CFPB issues new rule addressing supervision of nonbank payment providers

The Consumer Financial Protection Bureau (CFPB) has issued a new rule addressing its supervision of large nonbank companies offering US consumers certain digital funds transfer services and payment wallets and apps.

Under the Consumer Financial Protection Act of 2010, the CFPB is authorized to exercise supervisory authority over “larger participant[s] of a market for…consumer financial products or services, as defined by rules” the CFPB issues. CFPB is also authorized under the act to supervise any nonbank covered person that it “has reasonable cause to determine by order, after notice to the covered person and a reasonable opportunity . . . to respond . . . is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”

Pursuant to these provisions, the CFPB has determined that there is a need for closer supervision over “larger participants” providing “general-use digital consumer payment applications.” According to the CFPB, supervision and examination of the covered nonbank companies is needed to address issues that have arisen in several areas related to their provision of funds transfer and payment services, including:

• Incomplete disclosure concerning the use of data, data collection and sharing practices, and the availability/implementation of opt-out rights


• Inadequate procedures addressing the investigation and reversal of erroneous and fraudulent transactions – in particular, the CFPB maintains that some companies have been actively attempting to obscure and avoid their obligations for unauthorized transactions, or to shift responsibility impermissibly to other parties


• Termination of functionality and consumer access to funds, and sometimes permanent loss of the funds, when a digital payment service or application becomes unavailable, or the company supporting the service or app fails


• Failure to provide accurate and complete information about the extent to which Federal Deposit Insurance Corporation (FDIC) insurance does, or does not, apply to the funds held by, or transferred through, various digital payment products

The rule, which becomes effective January 9, 2025, establishes the criteria for identifying companies subject to supervision and examination as authorized by the act – it does this by defining what constitutes a “larger participant” in the market for provision of “general-use digital consumer payment applications.” The CFPB takes the position that it has always had enforcement authority over these entities and transactions, but that the rule formalizes the CFPB’s authority to proactively examine the covered nonbank companies for compliance with applicable consumer protection laws and regulations.

What companies are covered by the rule?

The rule applies to nonbank companies (including affiliates) that, in the prior calendar year, facilitated in the aggregate at least 50 million “consumer payment transactions,” denominated in US dollars, by providing “general-use digital consumer payment applications.” There is an exclusion for companies that qualify as a “small business concern” as defined in 15 USC 632(a). As is often the case with banking regulations, when trying to determine whether a particular nonbank company is covered by the rule, the devil lies in the definitional details.

What is a “general-use digital consumer payment application?”

To be covered by the rule, a company must provide one or more “general-use digital payment applications.” Understanding what constitutes a “general-use digital consumer payment application” requires working through a series of nested definitions in the rule.

In general, a company is offering a “general-use digital consumer payment application” if the company provides: “covered payment functionality” through a “digital payment application” for consumers’ “general use” in making “consumer payment transaction(s),” all as defined in the rule. If any one of these four defined terms does not apply to the company’s product offerings, then the company should not be covered by the rule, regardless of transaction volume.

What is a “consumer payment transaction?”

A “consumer payment transaction” is a transfer of funds that qualifies as an electronic funds transfer under Regulation E, and:

• The transfer of funds is initiated by or on behalf of a consumer


• The consumer resides in a state (which includes the 50 states, any territory or possession of the US, Washington, DC, Puerto Rico, or any political subdivision of any of the foregoing)


• The funds are transferred to another person, and


• The funds are transferred primarily for the consumer’s personal, family, or household purposes.

However, the term does not include:

• International money transfers as defined in 12 CFR § 1090.107(a)


• Transfers of funds that are linked to the consumer’s receipt of a different form of funds, such as foreign exchange


• Payment transactions conducted by a person for the sale or lease of goods or services that a consumer selected from that person or its affiliated company’s online or physical store or marketplace (such as credit card, debit card, or ACH debit payment transactions processed by a merchant), or for a donation to a fundraiser that a consumer selected from that person or its affiliated company’s platform, or


• An extension of consumer credit initiated through a digital application that is provided by a person who is extending, brokering, acquiring, or purchasing the credit or that person’s affiliated company.

What is “covered payment functionality?”

“Covered payment functionality” includes either or both of the following two functionalities:

• “Funds transfer functionality” in connection with a “consumer payment transaction” that consists of either:


• Receiving funds from a consumer for the purpose of transmitting them or


• Accepting payment instructions from a consumer and transmitting them.


• “Payment wallet functionality,” which is a product or service that:


• Stores account or payment credentials for a consumer and


• Transmits, routes, or otherwise processes such stored account or payment credential to facilitate a “consumer payment transaction.”

What is a “digital payment application?”

A “digital payment application” is a software program a consumer may access through a personal computing device, including but not limited to a mobile phone, smart watch, tablet, laptop computer, or desktop computer. The regulation specifically states that a web browser is not, in and of itself, a “digital payment application,” but a website accessed through a web browser can be a “digital payment application.”

What is “general use?”

A “digital payment application” is for “general use” if it allows a consumer to transfer funds, in a “consumer payment transaction,” to multiple unaffiliated persons. However, a “digital consumer payment application” is not for “general use” if it is used solely:

• With a “prepaid account” as defined in 12 CFR § 1005.2(b)(3)(ii)(A), (C) or (D) of Regulation E, or


• To pay a specific debt or type of debt, including:


• Debts owed in connection with origination or repayment of an extension of consumer credit or


• Debts in default.

Facilitating a “consumer payment transaction”

If a company is offering a “general-use digital payment application,” then the next question is whether the provided application “facilitates” a “consumer payment transaction.” The term “facilitate” is not defined in the rule, and so is presumably meant in its ordinary dictionary sense – that is, “to make something easier or to help bring something about.” To a certain extent, the question of facilitation appears somewhat redundant – if a company is providing a product that qualifies as a “general-use digital payment application,” then, by definition, it is almost certainly used to facilitate a “consumer payment transaction.”

Once it is determined that a company offers a “general-use digital payment application” and that the application facilitates a “consumer payment transaction,” then the rule provides additional guidance on calculating transaction volumes and aggregating transactions by affiliates.

For more information, please contact the authors.