The FTC's CARS rule is enforced. Not "coming." Not "under review." Enforced and state AGs are echoing it with their own examinations. Most F&I offices are still running 2019 processes.
The three things examiners are looking for
1. Payment packing. Quoting a monthly with F&I products baked in and no unpacked quote alongside. If your DMS spits out a menu that only shows "with-products payment," you have a problem.
2. Non-optional presentation. If the customer walks out unable to name the products as optional you failed the standard, regardless of what the paperwork says.
3. Total cost of credit disclosure. Amount financed, APR, total interest, total of payments. Not "hidden in the retail installment contract." Presented before the buyer signs.
The five-minute fix
Before the customer sits down:
- Menu shows base payment (no F&I products) on the left column
- Every add-on has a signature or initial line never pre-checked
- The word "optional" appears in the customer's paperwork on every add-on, not just in the manager's script
The language state examiners are flagging in 2026
Any language that implies a product is required:
- "It's built into the deal"
- "The bank requires this"
- "You have to have GAP with this loan-to-value"
Some of these have kernels of truth (LTV limits, some captives requiring specific products for buy-rates). But the wording turns a truth into a compliance issue. Rewrite as: "For this LTV, only certain lenders will approve. Here's what each requires pick the lender and product combination that works for you."
Your customer-facing test
Ask a real customer, 20 minutes after they sign: "What products did you buy?" If they can name them you're compliant. If they can't you have exposure whether the paperwork is technically clean or not.
The state-by-state layer
New York, California, Massachusetts, Illinois and Washington are leading with their own inquiries. What triggers an examination in most: 1-star reviews mentioning F&I, complaints filed with the state AG, or a former employee complaint. The reviews are the cheapest signal to fix.
Run your current menu language through the Compliance Disclosure Check it flags what a first-pass state audit would flag.