Consumer financial services at a crossroads: Payment processing

by White & Case LLP

White & Case LLP


Prepaid Card Rule update

The CFPB finalized changes to its rule on prepaid cards (Prepaid Card Rule) in January 2018 and delayed its compliance date to April 2019. The amended rule preserves significant restrictions on credit features and detailed disclosure requirements, while some burdens on industry participants have been alleviated. Notably, the rule now includes: (1) an exception for error resolution and limited liability requirements for unregistered prepaid accounts; (2) more flexibility for credit cards that are linked to digital wallets; (3) an exclusion from the rule for loyalty, award or promotional gift cards; (4) flexibility regarding the pre-acquisition disclosures for certain prepaid accounts; and (5) flexibility in submitting prepaid account agreements to the CFPB.2

“We don’t just work for the government, we work for the people, [for] those who use credit cards, and those who provide those cards.”
Acting CFPB Director Mick Mulvaney1

Pursuant to the Congressional Review Act (CRA),3 the CFPB is expected to submit a report to Congress containing the rule and any modifications prior to its effective date.4 Because the Prepaid Card Rule does not qualify as a “major rule” under the CRA5 and its original version survived a prior Senate challenge,6 we do not anticipate a push against the amended rule. It remains unclear, however, whether the CFPB’s new leadership will leave the rule intact, or instead seek to further delay or alter the rule’s requirements7 as part of the Bureau’s ongoing review of CFPB regulations.8

Deceptive practices by credit card companies

The CFPB has dedicated a significant portion of its supervisory efforts to address various consumer credit violations, including:

  • Inadequate account-opening disclosures
  • Misrepresentations to consumers as to the availability of free pay-by-phone options10
  • Misrepresentations to consumers concerning benefits and terms of credit card add-on products, such as the cost and coverage of optional debt cancellation add-on products
  • Failure to comply with billing error resolution and unauthorized transactions
  • Charging overdraft fees on ATM and one-time debit card transactions by misrepresenting to consumers opt-in deposit overdraft protection products

The CFPB also reached out to top retail credit card companies in June 2017 to encourage improved disclosure and transparency in their promotions, especially deferred-interest promotions.11 Moving forward, the CFPB will likely continue to closely monitor unfair and deceptive practices by credit card companies and address deficiencies through rulemaking rather than enforcement.

Fair access to credit

In recent years, the CFPB has devoted substantial attention to underserved communities’ fair access to credit. In 2017, the Bureau identified redlining as a primary concern12 and focused on the fair treatment of underserved communities regarding marketing and lending practices, which may also impact payment processors and card companies. The new CFPB leadership recently reaffirmed its commitment to protecting subprime consumers lacking access to credit markets.13 Furthermore, the repeal of the arbitration rule in November 2017 could lead the CFPB to search for other venues to protect consumers, and especially exercise enhanced scrutiny regarding practices affecting vulnerable populations.

Data security

The CFPB will likely continue to focus on payment processors’ data security practices. In October 2017, the CFPB issued its principles for protecting consumers who authorize third-party companies to access their financial data to provide a variety of financial products and services.14 Acting Director Mulvaney’s freeze of CFPB’s data collection until the Bureau resolves its own data security deficiencies may indicate a future interest in this topic.


Overall average debt increase of cardholding consumers (2015-2017)

Remittance rule

Although not likely a priority,15 the CFPB had noted in its last supervisory report that it would continue to examine both large banks and nonbanks for compliance with Regulation E concerning remittances.16 In March 2017, the CFPB sought public comments in order to assess the effectiveness of the remittance rule.17 No further developments have been announced in this area under the Bureau’s new leadership, and it remains unclear whether the rule will be reconsidered as part of the Bureau’s review of previously issued regulations.18


In 2017, the Bureau sanctioned two major payment processors that failed to effectively administer and transfer their customers’ accounts, resulting in thousands of consumers left without access to funds stored on their cards for days (or weeks), as well as paychecks or government benefits.19 In addition, the CFPB imposed a US$95 million fine on a leading credit card company that provided consumers in Puerto Rico, the US Virgin Islands, and other US territories with products and services that were inferior to those available in the continental US. Consumers in those territories were charged higher fees and interest rates, offered less advantageous promotional offers, denied credit and required to disburse more money to settle debts.


