The UDAAP 3 part test is the unfairness standard: an act or practice is unfair if it causes or is likely to cause substantial injury to consumers, the injury is not reasonably avoidable by them, and it is not outweighed by benefits to consumers or to competition. Deception has its own three parts: a representation likely to mislead, judged from a reasonable consumer's view, about something material. Abusive is different again, a set of stand-alone tests in the statute. A fee can pass every disclosure rule and still fail the second part of the unfairness test, because a disclosure that customers do not read, or cannot act on, does not make a fee avoidable. That gap is why Botminds' UDAAP Risk Assessment tests each claim on each screen against the agreement and records how a hurried customer reads it, before a compliance officer decides whether the practice crosses a line.
The UDAAP tests side by side: unfair, deceptive and abusive
| Standard | What must be shown | How the parts combine | Where it lives |
|---|---|---|---|
| Unfair | (1) substantial injury, actual or likely; (2) not reasonably avoidable by consumers; (3) not outweighed by countervailing benefits to consumers or competition | All three | FTC Act section 5 (codified in 1994); Dodd-Frank section 1031(c) |
| Deceptive | (1) a representation, omission or practice likely to mislead; (2) a reasonable consumer's interpretation; (3) material | All three | FTC Policy Statement on Deception (1983); applied under section 5 and Dodd-Frank |
| Abusive | Materially interferes with understanding a term, or takes unreasonable advantage of a lack of understanding, an inability to protect one's interests, or reasonable reliance | Any one prong is enough | Dodd-Frank section 1031(d) only |
What is the UDAAP 3 part test?
Strictly, it is the unfairness test, the only one of the three standards that Congress wrote as three conditions that must all be met. The FDIC's procedures state it in one line: an act or practice is unfair when it "(1) causes or is likely to cause substantial injury to consumers, (2) cannot be reasonably avoided by consumers, and (3) is not outweighed by countervailing benefits to consumers or to competition", a test "Congress codified ... in 1994" (FDIC Consumer Compliance Examination Manual, VII-1).
Practitioners also call the deception standard a three-part test, and both readings are common in search. The difference matters in a review. The FDIC notes that "the standards for establishing deception are less burdensome than the standards for establishing unfairness because, under deception, there is no requirement of substantial injury or the likelihood of substantial injury". A misleading headline does not need a dollar of harm to fail; an unfair fee does. Public policy can inform the unfairness analysis but, in the FDIC's words, "will not serve as the primary basis for determining that an act or practice is unfair."
What is substantial injury under UDAAP?
Usually money: a fee, an interest charge or another cost a customer pays because of the practice. The OCC's handbook is direct: "Generally, monetary harm, such as when a consumer pays a fee or interest charge, or incurs other similar costs to obtain a bank product or service as a result of an unfair practice, will be deemed to involve substantial injury" (OCC Comptroller's Handbook, UDAP and UDAAP). Size per customer does not decide it. The FDIC says "An act or practice that causes a small amount of harm to a large number of people, or a significant amount of harm to a small number of people, may be deemed to cause substantial injury," and that trivial or merely speculative harm is typically not enough.
Take a sample journey to see the arithmetic. The data are fictional: Fernway, a fintech partner of the sample bank, forecasts 40,000 Early Pay accounts in its first year and expects 30% of them to use a $4.99 instant transfer twice a month. That is about 12,000 customers paying under $10 a month each, and an estimated $1,437,120 a year in total. Small per head, large in aggregate: exactly the profile the FDIC's sentence describes.
One small fee, one large number: the sample journey's injury in figures
$4.99
per instant transfer, in the partner's fee schedule
Standard transfers are free
≈12,000
customers expected to use it: 30% of 40,000 accounts
The partner's own forecast
$1.44M
estimated fees a year under an "always free" headline
Twice a month, twelve months
Can a disclosed fee still be unfair?
Yes. Disclosure goes to the second part of the test, avoidability, and it only helps if it lets customers actually avoid the injury. The FDIC explains when they cannot: "Consumers cannot reasonably avoid injury from an act or practice if it interferes with their ability to effectively make decisions or to take action to avoid injury. This may occur if material information about a product, such as pricing, is modified or withheld until after the consumer has committed to purchasing the product". It adds that the same may occur "where testing reveals that disclosures do not effectively explain an act or practice to consumers."
