On October 5, 2016, the Consumer Financial Protection Bureau (the Bureau or the CFPB) issued its final rule to extend certain federal consumer protections to the prepaid market.¹ Specifically, the rule extends Regulation E (Electronic Fund Transfers) coverage to prepaid accounts and adopts provisions specific to such accounts, and generally expands coverage of Regulation Z (Truth in Lending) to overdraft credit features that may be offered in conjunction with prepaid accounts. The Bureau is generally adopting the rule as proposed in November 2014. Although the CFPB understands that a significant number of prepaid card issuers and program managers already voluntarily comply with Regulation E to a substantial degree, the CFPB believes that comprehensive federal protections in this market are needed.

The most significant aspect of the rule is that it would apply a number of specific federal consumer protections to broad parts of the prepaid market for the first time. The rule does so by establishing a new definition of “prepaid account” within Regulation E, along with comprehensive consumer protection rules for such accounts. The definition of prepaid account includes accounts issued on a prepaid basis in a specified amount or not issued on a prepaid basis but capable of being loaded with funds thereafter. The rule thereby covers traditional plastic prepaid cards, many of which are general purpose reloadable cards (GPR cards).² In addition, the rule covers:

• mobile wallets, peer-to-peer payment products/person-to-person (P2P) transfers, and other electronic prepaid accounts that can store funds;
• payroll cards; 
• student financial aid disbursement cards; 
• tax refund cards; and 
• certain federal, state, and local government benefit cards such as those used to distribute unemployment insurance and child support.

The rule contains a number of exclusions from the definition of prepaid account, including for:

• gift cards and gift certificates; 
• accounts used for savings or reimbursements related to certain health, dependent care, and transit or parking expenses; 
• accounts used to distribute qualified disaster relief payments; and 
• the P2P functionality of accounts established by or through the United States government whose primary function is to conduct closed-loop transactions on U.S. military installations or vessels, or similar government facilities.

Highlights

Prepaid Protections

The rule expressly brings prepaid financial products within the scope of Regulation E as “prepaid accounts” and creates new provisions specific to such accounts. The CFPB has extended certain protections under the Electronic Fund Transfer Act (EFTA) to prepaid accounts. These protections are generally similar to those checking account consumers already receive and include:

• Access to account information. The rule provides an alternative to Regulation E’s periodic statement requirement that permits financial institutions to make available to consumers certain methods for accessing information about their prepaid accounts in lieu of sending periodic statements. Financial institutions also will be required to provide summary totals of the fees they have assessed against the prepaid account on a monthly and annual basis.
• Error resolution rights. Financial institutions will be required to investigate unauthorized or fraudulent charges, or other errors, that consumers report on their accounts and resolve those errors in a timely and efficient fashion. If the financial institution is unable to resolve an alleged error within a certain period of time, it will be required to temporarily credit the disputed amount to the consumer pending the completion of the investigation.
• Unauthorized transactions and lost card protections. The rule adds protections against unauthorized, erroneous, or fraudulent withdrawals or purchases, including when registered cards are lost or stolen. If consumers lose their prepaid card or find erroneous or fraudulent charges on their prepaid account, the rule limits their responsibility for transactions they did not authorize to $50 (if they promptly notify the financial institution) and creates a timely method for them to get their money back.

The rule extends Regulation E’s limited liability and error resolution requirements to all prepaid accounts, regardless of whether the financial institution has completed its consumer identification and verification process with respect to the account. Once an account has been verified, the financial institution will be required to comply with the provisional credit requirements, for both errors that occur prior to and after account verification, within the provisional credit timeframe. Provisional credit will not be required for unverified accounts.

The rule also makes several revisions to the rules governing remittance transfers that are intended to continue the current application of those rules to prepaid products.³

Disclosures

The rule establishes pre-acquisition disclosure requirements specific to prepaid accounts. Financial institutions will generally be required to provide both a “short form” disclosure and a “long form” disclosure before a consumer acquires a prepaid account.⁴

The short form disclosure sets forth the prepaid account’s most important fees and certain other information to facilitate consumer understanding of the account’s key terms and comparison shopping among prepaid account programs. The long form disclosure provides a comprehensive list of all of the fees associated with the prepaid account and detailed information on how those fees are assessed, as well as certain other information about the prepaid account program. For example, this includes a separate disclosure for the fees associated with any overdraft credit feature that may be offered in conjunction with the prepaid account.

The rule also adopts specific content, form, and formatting requirements for both the short form and the long form disclosures. Short form disclosures for payroll card accounts and government benefit accounts will need to include, at the top of the form, a statement regarding alternative wage or benefit payment options. The rule also requires the disclosure of certain information such as any purchase price or activation fee outside, but in close proximity to, the short form disclosure; disclosures required to be printed on the prepaid card itself; and short form and long form disclosure requirements for prepaid accounts with multiple service plans.

