On March 28, 2012, Georgia Governor Nathan Deal signed into law the Georgia Merchant Acquirer Limited Purpose Bank Act (the "Act"), which creates a new state charter for payment card merchant processors.1 The Act allows entities to be chartered as "merchant acquirer limited purpose banks" ("MALP Banks"), effectively allowing them to participate in payment card networks without having to engage in Bank Identification Number ("BIN") rental arrangements2 or be classified as a "bank."3 Under the Act, MALP Banks are eligible for federal deposit insurance coverage provided by the Federal Deposit Insurance Corporation ("FDIC"). This ties into the requirement imposed by payment card networks that members be "eligible" for FDIC insurance coverage, i.e., but not necessarily required to have such coverage in place to participate in the network.
For companies eschewing a rent-a-BIN arrangement, the MALP Bank charter appears to offer a new avenue to participate in payment card networks without enduring the lengthy and uncertain process of attempting to charter a de novo depository institution and obtain FDIC approval for federal deposit insurance coverage. However, the framework of the new MALP Bank charter raises numerous issues and questions. For example, prepaid card issuers electing to use a MALP Bank for their operations face the prospect of a potentially large pool of uninsured funds held in place for cardholders. Presumably, an issuer will have to make other arrangements to protect the prepaid pool, which could add new challenges and complexities for a prepaid card issuer. Another important issue is the reach and applicability of other federal and state banking and consumer protection laws to a MALP Bank, including laws under the jurisdiction of the Consumer Financial Protection Bureau ("CFPB") and state consumer protection and money transmitter licensing laws.
Overview of MALP Banks under the Act
Under the Act, a corporation that "performs merchant acquiring activities or settlement activities" in the State of Georgia can obtain a charter as a MALP Bank from the Georgia Department of Banking and Finance (the "GDBF").4 The Act requires a MALP Bank to have, within one year of receiving its charter, at least 50 employees in Georgia devoted to merchant acquiring activities, unless the MALP Bank contracts with an "eligible organization," which must have at least 250 employees in Georgia, to perform merchant acquiring activities, settlement activities or other specified activities, including administrative, information technology, and finance support.5 In addition, the Act requires a MALP Bank to maintain a minimum of $3 million in capital at all times.6
The Act also imposes significant restrictions on the ability of a MALP Bank to solicit and hold deposits. While a MALP Bank can accept deposits from a corporation that owns a majority of its shares, it cannot solicit or accept deposits from the general public, or accept "brokered deposits," as defined in FDIC regulations.7 Further, the Act specifies that deposits from a MALP Bank cannot be withdrawn by a depositor "by check or similar means for payment to third parties or others."8 Additionally, a MALP Bank must conduct its deposit-taking activities from a single location in Georgia.9 While a MALP Bank is authorized to apply for and receive deposit insurance coverage from the FDIC, it does not appear that doing so will enable the MALP Bank to expand its deposit-taking capabilities beyond the limitations imposed by the Act.10
In the aggregate, the Act's deposit-related restrictions are evidently intended, at least in part, to avoid having a MALP Bank's parent company being deemed a "bank holding company" subject to the limitations and restrictions of the Bank Holding Company Act ("BHCA"). In this regard, a MALP Bank will not be deemed a "bank" (and its parent not a "bank holding company") for purposes of the BHCA either because the institution is not an FDIC-insured bank or by virtue of the BHCA credit card bank exception upon which the requirements of the Act appear to be tailored.