The OCC applies the same idea to overdraft programs in its 2024 booklet. Banks must disclose overdraft terms clearly, but "Even if terms and features are adequately disclosed, examiners should consider whether the features of products and services that the bank offers present risks of possible unfairness or abusiveness." The CFPB's examination procedures, still in its November 2025 manual, put it as a general rule: "a transaction that is in technical compliance with other federal or state laws may nevertheless violate the prohibition against UDAAPs" (CFPB Supervision and Examination Manual, UDAAP).
Two different questions about the same fee
Disclosure-compliant: Was the fee stated, in the required place and form?
Passes the unfairness test: Could a customer, acting reasonably, actually avoid paying it?
Disclosure-compliant: The fee schedule and the disclosure, as delivered.
Passes the unfairness test: The journey: when the fee appears, whether a free option is the default, what the customer must do to avoid it.
Disclosure-compliant: A missing or mistimed disclosure.
Passes the unfairness test: A fee revealed only after commitment, a paid default, a practice disclosures cannot explain.
Disclosure-compliant: Often a checklist.
Passes the unfairness test: A person, weighing the facts, because the standard is case by case.
Five questions that test avoidability on a screen, not in a document
- Does the customer see the fee before committing?
Pricing modified or withheld until after commitment is the FDIC's first example of injury that cannot be avoided.
- Is the free option the default?
A paid option chosen for the customer shifts the burden of avoiding the fee onto someone who may not notice it.
- Can the customer act on the information?
A fee that depends on timing the customer cannot see, such as settlement order, is hard to avoid however well it is described.
- Would a test of the disclosure show it works?
The FDIC treats disclosures that testing shows do not explain the practice as a sign the injury is not avoidable.
- Is avoiding the fee as easy as incurring it?
If incurring it takes one tap and avoiding it takes a phone call, the answer is already in the journey.
What is a countervailing benefit?
It is the good a practice does for consumers or competition, weighed against its injury; the practice is unfair only if it is "injurious in its net effects." The FDIC lists lower prices and wider availability of products as examples of offsetting benefits, and it counts the costs of preventing the injury too: "Costs that would be incurred for remedies or measures to prevent the injury are also taken into account."
The third part is where many fees survive. An instant transfer is a real service; customers who need money in minutes pay for speed, and a fee for it can easily pass the benefit test. That is why the sample review did not challenge the $4.99 fee itself. It challenged the headline that called the account "always free" two screens before the fee, which is a question for the deception test, where benefits are not weighed at all.
What is the deception test under UDAAP?
A representation, omission or practice is deceptive if it is likely to mislead, if the consumer's interpretation is reasonable, and if it is material. Two parts of the FDIC's explanation decide most launch reviews. The first is that a claim can have more than one honest reading: "If a representation conveys two or more meanings to reasonable consumers and one meaning is misleading, the representation may be deceptive." The second is that prominence matters.
"[O]ral disclosures or fine print are generally insufficient to cure a misleading headline or prominent written representation."
FDIC Consumer Compliance Examination Manual, VII-1
On a deposit journey materiality is usually presumed: the FDIC says "When express claims are made with respect to a financial product or service, the claims will be presumed to be material", and intent is not required. On the sample journey, the landing headline read "Get paid up to 2 days early, always free." The account agreement, at §7, says early availability is not guaranteed and timing may vary from pay period to pay period. The solution's Reasonable-consumer agent read the screen once, at phone size, as a hurried customer would, and reported the customer's reading: "Every payday, my pay lands two days early." The partner's Product agent gave the intended meaning: "up to" covers the variation. Both readings sit beside the passage, and a person decides.
Two readings of one headline in UDAAP Risk Assessment: the customer's and the partner's
A claim with two reasonable readings, one of them false, is the FDIC's own description of a potentially deceptive representation.
What is abusive under UDAAP?
Abusive is the standard Dodd-Frank added, and it is not a three-part test. Under 12 U.S.C. 5531(d), an act or practice is abusive if it "materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service", or if it "takes unreasonable advantage of" one of three things: "a lack of understanding on the part of the consumer of the material risks, costs, or conditions of the product or service", "the inability of the consumer to protect the interests of the consumer in selecting or using a consumer financial product or service", or "the reasonable reliance by the consumer on a covered person to act in the interests of the consumer" (12 U.S.C. 5531). Any one prong is enough.
