5 minute read | November.13.2023
The Consumer Financial Protection Bureau (CFPB) has issued a notice of proposed rulemaking that seeks to expand its authority to supervise and examine providers of digital wallets and payment applications.
The proposal is the latest “larger participant” rule issued by the CFPB, and the first since 2015. Prior rules defined larger participants for student loan servicing, consumer reporting, automobile financing, debt collection and remittance markets.
The proposed rule defines a new “general-use digital consumer payment applications market” and sets thresholds and requirements for defining the “larger participants” in that market subject to examination by the CFPB. The CFPB notes that the rule’s scope is intended to include many consumer financial products and services commonly described as “digital wallets,” “payment apps,” “funds transfer apps” and “P2P apps.”
The CFPB estimates that the new rule would apply to approximately 17 nonbank companies. While many states have supervisory programs relating to money transmitters, no federal program monitors these nonbank companies for compliance with consumer-protection laws.
Notably, the proposal includes the CFPB’s first public statement that the term “funds” is not limited to fiat currency or legal tender. Digital assets, including crypto-assets, with “monetary value readily useable for financial purposes, including as a medium of exchange,” may be considered “funds” under the Consumer Financial Protection Act (CFPA). This points to the CFPB’s intention to regulate digital consumer payments applications that use crypto, as well as fiat and legal tender for funds transfers.
The proposed rule would apply to companies that provide a covered payment functionality through a digital application consumers use to make consumer payment transactions.
The CFPB proposes to extend its examination authority to “larger participants” in this market, which are defined as: A nonbank with an annual volume of at least five million consumer payment transactions that does not meet the definition of a small business concern based on the Small Business Administration (SBA) size standard.
Under existing larger participant regulations, the CFPB can require the submission of certain records, documents and other information to assess whether an institution is a larger participant of a covered market. Once a nonbank-covered payments provider is designated as a “larger participant,” it will remain subject to examination authority until two years after the first day of the tax year in which the institution last met the larger participant test. Service providers to “larger participants” would also become subject to CFPB supervisory authority.
The CFPB has requested feedback regarding the appropriateness of the proposed criteria, asking whether it should instead be based on the dollar value of consumer payment transactions or other metrics.
Larger participants are subject to CFPB examination with respect to their compliance with federal consumer financial laws and “risks to consumers.” Specifically, the CFPB would examine for “compliance with applicable provisions of Federal consumer financial laws, including the Electronic Fund Transfer Act and its implementing Regulation E, as well as the privacy provisions of the Gramm-Leach-Bliley Act.” The CFPB also would examine whether larger participants engage in unfair, deceptive or abusive acts or practices and whether they comply with the CFPB’s rule implementing section 1033 of the Dodd-Frank Act, once finalized.
The proposed rule only impacts CFPB authority by extending its examination authority to a new cohort of nonbank financial services companies.
Importantly, by statute, the CFPB employs a risk prioritization process to determine which entities among the tens of thousands subject to its supervisory authority it will actually examine.
The rule would not affect the substantive law applicable to covered institutions, which are all already subject to the requirements of federal consumer financial law and the CFPB’s enforcement authority (i.e., its authority to issue civil investigative demands and take public enforcement actions).
Comments are due by January 8, 2024. The CFPB proposes that the final rule would take effect 30 days after it is published in the Federal Register.