The CFPB has included several model short form disclosures that offer a safe harbor to the financial institutions that use them, provided that the model forms are used accurately and appropriately, along with one sample long form disclosure.⁵

• Foreign language disclosures: Regulation E generally permits, but does not require, that disclosures be made in a language other than English, provided that where foreign language disclosures are provided the disclosures are made available in English upon a consumer’s request.⁶ The CFPB has modified the general Regulation E foreign language requirement for prepaid accounts such that financial institutions will be required to provide the short form and long form disclosures in a foreign language if the financial institution uses that same foreign language in connection with the acquisition of a prepaid account in certain circumstances. A financial institution will also need to provide the long form disclosure in English upon a consumer’s request and on its website where it provides the long form disclosure in a foreign language.
• Publicly available card agreements: Prepaid account issuers will be required to submit their prepaid account agreements to the CFPB and publicly post on their own websites prepaid account agreements that are offered to the general public. Financial institutions also will need to make any agreements not posted on their own websites available upon request for consumers who have prepaid accounts under those agreements.

Credit Protections

The rule amends Regulations E and Z generally to regulate prepaid accounts that offer overdraft credit features. Specifically, the rule generally covers under Regulation Z’s credit card rules any credit feature offered in conjunction with a prepaid account where the credit feature is offered by the prepaid account issuer, its affiliate, or its business partner, and credit can be accessed in the course of a transaction conducted with the prepaid card to obtain goods or services, obtain cash, or conduct P2P transfers. The rule uses the term “hybrid prepaid-credit card” to refer to a prepaid card that can access both an overdraft credit feature that is subject to the Regulation Z credit card rules and the asset portion of a prepaid account. The rule generally requires that such credit features be distinct from the asset portion of the prepaid account. This can be accomplished by structuring the credit features as a separate credit account or a credit sub-account to the prepaid asset account.⁷ An issuer may not extend credit via a negative balance on the prepaid account except in several limited circumstances where the credit is incidental and the issuer generally does not charge credit-related fees for that credit; in these circumstances, the incidental credit is not subject to Regulation Z.⁸

The rule subjects overdraft credit features accessible by hybrid prepaid-credit cards to various credit card rules under Regulation Z. For open-end products, this includes:

• Ability-to-pay requirement: Companies will be prohibited from opening a credit card account or increasing a credit line related to a prepaid card unless they consider the consumer’s ability to make the required payments. For consumers under 21, the companies will be required to assess these consumers’ independent ability to repay.
• Limits on fees and interest charges: Total fees for prepaid credit products may not exceed 25 percent of the credit limit during the first year a credit account is open. Card issuers generally are prohibited from increasing the interest rate on an existing balance unless the cardholder has missed two consecutive payments, although card issuers may increase the interest rate prospectively on new purchases after generally giving 45 days advance notice (during which time the consumer may cancel the account).
• Monthly credit billing statement: Prepaid companies will be required to give consumers the same monthly periodic statement that credit card consumers receive and that will detail consumers’ fees, and if applicable, interest rate, the amounts borrowed and owed, and other key information regarding debt repayment.
• Reasonable time to pay and limits on late fees: Like credit card companies, prepaid companies will be required to give consumers at least 21 days to repay their debt before they are charged a late fee. Late fees will need to be “reasonable and proportional” to the violation of the account terms in question.

The CFPB’s rule also includes some additional protections to ensure that the prepaid account and the credit product are distinct, including:

• 30-day waiting period: Issuers will be required to wait at least 30 days after a prepaid account is registered before soliciting a consumer to link a covered credit feature to the prepaid account and to obtain consumer consent before linking such a credit feature.
• Prepaid funds and credit repayment: Prepaid companies will be prohibited from automatically seizing a credit repayment the next time a prepaid account is loaded with funds. However, issuers will be permitted to deduct all or a part of the cardholder’s credit card debt automatically from the prepaid account or other deposit account held by the card issuer no more than once per month, pursuant to a signed, written authorization by the cardholder to do so. The rule also amends the compulsory use provision under Regulation E so that prepaid account issuers are prohibited from requiring consumers to set up preauthorized electronic fund transfers (EFTs) to repay credit extended through an overdraft credit feature accessible by a hybrid prepaid-credit card.

Effective Date

The rule generally becomes effective on October 1, 2017.⁹ Financial institutions will not be required to pull and replace prepaid account packaging materials prepared in the normal course of business prior to that date that do not comply with the new disclosure requirements, provided certain conditions are met. The requirement that issuers submit their prepaid account agreements to the Bureau becomes effective on October 1, 2018.

