitoring would catch a pattern, the example comes from a fictional sample bank, Corvane National Bank, and its sample data.
The casebook: six cases where the words on the call were the problem
2012
Capital OneCFPB, with the OCC
Call-center vendors sold add-on products when customers called to activate new cards. Some customers were led to believe the products would improve their credit scores, were not told buying was optional, or were enrolled without consent.
Rule: Deceptive
Amount: ≈ $140M refunds; $25M CFPB and $35M OCC penalties
2014
Bank of AmericaCFPB, with the OCC
Telemarketing scripts for payment protection contained misstatements, and telemarketers "often went off script" with misleading pitches: the first 30 days free, or the call only a request for information.
Rule: Deceptive; unfair billing
Amount: ≈ $727M relief; $20M CFPB and $25M OCC penalties
2014
A student loan servicer (unnamed)CFPB supervision
An automated dialer called delinquent borrowers early in the morning or late at night: more than 5,000 calls at inconvenient times in 45 days, 48 of them to one consumer.
Rule: Unfair
Amount: Supervisory finding; controls improved at examiners' direction
2016
Santander BankCFPB
A telemarketing vendor told customers "this is not a sales call", suggested overdraft coverage was free, and enrolled customers without asking; the vendor earned more for hitting sales targets.
Rule: Deceptive; EFTA opt-in rule
Amount: $10M penalty
2022
Bank of AmericaCFPB, with the OCC
Unemployment benefit cardholders were impeded in filing notices of error, and their notices were denied on the strength of an automated fraud filter alone.
Rule: Unfair; abusive; Regulation E
Amount: $100M CFPB and $125M OCC penalties, plus redress
2023
Citizens BankCFPB lawsuit, stipulated judgment
Alleged: billing-error claims denied for failure to return a fraud affidavit, and required credit counseling information not given to consumers who called the designated toll-free number.
Rule: TILA and Regulation Z, through the CFPA
Amount: $9M penalty
What are examples of UDAAP violations on bank calls?
Examples of UDAAP violations on bank calls fall into four groups: misstating what a product costs or does, enrolling or selling without real consent, framing a sales call as something else, and making it hard for customers to exercise a right, such as disputing an error. The casebook above has at least one of each.
Cost and benefit. Capital One's customers were "sometimes led to believe that they would be enrolling in a free product rather than making a purchase" (CFPB, 2012); Bank of America's were led to believe "the first 30 days of coverage were free of charge when, in fact, by enrolling, consumers were agreeing to purchase the credit protection products" (CFPB, 2014). Consent. At Santander, "during numerous telemarketing calls, call representatives did not ask the consumers if they wanted to opt in but enrolled them anyway" (CFPB, 2016). Framing. Santander's representatives "falsely told consumers that 'this is not a sales call'". Access to rights. Bank of America "engaged in unfair acts and practices by impeding unemployment insurance benefit prepaid debit cardholders' efforts to file notices of error" (CFPB, 2022).
Not every case in the casebook is a UDAAP case in name. Citizens was brought under the Truth in Lending Act, and part of Santander's violation was the overdraft opt-in rule. They are included because the failure happened on the phone, and a monitoring program that listens for UDAAP risk hears them on the same calls.
Unfair, deceptive or abusive: what is the difference?
Unfair turns on injury, deceptive on misleading, and abusive on taking advantage. The statute defines unfair and abusive; deception is defined by the regulators' long-standing three-part test. A single call can fail more than one.
The three UDAAP tests, in the words of the statute and the OCC
| Standard | The test | On a call, it sounds like |
|---|---|---|
| Unfair | Causes or is likely to cause "substantial injury to consumers which is not reasonably avoidable by consumers", not outweighed by benefits to consumers or competition (12 U.S.C. 5531(c)) | A queue or a script that keeps customers from disputing an error, or calls placed at hours that harass |
| Deceptive | A representation, omission, act or practice likely to mislead; deceptive from the perspective of a reasonable consumer; and material (OCC: "all three of the following factors") | "There's no fee for that" when the schedule says otherwise; "this is not a sales call" |
| Abusive | Materially interferes with a consumer's ability to understand a term, or takes unreasonable advantage of a lack of understanding, an inability to protect their interests, or reasonable reliance (12 U.S.C. 5531(d)) | Pressing a confused or distressed caller into a product, or relying on their trust in the banker to skip a material term |
Deception is the standard most call findings meet. The OCC's handbook says practices "must meet all three of the following factors to be considered deceptive", and names the first plainly: "Practices that can be misleading or deceptive include false oral and written representations; misleading claims about costs of services or products" (OCC Comptroller's Handbook, UDAP and UDAAP). Materiality is rarely in doubt on a bank call: "Generally, information about costs, benefits, or significant limitations related to the product or service would be material."
