PADFAA Is Real Enforcement Now: What Fintech Data Companies Need to Know Before the FTC Files Its First Case

TL;DR

• PADFAA (2024) prohibits data brokers from selling, licensing, or providing access to sensitive US consumer data — including financial records — to entities in China, Russia, Iran, North Korea, Cuba, or Venezuela.
• In February 2026, the FTC sent 13 warning letters reminding data brokers of their PADFAA obligations — the clearest enforcement ramp-up signal the agency has issued under the statute.
• Any fintech that aggregates or sells customer financial data to third parties may qualify as a PADFAA-covered data broker; the definition turns on whether you collected the data directly from the individual.
• Civil penalties reach $53,088 per violation; beneficial ownership scrutiny means “incorporated in Singapore” doesn’t clear the analysis.

In February 2026, the Federal Trade Commission sent warning letters to 13 data brokers reminding them of their obligations under the Protecting Americans’ Data from Foreign Adversaries Act. Most financial services compliance teams had never heard of it.

That’s a problem. Because PADFAA — signed in April 2024, effective June 23, 2024 — prohibits any “data broker” from selling or transferring sensitive consumer data, including financial records, to foreign adversary countries or entities under their control. The statute defines “sensitive data” to include financial account numbers, credit and debit card information, and financial transaction data. And it defines “data broker” in a way that reaches a significant portion of the fintech data ecosystem.

The February letters weren’t a courtesy. They were the FTC’s standard enforcement ramp-up pattern: publish the obligation, send public notice, then file the first case.

What PADFAA Actually Does

PADFAA’s core prohibition is straightforward: a data broker may not sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of US individuals to:

1. A foreign adversary country (China, Russia, Iran, North Korea, Cuba, Venezuela)
2. Any entity owned by, controlled by, or subject to the jurisdiction of a foreign adversary country

The prohibition is not limited to intentional transfers to government actors. It reaches commercial transactions — a data broker that licenses US consumer financial profiles to a data analytics company majority-owned by Chinese nationals has violated PADFAA, regardless of whether the buyer intends to provide that data to Chinese intelligence services.

Congress passed the law as part of a broader package addressing national security data risks. The TikTok provisions in the same legislation got more press coverage. PADFAA, which establishes the permanent enforcement framework for data broker transfers, received less attention — but it’s the mechanism that will generate the first FTC enforcement actions.

Who Is a Data Broker Under PADFAA?

The statute defines a data broker as an entity that, as a business, sells, licenses, trades for consideration, or provides access to covered data concerning a US individual that the entity did not collect directly from that individual.

The direct collection carve-out is critical. A bank that collects its own customer’s financial data, uses it for its own purposes, and shares it with its own affiliates is not a PADFAA data broker with respect to that data. The bank collected it directly.

But a company that:

• Purchases aggregated financial data from a core processor and resells it to analytics vendors
• Builds a financial profile product using data from multiple sources and licenses it to lenders
• Operates a lead generation platform that monetizes consumer financial attributes purchased from third parties
• Aggregates account data through an open banking API and sells analytical outputs to third parties

…may qualify as a PADFAA data broker, because the financial data at the core of its product was not collected directly from the consumers it describes.

Many fintechs have built exactly this kind of secondary data monetization business alongside their primary consumer product. A consumer lending platform that licenses its repayment behavior dataset to credit bureaus. A payments app that sells merchant spend analytics to advertising platforms. A banking aggregation service that provides financial insights to insurance companies. Each of these warrants a PADFAA coverage analysis.

What Counts as “Sensitive Data” — And Why Financial Records Are Front and Center

PADFAA’s sensitive data definition covers:

Financial account data is one of PADFAA’s enumerated sensitive categories — not inferred or implied. If your data product includes financial account numbers, credit card data, or transaction records, you are dealing with covered data.

Precise geolocation is worth a separate flag. Transaction location data — the coordinates attached to every card-present or mobile payment — is geolocation data. If you’re a payments platform that sells merchant analytics built from transaction location patterns, that data may be covered under both the geolocation category and the financial account category. The location data enforcement wave that hit Kochava, GM, and Allstate Arity in 2024-2026 demonstrates that geolocation is a top regulatory priority; PADFAA layered on top of that trend isn’t an incremental risk.

What the Thirteen Warning Letters Actually Signal

The FTC’s February 2026 letters were not the agency’s first PADFAA action. But they’re the clearest public signal of enforcement direction. The 13 letters went to named data brokers with the FTC’s explicit reminder that PADFAA violations carry civil penalties of up to $53,088 per violation — a number that can compound quickly when violations are measured per transaction or per record transferred.

