Summary of CFPB's Prepaid Rule



    On October 5, 2016, the Consumer Financial Protection Bureau (Bureau) issued a final rule (Prepaid Rule) amending Regulations E and Z to extend consumer protections to prepaid card accounts. The new protections include pre-acquisition disclosures, error resolution rights, and periodic statements. In addition, prepaid card accounts that include a separate credit feature are subject to some of Regulation Z’s credit card provisions, including an ability-to-repay requirement. Prepaid card issuers are also required to submit to the Bureau and to post to their websites any new and revised prepaid card account agreements. In this alert we summarize key provisions of the Prepaid Rule except those provisions that apply only to payroll and government benefits prepaid cards, which will be covered in a separate alert.


    The Prepaid Rule’s effective date is October 1, 2017, however, the effective date for posting prepaid card account agreements is October 1, 2018. Heeding concerns about burden, the Bureau stated that the Prepaid Rule does not require financial institutions to pull and replace prepaid account access devices or packaging materials that were manufactured, printed, or otherwise produced in the normal course of business prior to October 1, 2017. Instead, financial institutions must provide consumers with notice of certain changes in terms and updated initial disclosures, in certain circumstances.


The Prepaid Rule amends Regulation E’s definition of “account” to include certain “prepaid accounts.” 12 CFR 1005.2(b)(3). Accounts that meet the definition below are covered by Subpart A of Regulation E, unless they are expressly excluded. The Prepaid Rule’s scope is broad, and is not limited to general purpose reloadable cards. Despite urging from industry commenters, the Bureau declined to exclude digital wallets, P2P products, or student financial aid cards that otherwise meet the definition below.

Under the Prepaid Rule, a prepaid account includes:

  • A payroll card account as defined in 12 CFR 1005.2(b)(3)(i)(A)
  • A government benefits card account as defined in 12 CFR 1005.15(a)(2)
  • An account that is marketed or labeled as “prepaid” and is redeemable upon presentation at multiple, unaffiliated merchants for goods and services or usable at automated teller machines (ATMs)
  • An account that:
  • Is issued on a prepaid basis in a specified amount or is capable of being loaded with funds after issuance;
  • Whose primary function is to conduct transactions with multiple, unaffiliated merchants for goods or services, to conduct transactions at ATMs, or to conduct person-to-person transfers; and
  • Is not a checking account, share draft account, or NOW account (negotiable order of withdrawal)

Note that because Regulation E only applies to transactions that are for consumer, family, or household purposes, prepaid cards issued for non-consumer purposes are not covered by Regulation E. In addition, the Prepaid Rule expressly excludes certain other accounts from its coverage. 12 CFR 1005.2(b)( 3)(ii). The exclusions include the following:

  • An account that is loaded by a third party with qualified disaster relief payments
  • Gift certificates, store gift cards, loyalty, award or promotional gift cards
  • Cards that are marketed and labeled as gift cards or gift certificates, even if they are general-use prepaid cards
  • Benefit cards such as those that are loaded with funds from a health or medical savings account, flexible spending or health reimbursement arrangements, and transit reimbursement arrangements
  • An account established for distributing needs-tested benefits in a program established under state or local law or administered by a state or local agency


    The Prepaid Rule requires entirely new pre-acquisition disclosures for prepaid cards. 12 CFR 1005.18(b). These disclosures are required in addition to modified versions of existing Regulation E disclosures, including the initial disclosures required in 12 CFR 1005.7.

    Before a consumer acquires a prepaid account, the financial institution must provide a short form disclosure, a long form disclosure, and certain information disclosed outside of but in close proximity to the short form disclosure. Formatting requirements include font size requirements measured in both font size and pixels, and range from six points (8 pixels) to 15 points (21 pixels). Model forms are provided.

    How the account is acquired impacts the disclosures that must be provided

    As noted, the Prepaid Rule requires disclosures before the consumer acquires the account. 12 CFR 1005.18(b)(1). However, whether the Long Form disclosures must be provided before acquisition depends on how the account is acquired. For example, for an account acquired at a retail store or by phone, the financial institution need not provide the long form disclosure before acquisition so long as the short form explains how the consumer may access the long form disclosure via telephone and on a website, and certain other requirements are met. For prepaid accounts acquired online or through a mobile device, the financial institution must provide the pre-acquisition disclosures (both Short and Long Form) electronically and may do so without E-Sign consent. 12 CFR 1005.18(b)(6)(i)(B).

    Contents of the Short Form: The short form disclosure must include certain fees and other information about the prepaid account. 12 CFR 1005.18(b)(2). Regarding fees, the short form requires disclosure of “static fees,” “revenue-based fees,” and other information as follows:

    Static fees, which are fees that all prepaid accounts must list on the short form, even if the fee amount is zero and/or even if the fee is for a feature that is not offered for that specific prepaid account program:

  • Periodic fees
  • Per purchase fees
  • ATM withdrawal and balance inquiry fees, both within and out of network
  • Cash reload fees, including charges both from the financial institution and any third parties
  • Customer service fees for calling a customer service agent, both live and with a vru
  • Inactivity fees

The short form must also include the number of fee types that may be imposed under the particular program, in addition to the static fees (excluding any purchase price, any activation fee, and any finance charges related to credit).

