CFPB Keeps to Its Word by Issuing Additional Buy Now, Pay Later Guidance

Fueled by an increase in online and mobile app shopping during the COVID-19 pandemic, the Buy Now, Pay Later (BNPL) market has experienced higher growth and popularity as an innovative consumer finance offering, particularly for the unsecured credit market. Though there is no single definition of BNPL, the term is used to describe a type of short-term financing that allows consumers to make retail purchases and pay off the balances in typically interest-free, small-dollar installments (although, longer-term BNPL products may charge interest). BNPL products are generally grouped into two main types, depending on how they are offered to consumers. The first type of BNPL product, which is offered directly to consumers by financial technology (FinTech) companies before a purchase is made (the app-driven acquisition model), includes a virtual or physical payment card to make purchases and allows for multiple BNPL purchases up to a predetermined credit limit. The second type is offered during a purchase through a merchant who partners with a FinTech or financial institution (the merchant partner acquisition model). The explosion of the BNPL market, however, has attracted increased scrutiny from financial services regulators concerned about the lack of specific rules and potential risks to consumers.

As the BNPL option proliferated, the Consumer Financial Protection Bureau (CFPB) and others did not initially deem the program to be within the scope of the Truth in Lending Act and Regulation Z. However, things have started to change. States such as California have incorporated BNPL products as loans under its California Financing Law since 2020, and other states – including Massachusetts, Oregon and New York – may follow suit.

Earlier this year, the CFPB issued an interpretive rule that imposes some of the same rules on certain BNPL providers that apply to conventional credit card providers, including those related to billing disputes, refunds for returned products or canceled services, and disclosures such as periodic billing statements. The interpretive rule applies to digital user accounts used to access credit, including to those providers that market loans as BNPL. Although market participants' loan offerings vary in the BNPL sector, the CFPB issued this interpretive rule "to clarify existing obligations for market participants with specific business practices." The comment period closed on Aug. 1, 2024.

On Aug. 16, 2024, CFPB Director Rohit Chopra issued a blog post regarding the interpretive rule. In his blog post, Chopra noted that the CFPB plans to issue a set of FAQs in September 2024 "to help lenders make transitions." Furthermore, Chopra affirmed that the CFPB will provide a no-action position with respect to any BNPL lender "while it is transitioning into compliance in a good faith and expeditious manner" and noted the CFPB's expectation that "other federal and state regulators will follow the same path," but the basis of such expectation was left unsaid. This announcement was deemed to be only marginally helpful, however, as the CFPB decided not to extend the interpretive rule's effective date (July 30, 2024), but instead stated that it will not enforce the rule right away.

On Sept. 18, 2024, the CFPB delivered as promised by issuing its BNPL interpretive rule FAQs, which identify categories of Regulation Z provisions and specific Regulation Z sections applicable to Pay-in-Four BNPL products that are accessed through a digital user account and also include a section specific to periodic statement considerations.

Scope

For purposes of the FAQs, the CFPB defines Pay-in-Four BNPL loans as "loans to consumers made by the BNPL loan provider that 1) are structured as closed-end installment loans, in which the consumer incurs debt and has the right to defer payment, 2) are made for the purchase of goods and services for the consumer's personal, family, or household use, 3) are payable in four installments, and 4) do not incur interest or other finance charges." Though other BNPL loans and providers, such as those that apply finance charges to their BNPL loans, may also be covered by Regulation Z and, accordingly, would also be required to comply with Regulation Z, they are not the subject of the FAQs.

