CFPB takes steps to regulate “Buy Now, Pay Later” providers

The Consumer Financial Protection Bureau (CFPB) on May 22, 2024 issued an interpretive rule that imposes some of the same rules on Buy Now, Pay Later (BNPL) providers that apply to conventional credit card providers. Specifically, the rule applies to digital user accounts used to access credit, including to those providers that market loans as BNPL. The interpretive rule clarifies that the business practices of providers marketing their loans as BNPL will typically trigger the consumer protections in existing federal law and regulation that apply to traditional credit cards, including those related to billing disputes, refunds for returned products or canceled services and disclosures such as periodic billing statements. Although market participants’ loan offerings vary in the BNPL sector, the CFPB issued this interpretive rule “to clarify existing obligations for market participants with specific business practices.”

Background

The CFPB initially launched its inquiry into the rapidly expanding BNPL market with a focus on debt accumulation, regulatory arbitrage and data harvesting. In December 2021, the CFPB issued mandatory data collection orders to five large BNPL providers to understand market trends and practices. The agency published its results in 2022 (which we previously reported on), and highlighted the rapid expansion of the industry and growing consumer risks, including overextension and excessive debt accumulation. The report noted, among other findings, a lack of standardized disclosures and challenges in resolving disputes. Since publishing that report, the CFPB has undertaken a range of activities to further analyze the market, including an effort to identify commonly employed business practices in this sector, supervisory examinations and other market monitoring and investigation. Last year, the CFPB published its findings on the financial profiles of BNPL borrowers (which we also previously reported on). In March 2024, the CFPB released its “Consumer Response Annual Report” for 2023, which noted issues consumers faced with merchants regarding BNPL, such as non-receipt of items and challenges in canceling loans. The CFPB continues to receive consumer complaints related to refunds and disputed transactions, as BNPL products continue to be popular across ages, races and income levels.

Analysis

The interpretive rule’s legal analysis states that providers that issue digital user accounts that consumers use from time to time to access credit products to purchase goods and services are “card issuers” and “creditors” for purposes of subpart B of Regulation Z, including when those products are marketed as BNPL. The CFPB deems such providers as “card issuers” because such digital user accounts are “credit cards” under Regulation Z. Regulation Z defines “card issuer” as “a person that issues a credit card or that person’s agent with respect to the card.” Additionally, “card issuers” are considered “creditors” for purposes of subpart B if they also extend “either open-end credit or credit that is not subject to a finance charge and is not payable by written agreement in more than four installments.” Such “creditors” are broadly subject to the provisions of subpart B. The CFPB deems BNPL credit to satisfy the Regulation Z definition of “credit,” which is broadly defined as “the right to defer payment of debt or to incur debt and defer its payment.” Notably, where a BNPL provider partners with another party to extend credit, including a bank, depending on the facts and circumstances both entities may be “card issuers.”

While variations of the product exist, for purposes of this interpretive rule, the CFPB has defined BNPL credit as a "closed-end consumer loan for a retail transaction that is repaid in four (or fewer) interest-free installments and does not otherwise impose a finance charge.” (Other variations of BNPL include loans that, for example, incur interest or other finance charges—often referred to as point-of-sale loans—which, depending on their features, may be subject to other provisions of Regulation Z, including subparts C or G).

The CFPB interprets the term “credit card”—which, as defined by TILA and Regulation Z, includes the term “other credit device” or “other single credit device” used for the purpose of obtaining credit—to encompass digital user accounts that consumers can use through websites, mobile apps, browser extensions or integrations with merchant websites or mobile apps to access BNPL credit for the purchase of goods and services. The CFPB bases its interpretation on the definition of “credit card” in TILA and Regulation Z, which is not limited to a plastic or metal embossed physical card, and includes “archaic forms of credit devices like plates and coupon books, and non-physical credit devices like account numbers, including virtual credit cards where the account number itself is the ‘credit card.’” According to CFPB Director Rohit Chopra, “[w]hen Congress defined ‘credit card’ under the Truth in Lending Act, it deliberately defined the term to include devices both known and unknown.” While the CFPB acknowledges that the broad catch-all terms “other credit device” and “other single credit device” are not defined by TILA and Regulation Z, the CFPB deems its interpretation to be: (i) “consistent with the ordinary meaning and historical context of the words;” (ii) consistent with use of the word “device” broadly in other contexts; and (iii) consistent with Congress’ intent to define the terms “other credit device” and “credit card” broadly. As the CFPB states, “[t]he statutory and regulatory definitions of ‘credit card’ are broad enough to capture new, technologically advanced ‘devices’ designed to mimic the core features of conventional credit cards.”

Accordingly, providers that issue digital user account to access BNPL credit are subject to the provisions of subpart B of Regulation Z. Although subpart B is labeled “Open-End Credit,” many of its provisions apply more broadly, including to closed-end credit, under certain circumstances (and to the extent that subpart B applies to business-purpose credit cards, this would also include business-purpose BNPL credit). Certain subpart B provisions, such as those governing cardholder liability and the rules for credit and charge card applications and solicitation, apply to any “card issuer,” regardless of the type of credit offered. Moreover, subpart B, as noted above, also applies to credit that is not open end if, as with BNPL, the credit is not subject to a finance charge and is not payable by written agreement in more than four installments. Traditional BNPL products are closed-end loans payable in four or fewer installments without a finance charge, used to make purchases on credit. The CFPB affirms through this interpretive rule that BNPL providers that extend credit—even though that credit is not subject to a finance charge and is not payable by written agreement in more than four installments—are creditors subject to subpart B of Regulation Z.

