CFPB proposes new federal supervision of certain providers of digital wallets and payment apps

On November 7, 2023, the Consumer Financial Protection Bureau (CFPB) issued a proposed rule to supervise larger nonbank companies that offer services like digital wallets and payment apps. The issuance of this proposed rule should not come as a surprise, as the CFPB has provided several hints in recent months that it would be looking to use its authorities to conduct supervisory examinations of nonbanks operating consumer payment platforms, including through the issuance of a proposed rule to define larger participants operating in this market.

The proposed rule would define a market for general-use digital consumer payment applications, which would cover providers of funds transfer and wallet functionalities through digital applications for consumers' general use in making payments to other persons for personal, family, or household purposes. Examples include many consumer financial products and services that are commonly described as "digital wallets," "payment apps," "funds transfer apps," "person-to-person payment apps" and "P2P apps." According to the CFPB, greater supervision of nonbanks in this market would ensure federal consumer financial protection law is enforced consistently between non-depository and depository institutions, such as banks and credit unions. The proposed rule would be the sixth in a series of CFPB rulemakings to define larger participants operating in markets for consumer financial products and services.

Coverage

The proposed rule sets forth a two-pronged test to determine whether a nonbank covered person is a larger participant of the general-use digital consumer payment applications market. First, the nonbank covered person (together with its affiliated companies) must provide general-use digital consumer payment applications with an annual volume of at least US$5m consumer payment transactions. Second, the nonbank covered person must not be a small business concern based on the applicable Small Business Administration (SBA) size standard. Any nonbank covered person that qualifies as a larger participant would remain a larger participant until two years from the first day of the tax year in which the person last met the larger-participant test.

Certain transfers of funds in the form of digital assets that have monetary value and are readily useable for financial purposes, including as a medium of exchange, would fall within scope, unless one of the proposed exclusions applies. This by itself is significant because it would mark the first time the CFPB has taken a formal step towards regulation of certain digital asset products or services—including crypto-assets, sometimes referred to as virtual currency—by asserting jurisdiction over at least some of them. This may have implications beyond this larger participant rulemaking should the CFPB adopt similar interpretations with respect to other consumer financial services statutes and regulations.

Although a general-use digital consumer payment application also could help individuals to make payments that are not for personal, family, or household purposes, such as purely commercial (or "B2B" payments), those payments would not be within scope. The CFPB estimates that the proposed threshold would bring within the CFPB's supervisory authority approximately 17 entities, about 9 percent of all known nonbank covered persons in the market for general-use digital consumer payment apps. According to the CFPB's estimates, the approximately 17 providers of general-use digital consumer payment applications that meet the proposed threshold collectively facilitated about 12.8 billion transactions in 2021, with a total dollar value of about US$1.7t. The CFPB estimates that these nonbanks are responsible for approximately 88 percent of known transactions in the nonbank market for general-use digital consumer payment apps.

Scope of CFPB supervision

The proposed rule would subject larger nonbank digital consumer payment companies to the CFPB's authority under the Dodd-Frank Act to conduct examinations, which would allow the CFPB to supervise larger participants for compliance with applicable federal consumer financial protection laws. These include applicable protections against unfair, deceptive and abusive acts and practices (UDAAP), rights of consumers transferring money and privacy rights. In establishing the CFPB's supervisory authority over such entities, the proposed rule would not impose new substantive consumer protection requirements or alter the scope of the CFPB's other authorities. In addition, some nonbank covered persons that would be subject to the CFPB's supervisory authority under the proposed rule also may be subject to other CFPB supervisory authorities, including, for example, as a larger participant in another market defined by a previous CFPB larger participant rule. Importantly, regardless of whether they are subject to the CFPB's supervisory authority, nonbank covered persons generally are subject to the CFPB's regulatory and enforcement authority.

The CFPB's authority to supervise nonbank covered persons also allows the agency to obtain information about such persons' activities and compliance systems or procedures, and, as appropriate, request information from supervised entities prior to or without conducting examinations. The CFPB also may require submission of certain records, documents and other information for purposes of assessing whether a person is a larger participant of a covered market. The CFPB prioritizes supervisory activity among nonbank covered persons on the basis of risk, taking into account, among other factors, the size of each entity, the volume of its transactions involving consumer financial products or services, the size and risk presented by the market in which it is a participant, the extent of relevant state oversight and any field and market information that the CFPB has on the entity. For example, because states have been active in regulation of money transmission by money services businesses and that many states actively examine money transmitters, the CFPB states that it would coordinate with appropriate state regulatory authorities in examining larger participants, if the proposed rule is adopted.

CFPB's focus on technology and consumer finance

This proposed rule, if finalized, would be the latest addition to the CFPB's efforts to increase its monitoring and scrutiny of the impact of technology on consumer financial markets. Digital dollars and digital payments have been a core focus of CFPB Director Rohit Chopra throughout his two-year tenure at the agency. The CFPB also is exploring providing additional guidance to market participants to answer questions regarding the applicability of the Electronic Fund Transfer Act with respect to private digital dollars and other virtual currencies for consumer and retail use. Additionally, the CFPB has opened the Office of Competition and Innovation and established a supervision technology program staffed with technology experts and examiners.

Proposed effective date of final rule

The CFPB proposes that, once issued, the final rule for this proposal would be effective 30 days after it is published in the Federal Register.

Comment period

Comments must be received on or before January 8, 2024, or 30 days after publication of the proposed rule in the Federal Register, whichever is later. While this proposed rule is a potential first step towards more intrusive regulation of these companies, we expect that there will be significant industry pushback during the comment period.