When referenced in the FAQs, the CFPB is referring only to the typical Pay-in-Four BNPL loans accessed through digital user accounts issued by the BNPL loan provider or its agent, as discussed in the interpretive rule. According to the CFPB, digital user accounts are "secure, personal profile[s] that the BNPL provider activates for a consumer, enabling the consumer to access and use BNPL credit," which allow "a consumer to access Pay-in-Four BNPL loans as a form of payment for purchasing goods or services (resulting in BNPL loans from the BNPL loan provider that offers the digital user account)." Certain BNPL loan providers permit consumers to use their digital user account in every instance where the account is an acceptable payment method, while others restrict digital user account transactions to those provided on the BNPL loan provider's website or mobile app. The BNPL loan provider enables the payment part of the credit process either directly through the merchant's website or by issuing a single-use virtual card to the consumer, normally through an issuer processor and a bank partner, which typically grants the consumer 24 hours to complete his or her purchase directly with the merchant using the virtual card. The BNPL digital user account is activated when a consumer first accesses BNPL credit, similar to how a virtual credit card number for a traditional credit card account is issued at the same time a consumer opens the credit card account online and makes their first purchase on the card. Once a digital user account is activated, the consumer can then immediately use his or her BNPL digital user account on an ongoing basis to access credit to make additional purchases.

The FAQs clarify that Pay-in-Four BNPL loans are subject to Regulation Z because the covered digital user accounts for the loans are credit cards and charge cards under Regulation Z, with certain caveats. First, a digital user account that only accesses another credit card would not be deemed a digital user account that is a credit card under Regulation Z "because the account itself is not used to draw, transfer, or authorize the draw or transfer of credit." Second, the digital user account is a credit card under Regulation Z as long as the digital user account "can be used to access the Pay-in-Four BNPL loans as the method of payment to complete transactions," irrespective of whether the digital user account "includes other features or permits consumers to access other payment methods." Additionally, the Pay-in-Four BNPL loans with covered digital user accounts are charge cards (a type of credit card under Regulation Z) because they do not include finance charges calculated using a periodic rate (e.g., interest). This marks a significant expansion in scope, as the interpretive rule did not discuss the charge card concept in connection with digital user accounts.

Furthermore, the FAQs also provide that BNPL loan providers of Pay-in-Four BNPL loans with covered digital user accounts issued by those providers or their agents are covered by Regulation Z because they are both card issuers (including charge card issuers) and therefore subject to card issuer provisions through the regulation and creditors (for Subparts A, B and D). However, as closed-end loans, Pay-in-Four BNPL loans are subject only to the card issuer provisions (including charge card issuer provisions) that are not specific to open-end products.

Specific Application of Regulation Z Provisions

In general, the FAQs clarify that covered Pay-in-Four BNPL loan providers "must comply with Regulation Z provisions that apply to card issuers throughout the regulation (so long as those provisions are generic and do not exclude closed-end products, for example, by applying exclusively to open-end credit products, or are specific to closed-end credit) and to creditors when that term is used in Subparts A, B, and D (regardless of whether it states a provision applies to only open-end or closed-end products)." Additionally, the FAQs provide that certain provisions specific to charge cards "also apply if they are generic or specific to closed-end credit."

The FAQs also outline specific Regulation Z sections that are considered card issuer and creditor provisions and are therefore applicable to Pay-in-Four BNPL loans with covered digital user accounts and the BNPL loan providers. Of note, "[w]ithin these relevant provisions, particular facts and circumstances for the Pay-in-Four BNPL loan can impact how a BNPL loan provider complies or whether components of the provision are applicable to the loan" and the provisions "may also identify certain exceptions or provide instructions for applying the requirements that are triggered by Pay-in-Four BNPL loans." For example, while the Regulation Z account opening disclosures generally apply to creditors, a Pay-in-Four BNPL loan provider would not provide disclosures related to annual percentage rates (APRs) because Pay-in-Four BNPL loans are not subject to finance charges and, as a result, do not have an APR. BNPL loan providers also would need to carefully evaluate the Regulation Z application and solicitation requirements, including disclosures, that generally apply to card issuers (including those of closed-end products).

Additionally, the FAQs clarify that Pay-in-Four BNPL loan providers that provide covered digital user accounts are not required to comply with Regulation Z, Subpart C (which applies only to creditors, not card issuers, and is not listed in the specific definition of creditor applicable to Pay-in-Four BNPL loan providers) or the remaining provisions of Regulation Z, Subpart G (which apply only to card issuers of open-end credit or hybrid prepaid cards). They also are not within scope of Regulation Z, Subpart E, which is generally applicable to closed-end credit secured by a dwelling) or Subpart F (which is generally applicable to closed-end credit that is a private education loan) because those Subparts also are not listed in the specific definition of creditor applicable to Pay-in-Four BNPL loan providers.