Key Takeaways and Compliance Considerations

• Expansive definition of “prepaid account.” The Bureau has finalized a definition of prepaid account that covers a range of products including GPR cards, as well as other products that may not be used as transaction account substitutes, such as certain non-reloadable accounts and digital wallets. The Bureau believes that digital wallets that can hold funds operate in large part in a similar manner to physical or online prepaid accounts (i.e., a consumer can load funds into the account, spend the funds at multiple, unaffiliated merchants (or conduct P2P transfers), and reload the account once the funds are depleted). Digital wallets that can never be loaded with funds, such as a digital wallet that only stores payment credentials for other accounts, do not constitute a prepaid account under the rule. The Bureau also believes that the structure and usage of P2P products warrants their coverage. These inclusions may lead providers to be more cautious in developing additional products or features.
• Implications for virtual currency. The Bureau’s analysis with respect to virtual currencies and related products and services is ongoing. Although the CFPB received some comments addressing virtual currency products and services, the Bureau reiterates that application of Regulation E and that this rule to such products and services is outside the scope of this rulemaking. However, the Bureau cautions that as part of its broader administration and enforcement of the consumer financial protection statutes and the Dodd-Frank Act, it continues to analyze products or services tied to virtual currencies.
• Continued use of the ability-to-pay/ability-to-repay standard. This final rule highlights how the ability-to-pay/ability-to-repay requirement has become a benchmark for the Bureau. This marks yet another context, in addition to credit cards and mortgages, in which certain consumer financial services and products will be subject to an ability-to-pay/ability-to-repay standard. Earlier this year, the Bureau also proposed to adopt an ability-to-repay standard in the small dollar lending market.
• Foreign language disclosures and LEP consumers. Financial institutions should carefully review whether they principally use a foreign language to advertise, solicit, or market in connection with the acquisition of prepaid account products. This is a facts and circumstances determination not based at the prepaid account program level or across the financial institution’s activities as a whole. Companies should also carefully monitor any and all interactions and communications with non- and limited-English speaking consumers in light of the CFPB’s heightened UDAAP scrutiny.
• Relationship to state laws. EFTA section 922 does not preempt state laws except to the extent those laws are inconsistent with EFTA (and then only the extent of that inconsistency), and further provides that state law is not inconsistent with EFTA if the consumer protection afforded is greater than that provided by EFTA. State laws may require additional disclosures and obligations not required by the CFPB’s final rule so financial institutions and other persons involved in prepaid account programs, including employers, should be aware of additional obligations and restrictions under state law.
• Further agency action is likely. The Bureau intends to monitor compliance with this rule as well as developments and innovations in the prepaid market in general, and will consider additional action in future rulemakings if necessary.  

1 Consumer Financial Protection Bureau, Prepaid Accounts under the Electronic Fund Transfer Act (Regulation E) and the Truth In Lending Act (Regulation Z) (October 5, 2016), available at http://files.consumerfinance.gov/f/documents/20161005_cfpb_Final_Rule_Prepaid_Accounts.pdf. We also note that the CFPB began accepting consumer complaints about prepaid products in July 2014.

2 The rule covers payroll card accounts and government benefit accounts, as well as accounts that are marketed or labeled as “prepaid” that are redeemable upon presentation at multiple, unaffiliated merchants for goods or services, or that are usable at automated teller machines (ATMs). It also covers accounts that are issued on a prepaid basis or capable of being loaded with funds, whose primary function is to conduct transactions with multiple, unaffiliated merchants for goods or services, or at ATMs, or to conduct person-to-person (P2P) transfers, and that are not checking accounts, share draft accounts, or negotiable order of withdrawal (NOW) accounts.

3 Specifically, the amendments clarify that for prepaid accounts other than payroll card accounts and government benefit accounts, the location of these accounts does not determine where funds are being sent to or from for purposes of application of the rules in subpart B. The amendments also clarify that the temporary exception allowing insured institutions to use estimates when providing certain disclosures does not apply to prepaid accounts, unless the prepaid account is a payroll card account or government benefit account.

4 In general, under the rule, a consumer acquires a prepaid account by purchasing, opening, or choosing to be paid via a prepaid account. The rule offers an alternative timing regime for the delivery of the long form disclosure for prepaid accounts acquired at retail locations and by telephone, provided certain conditions are met. Examples of the disclosures can be found at: http://files.consumerfinance.gov/f/documents/102016_cfpb_KBYO_PrepaidDisclosures.pdf.

5 For the convenience of the prepaid industry and to help reduce development costs, the CFPB is also providing native design files for print and source code for web-based disclosures for all of the model and sample forms. These files are available at www.consumerfinance.gov/prepaid-disclosure-files.

6 Pursuant to a statutory mandate in section 1073 of the Dodd-Frank Act, the CFPB’s remittance transfer regulation (subpart B of Regulation E) altered Regulation E’s general requirement for foreign language disclosures to require disclosures be made in English in addition to a foreign language, if that foreign language is used principally by the remittance transfer provider to advertise, solicit, or market remittance transfer services at the office in which the sender conducts a transaction or asserts an error.

7 The rule’s provisions regarding hybrid prepaid-credit cards are largely housed in new Regulation Z § 1026.61 (12 C.F.R. § 1026.61).

8 These exceptions cover situations where the issuer has a general established policy and practice of declining to authorize transactions when the consumer has insufficient or unavailable funds to cover the transaction but credit is nonetheless extended as a result of so-called “force pay” transactions that will not take the account negative by more than $10 (i.e., a de minimis “purchase cushion”) or certain transactions that are conducted while incoming deposits to the prepaid account are pending.

9 The rule also contains several additional provisions addressing notices of certain changes in terms and updated initial disclosures as a result of this rule taking effect in certain circumstances, and for rolling compliance with certain access to account information requirements if financial institutions do not have readily accessible the data necessary to comply with the rule’s requirements as of October 1, 2017.