Late last year, we discussed the Consumer Financial Protection Bureau’s (CFPB or Bureau) proposed rule aimed at supervising larger technology companies offering digital wallets and payment apps. On November 21, the CFPB finalized this rule, which will bring significant changes to the oversight of nonbank digital payment companies. This final rule is set to take effect 30 days after its publication in the Federal Register.

The final rule targets nonbank companies that facilitate over 50 million consumer payment transactions annually. These companies, which include some of the largest technology firms, will now be subject to the CFPB’s supervisory authority, similar to large banks and credit unions. The CFPB estimates that seven nonbanks will be subject to the final rule, accounting for over 13 billion consumer payment transactions each year.

The rule will subject larger technology companies to supervision of existing financial services regulations, including, but not limited to, the following:

• Personal Financial Data Rights: The rule imposes requirements on how large technology companies collect and share data about individual transactions. It mandates that consumers be allowed to opt-out of certain data collection and sharing practices and prohibits misrepresentations about data protection practices.
• Regulation E: The rule establishes protocols for disputing incorrect or fraudulent transactions. The CFPB has highlighted concerns about the potential for digital payment apps to be used in fraudulent schemes, particularly targeting older adults and active-duty servicemembers. The rule seeks to ensure that these apps handle disputes directly rather than shifting responsibilities to banks and credit unions.
• Unfair, Deceptive, or Abusive Acts or Practices: The rule addresses issues related to consumers losing access to their payment apps without notice. It aims to prevent disruptions caused by account closures or freezes, which can significantly impact consumers who rely on these apps for daily transactions.

Changes from the Initial Proposal:

• The transaction threshold for supervision has been increased to 50 million annual transactions.
• The rule’s scope has been limited to transactions conducted in U.S. dollars, excluding the evolving market for digital currencies.

As we noted in our previous blog, the CFPB’s proposed rule aimed to close regulatory gaps and ensure that large nonbank digital consumer payment companies are subject to appropriate oversight. The final rule builds on this foundation by providing the CFPB with the authority to conduct proactive examinations and ensure compliance with federal consumer financial protection laws, such as the Electronic Fund Transfer Act, the Gramm-Leach-Bliley Act, and the Dodd-Frank Act’s prohibition against unfair, deceptive, and abusive acts and practices.

This rule is the sixth in a series of CFPB rulemakings to define larger participants in markets for consumer financial products and services. The first five rules covered larger participants in consumer reporting, consumer debt collection, student loan servicing, international money transfers, and automobile financing.

Our Take

The digital payment app rule became final at a time of uncertainty. President-Elect Trump is expected to replace Director Chopra early in his administration, which could lead to a shift in regulatory priorities and the rescinding of this rule. Another option would be to work with Congress, where Republicans appear to have narrow majorities in both the House of Representatives and the Senate. Under the Congressional Review Act (CRA), Congress can reject recent federal regulations within 60 legislative days by a simple majority vote in both chambers. Once CRA legislation is signed by the President, an agency is prohibited from issuing a substantially similar rule without explicit legislative authorization.

We will continue to monitor this rulemaking and posting updates.