In response to what it sees as the growing influence of ‘Big Tech’ and other large technology companies in consumer financial markets, the Consumer Financial Protection Bureau (CFPB) has introduced a proposed rule to establish its supervisory authority over larger nonbank providers of certain digital consumer payment functionalities (the Proposed Rule).

Through the Proposed Rule, which was announced on November 7, 2023, the CFPB seeks to subject these larger providers – specifically, those nonbank covered persons in a market for general-use digital consumer payment applications that handle more than five (5) million transactions annually – to the same CFPB oversight to which large banks, credit unions, and other financial institutions are already subject. In its notice of the Proposed Rule, the CFPB remarked that examples of those intended to be covered by the proposed market include many consumer financial products and services that are commonly described as “digital wallets,” “payment apps,” “funds transfer apps,” “person-to-person payment apps,” “P2P apps,” and the like.

The CFPB asserts that oversight of these covered nonbank providers is imperative to “ensure the consistent application of federal consumer financial laws across the marketplace”, and identifies a growing trend where large technology companies, operating in the payments industry, are involved in critical activities traditionally undertaken by supervised banks, but without commensurate regulatory scrutiny. According to the CFPB’s announcement, the Proposed Rule seeks to level the playing field, ensuring that federal consumer financial protection laws are enforced consistently between banks and larger nonbank providers of consumer digital payments functionality.

Navigating the regulatory framework

The Consumer Financial Protection Act (the CFP Act) created the CFPB and granted the agency various powers and authorities, including the authority to administer, enforce, and otherwise implement federal consumer financial laws, including making rules and issuing orders and guidance. With respect to covered nonbank entities, the CFP Act granted the CFPB the exclusive authority to enforce the federal consumer laws, but the authority to conduct supervisory examinations only over certain types of covered nonbank entities. These entities include (but are not limited to) those involved in mortgage origination or servicing, private education/student loans, and payday loans, as well as those identified as “larger participants” in markets for other consumer financial products or services, as those markets are defined by the CFPB.

The CFPB’s supervisory authority with respect to these “larger participants” includes assessing compliance with federal consumer financial protection laws, gathering information on activities and compliance systems and procedures, and detecting and assessing risks to consumers and consumer financial markets.

Expansion of oversight to digital payments providers

The Proposed Rule marks a notable expansion of the CFPB’s oversight of larger participants in markets for consumer financial products and services specifically to include those participating in the market for “general-use digital consumer payment applications.” These participants would join the ranks of entities in five other markets for consumer financial products or services over which the CFPB has exercised its ability to supervise, namely, consumer reporting, consumer debt collection, student loan servicing, international money transfers, and automobile financing.

The Proposed Rule defines the market for “general-use digital consumer payments applications” as those providing a covered payment functionality through a digital application for consumers’ general use in making consumer payment transaction(s). While nuanced and subject to a variety of exemptions, qualifications, and exclusions, the scope of potentially covered entities ultimately seems quite broad. Key terms and considerations include:

• Covered payment functionality means a funds transfer functionality, a wallet functionality, or both.

• Funds transfer functionality (in this context) means receiving funds for the purpose of transmitting them or accepting and transmitting payment instructions.
• Wallet functionality means a product or service that (i) stores account or payment credentials, including in encrypted or tokenized form, and (ii) transmits, routes, or otherwise processes such stored account or payment credentials to facilitate a consumer payment transaction.

• Digital application means a software program that a consumer may access through a personal computing device, including but not limited to a mobile phone, smartwatch, tablet, laptop computer, or desktop computer.

• A digital application would include an application that a consumer downloads to a personal computing device, a website that a consumer accesses by using an Internet browser on a personal computing device, or a program the consumer activates from a personal computing device using a consumer’s biometric identifier.

• General use refers to the absence of significant limitations on the purpose of consumer payment transactions facilitated by the covered payment functionality provided through the digital consumer payment application.

