CFPB Finalizes New Federal Supervision of Certain Providers of Digital Wallets, Payment Apps

The Consumer Financial Protection Bureau (CFPB) on Nov. 21, 2024, issued a final rule to supervise larger nonbank companies that offer "general-use digital consumer payment applications" such as digital wallets, payment apps and peer-to-peer payment apps. Pursuant to the rule, larger participants in this market will be subject to direct federal oversight through the CFPB's supervisory authority under the Consumer Financial Protection Act (CFPA).

This rule is the sixth in a series of CFPB rulemakings to define larger participants in markets for consumer financial products and services for purposes of the CFPB's supervisory authority over "larger participant[s] of a market for other consumer financial products or services, as defined by rule[s]" issued by the CFPB.¹

The rule finalizes the proposed rule that was issued in November 2023 largely as proposed, but with several significant changes. These key changes include 1) an increase in the transaction threshold to determine whether a nonbank covered person is a larger participant of a market for general-use digital consumer payment applications and 2) exclusion from coverage for transfers of digital assets, including cryptocurrencies such as Bitcoin and stablecoins.

Coverage

The rule defines larger participants of a market for general-use digital consumer payment applications, a market that encompasses specific activities. The market definition generally includes nonbank covered persons that provide funds transfer or payment wallet functionalities through a digital payment application for consumers' general use in making consumer payments transactions, which are defined to include payments to other persons for personal, household or family purposes, excluding certain transactions. This set of activities covered by the market definition – all of which digitally facilitate consumer payment transactions to multiple unaffiliated persons, regardless of the payment method, source or account used to fund the payment – marks the CFPB's conclusion of what "reasonably describes a market" for purposes of this aspect of the CFPB's statutory supervisory authority.

The rule adopts the proposed definition of "covered payment functionality" with certain minor clarifying changes. First, the rule changes "wallet functionality" to "payment wallet functionality" in order to address concerns about whether the rule will apply to digital wallets (or the part of their functionalities) that store and transmit data unrelated to consumer payments. The definition of "payment wallet functionality" also is revised to clarify that account or payment credentials must be stored "for a consumer" to satisfy the first prong of that that definition. Second, the definition of "funds transfer functionality" is revised to clarify that the funds received or instructions accepted must be "from a consumer" to qualify as market activity.

The rule also identifies a limited set of digital payment applications that do not fall within the market definition because they do not have general use. Although a general-use digital consumer payment application also could help individuals to make payments that are not for personal, family or household purposes, such as purely commercial (or "B2B" payments), those payments are not within scope.

The rule sets forth a two-pronged test to determine whether a nonbank covered person is a larger participant of the general-use digital consumer payment applications market.

• First, the nonbank covered person (together with its affiliated companies) must provide general-use digital consumer payment applications with an annual volume of at least 50 million consumer payment transactions denominated in U.S. dollars. This marks a substantial shift from the proposal, which would have covered nonbank covered persons (together with their affiliated companies) that provide general-use digital consumer payment applications with an annual volume of at least 5 million consumer payment transactions.
• Second, the nonbank covered person must not be a small business concern based on the applicable U.S. Small Business Administration (SBA) size standard. Any nonbank covered person that qualifies as a larger participant will remain a larger participant until two years from the first day of the tax year in which the person last met the larger-participant test.

Rather than adopt the proposal to base coverage of consumer payment transactions on whether the consumer is physically located in a state at the time of the transaction, the rule defines "consumer payment transactions" based on whether the consumer is a U.S. resident. This change reflects feedback received by the CFPB during the rulemaking process indicating that "most market participants may be more familiar with assessing where a consumer resides than where the consumer is located at the time of any given consumer payment transaction (which can change from transaction to transaction, especially when consumers make payments using mobile devices)."²

The rule excludes merchants and marketplaces conducting payment transactions for sales through their own platforms as distinct from the market defined in the rule. This marketplace exception was expanded from the proposed rule, which excluded marketplaces only to the extent they operated "prominently" in its name or the name of the affiliated company. Should marketplace operators expand into general-use consumer payment applications, however, they will qualify as larger participants under this rule and be subject to the CFPB's supervisory authority.

Despite comments from industry groups, the CFPB declined to exclude e-commerce checkout processes from coverage under the rule. Though merchants that embed or integrate a "payment button" or other payment application on their checkout page are not subject to the rule, the associated payment applications are within the scope of the rule. The rule also excludes payment platforms provided solely to facilitate donations to fundraisers.

In what is one of the most significant shifts from the proposed rule, the CFPB has decided to exclude certain digital asset transactions from coverage under the rule by not including them in the definition of "consumer payment transaction." This by itself is noteworthy because it would have marked the first time the CFPB has taken a formal step toward regulation of certain digital asset products or services – including crypto-assets, sometimes referred to as "virtual currency" – by asserting jurisdiction over at least some of them. The CFPB states that it "intends to continue to gather data and information regarding the nature of such transactions and the impact of digital assets transactions on consumers, and to take further action as appropriate." This may have broader implications beyond this larger participant rulemaking should the CFPB adopt similar interpretations with respect to other consumer financial services statutes and regulations, especially in the wake of the upcoming change in presidential administration.