Debt increase for deep subprime cardholding consumers (2015-2017)
Source: CFPB Credit Card Market Report (2017)

Notably, the CFPB imposed a US$100 million fine—its largest fine so far—on a major financial institution, whose employees illegally opened more than two million unauthorized deposit and credit card accounts to boost sales figures and reach compensation incentives.20 Initiated in 2016, this enforcement action prompted the Bureau to release a compliance bulletin that same year, which described compliance management steps that supervised entities should take to mitigate risks posed by compensation incentives.20

The FTC has also been an active player in policing industry participants:

  • In June 2017, the FTC and the Florida Attorney General announced a nearly US$5 million settlement regarding an illegal robocall ring in which defendants promised to help consumers lower their credit card interest rates through worthless credit card interest rate reduction programs21
  • In March 2017, the FTC agreed to settle charges with a prepaid card provider for US$53 million,22 in connection with alleged deceptive statements to consumers regarding immediate access to funds stored on their prepaid cards when, in fact, the consumers were subject to substantial delays (e.g., weeks or indefinitely)23


In December 2017, the US Court of Appeals for the Eleventh Circuit found a payment processor jointly and severally liable for providing substantial assistance to another entity that violated a federal ban on improper telemarking practices. This decision followed a suit filed by the FTC in October 2012 and leaves the payment processor responsible for paying a US$1.7 million judgment with its co-defendants.24

In September 2017, the Attorney General’s Office for the Eastern District of Pennsylvania reached a US$3.6 million settlement with a major national bank and its affiliated payment processor to settle allegations that they illegally debited money for specific telemarketing and internet marketing merchants.25

Fintech outlook and payment processing

  • Fintech companies have developed AI-based regtech tools to improve fraud detection, identity theft, compliance with anti-money laundering laws, as well as with Know-Your-Customer requirements 
  • Regulators, however, have yet to accept AI technology as a legally sufficient method of detecting fraud and money laundering
  • Faster payments developments and the use of blockchain technology, still budding, and fintechs that develop around such changes could significantly change this market segment moving forward. Their challenge will also be to assimilate into a highly regulated space

Mick Mulvaney, Memo to CFPB Staff (Jan. 23, 2018),
2 CFPB, Executive Summary of the 2018 Prepaid Amendments (Jan. 25, 2018),

3 5 U.S.C. §§ 801 et seq. 
4 CFPB, Rules Concerning Prepaid Accounts Under the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z), at 198 (Jan. 25, 2018),

6 Lisa Lambert, U.S. Consumer Watchdog’s Prepaid-Card Rule Survives Congress Challenge, Reuters (May 11, 2017),
Gabriel T. Rubin, CFPB Moves to Revise Rules on Prepaid Cards, Mortgage Data, The Wall Street Journal (Dec. 22, 2017),
8 CFPB, Request for Information Regarding the Bureau’s Adopted Regulations and New Rulemaking Authorities (Mar. 14, 2018),
CFPB Supervisory Highlights, Issue 16 (Summer 2017),

10 CFPB further issued a Phone Pay Fee CFPB Bulletin 2017-01.
11 CFPB, Consumer Financial Protection Bureau Encourages Retail Credit Card Companies to Consider More Transparent Promotions (Jun. 8, 2017),
12 CFPB Supervisory Highlights, Issue 13 (Fall 2016), at 27-31,

_Issue_13__Final_10.31.16.pdf. Redlining is defined as intentionally discouraging prospective applicants in minority neighborhoods from applying to credit.
13 CFPB, Semi-Annual Report, at 5 (Apr. 2, 2018),
14 CFPB, Consumer Protection Principles: Consumer-Authorized Financial Data Sharing and Aggregation (Oct. 18, 2017),
15 CFPB’s last substantial look at the Remittance Rule was conducted in winter 2016. See CFPB Supervisory Highlights, Issue 10 (Winter 2016), at 11-14,
16 CFPB Supervisory Highlights, Issue 16 (Summer 2017), at 23-24,

17 CFPB, We Are Seeking Comment On Our Plan For Assessing The Remittance Rule (Mar. 17, 2017),
18 CFPB, Request for Information Regarding the Bureau’s Adopted Regulations and New Rulemaking Authorities (Mar. 14, 2018),
19 CFPB, CFPB Orders Mastercard and UniRush to Pay $13 Million for RushCard Breakdowns That Cut Off Consumers’ Access to Funds (Feb. 1, 2017),
20 CFPB, Compliance Bulletin 2016-03, Detecting and Preventing Consumer Harm from Production Incentives (Nov. 28, 2018),
21 FTC, FTC, Florida Attorney General Close the Book on Robocall Ring That Pitched U.S. Consumers Worthless Credit Card Rate Reduction Programs (Jun. 5, 2017), https:
22 FTC, NetSpend Settles FTC Charges (Mar. 31, 2017),
23 FTC, FTC Charges Prepaid Card Company Deceptively Marketed Reloadable Debit Card (Nov. 10, 2016),
24 Fed. Trade Commission v. WV Universal Management, LLC, et al., No. 16-17727 (11th Cir. Dec. 13, 2017),
25 Dep’t of Justice, U.S. Attorney’s Office Eastern District of Pennsylvania, U.S. Attorney Announces $3.6 Million Settlement With Bank Accused Of Consumer Fraud (Sept. 28, 2017),  


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© White & Case LLP | Attorney Advertising

Written by:

White & Case LLP

White & Case LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.