Can a call center script violate UDAAP?
Yes. A script can contain the misstatement itself, and a script that is accurate does not protect a bank whose representatives depart from it. Bank of America's 2014 order covered both: "the telemarketing scripts Bank of America used for these products contained misstatements. Additionally, telemarketers often went off script to make sales pitches that were misleading and that omitted pertinent information. Over 1.4 million card members were affected by this deceptive marketing" (CFPB, April 2014).
Two lines in the OCC's deception standard explain why a script review is not enough. Regulators judge "the entire advertisement, transaction, or course of dealing", so what was said on the call counts, not only what was approved on paper. And "a practice that misleads a significant minority of consumers may be deceptive", so a misstatement does not have to be on most calls to matter. A third line closes the usual defence: "subsequent written disclosures containing accurate information about the benefits or material limitations of a product or service may be insufficient to correct a misleading representation." A correct letter after a misleading call may not cure the call.
Years on the phone before the order: the calls were evidence all along
- Practice on callsAug 2010 – 2012
- Practice on calls2010 – Aug 2012
- To the orderto Apr 2014
- Practice on calls2010 – 2014
- To the orderto Jul 2016
- Practice2020–21
- To the orderto Jul 2022
The timeline is the argument for monitoring every call. In each case the misstatements were made on recorded calls for months or years before an order, and in most of them the pattern was the point: incentives that rewarded a vendor for sales targets, a script that said the wrong thing, a queue that kept customers out. A sample of a few calls a month per representative hears some of those calls; it does not see that the same words are on hundreds of them.
What UDAAP risks exist in a call center?
The UDAAP risks in a bank call center are the statements and practices the casebook shows, plus the ones a bank's own systems can introduce at scale: a wrong knowledge article, a changed phone menu, a virtual assistant answer. The list below is what a monitoring program should be listening for.
Ten UDAAP risks to listen for on bank calls and chats
- Cost stated as free or lower than the schedule
Fees, trial periods, replacement cards, overdraft charges, checked against the current fee schedule.
- Optional presented as required
Or the reverse: a product the customer must agree to described as automatic.
- Enrolment without a clear yes
Especially where an opt-in rule applies, as it does for overdraft coverage on ATM and one-time debit card transactions.
- Sales framed as service
"This is not a sales call", or a service call that turns into a pitch without saying so.
- Benefits and eligibility overstated
Credit score effects, coverage periods, who qualifies.
- Availability and holds misstated
A deposit promised for Monday when the hold notice says Tuesday.
- A right made harder to use
Disputes sent to the merchant, complaints not taken, cancellations talked out of.
- Off-script statements
Approved scripts prove little if what is said departs from them.
- Incentives that reward the wrong words
Sales targets and pay tied to enrolments, for staff and vendors.
- System-made misstatements
A knowledge article, IVR change or virtual assistant answer that puts the same wrong words on many calls.
The last item is the one hand sampling handles worst, because no single banker is at fault. At Corvane a knowledge article written for credit card billing disputes was linked to debit card questions on September 28, and bankers began telling customers to call the merchant first. By October 21 the same advice had been given on 37 calls by 11 bankers at three sites. On a debit card that advice is also a Regulation E problem, because a bank may not make a customer contact the merchant before it investigates; why a call is a notice of error sets out the rule. A pattern like this is what turns individual coaching points into a possible unfair or deceptive practice.
Thirty-seven calls, one cause: a possible UDAAP issue found in three weeks
How do banks monitor for UDAAP on calls?
