On October 5, the Consumer Financial Protection Bureau (CFPB) released its final rule (Final Rule) extending an array of new substantive restrictions, upfront and ongoing disclosure obligations, and government reporting requirements on prepaid cards and a range of electronic non-bank accounts, commonly referred to as “digital wallets.”
The Final Rule makes a number of changes to both Regulation E (which implements the Electronic Funds Transfer Act) and the credit card rules that are part of Regulation Z (which implements the Truth in Lending Act). The Final Rule takes effect on October 1, 2017, with certain provisions phased in over time, and the reporting requirement for issuers is delayed until October 1, 2018.
The Final Rule makes limited changes from the original proposed rule, which we analyzed when it was first released nearly two years ago. This summary highlights the CFPB’s most significant measures requiring the most immediate attention by businesses:
- The Final Rule covers far more than prepaid cards. While denominated the “prepaid rule,” the CFPB adopted a broad definition of a covered “prepaid account” that brings within its scope, with a few specified exceptions, nearly any general-purpose stored-value payment mechanism that is not a bank account, as long as the card or mechanism (1) is redeemable with multiple, unaffiliated merchants for goods and services; (2) can be used at ATMs; or (3) can be used to conduct person-to-person transfers.
Thus, mobile wallets, internet-based person-to-person payment accounts, payroll cards, and many other types of prepaid accounts are subject to the Final Rule. The CFPB emphasizes in the Final Rule that the definition is intentionally broad to ensure coverage of both existing and future payment technologies.
- Exceptions from the rule are narrow. The few exceptions that the Final Rule expressly adopts appear designed to carve out products that either (1) a consumer is unlikely to use as a substitute for a traditional bank account or (2) are sufficiently otherwise regulated as to present a low risk to consumers.
Specifically, the regulation excludes the following:
- Gift cards, if “marketed and labeled as a gift card”
- Gift certificates and “closed-loop” store cards redeemable at a specific merchant
- Cards given as loyalty or promotional rewards
- Payment cards associated with IRS-regulated tax savings accounts (health savings account and flexible spending accounts)
- Payment cards used to distributed means-tested benefits under state or local law, or administered by a state or local government
- Federal government store cards for making purchases at military installations, even if capable of person-to-person transfers
- Commercial accounts, that is, where the cardholder is a business or uses the card solely for business purposes
- Accounts in which the funds are held in a bona fide trust
- The compliance burden will be high for all covered products. Unlike some other CFPB regulations where the compliance burden falls most heavily on companies engaged in riskier practices, all issuers of covered products face significant implementation tasks over the next year.
Every covered product will be required to
- provide detailed disclosures both before and when a consumer opens a prepaid account, including both short-form and long-form disclosures that focus on advising consumers of the product’s fees and the consumer’s rights (the Final Rule provides form disclosures that can be used by issuers);
- provide specific disclosures on the card itself, or, for covered non-card products, in the application used to access the account;
- comply with Regulation E’s liability-limitation and error-resolution procedures;
- issue periodic statements or alternatively make a specified list of balance, transaction history, and fee history information readily available to the consumer; and
- provide, beginning in October 2018 (with limited exceptions), copies of all new and amended prepaid account agreements to the CFPB, and notification of withdrawal of agreements, within 30 days.
- Covered accounts with credit or overdraft features will face the most scrutiny. The CFPB imposed the greatest number of substantive restrictions—and additional disclosure requirements—on covered accounts that can be used as an extension of credit, whether by design or in practice, such as an overdraft feature. Among other limitations, the regulation creates a new category of Regulation Z covered product called the “hybrid prepaid-credit card” and, in addition to specific new rules, subjects such products to all Regulation Z requirements for credit cards, particularly those related to error resolution and chargebacks.
A prepaid card becomes a hybrid prepaid-credit card if it meets either of the following tests:
- The card allows the consumer to draw on a separate credit account in the course of a card transaction, including any overdraft feature.
- The card otherwise allows the consumer to incur a negative balance, unless the issuer has a policy and practice of denying transactions that caused the account to be negative by more than $10; does not charge credit-related fees; and does not allow access to a separate credit feature.
Observations
The Final Rule will create yet another avenue for the CFPB to initiate investigations and enforcement actions against financial institutions and retailers—either as primary actors or for assisting and facilitating violations. State attorneys general will also likely get involved in any enforcement actions, as claims of unfair, deceptive, or abusive acts or practices (UDAAP) violations are becoming a more common foundation for enforcement action.
To that end, retailers and issuers alike, as well as employers that pay wages through prepaid cards and service providers to any type of prepaid access, will need to become familiar with the Final Rule, assess its applicability and, if necessary, develop compliance strategies without delay in order to comply with the conformance date. The disclosure, account information, and data collection requirements of the Final Rule create a significant compliance burden, and the time given for implementation is relatively short. In addition, service agreements with prepaid issuers will need to be reviewed and updated in order to incorporate the requirements of the Final Rule, and there are certain to be negotiations among issuers and retailers regarding bearing the costs on compliance.
These burdens will be especially hard for issuers where there is no other relationship with the consumer and thus no basis (as there is now with a credit card customer) to determine the accuracy of a complaint.
It remains to be seen whether the Final Rule will have a dampening effect on prepaid accounts and innovations in person-to-person payments and digital wallets. Such a negative effect would be unfortunate, especially in light of the federal financial regulators’ strong support—at least in speeches—on FinTech innovation.
Copyright © 2025 by Morgan, Lewis & Bockius LLP. All Rights Reserved.