Yesterday the CFPB issued a Notice of Proposed Rulemaking (NPRM) that, according to the agency, aims to “crack down on [fintech] regulatory arbitrage by ensuring large technology firms and other nonbank payment providers are subjected to appropriate oversight.”

The proposed rule would subject large nonbank digital consumer payment companies to the CFPB’s supervisory oversight. Specifically, the new rule would define an additional market the CFPB will oversee: the “general-use digital consumer payment applications market.” It would cover “providers of funds transfer and wallet functionalities through digital applications for consumers’ general use in making payments to other persons for personal, family, or household purposes.”

The rule would cover transactions involving fiat currency or crypto currency. The NPRM noted examples of the types of products within the rule’s reach, including “digital wallets,” “payment apps,” “funds transfer apps,” “person-to-person payment apps,” “P2P apps,” and the like.

To fall within the new regulated market, an entity must meet both of the following criteria:

1. The nonbank covered person (together with its affiliated companies) must provide general-use digital consumer payment applications with an annual volume of at least five million consumer payment transactions.
2. The nonbank covered person must not be a small business concern based on the applicable Small Business Administration (SBA) size standard.

Based on these thresholds, the CFPB estimates that the rule would apply to 17 entities, although the agency acknowledges that it lacks sufficient information about many entities that may or may not meet the above thresholds.

Swift pushback arose by Representative McHenry (who chairs the House Financial Services Committee), claiming that the NPRM “will only entrench the status quo by impeding the adoption and development of innovative products and services . . . [limiting] nonbanks’ ability to offer products and services consumers and small businesses rely on.”

Comments to the NPRM are due on or before 8 January 2024, or 30 days after publication of the proposed rule in the Federal Register, whichever is later.

K&L Gates is digesting the rule and will provide a more detailed analysis.