On March 17, 2017 the United States District Court for the District of North Dakota granted the motion of Intercept Corporation (“Intercept”) and its senior executives to dismiss the complaint filed almost a year ago by the Consumer Financial Protection Bureau (“CFPB”). Intercept is a payment processor that initiates ACH transactions to consumer accounts on behalf of its merchant-customers. This case is one of the few to go forward where the court is confronted with defining the parameters of the CFPB’s authority under the Dodd-Frank Consumer Financial Protection Act (“CFPA”).

In our June 2016 client alert we noted that the Intercept CFPB complaint was somewhat novel in that it alleged that Intercept and its owners were “covered persons” under the CFPA, even though Intercept acts as an agent of the merchant-customer, but not as an agent to the consumer whose account is being debited. We noted that the CFPB’s approach expands the reach of CFPA enforcement for unfair, deceptive, or abusive acts or practices to include within the definition of “covered person” entities that provide payment processing or “other financial data processing” services to businesses that do not offer consumer financial products or services. Practically speaking, this theory means that any entity that processes payments (or offers other financial data processing services) is responsible for monitoring the business practices for every person for whom it processes payments.