The CFPB's 2023 policy statement interpreting those prongs was withdrawn on May 12, 2025 (90 FR 20084); the statutory text was not, and the CFPB's November 2025 manual still describes the abusive standard. The CFPB's last supervisory report before the change shows what the second prong looks like in practice: lenders "took unreasonable advantage of consumers' inability to protect their interests when they blocked consumers from closing their loan accounts and continued to attempt to debit their deposit accounts" (CFPB Supervisory Highlights, Issue 37). On the sample journey, the two notes rated abusive are an exit that needs a weekday phone call for an account opened in three taps, and a paid transfer option chosen for the customer by default.
Regulation DD's "free" rule is narrower than the UDAAP test
Regulation DD bars an advertisement from describing an account as "free" or "no cost" "if any maintenance or activity fee may be imposed on the account" (12 CFR 1030.8(a)(2)). The official commentary pulls in two directions for a transfer fee. Comment 8(a)-3.iv counts "Fees imposed to deposit, withdraw, or transfer funds" as maintenance or activity fees; comment 8(a)-4.vi excludes "Fees for ATM or electronic transfer services ... not required to obtain an account." And comment 8(a)-10.v says that advertising a fee-bearing account service next to the word "free" is ordinarily misleading "unless the advertisement clearly and conspicuously indicates that there is a cost associated with the service" (Supplement I to Part 1030).
So whether an optional instant transfer fee stops an account being "free" under Regulation DD is a close question, and the sample review leaves it open for a person. The UDAAP question is not close in the same way. It asks what a reasonable customer takes from "always free" on a screen that shows no fee, and the agreement and fee schedule answer it. A bank can win the first argument and lose the second. That is also why a review that only checks Regulation DD misses the larger risk; how the two legal regimes divide is set out in the UDAP vs UDAAP chart.
How examiners apply the tests, and where the solution stops
Case by case, with legal review. The OCC says it "applies UDAP and, as applicable, UDAAP standards on a case-by-case basis" and tells examiners to "always seek guidance from the Chief Counsel's office if they believe there is a potential UDAP violation." The FDIC says it "will conduct appropriate legal analysis" of the facts at each bank. A review tool that declares practices lawful or unlawful would be claiming a role the regulators keep for lawyers.
UDAAP Risk Assessment stops short of that. Its Standards agent weighs the claim, the passage and both readings, classifies each note as potentially unfair, deceptive or abusive, cites the rule and proposes wording; it never decides. The compliance officer decides each note with a reason code, and the chief compliance officer signs the launch. On the sample journey she required a change to the headline, with the agents' proposed wording: "Get paid up to 2 days early. Early pay depends on when your employer sends pay." Dark patterns that trigger the abusive prongs are covered in dark patterns in banking apps; to see the tests applied to one of your own journeys, start from UDAAP Risk Assessment.
Questions people ask
Does a UDAAP violation require intent?
No. The FDIC's procedures say "intent to deceive is not a required element of proving that an act or practice is deceptive", and unfairness turns on injury and avoidability, not motive. Intent can still matter: an implied claim is presumed material if the bank meant customers to draw that conclusion.
Can one practice be unfair, deceptive and abusive at the same time?
Yes. The standards are independent, and the FDIC says an act or practice "may be unfair or deceptive or abusive or any combination of the three, or not constitute a violation." On the sample journey, the phone-only exit was rated both deceptive, because the agreement promised in-app closing, and abusive.
Do the same tests apply under the FTC Act and Dodd-Frank?
For unfair and deceptive, effectively yes: the FDIC and the OCC describe the Dodd-Frank standards as substantially similar to the FTC Act's. Abusive exists only under Dodd-Frank, which is the main difference between UDAP and UDAAP.
Does a complaint prove a practice is deceptive?
No, but regulators treat complaints as evidence of how reasonable consumers read a product, because the deception test is judged from that consumer's point of view. The FDIC's procedures treat similar complaints from several customers about the same product as a sign that a more detailed review is warranted.
Is it deceptive to call an account free if one optional service costs money?
It can be. Regulation DD's commentary may let an optional electronic transfer fee fall outside the "free" rule, but it still expects the cost to be shown clearly next to the word, and the deception test looks at the net impression of the whole screen.