Yesterday, the Consumer Financial Protection Bureau (CFPB or Bureau) issued an “interpretive rule,” subjecting “Buy Now, Pay Later” (BNPL) transactions to provisions of Regulation Z applicable to “credit cards.” Among other things, this classification would require BNPL and other lenders to extend many of the same legal protections and rights to consumers that apply to traditional credit cards, including the rights to dispute charges and demand refunds for returned products, and, potentially, receive periodic statements. The Bureau claims its authority to issue this interpretive rule — in lieu of a formal rulemaking — stems from the Truth in Lending Act (TILA) and Regulation Z, and its general authority to issue guidance as set forth in § 1022(b)(1) of the Consumer Financial Protection Act of 2010.

The CFPB broadly argues with little additional support that a BNPL “digital user account” is an “other credit device” or “other single credit device” within the TILA/Regulation Z definition of “credit card.” See, e.g., 12 C.F.R. § 1026.2(a)(15)(i) (defining a “credit card” as any card, plate, or other single credit device that may be used from time to time to obtain credit) (emphasis added). It largely ignores its own commentary that a mere account number used to access credit and that is associated with closed-end credit is not a credit card even if used “to purchase goods and services.” See Regulation Z, Comment 2(a)(15)-2.ii (In contrast, credit card does not include, for example: An account number that accesses a credit account, unless the account number can access an open-end line of credit to purchase goods or services or as provided in § 1026.61 with respect to a hybrid prepaid-credit card.) (emphasis added). It also seems to ignore the TILA’s definition of “credit card,” which contemplates a physical device.

Regardless, once deemed a “credit card,” both open- and closed-end products have always been subject to various consumer protections set forth in Subpart B of Regulation Z. See, e.g., 12 C.F.R. § 1026.2(a)(17) (subjecting creditors offering “closed-end cards” to various provisions of Subpart B). This effectively means that, left unchallenged, BNPL providers offering “digital user accounts” will be required to: 1) investigate disputes from consumers as well as pause payment requirements during the investigation; 2) credit funds to consumers’ accounts for returned products or cancelled services; and 3) provide periodic billing statements.

While the Bureau is accepting comments on the interpretive rule until August 1, 2024, it also states that the interpretive rule as issued will become effective 60 days after publication in the Federal Register.

Our Take

This “interpretive rule” is a paradigm shift for the BNPL space that will require rapid and burdensome changes to businesses offering 0% APR products:

• Like the CFPB’s late fee rule, the timeline for compliance — 60 days from publication in the Federal Register — is extraordinarily brief considering the necessary programming and procedural changes to be made. The CFPB’s timeline will require a blistering pace that many BNPL providers will not be able to achieve for Fair Credit Billing Act (FCBA) compliance. This timeline will become even more unworkable if lenders must create and implement periodic statements and other potentially applicable requirements.
• There seem to be procedural problems with the rule making it ripe for challenge. It seems odd that the CFPB can make what we view as one of the most significant amendments to Regulation Z with a mere “interpretive rule.” Moreover, while the CFPB confirmed it is collecting comments, it suggests no revisions or further action may be made or taken if not “appropriate” or “warranted.” We fully expect industry challenges to the “rule” as a result.
• The CFPB’s policy rationale does not align with the FCBA and finds no support in the TILA. In our view, the CFPB fails to appreciate the reason the FCBA affords physical “credit cards” or “credit devices” special protections is that physical devices can easily be obtained, picked up, stolen, etc. and used by anyone. This is decidedly different than a BNPL product accessible via what the CFPB’s own “rule” describes as a “secure, personal profile.” Put another way, the key protections for physical credit cards exist because of how easily they can be stolen and/or misused. BNPL credit, on the other hand, generally requires a username, a password, and a number of other checks related to identity and fraud before any purchase.

We will continue monitoring this development and offering further commentary on our blog and podcasts.