• The Proposed Rule includes a list of payment functionalities which would not have a general use, including:

• For the purchase or lease of specific types of services, goods, or other property, such as transportation, lodging, food, an automobile, real property, or a consumer financial product or service as defined in the CFP Act.
• Certain accounts that are excluded from the “prepaid account” definition under Regulation E.
• To pay a specific debt or type of debt including repayment of an extension of consumer credit.
• To split a charge for specific types of goods or services (e.g., restaurant or other similar bill splitting).

• A consumer payment transaction means the transfer of funds by or on behalf of a consumer in the U.S. to another person primarily for personal, family, or household purposes. The term applies to transfers of consumer funds and would also include a transfer made by extending consumer credit (i.e., a creditor’s transfer of funds to a person on behalf of a consumer in connection with a credit transaction).

• Exclusions from the definition of a consumer payment transaction include:

• An international money transfer as defined by the CFPB in its rule regarding larger participants in the international money transfer market.
• A transfer by a consumer: (A) that is linked to the consumer’s receipt of a different form of funds, such as a foreign exchange transaction, or (B) that is for the primary purpose of purchasing or selling a security or commodity which is excluded from the definition of an electronic funds transfer under Regulation E.
• A payment transaction conducted by a person for the sale or lease of goods or services that a consumer selected from an online or physical store or marketplace operated prominently in the name of such person or its affiliated company (e.g., when a consumer purchases a good or service in a store or from a website operated in the name of the merchant using an account stored by such merchant, which also conducts the payment transaction).
• An extension of consumer credit that is made using a digital application provided by the person who is extending the credit or that person’s affiliated company.

Within this defined market for “general-use digital consumer payments applications”, the Proposed Rule defines the covered “larger participants” as those nonbank providers with an annual covered consumer payment transaction volume of at least five million transactions, excluding those that qualified as a “small business concern” as defined by the Small Business Administration in the preceding calendar year. The calculation of the annual covered consumer payment transaction volume is the sum of the number of consumer payment transactions that the nonbank covered person and its affiliated companies facilitated in the preceding calendar year by providing general-use digital consumer payment applications. The Proposed Rule also includes information for aggregating the relevant transaction volume amongst affiliated companies.

If finalized, the Proposed Rule would empower the CFPB to actively supervise covered larger participants for compliance with applicable federal consumer protection laws, including those related to funds transfers and privacy, as well as the prohibition against unfair, deceptive, and abusive acts and practices. The CFPB has also noted that its supervisory authority extends to service providers of those covered persons who are subject to its supervision, which includes larger participants. Therefore, the Proposed Rule would seemingly permit the CFPB to also supervise all service providers to larger participants in the market for general-use digital consumer payment applications in these same areas.

The notice of the Proposed Rule also indicates that the CFPB intends to take a broad approach to its supervision of providers covered by the Proposed Rule. To this end, the CFPB reminded stakeholders that its supervisory authority is not limited to the products or services that qualified the person for supervision, but also includes other activities of such a person that involve other consumer financial products or services or are subject to the federal consumer financial laws. Therefore, as an example, if the sale, provision, or issuance of stored value or payment instruments is associated with the activity that falls within the proposed market definition, it may constitute a consumer financial product or service that the CFPB may supervise when examining a larger participant within the proposed market. This is notable since it can open the door for the CFPB to exercise its supervisory authority over covered nonbank entities vis-à-vis a range of areas not explicitly covered by the Proposed Rule, including with respect to hot-button compliance areas like privacy and the prohibition against unfair, deceptive, and abusive acts and practices.

Taken altogether, the Proposed Rule has the potential to subject a wide range of companies and activities to CFPB scrutiny.

Stakeholder attention and engagement

The Proposed Rule is subject to a notice and comment period before it can be finalized, with comments from the public due by January 8, 2024, or thirty (30) days after publication in the Federal Register, whichever later. If your company operates in this digital payments space or falls within the criteria outlined in the Proposed Rule, you should carefully review the Proposed Rule and determine whether it would be beneficial to participate in this comment period, as it presents a crucial opportunity to contribute your insights and perspectives, as well as voice any concerns you may have.