In the ever-evolving world of financial services regulation, few areas are poised for more dramatic change over the coming months and years than payments regulation. Whether one considers continued state adoption of the Conference of State Bank Supervisors ("CSBS") Model Money Transmission Modernization Act (the "Model Act")1 or the expected decrease in federal regulatory scrutiny under the second Trump administration, it is clear that significant change is in store for the payments industry on both the state and federal level. This article discusses emerging trends in the payments industry and forecasts the development of payments law over the coming months and years.
I. State Law Developments and The Model Act
One major factor driving the development of payments law in recent years has been the adoption of the Model Act, in whole or in part, by several states. The Model Act is a uniform law released in 2021 by the CSBS, with input from a working group constituted of industry participants and regulators. The Model Act is intended to standardize and harmonize the regulation of companies subject to state money transmission laws.
Currently, every state other than Montana has a state law regulating companies engaged in money transmission. While the scope and coverage of these laws varies, they generally require persons engaged in receiving money for transmission or otherwise facilitating payments on behalf of others to be licensed in each jurisdiction where they have customers. Furthermore, regulations promulgated by the federal Financial Crimes Enforcement Network require any person acting as a "money services business" to register and comply with various requirements, including the obligation to maintain an anti-money laundering ("AML") compliance program.
As such, companies engaged in offering certain payments services nationwide must obtain licensure and comply with specific legal requirements in 49 states, several U.S. territories, and under federal law. However, the coverage and requirements of these state laws vary, and a 50-state analysis is often required to determine whether and how these laws apply to specific companies and business models. This lack of uniformity leads to heightened compliance costs, uncertainty as to the applicability of individual state laws and a fragmented regulatory regime.
While the continued adoption of the Model Act is a positive development for regulated entities seeking a uniform framework for payments regulation throughout the country, the fragmented regulatory regime remains, and even states that have adopted the Model Act have taken disparate approaches to various key issues. The following discusses some of these key issues.
II. Differing Treatment of Digital Currency
One example of an area in which payments regulation has been uneven is the coverage of digital currency and digital assets under state money transmission laws. As most, if not all, state money transmitter laws predated the rise of Bitcoin and other digital currencies, many existing laws are unclear on whether entities transmitting digital currency are subject to state licensing requirements and other legal requirements.
To respond to this uncertainty, some states, including Connecticut, Georgia and Washington, have amended their state money transmitter laws to expressly include digital currency. Others, including Louisiana and New York, have passed separate licensing regimes for companies engaging in digital currency business activities. The Model Act, following the approach of states like Georgia, includes an article that regulates digital currency business activity under existing money transmitter laws.
Instead of amending their laws, a few states, including Pennsylvania and Idaho, have published regulatory guidance specifying that transmission of digital currency is regulated under state money transmitter law. And others simply have broad, open-ended statutes that require any person engaged in transmitting "money" or "monetary value" to obtain a license, and courts and regulators may interpret such terms to include digital currency.
Given these disparate approaches, digital currency businesses must pay careful attention to developments in state law and obtain sound legal advice prior to conducting business with customers in the United States. Even in states that cover digital currency, there may be lack of clarity as to whether certain products constitute digital currency and a detailed analysis of the products, their function and control considerations must be performed for certain types of instruments.
A. Exemptions
Often, the first question when a company is considering whether it is subject to state money transmission requirements is whether it conducts the threshold activities to subject it to regulation in a given state. If the answer to that question is "yes," the next question is often whether it qualifies for an exemption from regulation. While most states exempt certain entities (e.g. banks, credit unions, and other depository institutions) from money transmission requirements, some states have unique exemptions that are not recognized in other states. The following discusses two such unique exemptions.
1. Agent of the Payee
In recent years, certain states have amended their money transmitter laws or published guidance providing that persons appointed to transmit payments as an "agent of the payee" are exempt from state law requirements if certain conditions are met. While the conditions vary by state, generally for an entity to qualify for the exemption there must be a written agreement between the entity and the payee (in this case the seller) appointing the entity to collect payments on the payee's behalf and payment must be treated as received by the payee upon receipt by the entity. Although this is a fluid situation, as of this writing about half of the states recognize the agent of the payee exemption. The Model Act includes the agent of the payee exemption, and as such continued adoption of the Model Act is likely to increase the availability of the exemption throughout the country.
