On November 21, 2024, the Consumer Financial Protection Bureau (CFPB) issued a final rule that deems payment app providers “larger participants” subject to the agency’s direct supervision (Rule).1
Large technology companies’ involvement in financial services markets has been an area of significant focus for the CFPB under Director Rohit Chopra.2 It is not yet clear whether or to what extent that focus will change under the incoming Trump administration. We discuss the CFPB’s supervisory jurisdiction, key requirements and implications under the Rule, and next steps for payment app providers now subject to the CFPB’s supervision.
CFPB’s Supervisory Jurisdiction
The Dodd-Frank Act gives the CFPB authority to supervise depository institutions and their affiliates with more than $10 billion in total assets3 and certain nondepository institutions as set forth below.
- Nondepository institutions offering or providing three enumerated types of consumer financial products or services: (1) origination, brokerage or servicing of consumer loans secured by real estate and related mortgage loan modification or foreclosure relief services; (2) private education loans; and (3) payday loans.4
- Larger participants of a market for other consumer financial products or services, as defined by rules the CFPB issues.5
- Any nondepsitory institution that the CFPB “has reasonable cause to determine by order, after notice to the covered person and a reasonable opportunity ... to respond ... is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”6
The CFPB issued the Rule under its authority to designate “larger participants,” which allows the agency to supervise nonbank financial companies that offer significant consumer financial products or services to ensure they comply with federal consumer protection laws. The CFPB has defined larger participants for five other financial products or services markets: consumer debt collection, student loan servicing, consumer reporting, international money transfers and automobile financing.
The Rule’s Requirements and Implications
The Rule grants the CFPB supervisory authority over larger participants in the market for “general-use digital consumer payment applications.”7 The market definition encompasses nonbank entities that offer funds transfer or payment wallet functionalities through digital payment applications for consumers’ general use in making consumer payment transactions.8
The Rule defines “consumer payment transactions” to include transfers of funds by or on behalf of consumers to other persons for personal, family or household purposes, subject to certain exclusions listed below.9
- International money transfers.10
- A transfer of funds by a consumer that is linked to the consumer’s receipt of a different form of funds, such as a transaction for foreign exchange, or that is excluded from the definition of “electronic fund transfer” under Regulation E.
- A payment transaction for the purchase or rental of goods or services that a consumer selected from that company’s online or physical store or marketplace, or for a donation to a fundraiser selected by the consumer from that person’s or its affiliated company’s platform.
- An extension of consumer credit initiated through a digital application provided by a party who is extending, brokering, acquiring or purchasing the credit.
To be considered a larger participant, a nonbank must facilitate at least 50 million transactions a year that are denominated in U.S. dollars and cannot be a “small business concern” as defined in the Small Business Act.11 The annual transaction volume threshold excludes transfers of digital assets, including Bitcoin and stablecoins, to “ensure the administrability” of the test.12
The annual transaction volume threshold of 50 million marks a significant increase from the 5 million annual transaction volume threshold in the proposed rule. Even though the Rule does not explicitly identify larger participants by name, the CFPB estimated that larger participants would include seven large payment app companies that have facilitated 13.3 billion consumer payments, accounting for 98% of nonbank payment volume.13
The Rule does not impose new substantive consumer protection requirements. The Rule’s key implication is that the CFPB may now directly supervise payment app providers that are larger participants, instead of relying on its enforcement authority alone.
Next Steps for Payment App Providers
The CFPB has issued the Rule with two months remaining in the Biden administration, and it remains to be seen whether the incoming Trump administration’s CFPB director will reverse the Rule and other recent agency rulemakings. Payment app providers nevertheless may wish to take steps to prepare for CFPB supervision under the Rule, which is slated to go into effect on January 9, 2025, including the following:
- Conduct a self-assessment and/or mock examination. Payment app providers deemed larger participants may wish to undertake a self-assessment of their policies and procedures with respect to areas of likely CFPB focus and determine whether adjustments to business practices are warranted to mitigate compliance risk. In addition, a larger participant may wish to undertake a “mock examination” of itself, using written requests for documents, information and data focusing on those areas that are likely to be subjects of a CFPB examination. Such an exercise can provide valuable insights into where and how responsive information and documentation is stored, develop routines and coordination that will help an actual examination run more smoothly, and identify pain points in a potential examination that can be addressed before a real examination occurs.
- Review and revise or draft policies and procedures to align with consumer protection requirements and demonstrate compliance. Payment app providers deemed larger participants should review existing policies and procedures against consumer protection requirements in preparation for CFPB supervision. Policies and procedures should be updated, and in some cases new policies and procedures may need to be drafted, to the extent that current policies and procedures do not align with consumer protection requirements or do not properly document existing policies and procedures.
- Understand the supervisory process and plan for expenses. The supervisory process will require organization and cooperation on the part of the newly supervised payment app providers. Newly supervised entities can expect to incur expenses associated with preparing for and undergoing examinations.
- Prepare for examination scrutiny. Payment app providers deemed larger participants should be ready for additional scrutiny that comes with the examination process, including the potential for findings and matters requiring attentions. The CFPB press release regarding the Rule hints at some areas of supervisory interest, including privacy and surveillance programs, dispute resolution management for errors and fraudulent transactions, and debanking that results from loss of access to apps and technical disruptions.14 The agency has also created a supervision technology program that assesses technology controls and technology’s impact on compliance with federal consumer financial law.15 Payment app providers deemed larger participants should be prepared for these areas of supervisory focus and others as they undergo examination.
_______________
1 CFPB Rule, Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications (to be codified at 12 C.F.R. Part 1090), 89 Fed. Reg. 99,582 (Dec. 10, 2024).
2 The CFPB has asserted its supervisory authority over technology and other companies under other provisions of the Dodd-Frank Act. See, e.g., CFPB No. 2024-CFPB-SUP-0001 (Nov. 8, 2024). In addition, the agency has issued market monitoring orders to collect information on the business practices of several prominent technology and payments companies. See CFPB Press Release, “CFPB Orders Tech Giants To Turn Over Information on Their Payment System Plans” (Oct. 21, 2021).
3 12 U.S.C. § 5515(a).
4 12 U.S.C. §§ 5514(a)(1)(A), (D), (E).
5 12 U.S.C. §§ 5514(a)(1)(B), (a)(2).
6 12 U.S.C. § 5514(a)(1)(C); see also 12 C.F.R. Part 1091 (prescribing procedures for making determinations under 12 U.S.C. § 5514(a)(1)(C)).
7 12 C.F.R. § 1090.109(a)(1)
8 Id.
9 12 C.F.R. § 1090.109(a)(2)(i).
10 As noted above, the CFPB has separately defined larger participants in the market for international money transfers. 12 C.F.R. § 1090.107.
11 12 C.F.R. § 1090.109(b).
12 Rule, supra note 1, at 99,640.
13 Rule, supra note 1, at 99,639-40.
14 CFPB Press Release, “CFPB Finalizes Rule on Federal Oversight of Popular Digital Payment Apps to Protect Personal Data, Reduce Fraud, and Stop Illegal ‘Debanking’” (Nov. 21, 2024).
15 Id.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.