CFPB Finalizes Federal Oversight of Digital Payment Apps

On November 21, 2024, the Consumer Financial Protection Bureau (CFPB) issued a final rule (Rule) providing it with supervisory authority over nonbank digital payments companies that meet specific thresholds. This move marks a significant step in bringing oversight to a fast-evolving segment of the consumer payments ecosystem and will subject large participants in the digital payments market to periodic examination by the CFPB. The CFPB notes that the Rule "does not impose new substantive consumer protection requirements" on any entity. Rather, it will enable the CFPB to proactively ensure that large participants "follow federal law just like large banks, credit unions, and other financial institutions already supervised by the CFPB."¹

Key Takeaways

1. Larger Participant Thresholds: The Rule defines larger participants as nonbank covered persons who (1) facilitate at least 50 million annual covered consumer payment transactions denominated in US dollars and (2) do not qualify as small business concerns under the applicable Small Business Administration (SBA) size standard.² This represents a significant increase from the initial proposed threshold of 5 million transactions.
• Based on available data, the CFPB states that seven nonbank entities meet these thresholds, accounting for 98% of covered consumer payment transactions.³ However, the CFPB acknowledged that its data on nonbank market participants is limited, meaning more entities will likely fall within the scope of the Rule.
2. Broad Market Definition: The general-use digital consumer payment applications market is broadly defined. According to the CFPB, "The market described in the Final Rule includes providers of funds transfer and payment wallet functionalities through digital applications for consumers’ general use in making payments to other persons for personal, family, or household purposes. Examples include consumer financial products and services that are commonly described as 'digital wallets,' 'payment apps,' 'funds transfer apps,' 'peer-to-peer payment apps,' 'person-to-person payment apps,' 'P2P apps,' and the like."⁴
3. Exclusion of Digital Asset Transactions: Transactions involving cryptocurrencies such as Bitcoin and stablecoins are excluded from the definition of consumer payment transactions.
• The CFPB conceded that it does not have sufficient data regarding whether and how to distinguish between hosted and unhosted wallets, which is a reason for their exclusion.⁵
4. Focus Areas for Supervision: The CFPB noted it will use its supervisory authority to address key areas such as privacy, fraud prevention, and debanking risks while ensuring compliance with federal consumer financial laws.⁶
5. Effective Date: The Rule will take effect 30 days after publication in the Federal Register.

Important Definitions

General-Use Digital Consumer Payment Applications Market: This term encompasses digital payment platforms that provide covered payment functionalities for consumers to conduct various transactions. Examples include digital wallets, peer-to-peer (P2P) payment apps, and funds transfer applications commonly used for personal payments or purchases.

Consumer Payment Transaction: Defined as a transfer of funds by or on behalf of a consumer for personal, family, or household purposes. Key exclusions include:

• International money transfers.
• Payments tied to credit origination or defaulted debts.
• Transactions conducted via closed-loop platforms for specific goods or services.

Covered Payment Functionality: The Rule defines two types of covered payment functionalities:

• Funds Transfer Functionality: In connection with a consumer payment transaction,
  • the ability to accept funds from a consumer for the purpose of transmitting them; or
  • accepting payment instructions from consumers for transfer.⁷
• Payment Wallet Functionality: A product or service that:
  • Stores for a consumer account or payment credentials, including in encrypted or tokenized form; and
  • Transmits, routes, or otherwise processes such stored account or payment credentials that allow consumers to initiate transactions.⁸

Digital Payment Application: Refers to software programs accessible to consumers through personal devices such as smartphones, tablets, or computers, enabling payment functionalities. The Rule clarifies that general web browsers are excluded from the definition.⁹

General Use: Payment functionalities that are usable for transferring funds to multiple unaffiliated persons. Closed-loop systems or single-merchant applications do not meet this definition.¹⁰

Our Take

The CFPB's Rule represents a pivotal development in the regulatory oversight of nonbank digital payment providers. By extending its supervisory reach, the CFPB aims to enhance consumer protections, promote fair competition, and address evolving risks in the digital payments landscape. While the CFPB has identified a narrow set of entities likely to fall under its supervision, the Rule's broad definitions and finalized threshold criteria suggest a potential overreach that could bring additional entities, including fintech firms and newer market participants, into its ambit.

For some firms, this potential for over-inclusiveness may mean unexpected regulatory scrutiny, especially for those close to the transaction volume threshold or operating in nuanced areas of the market. The CFPB's supervisory framework places significant emphasis on compliance management systems, fraud prevention, and consumer protection standards, which could present operational challenges for companies unaccustomed to federal oversight.

The Rule's broad language has drawn criticism from current members of Congress, who have expressed concerns over regulatory overreach and disappointment in the quick 30-day implementation timeline arguing it prevents incoming leadership from assessing the Rule’s necessity. One member of Congress pointed to the Congressional Review Act (CRA) as a potential tool to overturn the Rule. Under the CRA, Congress can nullify a final rule promulgated by a federal agency through the passage of a joint resolution by a simple majority in each chamber. Because the 119th Congress will begin on January 3, 2025, within sixty days of the issuance of the Rule, the CRA’s sixty-day lookback period will restart, providing the 119th Congress with more time to nullify the Rule if it chooses to do so. In 2017, when Republicans held majorities in the House of Representatives and in the Senate and President Trump took office, Congress overturned sixteen rules using the CRA—eighty percent of all rules overturned since the CRA’s enactment in 1996.¹¹

Congressional Republicans could overturn the Rule when the 119th Congress begins, or the Trump administration could simply decline to apply harsh regulatory scrutiny to larger participants, even though they may fall within the Rule’s scope. However, some in the incoming administration, including incoming Vice President J.D. Vance, have expressed skepticism of large technology firms and may not be inclined to prioritize overturning the Rule.¹²

Therefore, we suggest that potentially affected entities prioritize compliance readiness and take proactive steps to prepare for this new regulatory scrutiny, including:

Immediate Steps

1. Threshold Assessment: Determine whether your organization meets the 50 million transaction threshold and falls outside SBA small business criteria.
2. Review Compliance Programs: Evaluate data security, fraud prevention, and consumer error resolution protocols to ensure readiness for CFPB examinations.
3. Monitoring: Keep abreast of further CFPB developments, particularly regarding potential oversight of digital asset transactions.

Strategic Implications

• Risk Mitigation: Strengthen internal controls and compliance frameworks to minimize the risk of supervisory findings.
• Competitive Positioning: Leverage compliance readiness as a competitive advantage in the increasingly regulated payments ecosystem.
• Regulatory Advocacy: Engage in dialogue with regulators to clarify expectations and share insights on operational impacts.

¹ 12 CFR Part 1090.

² Id, at § 1090.109.

³ Final Rule, 244.

⁴ Final Rule, 3

⁵ Final Rule, 107.

⁶ Final Rule, 104.

⁷ Section 1090.109(a)(2)(ii)(A).

⁸ Id, at (2)(ii)(B).

⁹ Section 1090.109(a)(2)(iii).

¹⁰ Section 1090.109(a)(2)(iv).

11 The Congressional Review Act (CRA): A Brief Overview, supra n.1.

¹² See, e.g., Gopal Ratnam, Once a tech investor, Vance is now Big Tech critic, Roll Call (Jul. 17, 2024) https://rollcall.com/2024/07/17/once-a-tech-investor-vance-is-now-big-tech-critic/.