Periodic Statement Considerations

The FAQs clarify that Pay-in-Four BNPL loan providers are required to provide periodic statements for each billing cycle that the consumer has a debt or credit balance of more than $1 for an account, unless an exception applies. BNPL loan providers are permitted to either treat each BNPL loan as a separate credit account, for which separate periodic statements would be provided, or create a single, multifeatured credit account where each BNPL loan accessed through the digital user account is a feature of the account, for which a single statement would be provided. The particular billing cycle selected by the BNPL loan provider will impact certain other consumer protections (e.g., when a BNPL loan provider may treat a payment as late, report credit as delinquent, initiate collection activities or terminate benefits).

The FAQs also identify the specific required periodic statement disclosures that must be provided for covered Pay-in-Four BNPL loans, including certain disclosures, in addition to the other information required under Regulation Z that must be included if the Pay-in-Four BNPL loan provider presents a single periodic statement to the consumer that includes multiple Pay-in-Four BNPL loans.

Finally, the FAQs clarify that a covered Pay-in-Four BNPL loan provider also must comply with Regulation Z timing requirements before treating a payment as late.

Compliance Implications

The CFPB's issuance of the FAQs was a helpful step in the compliance process, as the agency received feedback during the comment period and held meetings with BNPL providers to answer questions, including about which sections of Regulation Z specifically apply to different business models. Chopra acknowledged in his August 2024 blog post that "[m]any [BNPL] lenders are working diligently and in good faith to come into compliance." The FAQs were designed and issued to support this transition, respond to questions the CFPB received in the comments and ensure all entities benefit from the clarifications provided in CFPB meetings with BNPL providers.

However, despite the CFPB's goal of increasing transparency about how existing laws apply to emerging products, in some ways the FAQs create new questions and, as a result, lead to additional uncertainty. Rather than simply clarifying provisions of the interpretive rule, the FAQs in certain areas expand the scope of the rule (as noted above in the "credit cards" and "charge cards" characterization of digital user accounts), the FAQs also leave open questions. For example, in one section of the FAQs the CFPB states that requirements for "open-end consumer credit plans" do not apply to digital user accounts, but in another section the CFPB states that the 14-day rule with respect to periodic statements/treatment of late payments applies to digital user accounts, even though that provision only applies to "open-end consumer credit plans." In certain places, the CFPB's interpretation of Regulation Z requirements in the FAQs is seemingly inconsistent with the requirements of the Truth in Lending Act, as reflected in the requirements that may be imposed on card issuers, regardless of whether the amount due is payable in more than four installments or if a finance charge is required. These issues may further fuel any legal challenges to this interpretive rule, especially with the end of Chevron deference.

This additional guidance put forth by the CFPB highlights the complexities associated with compliance. As discussed above, the interpretive rule went into effect on July 30, 2024, and the CFPB did not delay the effective date. Though some large BNPL providers are already investigating disputes, pausing payments and providing consumers comprehensive billing statements, these new federal requirements may create operational burdens for them and other BNPL providers and may lead to changes in the nature of the BNPL product. Even though the CFPB stated that it does not intend to seek penalties for violations of the interpretive rule against any BNPL loan provider while it is transitioning into compliance "in a good faith and expeditious manner," immediate changes are needed to comply with this interpretive rule. This is especially the case for those BNPL providers for which these developments require major changes to their businesses, and such steps include ensuring that appropriate policies, procedures and mechanisms are in place to provide compliant disclosures, deliver regular billing statements, manage and investigate disputes, and permit customers to obtain refunds for returned products or cancelled services.

It also is noted that the FAQs are a "Compliance Aid" issued by the CFPB, which is subject to the CFPB's Policy Statement on Compliance Aids that explains the agency's approach to Compliance Aids.

For more information or questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.