New Opportunity to Participate in Payment Card Networks
For firms seeking to enter a payment card network, the MALP Bank presents a new opportunity to do so without having to engage in a Rent-a-BIN arrangement or form a de novo bank. Both approaches present issues and special challenges. Many banks are reluctant to structure or model a Rent-a-BIN arrangement due to concerns that the bank may not have sufficient controls over the nonbank partner's activities with respect to use of the BIN.11 Similarly, entering the payment card market through formation of a de novo bank has been exceedingly difficult recently.12
Potential Risks for Prepaid Card Networks and Card Issuers
One possibility for use of the charter is the issuance of prepaid cards. The presence of a MALP Bank in a prepaid card network, however, may present unique challenges as well as additional risks shared with other card issuers in the network. Prepaid funds held by a prepaid card issuer on behalf of customers are typically "deposited" by the issuer in one or more pooled accounts insured by the FDIC. If a MALP Bank is the issuer and does not have FDIC insurance coverage, customer prepaid funds may be exposed. There are several solutions for a MALP Bank issuer to address this deficiency, including collateralizing the deposited funds and/or structuring deposit placements at third party insured depository institutions (which may be deemed brokered deposits at such institutions) to obtain federal deposit insurance coverage. These arrangements, however, could raise potential safety and soundness considerations regarding the potential impact on the availability and security of customer funds.13 These are among the significant issues that the GDBF will have to consider in its efforts to implement the Act.
Additional Issues under Federal and State Banking Laws
There are numerous other issues to consider under various federal and state banking and related laws in connection with the formation of a MALP Bank. For example, a newly-chartered MALP Bank could draw the attention and scrutiny of the CFPB, which has significant authority over federal consumer financial laws, including the consumer credit and prepaid card markets, which the CFPB has identified as markets subject to its "larger participant" nonbank supervision program.14 Depending on the size and extent of a MALP Bank's consumer financial activities and operations, it could also draw the attention of the Georgia and other State Attorneys General. Thus, while a MALP Bank may avoid jurisdiction of the Federal Banking Agencies, the CFPB's and State AGs' consumer protection interests could raise significant issues.
In structuring a progam, a MALP Bank will also have to consider developing policies and procedures to conduct its operations in conformity with existing (and potentially applicable) laws; manage and oversee the activities of any third-party vendor organizations that provide services to the MALP Bank (in much the same manner as insured depository institutions must do); and be mindful of other sensitive consumer compliance areas, such as data protection and rules applicable to the privacy of consumer financial information.15 Other important areas are compliance with Bank Secrecy Act and anti-money laundering ("BSA/AML") laws, and compliance with the economic and trade sanctions issued by the Office of Foreign Assets Control, or OFAC. Finally, a potential state law issue is the applicability of state money transmitter laws.
Other Potential Risks
From a practical perspective, merchant processing is a high-volume, low-margin business. This means that firms seeking to enter payment card networks as MALP Banks must be prepared to maintain the necessary cost controls to compete with the aggressive pricing and economies of scale that existing banks functioning as merchant acquirers have developed. A MALP Bank will need to develop an effective pricing model that takes into account factors such as the risks posed by merchants, transaction volumes, and maintaining adequate internal controls to monitor and guard against fraud and operational system breakdowns. Another potential concern is the risk posed by the statutory limits imposed by the Act on a MALP Bank, including what appears to be an extremely narrow and tightly controlled operating environment.
There are also multiple risks posed by third parties and vendor relationships, including with respect to many of the compliance issues noted above. To manage these risks, a MALP Bank will need to develop effective screening processes to identify potentially risky vendors prior to allowing them to service the MALP Bank. For third parties already supporting a MALP Bank, a strong vendor management program will be required, including onsite inspections and audits to maintain and monitor ongoing controls.
Another consideration for a MALP Bank will be effective merchant screening and monitoring to prevent significant chargeback losses that could deplete capital and earnings. At the front-end, this will involve a formal merchant underwriting and approval process to allow a MALP Bank to identify creditworthy merchants that do not experience a high volume of chargebacks. Once a merchant is serviced by the MALP Bank, the Bank must have an effective antifraud system to monitor the merchant's daily activity, including for daily sales volume, average ticket size, and percentage of transactions keyed versus swiped. Additionally, a MALP Bank will need to engage in periodic monitoring of a merchant's financial condition. Because of the potentially high volume of transactions in a payment card network, the minimum $3 million capital requirement imposed by the Act will likely not be sufficient to support the level of risk posed by a large MALP Bank, especially if there is significant off-balance sheet risk arising from fraud and chargeback exposure. While insurance could be purchased to protect against excessive charge-backs, this could also be a costly solution.
