CFPB Proposes Federal Oversight of Digital Wallet and Payment App Providers

Updates

December 04, 2023

CFPB Proposes Federal Oversight of Digital Wallet and Payment App Providers

The Consumer Financial Protection Bureau (CFPB) published a proposed rule on November 7, 2023, that, if finalized, would subject to its supervisory authority certain Big Tech firms and other nonbank companies operating in the payments sphere.

[1] The proposed rule would bring under the CFPB's supervisory jurisdiction "larger participant" nonbank companies that facilitate at least five million annual "covered consumer payment transactions" through digital wallets, payment applications, and other "covered payment functionalities."

Although the CFPB already has enforcement authority over these companies, "the CFPB has not previously had, inside many of these firms, examiners carefully scrutinizing their activities to ensure they are following the law and monitoring their executives."[2] If the proposed rule is finalized, these companies would become subject to CFPB supervision and, at the CFPB's discretion, to CFPB examination. Comments are due on or before January 8, 2024.

This Update summarizes the proposed rule and discusses the potential implications for participants in the U.S. consumer financial services market.

Background

In the United States, companies offering payment and peer-to-peer (P2P) transfer functions are federally regulated as money services businesses. Unlike banks, which are supervised by one of the three federal banking agencies, money services businesses are not supervised by a federal prudential bank regulatory agency. Instead, money services businesses are supervised by the agencies of the states in which they are licensed and subject to registration with and oversight by the Financial Crimes Enforcement Network (FinCEN) and examination by the Internal Revenue Service (IRS) (based on delegated authority from FinCEN).

In recent years, policymakers have questioned whether this framework is sufficient to mitigate existing or future risks, particularly for the Big Tech companies involved in payments. For instance, the Bank for International Settlements (BIS), an international financial body that influences financial services policies globally, has implicitly criticized the current approach, noting that "the current licensing requirements on payment service providers … were formulated with small remittance service providers in mind and will fall short of addressing the very different and far-reaching challenges associated with dominant big tech platforms."[3] CFPB Director Rohit Chopra has referred to banking, money, and payments as "essential facilities" akin to critical infrastructure like transportation and telecommunications.[4] The CFPB also views certain Big Tech players and other payment firms as "dominant" or "gatekeepers" in the payments ecosystem, leading to agency questions about surveillance and monetization of customer transaction data, the blurring of lines between technology companies and finance, and competition in the marketplace.[5]

In response, the CFPB has undertaken a series of actions to "carefully monitor the entry of large technology firms, including Big Tech giants, into consumer financial markets."[6] In October 2021, the CFPB ordered six technology platforms offering payment services to provide information about their products, plans, and practices for consumer payments.[7] The CFPB also collected information from other sources, which informed reports highlighting risks of "super-apps"[8] and the impact of Big Tech companies in the mobile payments space.[9] The proposed rule is the latest—and most significant—action in the CFPB's ongoing effort.

The Proposed Rule

Under the Dodd-Frank Act, the CFPB has the authority to supervise "larger participant[s] of a market for other consumer financial products or services" as the CFPB defines by rule.[10] The CFPB has previously asserted supervisory authority over larger participants in five other markets: consumer reporting, consumer debt collection, student loan servicing, international money transfers, and automobile financing. The proposed rule would bring larger participants of a sixth market—the market for "general-use consumer payment applications"—under the CFPB's supervisory jurisdiction, and they would be subject to examination by the CFPB at its discretion.

Supervision may involve requests for information or records, on-site or off-site examinations, or some combination of these activities. The specifics of an examination may vary by market and by firm. Typically, CFPB officials begin an on-site examination by contacting the firm for an initial conference with management, and often by also requesting records and information. Based on these discussions and an initial review of the information received, examiners will determine the scope of an on-site examination and coordinate with the firm to initiate the on-site portion of the examination. While on site, examiners will hold discussions with management about the company's processes and procedures; review documents, records, and accounts for compliance; and evaluate the firm's compliance management systems. As with the CFPB's bank examinations, examinations of nonbanks will involve issuing confidential examination reports and compliance ratings.

The CFPB's supervisory authority is not limited to the products or services that qualified a company for supervision, but also includes other company activities that involve other consumer financial products or services or are subject to federal consumer financial law.[11] If an entity is a "larger participant" under the proposed rule, the CFPB may examine the entire entity for compliance with all federal consumer financial law, assess enterprise-wide compliance systems and procedures, and assess and detect risks to consumers or to markets for consumer financial products and services posed by any activity of the entity.[12] As a result, a Big Tech company deemed a larger participant that conducts its money transmission activities through a state-licensed affiliate may also be subject to CFPB supervision of a lending product offered by a different affiliate of the parent company.

Larger Participant Threshold and Market Definition

The proposed rule would define a class of providers of general-use digital consumer payment applications as "larger participants" of a market for "general-use digital consumer payment applications" and thereby authorize the CFPB to undertake supervisory activities with respect to those providers.

Larger Participant Threshold

The proposed rule would use a two-pronged test for determining "larger participant" status. First, the proposed threshold for larger-participant status would be any entity whose transaction volume meets or exceeds five million "annual covered consumer payment transaction[s]." Second, the proposed test would incorporate a small entity exclusion. As a result, larger-participant status would only apply to a provider that, together with its affiliated companies, both meets the proposed five-million-transaction threshold and is not a small business concern based on the applicable Small Business Administration (SBA) size standard.

Market Definition

The proposed rule would define the market for "providing a general-use digital consumer payment application" to mean "providing a covered payment functionality through a digital application for consumers' general use in making consumer payment transaction(s)." This definition relies on other defined terms, which are summarized below.