The CFPB estimates that seven nonbanks have annual consumer payment transaction volumes that exceed the 50 million transaction threshold and that these seven nonbank firms facilitated approximately 13.3 billion consumer payment transactions, which accounts for approximately 98 percent of the more than 13.5 billion consumer payment transactions market participants provide.³

Scope of CFPB Supervision

The rule will subject larger nonbank digital consumer payment companies to the CFPB's authority under the Dodd-Frank Act to conduct regular and proactive examinations, which will allow the CFPB to supervise larger participants for compliance with applicable federal consumer financial protection laws. These include applicable protections against unfair, deceptive and abusive acts and practices (UDAAP), rights of consumers transferring money (including errors and fraud), privacy rights and debanking (when consumers lose access to their apps without notice or when their ability to make or receive payments is disrupted).

The CFPB conducts examinations of various scopes of supervised entities. The CFPB's authority to supervise nonbank covered persons also allows the agency to obtain information about such persons' activities and compliance systems or procedures, and, as appropriate, request information from supervised entities prior to or without conducting examinations. The CFPB also may require submission of certain records, documents and other information for purposes of assessing whether a person is a larger participant of a covered market. Though the specifics of how an examination takes place vary by market and entity, the rule outlines the steps in the CFPB's general examination process. Additionally, the CFPB may conduct other supervisory activities, such as periodic monitoring.

The CFPB prioritizes supervisory activity among nonbank covered persons on the basis of risk, taking into account, among other factors, the size of each entity, volume of its transactions involving consumer financial products or services, size and risk presented by the market in which it is a participant, extent of relevant federal and state oversight, and any field and market information that the CFPB has on the entity. Specifically, and as highlighted in the CFPB Supervision and Examination Manual, the CFPB evaluates risks to consumers at marketwide and institution product-line levels, which allows the CFPB to focus on areas where consumers have the greatest potential to be harmed (specifically, on relatively higher-risk institution product lines within relatively higher-risk markets).

Pursuant to the CFPB's existing larger participant regulation, a person will be able to dispute whether it qualifies as a larger participant in the general-use digital payment applications market. The CFPB will notify an entity when the CFPB intends to undertake supervisory activity; if the entity claims not to be a larger participant, it will then have an opportunity to submit documentary evidence and written arguments in support of its claim.

Importantly, the rule does not impose new substantive consumer protection requirements, and some nonbank covered persons that will be subject to the CFPB's supervisory authority under the rule also may be subject to other CFPB supervisory authorities, including as a larger participant in another market defined by a previous CFPB larger participant rule. In addition, regardless of whether they are subject to the CFPB's supervisory authority, nonbank covered persons generally are subject to the CFPB's regulatory and enforcement authority and to applicable federal consumer financial law.

Continued Scrutiny of Technology and Consumer Finance

This rulemaking initiative marks the latest addition to the CFPB's efforts to increase its monitoring and scrutiny of the impact of technology on consumer financial services and products. The payments sector in general has been a core focus of CFPB Director Rohit Chopra throughout his tenure at the agency. In 2022, the CFPB warned Big Tech firms about their obligations under consumer protection laws when using behavioral targeting for financial products. Additionally, the CFPB issued a report about how funds held in some popular apps are not protected by federal deposit insurance and advised consumers to regularly move their funds to a federally insured account. CFPB Supervision has also created a supervision technology program that assesses, among other things, technology and technology controls and their impact on compliance with federal consumer financial law.

The CFPB also has been invoking what had been a largely unused legal authority to examine nonbank financial companies (many today operate nationally and brand themselves as "FinTechs") whose activities the CFPB has reasonable cause to determine pose risks to consumers.⁴ This authority is not specific to any particular consumer financial product or service and allows the CFPB to supervise entities that may be fast-growing or in markets outside the existing nonbank supervision program.

Impact of Recent Election

This is an important step in terms of expanding the CFPB's reach, but it remains to be seen how the rule will be applied and enforced in a Trump Administration and with a new CFPB director. Given the timing of its issuance, the rule is subject to the Congressional Review Act and may be considered by the 119th Congress.

This rule also may impact state-level jurisdiction. Given the incoming administration, one thought is that states will become more assertive, particularly California and New York, which have been particularly aggressive with all consumer protection-oriented regulation. However, if this rule has teeth to it and is enforced, state regulators may potentially be less emboldened to fill any gaps.

Effective Date

In keeping with the proposed rule's anticipated effective date, the final rule will be effective 30 days after it is published in the Federal Register.

Notes

¹ See 12 U.S.C. 5514(a)(1)(B).

² Consumer Financial Protection Bureau, "Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications" at p. 108 (Nov. 21, 2024).

³ Unsurprisingly, none of these seven nonbank firms constitutes small business concerns under the SBA.

⁴ Separate and apart from the larger participant rulemaking described above, "the CFPB has taken steps to place Google under formal federal supervision," The Washington Post (Nov. 13, 2024).

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.