On Nov. 21, 2024, the Consumer Financial Protection Bureau (CFPB) issued a final rule (Rule), pursuant to 12 U.S.C. § 5514(a)(1)(B), to establish supervisory authority over nonbank entities identified as larger participants in the general-use digital consumer payment applications market. While the CFPB already has enforcement power over digital funds transfer and payment wallet app providers, the Rule subjects “larger participants” of this market to CFPB supervisory examinations, similar to banks and credit unions. The Rule will apply to companies that facilitate at least 50 million “consumer payment transactions” per year, higher than the five million threshold contemplated in the CFPB’s initial proposal, and its scope extends only to U.S.-dollar transactions (digital asset transactions are excluded).

According to the CFPB, the Rule intends to protect consumer privacy, reduce fraud, and curtail what the bureau deems unlawful “debanking” practices. “Digital payments have gone from novelty to necessity and our oversight must reflect this realty,” current CFPB Director Rohit Chopra said in the announcement. 

Background

In November 2023, the CFPB requested comments to its proposal to supervise larger nonbank entities offering digital wallet and payment apps. This proposed rulemaking followed a 2022 inquiry the CFPB conducted on digital payment practices, wherein the agency ordered large technology and peer-to-peer platforms to provide information on data and consumer protection practices, among other categories of consumer-facing information. That same year, the CFPB warned firms that provide financial technologies about their obligations under consumer protection laws, and issued an advisory on the potential risks of using and relying on digital payment apps. 

The Rule is the sixth CFPB rulemaking to define larger participants of markets for consumer financial products and services. The first five rules defined larger participants in markets for consumer reporting, 77 Fed. Reg. 42874 (July 20, 2012), consumer debt collection, 77 Fed. Reg. 65775 (Oct. 31, 2012), student loan servicing, 78 Fed. Reg. 73383 (Dec. 6, 2013), international money transfers, 79 Fed. Reg. 56631 (Sept. 23, 2014), and automobile financing, 80 Fed. Reg. 37496 (June 30, 2015).

The Final Rule

Under the Rule, nonbank covered persons that are “larger participants” in the “general-use digital consumer payment applications” market are subject to CFPB supervisory examination authority.

Test to Define ‘Larger Participants

The Rule sets forth a two-pronged test to determine whether a nonbank covered person is a larger participant of the general-use digital consumer payment applications market.¹ 
 

Nonbank covered persons wishing to claim they are not “larger participants” after the CFPB notifies them of its intent to undertake supervisory activity can submit evidence and arguments to the CFPB to support their claim.

Market Scope for General-Use Digital Consumer Payment Applications

Under the Rule, “general-use digital consumer payment application” means providing a [1] covered payment functionality through a [2] digital application for consumers’ [3] general use in making [4] consumer payment transaction(s).
 

The Rule covers two types of payment functionalities: (a) a funds transfer functionality; and (b) a payment wallet functionality.

• “Funds transfer functionality” means (1) receiving funds to transmit them (e.g., a nonbank transferring funds it holds for the consumer, such as in a stored value product/wallet, to another person); or (2) accepting and transmitting payment instructions from a consumer (i.e., transmitting consumer payment instructions to the entity that holds or receives the funds to be transferred).
   
• “Payment wallet functionality” refers to a product or service that (1) stores account or payment credentials, including in encrypted or tokenized form; and (2) transmits, routes, or otherwise processes such stored account or payment credentials to facilitate a consumer payment transaction.

Generally, “digital payment applications” include software programs that consumers may access through a personal computing device, including, but not limited to, a mobile phone, laptop computer, or other common means, such as a personal identifier (e.g., a passkey, password, or PIN). The Rule does not include market payment transactions that do not rely upon the use of digital applications (e.g., presenting a debit or credit card at the point of sale).
 

The Rule defines “general use” as being “usable for a consumer to transfer funds in a consumer payment transaction to multiple, unaffiliated persons.”

The Rule borrowed from Regulation E by adopting the phrase “multiple, unaffiliated persons” to define the universe of potential funds transfer recipients that would cause a payment functionality to have “general use.” Accordingly, unless an exclusion applies, a covered payment functionality that facilitates consumer payment transactions to multiple unaffiliated entities or persons would qualify as having “general use” under the Rule. By contrast, payment functionalities that facilitate consumer payment transactions to a single entity/person or to a group of affiliated entities/persons (e.g., flexible spending arrangements, gift certificates, payment functionalities used to pay a specific debt or type of debt or that facilitate purchases from a single merchant) are not considered “general use” under the Rule.
 

“Consumer payment transactions” generally include payments to other persons for personal, household, or family purposes. The term covers transactions made by or on behalf of a consumer “who resides in” a U.S. state or territory (narrowing the scope of covered transactions from the proposed rule, which purported to cover transactions facilitated for consumers “physically located” in a U.S. state or territory).² The term excludes from its definition certain transactions such as: (a) international money transfers; (b) foreign currency exchange transactions; (c) credit extensions through a digital application provided by the person who is extending, brokering or purchasing the credit; (d) payments for donations to a fundraiser selected from the provider’s platform; and (e) payments for the sale or lease of goods or services purchased from merchants and marketplaces.

One of the most significant changes in the Rule is the exclusion of digital assets, such as cryptocurrencies, from the scope of “consumer payment transactions.” This is a notable shift from the proposed rule, which initially interpreted “funds” to include digital assets. By excluding digital assets, the CFPB limited its scope of expanded oversight to payment transactions conducted in U.S. fiat currency only. Nonetheless, the Rule notes that the “CFPB intends to continue to gather data and information regarding the nature of such transactions and the impact of digital transactions on consumers, and to take further action as appropriate[,]” leaving open the possibility of future oversight over digital asset transactions.

Other Relevant Exclusions: BNPL and Earned Wage Access Products

The CFPB has also declined to include “buy now, pay later” (BNPL) transactions in the scope of “consumer payment transactions.” The CFPB reasoned that exempting BNPL transactions would be consistent with the exemption for nonbank persons that provide digital applications to initiate consumer credit transactions and also engage in activities directed at originating consumer credit extensions, regardless of who is extending the credit (and even if a third-party financial institution such as a bank or credit union is extending the credit). 

The CFPB also has opted to exclude earned wage access products insofar as they transfer wages belonging to or advanced on behalf of a consumer to that same consumer. As the CFPB explains in the Rule, a “consumer payment transaction” does not include “transfers between a consumer’s own deposit accounts [or] transfers between a consumer deposit account and the same consumer’s stored value account held at another financial institution, such as loading or redemptions[.]” Similarly, the Rule notes that the CFPB does not interpret the market definition to include payments by or on behalf of a consumer to other accounts the consumer owns or controls in which another person, such as a spouse co-owner or minor child, also holds an interest.

Takeaways

The digital payment market has grown rapidly, with consumers broadly relying on general-use digital consumer payment applications. However, the Rule has generated mixed reactions. At least one industry group has urged the CFPB to withdraw the Rule, while at least one consumer advocate group stated the Rule would ensure people are treated fairly when they use a payment app, taking “payment apps out of a regulatory blind spot.” 

The timing of the Rule is noteworthy, with the Trump administration set to take over in January 2025, and Director Chopra unlikely to remain agency head. What priority this Rule has for the new president, who is expected to generally ease regulations, and a newly appointed director, is yet to be seen. Nonetheless, impacted companies should review their products, services, consumer-facing documents, and compliance management systems, including all relevant policies and procedures, and consider establishing a strategy for managing a CFPB exam.