.svg)
As financial technology continues to revolutionize how consumers transact, the U.S. Consumer Financial Protection Bureau (CFPB) has issued a final rule, “,” which grants the CFPB expanded supervisory authority over certain nonbank entities that facilitate significant volumes of consumer payment transactions, marking a pivotal development for the payments industry.
The Bigger Picture
The rule, finalized after a proposal and comment process launched in November of 2023, underscores growing concerns about the potential risks posed by nonbanks that play an increasingly necessary role in consumers’ financial lives. By supervising “larger participants” in the market, the CFPB aims to:
- Promote compliance with federal consumer financial laws.
- Detect and mitigate emerging risks tied to fraud, misuse of consumer data and financial losses.
- Բܰregulatory parity with insured banks and credit unions already subject to similar scrutiny.
Due to many nonbanks providing consumers with access to financial products and services through mobile phones and other portable devices, the CFPB stipulates that most consumers rely on the accessibility of these entities to seamlessly send and receive payments. According to the agency, approximately 76 percent of Americans have used at least one of the four most popular peer-to-peer payment apps as of July 2024.
The final rule provides a test for nonbank covered entities to determine whether they are larger participants of the general-use digital consumer payments application market. The rule applies to any nonbank entity that:
- Provides general-use consumer payment applications with an annual volume of at least 50m consumer payment transactions denominated in U.S. dollars.
- not a small business concern based on the applicable Small Business Administration (SBA) size standard.
Why Should You Care?
The CFPB’s final rule has significant implications for widely used tap-to-pay digital wallet providers like Apple Pay and Google Pay, and peer-to-peer payment apps like Venmo and Cash App, all of which facilitate billions of dollars in transactions annually.
The CFPB’s expanded oversight will include the ability to conduct proactive examinations wherein the agency may:
- Request to see a company’s existing compliance policies and procedures.
- Review a company’s records and operations.
- Conduct interviews with personnel.
- Assess how the company complies with applicable federal consumer financial laws.
This oversight ensures that nonbank entities providing essential financial services are held to standards comparable to those governing banks and other major lenders. Consumers stand to benefit from heightened protections against fraud, data misuse and inadequate error resolution practices. Meanwhile, nonbank companies may face increased compliance costs tied to CFPB examinations and adjustments to their operations to meet federal law requirements.
Next Steps
To prepare for the rule’s implementation, financial technology companies should:
- Evaluate applicability:
- Confirm whether the amount of transactions processed exceeds $50m annually.
- Determine whether the entity qualifies as a small business under SBA guidelines.
- Ensure adherence to federal consumer financial laws, including:
- ճ, which establishes a basic framework of rights, liabilities, and responsibilities of participants in the electronic fund and remittance transfer system.
- ճ, which requires financial institutions to provide certain privacy notices and to comply with certain limitations on the disclosure of nonpublic personal information to nonaffiliated third parties.
- Prohibitions on , wherein CFPB examiners review products or services to identify the risks of harm to consumers that are particular to those activities.
- Prepare for CFPB examinations by:
- Reviewing records containing customers’ sensitive information.
- Testing transactions and accounts for compliance.
- Evaluating the entity’s existing compliance management system.
As of December 6, 2024, the rule has not yet been published in the Federal Register. Once published, the rule’s provisions will take effect after 30 days.