"Providing a covered payment functionality…." The proposed rule would define two types of payment functionalities as "covered payment functionalities": a "funds transfer functionality" and a "wallet functionality."[13]
- "Funds transfer functionality." Either (1) receiving funds for the purpose of transmitting them or (2) accepting and transmitting payment instructions.
- "Wallet functionality." A product or service that both (1) stores account or payment credentials, including in encrypted or tokenized form, and (2) transmits, routes, or otherwise processes such stored account or payment credentials to facilitate a consumer payment transaction.
"…Through a digital application…." A software program accessible to a consumer through a personal computing device, including but not limited to a mobile phone, smart watch, tablet, laptop computer, or desktop computer.
"…For consumers' general use…." No significant limitations on the purpose of consumer payment transactions facilitated by the covered payment functionality provided through the digital consumer payment application. For example, general use encompasses most forms of consumer payments for personal, family, or household purposes, including products and services like digital wallets, payment apps, funds transfer apps, and person-to-person apps.
"…In making consumer payment transaction(s)." The transfer of funds by or on behalf of a consumer physically located in a "state" (including U.S. states, territories, possessions, and the Commonwealth of Puerto Rico) to another person primarily for personal, family, or household purposes. The term applies to transfers of consumer funds and transfers made by extending consumer credit, except for the following four categories of transactions:
- "International Money Transfers," as defined in the CFPB's "Defining Larger Participants of the International Money Transfer Market" Rule.[14]
- A transfer of funds by a consumer that (1) is linked to the consumer's receipt of a different form of funds,[15] such as a transaction for "foreign exchange"[16] or (2) is a securities or commodity transfer excluded from the definition of "electronic fund transfer"[17] under Regulation E.
- A payment transaction conducted by a person for the sale or lease of goods or services that a consumer selected from an online or physical store or marketplace operated prominently in the name of such person or its affiliated company.
- An extension of consumer credit that is made using a digital application provided by the person who is extending the credit or that person's affiliated company.

Considerations for Firms Potentially Affected

The CFPB has identified 17 firms that would be "larger participants" under the proposed rule. According to the CFPB's estimates, the approximately 17 providers of general-use digital consumer payment applications that meet the proposed threshold collectively facilitated about 12.8 billion transactions in 2021, with a total dollar value of about $1.7 trillion. The CFPB estimates that these nonbanks are responsible for approximately 88% of known transactions in the nonbank market for general-use digital consumer payment applications.

If the proposed rule is finalized, the CFPB would notify these entities of their status at the time the CFPB initiates supervisory activities (e.g., information requests, examinations, etc.). Any firms seeking to dispute the "larger participant" status (and CFPB supervisory jurisdiction over their firm) would have 45 days to provide documentary evidence to the CFPB that they are not "larger participants" under the rule. For example, firms could provide data that they are "small business concerns" or data showing that they have fewer than five million "annual covered consumer payment transactions" in accordance with the market-related definitions of "consumer payment transactions," "covered payment functionality," "general use," and "digital application."

The CFPB has requested comment on all aspects of the proposed rule with a deadline of January 8, 2024. Because of the challenges inherent in rebutting a "larger participant" determination, the comment period represents the best remaining window for firms to express concerns and offer suggested changes.

Endnotes

[1] CFPB, "Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications" 88 Fed. Reg. 80,197 (Nov. 17, 2023) (Proposed Rule).

[2] Press Release, "CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps" (Nov. 7, 2023) (Larger Participant Rule Press Release).

[3] Agustín Carstens et al., "Regulating Big Techs in Finance" BIS, BIS Bulletin, no. 45 (2021), p. 7.

[4] CFPB, "Prepared Remarks of CFPB Director Rohit Chopra at the Brookings Institution Event on Payments in a Digital Century" (Oct. 6, 2024).

[5] Id.

[6] See Larger Participant Rule Press Release.

[7] Press Release, "CFPB Orders Tech Giants to Turn Over Information on their Payment System Plans" (Oct. 21, 2021).

[8] CFPB, "The Convergence of Payments and Commerce: Implications for Consumers" (Aug. 4, 2022).

[9] CFPB, "Big Tech's Role in Contactless Payments: Analysis of Mobile Device Operating Systems and Tap-to-Pay Practices" (Sept. 7, 2023).

[10] See 12 U.S.C. 5514(a)(1)(B), (a)(2).

[11] See 77 Fed. Reg. 42,874, 42,880 (July 20, 2012).

[12] Id.

[13] If a nonbank covered person provides a covered payment functionality a consumer may access through a digital application provided by a bank or credit union, the Proposed Rule would only apply to the nonbank. Depository institutions and credit unions are not subject to the CFPB's larger participant rules.

[14] 12 C.F.R. § 1090.107(a) (definition of "international money transfer").

[15] The purchase of a crypto-asset using fiat currency, the sale of a crypto-asset in which the seller receives fiat currency in return, or the exchange of one type of crypto-asset for another type of crypto-asset, would not qualify as "consumer payment transactions" for purposes of the Proposed Rule because they would fall within this categorical exclusion.

[16] See 12 U.S.C. § 5481(16) ("The term "foreign exchange" means the exchange, for compensation, of currency of the United States or of a foreign government for currency of another government.").

[17] See 12 C.F.R. § 1005.3(c)(4) ("The term "electronic funds transfer" does not include…any transfer of funds the primary purpose of which is the purchase or sale of a security or commodity, if the security or commodity is: (i) Regulated by the Securities and Exchange Commission or the Commodity Futures Trading Commission; (ii) Purchased or sold through a broker-dealer regulated by the Securities and Exchange Commission or through a futures commission merchant regulated by the Commodity Futures Trading Commission; or (iii) Held in book-entry form by a Federal Reserve Bank or Federal agency.").