CFPB Asserts Authority to Supervise Large Digital Wallet and Payment App Providers

On December 10, 2024, the Consumer Financial Protection Bureau (CFPB) published a final rule (“Final Rule”) to supervise large providers of digital wallets and payment apps. Specifically, the Final Rule, entitled Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications, extends the CFPB’s supervisory authority to certain nonbank covered persons participating in a market for general-use digital consumer payment applications.

Overview of the Final Rule

Under the Consumer Financial Protection Act (CFPA), the CFPB has supervisory authority over “larger participant[s] of a market for . . . consumer financial products or services,” as defined by rule. 12 U.S.C. § 5514. Subject to certain exclusions, the Final Rule covers larger participants in the market for providers of digital apps that offer funds transfers and wallet functionalities for consumers’ general use to make payments to other persons for personal, family, or household purposes.

Whether an entity is a “larger participant” under the Final Rule depends on whether the entity, together with its affiliated entities, in the prior calendar year:

• Provided general-use digital consumer payment transaction volume of at least 50 million U.S. dollar-denominated consumer payments (an increase from 5 million transactions in the proposed rule); and
• Was not a small business concern as defined by the Small Business Administration.

Pursuant to existing CFPB larger participant regulations (12 C.F.R. § 1090.103(d)), the CFPB is permitted to require an entity to submit documents for the purpose of assessing whether the entity qualifies as a larger participant.

Defined Terms

The Final Rule defines key terms, including:

• Consumer payment transactions: Subject to certain exceptions, “consumer payment transactions” include funds transfers by or on behalf of a consumer in a U.S. state or territory to another person, primarily for personal, family, or household purposes. The term also includes payments to individuals or businesses and is not limited to peer-to-peer (P2P) payments. Also, subject to exceptions, the term includes transfers made by extending consumer credit. The Final Rule excludes from the definition of consumer payment transactions:
• International money transfers;
• Transfers of funds by a consumer:
• Linked to the consumer’s receipt of a different form of funds, such as a foreign exchange transaction; or
• Excluded from the definition of “electronic fund transfer” under 12 C.F.R. § 1005.3(c)(4) as a transfer for the primary purpose of purchasing or selling a security or commodity;
• Payment transactions for the sale or lease of goods or services selected from an online or physical store or marketplace;
• Donations to a fundraiser selected by a consumer from that entity’s platform; and
• Extensions of consumer credit initiated through a digital application provided by a person extending, brokering, acquiring, or purchasing the credit or that person’s affiliated company as part of a market for consumer credit originations.

• Covered payment functionality: This term refers to the market definition for providing a general-use digital consumer payment application, which generally involves transmitting funds or payment instructions and includes one or both of the following:

• Funds transfer functionality: With respect to a consumer payment transaction, receiving funds from a consumer for the purpose of transmitting them, or accepting from a consumer and transmitting payment instructions; or

• Payment wallet functionality: A product or service that: (1) stores for a consumer account or payment credentials, including in encrypted or tokenized form, and (2) transmits, routes, or otherwise processes such stored account or payment credentials to facilitate a consumer payment transaction.

The Final Rule clarifies that this term does not cover traditional payment processors, entities operating solely as business-to-business intermediaries during consumer payment transactions, or providers of digital wallets that store and transmit data unrelated to consumer payments.

• Digital payment application: This term refers to a software program, including an application or website, that a consumer can access through a personal computing device, such as mobile phone, smart watch, tablet, laptop, or desktop computer.
• General use: For purposes of the Final Rule, “general use” means usable for a consumer to transfer funds in a consumer payment transaction to multiple, unaffiliated persons. The term includes exceptions for:
• Payment functionality provided through a digital consumer payment application solely for use under certain exceptions to the definition of prepaid account under Regulation E; or
• Debts owed in connection with origination or repayment of an extension of consumer credit or debts in default.
• Annual covered consumer payment transaction volume: This term refers to the number of consumer payment transactions denominated in U.S. dollars that the nonbank covered person and its affiliates facilitated in the preceding calendar year. According to the CFPB press release, the scope of the Final Rule is limited to specifically exclude “the evolving market for digital currencies.”

The CFPB estimates that the Final Rule will bring seven entities under CFPB supervision and that the revised transaction volume threshold will cover approximately 98 percent of the more than 13.5 billion consumer payment transactions provided by market participants.

The Final Rule will take effect on January 9, 2025.

Impact & Purpose

In its press release, the CFPB noted that while the agency has had enforcement authority over the largest nonbank companies offering digital payment apps, the Final Rule provides the CFPB with supervisory authority, which allows the agency to conduct proactive examinations of these companies.

Under the Final Rule, the CFPB will examine larger participants for compliance with applicable federal consumer financial laws, including the Electronic Fund Transfer Act (EFTA) and implementing Regulation E; the privacy provisions of the Gramm-Leach-Bliley Act and implementing Regulation P; and the CFPA prohibition on unfair, deceptive, or abusive acts or practices. In particular, the CFPB is concerned about payment fraud targeting older adults, active duty servicemembers, and other EFTA violations occurring on digital payment apps. The CFPB’s oversight of digital payment apps will also focus on examining dispute and error resolution practices that enable digital payment apps to offload fraud and error resolution to financial institutions.

The Final Rule follows other recent CFPB actions relating to digital payment apps. For example, on August 26, 2024, the CFPB published a report highlighting the continued importance of consumer access to cash in case of a serious disruption, failure, or outage involving digital payment systems. The CFPB’s focus on P2P payment platforms stretches back to the CFPB’s 2021 series of orders to such platforms to provide data to the CFPB relating to their businesses.

On December 6, 2024, the CFPB published a contested supervisory designation order over Google Payment Corporation, which operated a now-retired P2P payment platform and stored-value product. The CFPB based its determination on risks related to error resolution and risks related to fraud prevention. The supervisory designation order represents the CFPB’s finding that the company is a covered person under the CFPA and does not represent a finding that the company has engaged in wrongdoing or violated the law. While Google Payments Corporation quickly filed suit challenging the supervisory designation, the nonbank entity will now be under the CFPB’s supervision and may be required to provide reports to the CFPB or allow the agency to conduct an examination.

Key Takeaways

The Final Rule represents another expansion of the CFPB’s supervisory authority beyond traditional financial institutions and into the nonbank payments sector. Nonbank entities providing covered payment functionality should expect increased scrutiny and oversight of their privacy and data collection operations, fraud and dispute resolution practices, and account closure and debanking procedures. In its most-recent Consumer Response Annual Report, the CFPB listed complaints involving fraud or scams and unauthorized transactions or other transaction problems as the most-common complaints received regarding money services and payments entities. Nonbank entities subject to examination should prepare for these areas to remain a focus of supervisory scrutiny. Additionally, nonbank entities that meet the transaction volume threshold should take steps to solidify their internal compliance procedures to prepare for CFPB supervision and examination.

The timing of the Final Rule may leave its future uncertain. President-elect Trump can remove Director Chopra at will, and we expect that Director Chopra will announce his resignation or be removed from office at the start of the next administration. Although the Final Rule will take effect before the start of the next administration, a future Republican-appointed director could elect to revise, withdraw, or simply decline to enforce the Final Rule.

Moreover, under unified government, Congress may seek to rescind the Final Rule under the Congressional Review Act (CRA). If Congress adopts a joint resolution of disapproval that the president signs, the CFPB would be precluded from promulgating a rule on a substantially similar topic unless specifically authorized by a law enacted after the CRA joint resolution.

We will continue to follow developments in the nonbank payments space, including in relation to the CFPB’s Final Rule to supervise larger participants of the market.