FTC Commissioner Holyoak has publicly stated PADFAA enforcement as a priority. The warning letter pattern the agency uses is consistent: send letters establishing that companies are on notice, then file cases against entities that didn’t comply after receiving notice.

The 13 letters covered companies across the data broker spectrum — credit data aggregators, behavioral analytics firms, contact data companies. Financial services data was among the data types flagged. Whether the first enforcement case targets a financial services data company specifically, or a company with financial services data as one of many product lines, the underlying analysis is the same.

PADFAA vs. the DOJ Data Security Program: Two Frameworks, Different Scope

The DOJ’s Data Security Program, which became effective April 8, 2025, regulates a different set of data transactions. Understanding the distinction matters because they impose different obligations and enforcement mechanisms:

PADFAA is an FTC statute focused specifically on data brokers — companies that sell or license data they didn’t collect directly. It prohibits transferring sensitive data to foreign adversary entities. Enforcement is by the FTC through civil penalty actions. It applies broadly to the commercial data broker market.

The DOJ DSP applies to a broader range of entities (not just data brokers) and distinguishes between prohibited “restricted transactions” (which can’t happen at all) and “covered transactions” (which can happen subject to security requirements). The DOJ DSP focuses on bulk data transactions above defined thresholds and on specific relationship types — vendor agreements, employment arrangements, investment relationships. It’s enforced through civil and criminal action by the DOJ’s National Security Division.

If your company transfers significant volumes of sensitive data to foreign-connected entities — whether as a data monetization product or through vendor relationships — you may need both analyses. They’re not redundant; they cover different transaction types through different frameworks.

What Your Compliance Program Needs Before the First Case Drops

If your organization sells, licenses, or provides access to data you didn’t collect directly from the consumers it describes, PADFAA should be in your data governance framework. Here’s the compliance checklist:

1. Conduct a data product inventory. Map every data product or data sharing arrangement where you sell, license, or provide access to consumer data. For each product, determine whether the data was collected directly from consumers or aggregated from third-party sources.

2. Screen your buyers and licensees. For each data sharing arrangement where you may qualify as a data broker, conduct a counterparty screening to identify any connections to PADFAA’s six foreign adversary countries. Beneficial ownership screening matters — look through to ultimate beneficial owners, not just the contracting entity’s country of incorporation. Update your contract templates to include representations about foreign adversary ties and beneficial ownership.

3. Build a data broker determination into your product launch review. If your company is developing any new product that involves selling or licensing consumer data to third parties, add a PADFAA data broker determination to the pre-launch compliance checklist. This is particularly important for API-based data products, data licensing programs, and analytics platforms built on purchased data assets.

4. Review existing data licensing agreements. For contracts already in place, add a review for foreign adversary exposure. Update contract terms to require counterparty certification that the buyer is not owned or controlled by a foreign adversary country.

5. Establish a monitoring process for counterparty changes. PADFAA compliance is not a one-time point-in-time analysis. Buyers can be acquired. Ownership can change. A company that was PADFAA-compliant at contract signing may not be compliant 18 months later if the buyer was acquired by a foreign adversary-linked entity. Build periodic re-screening into your data licensing program management.

The Broader Picture: PADFAA in the 2026 Data Privacy Enforcement Landscape

PADFAA sits at the intersection of two enforcement trends that have been accelerating throughout 2026. The state-level data broker enforcement wave — California’s DELETE Act, New Jersey’s A5328, and the growing number of states requiring data broker registration — is establishing that data broker status has regulatory consequences across multiple frameworks simultaneously.

PADFAA adds a federal layer with a national security rationale and an FTC enforcement mechanism that can reach companies regardless of where they’re incorporated or where their customers are located. The statute’s scope is broad enough to capture most commercially significant data monetization businesses in the US.

The compliance calculus is straightforward: if you sell consumer data — particularly financial data — to third parties, determine whether PADFAA applies before the FTC files its first case and makes the analysis for you.

Sources:

• Protecting Americans’ Data from Foreign Adversaries Act (PADFAA) — FTC
• FTC Reminds Data Brokers of Obligations to Comply with PADFAA — FTC Press Release, February 2026
• FTC Looks to Leverage PADFAA Enforcement — Morrison Foerster
• Data Brokers, Beware: Distinguishing PADFAA from the DOJ’s DSP — IAPP
• FTC Sends Letters Reminding Data Brokers of PADFAA Obligations — Alston & Bird
• Data Broker Compliance 2026: State Laws, PADFAA, DROP — Fintech Law AI