On November 21, the Consumer Financial Protection Bureau (CFPB) finalized a rule to supervise nonbank companies that offer digital wallets and payment apps. The rule allows the CFPB to supervise and examine nonbank companies in the market for "general-use digital consumer payment applications" that handle more than 50 million transactions per year. The CFPB already has enforcement authority over these companies, but this rule now allows the CFPB to conduct examinations.
The CFPB has the authority to examine certain firms, including banks, credit unions, payday lenders, and nonbank mortgage companies. But it can also extend supervisory authority to larger nonbank entities. According to CFPB Director Rohit Chopra, digital payments have gone from "novelty to necessity" as consumers use payment apps for daily transactions at rates that rival or exceed the use of cash.
This move aligns with the CFPB's broader goal of strengthening oversight of technology companies in consumer finance. By expanding its supervisory authority, the agency aims to detect and address issues early, ultimately reducing consumer harm. The CFPB highlighted its intent to focus on areas such as data privacy, error resolution, fraud prevention, and "debanking" (account closures or freezes).
The Final Rule
The original proposal, released in November 2023, set the supervisory threshold at five million transactions. The CFPB increased this to fifty million in the final rule after considering comments that noted that many small and mid-size companies would be subject to supervision. Certain types of transactions, including international money transfers, extensions of consumer credit (initiated through a digital application provided by the entity who is extending, brokering, acquiring, or purchasing the credit), purchases for goods and services (when conducted through the seller's online or physical store or marketplace), and fundraiser donations (when conducted through a donation/fundraiser platform), do not count towards the 50 million transactions threshold.
In addition to the tenfold increase in the transaction threshold, the final rule limits the scope to count only transactions conducted in U.S. dollars. The CFPB decided to limit the rule to dollar-based transactions given the "evolving market for digital currencies."
Examination Expectations
Although the CFPB has not said when it will begin its examinations, it did give some insight into the scope of such exams. The agency explained that examiners may request compliance policies and procedures, review records for selected accounts, and conduct employee interviews to assess compliance with the law. The examination will also depend on the size and complexity of the company. The CFPB estimates that seven nonbank companies1 currently meet the rule's criteria, collectively processing over 13 billion transactions annually. Given the novelty of the rule and the operational complexity of these companies, it is unlikely that the first examinations will be a quick endeavor.
What's Next
The rule is effective 30 days after it is published in the Federal Register. However, the final rule is subject to the Congressional Review Act and may be considered by the new Congress. Additionally, technology companies or industry groups could challenge the rule in court, which may delay its enforcement.
Footnotes
1 The final rule did not explicitly mention any of the companies the CFPB expects to be subject to the rule, though it did reference PayPal, Venmo, and Cash App, among others.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