However, even if there is significant progress towards uniformity on this front, it is likely that a significant portion of states will continue not to recognize the exemption. States that adopt the Model Act are free to pick and choose the exemptions and other provisions they would like to adopt, and as such even some states that adopt the Model Act will likely choose not to adopt the exemption. And other states will likely not consider adopting the Model Act at all. Accordingly, while companies that carefully structure their payment services to qualify for the agent of the payee exemption can lessen their licensing and compliance obligations, the exemption is not a panacea and likely will not be for the foreseeable future.
2. Agent of an Exempt Entity
As mentioned above, certain categories of regulated financial institutions are exempt under most, if not all, state money transmitter laws. For example, banks, credit unions, bank holding companies, and securities broker-dealers, among others, are generally not required to obtain money transmission licenses, and exemptions for these entities are relatively uniform throughout the country. However, states differ on whether third parties appointed to transmit payments as a service provider or an agent of an exempt entity are themselves exempt from state money transmitter laws.
Although a number of states have historically exempted agents of an exempt entity, this is yet another area of inconsistent coverage. The Model Act provides that an agent of an exempt entity is not subject to the Act, provided (1) the agent is engaging in money transmission on behalf of and pursuant to a written agreement with the exempt entity that sets forth the specific functions that the agent must perform; and (2) the exempt entity assumes all risk of loss and all legal responsibility for satisfying the outstanding money transmission obligations owed to customers upon receipt of the customer's money or monetary value by the agent.
In states that recognize the agent of an exempt entity exemption, companies that wish to minimize their compliance and licensing burdens can seek to do so on behalf of a bank, credit union or another regulated financial institution. However, similar to the agent of the payee exemption, this structure will only be viable in certain jurisdictions. Also, financial institutions will often require their agents and service providers to undergo comprehensive due diligence and take on a variety of obligations to support the institution's compliance program. As a result, companies seeking to operate as an agent of such institutions may find that this exemption is not a complete solution for alleviating their compliance burdens.
III. Federal Regulatory Pullback
A. CFPB Rules and Enforcement a Thing of the Past?
Under the second Trump administration, most commentators have predicted a pullback in federal regulatory activities, including at the Consumer Financial Protection Bureau ("CFPB") and the federal banking agencies. While it remains to be seen whether Elon Musk will accomplish his stated goal to "delete" the CFPB entirely, it is a virtual certainty that a wide variety of financial services activities will face a decidedly less perilous regulatory environment on the federal level over the next few years, and the payments industry is no exception.
The Trump administration wasted no time in dramatically reshaping the CFPB, including with respect to various payments-related priorities of the prior administration. In March, the CFPB dropped a lawsuit against several large banks for failing to prevent fraud on the Zelle payment platform co-owned and operated by the banks. On May 9, the CFPB issued a notice withdrawing nearly 70 guidance documents, interpretive rules, policy statements, and advisory opinions issued since the agency was established in 2011. Additionally, on the same day, President Trump signed into law a Congressional Review Act resolution disapproving of the CFPB's larger participant rule subjecting certain companies offering digital funds transfer and payment wallet apps to CFPB supervision. The list of regulatory requirements rolled back under the new administration is likely to grow over the coming months and years.
B. State Regulators to Fill the Gap?
With the CFPB and other federal regulatory agencies expected to adopt a "light touch" supervision and enforcement posture under the Trump administration, many have speculated that states may step up to fill the perceived regulatory vacuum. In fact, in January, the CFPB issued a Report urging states to take various steps to strengthen state-level consumer protections in light of this dynamic. Among other things, the Report recommends that states expand their unfair and deceptive practices statutes to prohibit "abusive" practices, similar to the Dodd-Frank Act.2 Similarly, the Report calls on states to expand the remedies and tools available to state agencies to combat consumer protection law violations. To this end, New York is considering an amendment to its longstanding consumer protection law prohibiting deceptive business acts and practices. If passed, the law would additionally prohibit unfair and abusive conduct, mirroring the CFPB's authority.
With the mass exodus of staff from the CFPB and other federal regulators, some expect that state financial services regulators will seek to hire CFPB officials and staff. For example, in March, the New York Department of Financial Services announced that it had hired Gabriel O'Malley, the former Deputy Enforcement Director for Policy and Strategy at the CFPB, to head its Consumer Protection and Financial Enforcement Division.