In order for a device to constitute a credit card under Regulation Z, it must be usable from time to time to obtain credit. The commentary to Regulation Z interprets the term “time to time” to “involve[] the possibility of repeated use of a single device.” The CFPB interprets the phrase “usable from time to time” to cover a consumer’s BNPL digital user account “that is issued as part of a business model designed for repeat use that can be used through websites, mobile apps, browser extensions or integrations with merchant websites or mobile apps, to access credit for the purchase of goods and services.” The interpretive rule clarifies that the “existence of a limit on the number of BNPL loans a consumer can have at one time or the issuance of a single-use virtual card as part of the credit extension and payment process would not preclude the credit device from satisfying the ‘time to time’ requirement.”

We note that not all digital user accounts are credit cards, but the interpretive rule makes clear that digital user accounts “with the purpose of giving consumers access to credit from time to time in the course of completing transactions to purchase goods or services, including those marketed as BNPL”, satisfy the Regulation Z definition of “credit card.”

However, the interpretive rule further clarifies that traditional BNPL products do not satisfy the Regulation Z definitions of “open-end credit” or of a “credit card account under an open-end (not home-secured) consumer credit plan.” Importantly, providers that issue digital user accounts to access BNPL credit are generally not subject to the credit card regulations appearing in subpart G of Regulation Z (such as penalty fee limits and ability-to-repay requirements).

For consumers, this means BNPL providers will be required to:

• Investigate disputes: BNPL providers will be required to investigate disputes that consumers initiate, and will also need to pause payment requirements during the investigation and sometimes will be required to issue credits.
• Refund returned products or cancelled services: When consumers return products or cancel services for a refund, BNPL providers will be required to credit the refunds to consumers’ accounts.
• Provide certain disclosures, including billing statements: Consumers will be required to receive disclosures that lay out the cost of credit (such as fees and pricing structures), along with periodic billing statements like the ones received for classic credit card accounts.

While not required under the Administrative Procedure Act, the CFPB is opting to solicit comments on this interpretive rule and may make revisions as appropriate after reviewing feedback received. According to the CFPB, “[g]iven the rapid changes in this market, public comments will help inform where the CFPB can offer further clarity, including through rules and guidance, related to the [BNPL] market.” The CFPB also notes that comments “will also help to inform future rules and guidance relevant to [BNPL].” Comments will be accepted until August 1, 2024. 

Implications

The issuance of this interpretive rule was long expected, as Director Chopra stated almost two years ago that he had asked CFPB staff to identify potential interpretive guidance or rules to issue with respect to BNPL, with the key objective being to extend “many of the baseline protections that Congress has already established for credit cards” to the BNPL sector. That said, the rule marks a significant step forward in getting BNPL regulation in place in the United States. This additional regulatory backstop could actually help to drive more confidence in these products, and so far industry seems to be generally supportive of the interpretive rule. 

So far, industry reaction to this interpretive rule has been generally supportive, but lukewarm. Some of the largest BNPL providers were quick to point out that this development does not require any major changes to their businesses, which suggests that industry reaction to this regulatory framework may be more positive than it’s been to other recent CFPB regulatory developments, such as the CFPB’s small business lending rule and credit card penalty fees rule. For example, some large BNPL providers are already investigating disputes, pausing payments and providing consumers with comprehensive billing statements. 

Interestingly enough, BNPL is largely advertised and marketed as an alternative to credit cards, offering consumers a more easily navigated fixed installment plan and the ability to avoid increasing revolving balances, but now the CFPB is making them more akin to traditional credit cards, at least with respect to the regulatory overlay. While the CFPB recognizes some of these differences (and the rule does not subject BNPL to the entirety of requirements that attach to credit card accounts), industry is taking issue with what they argue is the CFPB’s failure to sufficiently differentiate between the two. By comparison, some have pointed to efforts made in recent years in other jurisdictions, including Australia and the United Kingdom, to create a proportionate regulatory framework that both imposes appropriate consumer protections and recognizes the fundamental differences between credit cards and BNPL products. For its part, the CFPB states that BNPL offerings and conventional credit cards share many similarities—both combine payment processing and credit services, both charge transaction fees to merchants and are extensively used for retail transactions, and consumers often use these two payment methods in a similar manner). It is not yet clear whether industry opposition will rise to the level of a formal challenge to this interpretive rule, but we note that the rule is still subject to the Congressional Review Act process, at the very least.

The interpretive rule also is an important reminder to industry that various Regulation Z provisions already apply to credit such as BNPL that is not open-end, not subject to a finance charge and not payable by written agreement in more than four installments.”

Going forward, we expect to see the CFPB use a number of tools to oversee the BNPL sector, including the authority to bring claims of unfair, deceptive or abusive practices (UDAAP). As BNPL products continue to grow in popularity and the industry continues to add products and services to meet consumer need, market participants should ensure they understand their regulatory obligations and licensing requirements, know how to navigate the processes and procedures to achieve compliance with the evolving regulatory regimes and develop structures to address regulatory risks, including possible CFPB supervision.