Next Steps
The GDBF is currently working on regulations to implement the Act, including how its statutory requirements will be applied and how many of the above issues and complexities will be addressed. These issues present significant challenges and will require the GDBF carefully to consider a number of competing concerns, including the scope of the charter and extent of regulatory limits imposed on use of the charter, capital levels tailored to address risks presented by MALP Bank activities and operations, the appropriate examination and supervisory regime required to oversee MALP Banks, and particular issues related to information technology risks and consumer protection.
Conclusion
Where a rent-a-BIN arrangement is not a viable option, the Georgia MALP Bank charter may provide a company the opportunity to participate in a payment card network even though it lacks FDIC deposit insurance coverage. This offers significant promise given the substantial obstacles that exist to getting FDIC insurance coverage, but also presents unique issues with respect to the protection of cardholder funds processed through a MALP Bank. At the same time, this poses potential challenges for any card payment networks in which a MALP Bank participates. Other important issues involve the reach and applicability of federal and state banking and consumer protection laws, jurisdiction of the CFPB, BSA/AML and OFAC compliance, and state money transmitter laws to a MALP Bank. Clearly, the Georgia legislature intended the new charter to serve a purpose that it views as not currently being met, but it remains to be seen how the GDBF will allow the new MALP Bank charter to operate and expand. Key issues remain to be worked out, both with respect to the new law and the extent to which payment card systems will encourage or resist MALP Bank participation. We view the optimal resolution of these issues involving a collaborative approach among the GDBF, potential new MALP Banks, and payment card networks, which would involve actions that further the legislative intent and assist a regulatory process that develops acceptable solutions to all stakeholders.
Footnotes
1 See O.C.G.A. § 7-9-1 et seq. The text of the act is available online at http://www.legis.ga.gov/legislation/en-US/display/20112012/HB/898 .
2 A description of a so-called "Rent-a-BIN" arrangement is provided in the FDIC's Risk Management Examination Manual for Credit Card Activities, Ch. XIV (March 2007).
3 Id at § 7-9-3.
4 The Act defines "merchant acquiring activities" as "various activities associated with effecting transactions within payment card networks, including obtaining and maintaining membership in one or more payment card networks; signing up and underwriting merchants to accept payment card network branded payment cards; providing the means to authorize valid card transactions at client merchant locations; facilitating the clearing and settlement of the transactions through a payment card network; providing access to one or more payment card networks to merchant acquirer limited purpose bank affiliates, customers, or customers of its affiliates; sponsoring the participation of merchant acquirer limited purpose bank affiliates, customers, or customers of its affiliates in one or more payment card networks; and conducting such other activities as may be necessary, convenient, or incidental to effecting transactions within payment card networks" and "settlement activities" as "the processing of payment card transactions to send to a payment card network for processing, to make payments to a merchant, and, ultimately, for cardholder billing." Id at § 7-9-3.
5 Id at § 7-9-4.
6 O.C.G.A. § 7-9-11.
7 Id at § 7-9-12(a).
8 Id.
9 Id at § 7-9-12(b).
10 Id at § 7-9-12(c).
11 For example, a partner that does not adhere to applicable laws, guidance, and regulations, or that experiences financial difficulties, could expose a bank to significant operational and reputation risks, as well as funding, liquidity and/or credit risks for charges the partner cannot fund and the bank must cover.
12 As those that have tried can attest, the regulatory application and approval process for obtaining a de novo bank charter and accompanying federal deposit insurance is arduous and, most often, unsuccessful. In fact, the FDIC has approved only one new application for deposit insurance in the last three years.
13 As a general rule, national banks are prohibited from collateralizing private deposits unless otherwise permitted by law. See 12 C.F.R. § 31 Appendix A. Private deposits include both retail or individual depositors and institutional or corporate depositors. While state banks may collateralize private deposits if permitted by state law, they can only do so with the permission of the FDIC, which it is unlikely to grant. See 12 U.S.C. § 1831a.
14 See 78 Fed. Reg. 38059 (June 29, 2011).
15 See Regulation P, 12 C.F.R. § 216.
The content of this article does not constitute legal advice and should not be relied on in that way. Specific advice should be sought about your specific circumstances.