Also, in February the attorneys general of 23 states filed an amicus brief in a lawsuit brought by the city of Baltimore in Maryland federal court seeking to enjoin the Trump administration from defunding the CFPB, calling the agency "a critical watchdog." In March, the court denied Baltimore's motion for a preliminary injunction in the suit, finding that the city had failed to demonstrate a likelihood of success on the merits of its claims. The parties continue to litigate the case in Maryland federal court. Government agencies, particularly in blue states, are expected to continue to support attempts by other litigants to prevent or slow the federal deregulatory push and to try to step in to "fill the gap" left by more lax federal enforcement.
C. Bank-Fintech Relationships
Relationships between banks and financial technology companies ("Fintechs"), including banking-as-a-service ("BaaS") relationships, will also likely continue to play a major role in the future of digital payments. The increase in partnerships between banks and Fintech companies has led to significant innovation in financial services and the distribution of such services to end users. Banks sponsor or contract with Fintechs to help provide a variety of financial services, including payment services, consumer and commercial loans, and BaaS. Most Fintechs typically need a bank partner to some extent, including to receive, hold, and transfer funds, to minimize licensing burdens and other risks for the Fintech, and to help ensure compliance with payment card network requirements.
Some more successful and tested Fintechs have begun to obtain money transmitter licenses nationwide, as such mature players can meet the costs and burdens of compliance. This provides companies with more flexibility in providing digital payment services and also may increase their economic returns in comparison to partnering with a bank. Obtaining money transmitter licenses is not a complete solution for all Fintechs, however, as they may still need to rely on bank sponsorships for many services, such as facilitating merchant acquiring, deposit taking and making loans where that is part of their suite of services.
Fintechs that do not wish to obtain licensure nationwide should consider partnering with banks to offer payment services. Although many banks have ceased to sponsor Fintechs in the past several years (sometimes by order of banking regulators), the second Trump administration is expected to promote innovation by making it easier for banks to sponsor Fintechs again, including through promises to change supervision and enforcement priorities for banks. While bank-Fintech relationships can be mutually beneficial for both parties, these relationships have also created challenges for banks in managing their compliance obligations, including with respect to the Bank Secrecy Act ("BSA") and AML laws because banks are typically not in direct contact with the Fintech's end user, yet are ultimately responsible for compliance. The bank's challenges can be compounded where the Fintech has contracted to provide financial services through a third-party platform.
In view of these challenges, federal and state regulators expect banking institutions to have appropriate internal controls to manage third-party Fintech relationships and expect the bank's board and management to ensure that these controls are implemented. Regulators expect written agreements between banks and Fintechs relating to payment services to make clear that the bank has ultimate control of all aspects of the regulated product or service and to clearly set forth the responsibilities of the parties for implementing applicable relevant compliance requirements. Specifically, such agreements should set forth the obligations, if any, of the Fintech regarding BSA/AML compliance, and the bank must ensure it has the ability and resources to ensure that the Fintech is complying with these requirements. The agreement should also give the bank audit rights and require the Fintech to provide periodic reports to the bank regarding its performance under the agreement and various compliance matters.
While federal regulatory scrutiny under the current administration is likely to decline, including with respect to bank-Fintech relationships, companies must remain cognizant of regulatory expectations in this space. Companies must ensure that they not only have a comprehensive understanding of the risks posed by specific third-party relationships, but also that their compliance management programs adequately account for these risks. As discussed above, even if the supervision and enforcement posture of federal regulators over the next four years may be more innovation-friendly than under the prior administration, such regulators will expect banks and their service providers to maintain their compliance with applicable law. Furthermore, and as discussed above, state regulators may ramp up their supervision and enforcement efforts to compensate for the downturn in federal enforcement, and it is quite possible that the next presidential administration reverses the federal deregulatory push that is currently underway.
IV. Conclusion
In sum, like many areas of financial services law, payments regulation is likely due for a major upheaval in the coming months and years. On the state level, while progress has been made towards establishing a uniform nationwide regulatory framework, there is more progress to be made and true uniformity may not ultimately be possible. On the federal level, while various signs point towards decreased regulation of the payments industry, companies should remain mindful of compliance, including to be prepared for the possibility that the regulatory pendulum to swing back towards increased regulation.
Footnotes
Originally published by Competition Policy International.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