Revenue-based fees are fees that generate the most revenue in the previous 24 months. With limited exceptions, the short form must include the two additional fee types that generated the highest revenue from consumers during the previous 24 months for the specific prepaid account program, or across programs with the same fees schedule. In identifying these fees, the financial institution must not include any of the static fees, any purchase price, activation fee, finance charges related to credit, and fee types that generated less than 5 percent of the total revenue from consumers. Financial institutions will need to review fee revenue periodically and may need to update the short form disclosure every 24 months. This is a notable change from the Bureau’s proposal, which would have required disclosure of fees that were most frequently imposed measured over a 12 month period. 1005.18(b)(2)(ix)].

Other information that must be on the short form: Statements regarding linked overdraft credit features, registration and FDIC/NCUA insurance, the URL for the Bureau’s website information about prepaid accounts (, and where the consumer can find the long form disclosure.

Disclosures “Outside” the Short Form Disclosure

Except when a card is acquired in a retail store, the financial institution must make certain information available “outside” and “in close proximity to” the short form disclosure. 12 CFR 1005.18(b)(5). If the card is acquired in a retail store, the information must be provided on the outside of the packaging material. The information that must be provided includes the financial institution’s name, the name of the prepaid account program, any purchase price for the prepaid account (except when the card is acquired in a retail store), and any fee for activating the prepaid account. It is not entirely clear what the “name of the prepaid account program” is. A single issuer may want to brand programs with different names even when the underlying program is the same.

The Long Form disclosure

The Long Form must be provided before acquisition except in the phone and retail circumstances discussed above. 12 CFR 1005.18(b)(4). The Long Form must include:

  • A title, including the name of the prepaid account program;
  • The financial institution’s contact information;
  • Information about all fees that may be imposed in connection with the prepaid account (not just fees for electronic fund transfers) and the conditions under which they may be imposed;
  • Statements regarding registration, FDIC/NCUA insurance, and linked overdraft credit features;
  • Statements directing the consumer to for general information about prepaid accounts and to and the Bureau’s telephone number (1 -855-411-2372) to submit a complaint related to a prepaid account.
  • For prepaid accounts offering an overdraft credit feature, the long form disclosure must also include the Regulation Z disclosures described in § 1026.60(e)(1).

The Prepaid Rule’s requirement that an issuer include contact information requires “a telephone number, mailing address, and web site url” runs counter to the all-electronic interface that many issuers strive for and which some consumers may prefer.

Foreign Language Requirements for Pre-acquisition Prepaid Account Disclosures

The Prepaid Rule requires financial institutions to provide pre-acquisition disclosures in the language the financial institution used in connection with the consumer’s acquisition of the account. 12 CFR 1005.18(b)(9)(i). For example, if the prepaid card is packaged in material that includes Spanish advertising, the solicitation for the account is in Spanish, or the institution provides the means for a consumer to acquire the account by telephone or online using Spanish, then the pre-acquisition disclosures must be provided in Spanish. However, the final rule does not adopt the proposed requirement to provide the pre-acquisition disclosures in a foreign language “if the financial institution principally uses that foreign language in person.” The Bureau indicated that finalizing that requirement might discourage financial institutions and their employees from assisting limited-English consumers in person because of the expense of providing disclosures in a wide variety of other languages. Page 583.


    If a consumer may access the prepaid account using a card or another physical access device, the Prepaid Rule requires financial institutions to make certain disclosures on the device. 12 CFR 20015.18(f)(3). If there is no physical access device, then the financial institution must include the disclosures on the website, mobile application, or other entry point the consumer uses to electronically access the prepaid account. The disclosures include the name of the financial institution, website, and telephone number. As noted previously, many issuers and consumers prefer a digital-only interface, but the rule will require issuers to incur the costs associated with providing telephone access to the financial institution.


If an account is a “prepaid account” and is not otherwise excluded by the Prepaid Rule, then it is subject to Regulation E’s limited liability and error resolution requirements.12 CFR 1005.11. These requirements are potentially a burdensome feature of the new rule, though they have been modified in some respects to reflect the nature of prepaid accounts. In an expansion of consumer protections provided in the proposed rule, the Prepaid Rule applies these protections to prepaid accounts even if the financial institution has not completed its consumer identification and verification process with respect to the account. However, the Prepaid Rule does not require provisional credit for unverified accounts. Still, once a prepaid account has been verified, the financial institution generally may take longer than ten days to investigate and determine whether an error occurred only if it provisionally credits the consumer’s account in the amount of the alleged error, minus a maximum of $50.


