Federal framework that still applies (quick reference)
**Equal Credit Opportunity Act (ECOA) / Regulation B (12 CFR Part 1002)** â Applies to **business credit**. Requires timely **adverse-action** notices and provides sample forms (Appendix C). Business-credit notice flexibilities exist for firms â¤$1M revenue, but notice duties still apply. [consumerfinance.gov](https://www.consumerfinance.gov/rules-policy/regulations/1002/?utm_source=chatgpt.com)
The CFPB finalized the extension of the §1071 compliance dates in a **Final Rule** published on **October 2, 2025**. [Federal Register](https://www.federalregister.gov/documents/2025/10/02/2025-19370/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b-extension-of-compliance)
**FTC Act §5 / Advertising Substantiation** â You must have a **reasonable basis** for objective claims in ads and sales materials; UDAP applies to B2B marketing as well. [Federal Trade Commission](https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation?utm_source=chatgpt.com)
**Gramm-Leach-Bliley Act (GLBA)** â **Safeguards Rule (16 CFR Part 314)** requires a written information security program for âfinancial institutionsâ under FTC jurisdiction (many non-bank lenders/brokers qualify); also observe GLBA privacy duties where applicable. [Federal Trade Commission](https://www.ftc.gov/legal-library/browse/rules/safeguards-rule?utm_source=chatgpt.com)
**E-SIGN Act** â If you deliver disclosures electronically, obtain **proper consumer consent** and meet E-SIGN delivery standards (when a law requires âin writingâ). [Federal Trade Commission](https://www.ftc.gov/sites/default/files/documents/reports/report-congress-electronic-signatures-global-and-national-commerce-act-consumer-consent-provision/esignreport.pdf?utm_source=chatgpt.com)
**TCPA (FCC) â Consent & Revocation.** Most of the FCCâs new revocation-of-consent rules took effect on **April 11, 2025**; a specific provision was **delayed to April 11, 2026**. Separately, the âone-to-oneâ lead-generation consent rule is not in force â it was postponed and later formally eliminated following the Eleventh Circuitâs decision. [fcc.gov](https://www.fcc.gov/general/telemarketing-and-robocalls)
**CAN-SPAM (16 CFR Part 316)** â Governs commercial email: clear identification, **physical address**, and **opt-out** mechanism; prompt honoring of opt-out requests. [Federal Trade Commission](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business?utm_source=chatgpt.com)
**OFAC Sanctions** â Maintain a **risk-based sanctions program** (screen counterparties; monitor changes). OFACâs compliance **Framework** and subsequent guidance remain the reference standard. [OFAC](https://ofac.treasury.gov/media/16331/download?inline=&utm_source=chatgpt.com)
**BSA/AML Customer Due Diligence (FinCEN CDD Rule)** â Covered financial institutions must identify and verify **beneficial owners** of legal-entity customers; note CTA-related **BOI access** rules do **not** change the CDD Rule but interact with it. [FinCEN.gov](http://FinCEN.gov)
**Nacha Operating Rules (ACH)** â If you take ACH payments, follow Nachaâs **authorization**, **record-retention**, and **fraud-screening** standards (e.g., account validation for WEB debits). Track Nacha bulletins and rule updates. [nacha.org](https://www.nacha.org/products/2025-nacha-operating-rules-guidelines?utm_source=chatgpt.com)