The proposal would subject certain large non-bank companies offering wallet and payment services to federal regulatory oversight on par with banks and credit unions.

On November 7, 2023, the Consumer Financial Protection Bureau (CFPB) proposed a rule, Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications (the Proposal), to supervise large providers of digital wallets and payment apps. The Proposal aims to ensure that US-based non-bank financial service companies providing digital wallets and payment apps will be subject to the same federal supervisory rules as banks, credit unions, and other financial institutions that the CFPB already supervises.

According to the CFPB, fintech companies and other firms offering novel products and services in the consumer finance space have “blur[ed] the traditional lines of banking and commerce.” The Proposal therefore aims to “enable the CFPB to monitor for new risks to both consumers and the market,” and to “promote fair competition” through consistent enforcement between depository and non-depository institutions.

This Proposal is the sixth CFPB rulemaking (proposed or finalized) to clarify the scope of larger participants of markets for consumer financial products or services. It follows other rules related to consumer reporting, consumer debt collection, student loan servicing, automobile financing, and international money transfers.

General Applicability

The Proposal would only apply to “larger participants” of the payments market that provide over 5 million covered consumer payment transactions per year through a digital application for consumers’ general use in making consumer payment transactions.

The Proposal defines two types of covered payment functionalities:

1. Funds transfer functionality: Receiving funds for the purpose of transmitting them or accepting and transmitting payment instructions
2. Wallet functionality: A product or service that stores account or payment credentials (including in encrypted or tokenized form), and transmits, routes, or otherwise processes such credentials to facilitate a consumer payment transaction

General use transactions are defined as those that are free of significant limitations for the purpose of consumer payment transactions facilitated by the covered payment functionality. General use would therefore encompass most forms of person-to-person (P2P) and consumer-merchant fund transfers by or on behalf of a consumer to another US-based person for personal, family, or household purposes.

Exclusions

Larger-participant status would only apply to companies that do not qualify as a small business concern based on the Small Business Administration’s size standard.

The Proposal also excludes certain types of transactions, including the following:

• International payments or money transfers (e.g., remittances)
• Foreign exchange (conversion of US dollars for another currency)
• Certain purchases, sales, or exchanges of digital assets
• Transfers of funds for the primary purpose of buying or selling a security or commodity
• Payments that a non-bank processes for a consumer to buy goods or services from its own online or physical store or marketplace (e.g., loyalty apps)
• Consumer credit extensions, such as digital apps through which a non-bank lends money to consumers to buy goods or services

Implications

The Proposal sets forth that large non-bank companies that offer digital payments and wallet apps would be subject to applicable federal laws governing:

• consumer funds transfers (the Electronic Fund Transfer Act and its implementing Regulation E);
• consumer privacy (the Gramm-Leach-Bliley Act and its implementing Regulation P);
• unfair, deceptive, or abusive acts or practices (the Consumer Financial Protection Act); and
• executive conduct.

Under the Dodd-Frank Act, large non-bank digital consumer payment companies are subject to CFPB enforcement authority. Under the Proposal, however, they would be subject to heightened scrutiny via routine monitoring, requests for information, and on-site or off-site compliance examinations.

The Proposal’s enhanced oversight of larger participants would be operable alongside state oversight of money transmission by money services businesses. However, the CFPB will take into account “the extent of relevant state oversight” and pledged to “coordinate with appropriate State regulatory authorities in examining larger participants.”

The CFPB has set the minimum duration of “larger participant” designation at two years: “Any nonbank covered person that qualifies as a larger participant would remain a larger participant until two years from the first day of the tax year in which the person last met the larger-participant test.”

Application to Digital Assets

Under the Proposal, a “consumer payment transaction” includes digital assets that have monetary value and are readily useable for financial purposes. P2P or consumer-merchant transactions involving digital assets such as bitcoin, therefore, would be within scope unless some other exclusion applies.

The proposed rule’s broad definition of “funds transfer functionality” and “wallet functionality” could both potentially be interpreted to include non-custodial wallet services. Further, “accepting and transmitting payment instructions” could be viewed to include transmitting payment instructions to a blockchain. “Wallet functionality” includes storage of account credentials and processing such credentials to facilitate a consumer payment transaction which could be viewed to include storage and processing of private keys. Importantly, the proposal specifically states that the covered person does not actually need to ever hold the funds.

However, while the Proposal may technically encompass larger crypto wallet providers, these wallets are generally not being employed for fund transfers or consumer payments “primarily for personal, family, or household purposes.” As crypto adoption becomes more mainstream, however, wallet providers could exceed the threshold of 5 million covered consumer payments.

Advocates and Critics Respond

CFPB Director Rohit Chopra advocated for the Proposal, and stated that if finalized, it “would crack down on one avenue for regulatory arbitrage by ensuring large technology firms and other nonbank payments companies are subjected to appropriate oversight.”

Patrick McHenry, chairman of the House Financial Services Committee and consistent advocate for innovation in the US financial system, was critical of the Proposal. He stated that the CFPB was overreaching its congressionally determined supervisory authority, and that along with other recent CFPB actions “will only limit nonbanks’ ability to offer products and services consumers and small businesses rely on—eliminating choice and competition in our payments system.”

Maxine Waters, House Financial Services Committee Ranking Member, applauded the Proposal as a “critical step in ensuring that consumers everywhere are fully protected no matter if they use a traditional bank account or digital wallet to make payments.”

Conclusion

The CFPB estimated that if finalized, approximately 17 companies out of an overall market of over 190 non-bank providers would meet the Proposal’s transaction threshold, accounting for 88% of market share.

Although the US Supreme Court has yet to furnish its opinion on the CFPB’s rule-making authority, the CFPB continues to publish controversial Proposals and rules expanding its regulatory perimeter. Whether a judicial ruling or persistent legal challenges will delay implementation of this Proposal (or others) remains to be seen.

Firms that are squarely or peripherally within the CFPB’s sights under the Proposal should consider revised risk assessments and risk management measures.

The CFPB published the Proposal in the Federal Register on November 17, 2023 and requested comments by January 8, 2024.

Latham & Watkins will continue to monitor developments in this area.