The Prepaid Rule requires financial institutions to provide periodic statements for prepaid accounts for each monthly billing cycle in which an electronic funds transfer (EFT) has occurred and in any case at least quarterly. 12 CFR 1005.18(c). Periodic statements must provide detailed information about each EFT, as well as account balance and fee information. However, the Prepaid Rule does not require financial institutions to send periodic statements for prepaid accounts if they give consumers access to certain information about their accounts. Specifically, the financial institution must make the following information available to consumers:

  • Account balance information, by telephone;
  • Electronic account transaction histories (e.g. provided via a website) covering at least the 12 months preceding the date on which the consumer electronically accesses the prepaid account; and
  • Written account transaction histories upon request, covering at least the 24 months preceding the consumer’s request.

Although this alternative to periodic statements may reduce burden, the Prepaid Rule also provides that periodic statements and alternative account transaction histories must display a summary total of the amount of all fees assessed by the financial institution against the consumer’s prepaid account for the prior calendar month and for the calendar year to date, among other things.


    Similar to the Reg Z requirement for credit cards, the Prepaid Rule requires issuers to post on their websites, and submit to the Bureau new and amended prepaid account agreements and notification of withdrawn agreements.12 CFR 1005.19. However, issuers must meet more stringent submission deadlines than the quarterly filing requirements for credit card issuers under Regulation Z. The Prepaid Card Rule requires submissions to the Bureau no later than 30 days after the issuer offers, amends, or ceases to offer the agreement. The Prepaid Rule includes a de minimis exception and a limited product testing exception. As with the credit card agreement requirement, if fees vary by consumers, the Prepaid Rule permits issuers to show a range. Comment 19(b)(6)-2.

    Note that payroll card agreements and other agreements an issuer offers must be submitted to the Bureau even if the agreement is not offered to the general public. If a prepaid account agreement is not posted on the issuer’s website, the issuer must provide a consumer with a copy of the consumer’s prepaid account agreement no later than five business days after the issuer receives the consumer’s request for the agreement. The consumer must be able to request the agreement by phone.


The Prepaid Rule essentially limits issuers’ ability to offer overdraft credit as a negative balance on prepaid accounts. The rule does this by amending Regulation Z to require issuers to structure the overdraft feature as a separate credit feature in connection with a prepaid card, which in turn is subject to Regulation Z credit card protections. These arrangements are referred to as “hybrid prepaid-credit cards.”


Definition of a hybrid prepaid-credit card

A prepaid card is a hybrid prepaid-credit card if:

  • The card can be used from time to time to access a credit feature that is separate from the prepaid account’s asset feature;
  • The separate credit feature is offered by the prepaid account issuer, its affiliate, or its business partner; and
  • The card can be used to access the separate credit feature in the course of authorizing, settling, or otherwise completing transactions conducted with the card to obtain goods or services, to obtain cash, or to conduct P2P transfers.

    In addition, a prepaid card is a hybrid prepaid-credit card if it is a single device that can be used from time to time to access credit through a negative balance on the prepaid account’s asset feature, except in force pay transactions and other situations where incidental credit is extended as a negative balance on the prepaid account’s asset feature. To qualify for this exception, the following requirements must be met:

  • The prepaid account issuer has a policy and practice of declining to authorize transactions where the consumer has insufficient or unavailable funds to cover the transactions or declining to authorize such transactions, except when the amount of the transaction will not cause the account to be negative by more than $10 or the transaction is conducted when incoming deposits to the prepaid account are pending;
  • The prepaid account issuer does not charge certain credit-related fees such as negative balance fees; and
  • The prepaid card cannot access credit from a covered separate credit feature (described above).

Protections that apply to hybrid prepaid-credit cards

Hybrid prepaid credit cards are subject to several protections under Regulation Z. 12 CFR 1026.61(c). First, issuers must observe a 30 day cooling off period after the prepaid account is registered before soliciting a consumer to link a covered separate credit feature to a prepaid account. Even then, the issuer must obtain the consumer’s consent to link such a credit feature to the prepaid account. Second, issuers must assess the card holder’s ability to repay the credit. Third, issuers may not deduct all or part of the cardholder’s debt on a covered separate credit feature automatically from the prepaid account or other deposit account held by the card issuer more than once a month. The cardholder must provide a signed written authorization before any automatic deduction can be made. Fourth, the issuer must give consumers at least 21 days to repay the debt incurred in connection with the use of the covered separate credit features. Finally, issuers are prohibited from requiring consumers to set up preauthorized electronic fund transfers to repay credit extended through covered separate credit features.

Under the Prepaid Rule, a covered separate credit feature accessible by a hybrid prepaid-credit card is not an “overdraft service” for purposes of Regulation E. Therefore, financial institutions will not provide opt-in notices under Regulation E for covered separate credit features accessible by hybrid prepaid-credit cards, but will need to comply with Regulation Z.

Generally, a financial institution that provides a prepaid account with a covered separate credit feature must provide the same account terms, conditions, and features to prepaid accounts without a covered credit feature in the same prepaid account program. However, the financial institution may impose higher fees or charges on a prepaid account with a covered separate credit feature.

Questions regarding the matters discussed may be directed to any of our lawyers listed in this alert.