Banks monitor for UDAAP on calls by testing what was actually said against what the bank's products and documents say, and by reading complaints for signs that customers were misled. The OCC expects it: "All banks should have adequate risk-based controls in place to prevent and detect UDAP and UDAAP issues", and the items "commonly evaluated within the scope of monitoring or audit" include "Contracts, product disclosures, marketing materials, sales scripts, and call recordings" (OCC Comptroller's Handbook).
Complaints are the other half. The same handbook says "customer complaints alleging misrepresentations or misunderstandings may provide a window into the perspective of a reasonable consumer", which is the perspective the deception test uses. A complaint the banker never logged closes that window, which is why where a bank draws the line between a complaint and an inquiry is a UDAAP question as well as a complaint-handling one.
Checking every fee and hold statement against the bank's own records
At Corvane, every statement about a fee, a hold or a protection is checked against the bank's own records, and every flag is re-read by a second agent before a person sees it. A banker who said "there's no fee for that" about a replacement debit card was right, because the fee schedule says $0, so the flag was removed with that reason. Confirmed misstatements open a case for their owner, and a repeated one opens a UDAAP issue for the Compliance Monitoring Manager.
Every confirmed finding becomes a case, including the UDAAP issue behind a pattern
What penalties have banks paid for UDAAP and call-center failures?
The civil penalties in the casebook range from $9 million to $225 million, and they are the smaller part of what the banks paid. Capital One refunded about $140 million to two million customers; Bank of America's 2014 order required an estimated $727 million in relief. Redress follows the customers who were affected, which is why finding the pattern early matters more than any single fine.
Civil penalties in the call-center cases, CFPB and OCC combined
Is UDAAP still enforced in 2026?
Yes. The statute has not changed: the CFPB enforces it, and the prudential regulators apply Section 5 of the FTC Act to the banks they supervise. What changed in 2025 was the CFPB's guidance. On May 12, 2025 it withdrew a long list of guidance documents, including its 2023 "Statement of Policy Regarding Prohibition on Abusive Acts or Practices", and said it "does not intend to prioritize the enforcement of such guidance against parties that do not conform to the guidance during the pendency of any withdrawal" (Federal Register, 90 FR 20084). Withdrawing an interpretation of "abusive" does not withdraw the word from 12 U.S.C. 5531.
The prudential regulators kept acting. In 2025 the FDIC "issued civil money penalty (CMP) orders totaling approximately $150 million against institutions to address violations of the FDPA and Section 5 of the Federal Trade Commission Act for Unfair or Deceptive Acts or Practices" (FDIC Consumer Compliance Supervisory Highlights, March 2026), a figure that combines flood insurance and UDAP penalties. The OCC revised its UDAP and UDAAP examination booklet in December 2024. A bank's own monitoring is what lets it find a pattern and fix it before an examiner does; the agents and limits behind that are on the Call Compliance Monitoring page.
Questions people ask
What is a deceptive practice in banking?
A representation, omission, act or practice that is likely to mislead, judged from the perspective of a reasonable consumer, about something material such as cost, benefits or significant limitations. The OCC requires all three factors, and notes that "false oral and written representations" are among the practices that can be deceptive.
Is one banker's misstatement a UDAAP violation?
It can be, since the test looks at whether a representation is likely to mislead, not how often it happened. In practice a single misstatement is usually corrected with the customer and coached; the same misstatement on many calls, from a script, an article or an incentive, is what regulators have treated as a practice.
Does a correct letter after the call fix a misleading call?
Not necessarily. The OCC says "subsequent written disclosures containing accurate information about the benefits or material limitations of a product or service may be insufficient to correct a misleading representation", especially where the customer is steered away from the qualifying language.
Is the bank responsible for a vendor's call center?
Yes. Capital One's and Santander's cases both turned on vendors' calls, and in 2012 the CFPB said "institutions will be held responsible for the actions of their third-party vendors." Vendor calls belong in the same monitoring program as the bank's own.
Who enforces UDAAP and UDAP at banks?
The CFPB enforces the Dodd-Frank UDAAP prohibition, and its jurisdiction over depository institutions "is shared by the Federal Deposit Insurance Corporation, the Office of the Comptroller of Currency, and the Federal Reserve Board of Governors". The FDIC and the OCC also apply the FTC Act's ban on unfair or deceptive practices to the banks they supervise, and the FTC itself keeps broad authority over unfair and deceptive practices.