CFPB Approves Rule for Federal Oversight of Digital Payment Apps

The Consumer Financial Protection Bureau (CFPB) approved a new rule today that will subject nonbank digital payment companies to federal oversight, aiming to ensure the security of personal data, reduce fraud, and prevent illegal “debanking.”

This rule specifically targets large digital payment companies—those handling more than 50 million transactions annually—to align their obligations with those of banks, credit unions, and other financial institutions already under CFPB supervision. According to the CFPB, the largest digital payment apps collectively process over 13 billion consumer payment transactions each year.

Many of these apps are owned by major tech corporations, which, unlike banks and credit unions offering similar services, have not previously been subject to CFPB supervision. This rule is a response to growing consumer complaints and the CFPB’s broader inquiry into Big Tech platforms providing payment services.

The new rule empowers the CFPB to supervise these companies in key areas, including:

• Privacy and Surveillance: Tech companies collect vast amounts of transaction data. Federal law mandates transparency in data protection policies, prevents misleading practices, and allows consumers to opt out of certain data collection practices.
• Errors and Fraud: Federal law protects consumers by requiring financial institutions to investigate fraudulent or incorrect transactions. The CFPB has found evidence of these apps being used to exploit vulnerable populations, including elderly individuals and active servicemembers. Previously, these companies often shifted dispute resolution responsibilities to other financial institutions. Under the new rule, they must handle disputes directly in compliance with federal law.
• Debanking: Consumers relying on these apps for transactions can face significant disruption if access is suddenly restricted. The CFPB has received numerous complaints about how such disruptions have affected consumers’ daily lives.

Digital payment apps, such as PayPal, Venmo, CashApp, Zelle, Google Pay, and Apple Pay, have become integral to modern commerce, rivaling debit and credit cards in both in-store and online transactions. Once viewed as a convenient novelty, these apps now process more than $1 trillion annually.

Although the CFPB previously had enforcement authority over these companies, the new rule allows the agency to conduct proactive examinations to ensure compliance with federal law. By identifying issues early, the CFPB aims to mitigate risks and protect consumers.

Modifications to the Final Rule

Several adjustments were made to the CFPB’s initial proposal, including:

• Raising the transaction threshold to 50 million annual transactions to determine which companies are subject to the rule.
• Limiting the rule’s scope to transactions conducted exclusively in U.S. dollars.

This move builds on the CFPB’s ongoing efforts to regulate large tech companies in consumer financial markets. Over the past two years, the CFPB has issued warnings against behavioral targeting for financial products, advised consumers to ensure their funds are held in insured accounts, and published research on Apple and Google’s regulations in the “tap-to-pay” market.

This rule is the sixth in a series of CFPB measures aimed at defining key players in consumer financial markets. Previous rules have addressed consumer reporting, debt collection, student loan servicing, international money transfers, and automobile financing.

The rule will take effect 30 days after its publication in the Federal Register.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.