CFPB finalizes big tech payments rule

The Consumer Financial Protection Bureau made final a rule that would put Big Tech companies offering digital payment apps on a regulatory par with large banks and other financial institutions that already are subject to CFPB oversight.

The CFPB estimates that the most widely used apps covered by the rule collectively process over 13 billion consumer payment transactions annually. "Digital payments have gone from novelty to necessity and our oversight must reflect this reality," CFPB Director Rohit Chopra said in a statement. "The rules will help to protect consumer privacy, guard against fraud, and prevent illegal account closures."

50 million transaction threshold

In 2022, the consumer watchdog agency ordered six big tech firms – Amazon, Apple, Facebook, Google, PayPal and Square (now Block) – to hand over information on their digital payment activities, including how they manage personal user data. The final rule, published Nov. 21, 2024, is an outgrowth of that action.

There were some significant changes, however, between the rule proposed by the CFPB last year and the final rule. The CFPB, for example, had proposed coverage for companies that processed at least 5 million transactions a year. Under the final rule a tech company will need to process at least 10 times as many payment transactions – 50 million a year – to be subject to CFPB oversight.

The final rule also applies only to transactions in U.S. dollars. Originally, the CFPB had proposed coverage of digital currencies.

Digital payments are "cornerstone" of commerce

The CFPB, in announcing the new rule, noted that digital payment apps "have become a cornerstone of daily commerce, rivaling traditional payment methods like credit cards and debit cards" both for online and in-person purchases.

The apps, the CFPB continued, "have gained particularly strong adoption among middle and lower-income consumers," who use payment apps to spend and transfer funds "at rates that rival or exceed" cash usage. "What began as a convenient alternative to cash has evolved into a critical financial tool, processing over a trillion dollars in payments between consumers and their friends, families and businesses" the agency stated.

While banks and credit unions offering consumer payment services are subject to CFPB supervisory exams, many large tech companies that handle billions of transactions have not been subject to exams, according to the CFPB.

The CFPB noted that while it has always had enforcement authority over these companies, the new rule gives it the authority to "conduct proactive examinations" to ensure compliance with consumer protection laws. The new supervisory powers also make possible the ability to "assess risks that can emerge rapidly in this market, including from outages and other issues that could lead to millions of consumers losing access to their funds," the bureau added.

Privacy, errors and fraud, 'debanking'

The consumer watchdog agency said the new rule gives it the tools it needs to supervise big tech companies in several key areas. Specifically it addresses:

• Privacy and surveillance: Large technology companies are collecting vast amounts of information about individuals' transactions. Federal law makes clear that consumers' right to opt out of certain data collection and sharing, and bans misrepresentations about data protection practices, the agency stated.

• Errors and fraud: Long-standing law gives consumers the right to dispute transactions with their (regulated) financial institutions. CFPB said some payment apps have been designed to shift consumer disputes to FIs. They won't be able to do that under the new rule.

• Debanking: When, how and why consumers lose access to an app, or when the ability to make or receive payments is disrupted without notice – a situation commonly referred to as "debanking." The CFPB said it has received reports from consumers about "disruptions" to their lives due to such actions.

Rule takes effect before year's end

The new rule becomes effective in about a month, just before President-elect Donald Trump takes office. When Trump was in office last time the CFPB, which was created under the Dodd-Frank Act, was effectively sidelined, emphasizing consumer education and financial literacy over aggressive regulatory actions. It also watered down rules around payday lending and debt collection.

Mick Mulvaney, a vocal critic of the CFPB, served a stint as CFPB director under Trump, while simultaneously being director of the Office of Management and Budget, during which time he slashed the agency's budget. (Mulvaney also had a stint as acting White House chief of staff following his tenure at CFPB and OMB.)

Chopra, a former commissioner at the Federal Trade Commission who also worked at CFPB when it was first created, was appointed director in 2021, and took the agency on a much more aggressive pro-consumer path.

Banking groups cheered the CFPB's latest action. The Consumer Bankers Association said the final rule "marks an important step forward for the CFPB to regularly ensure that non-bank market participants actually comply with their obligations to consumers."

Unsurprisingly, representatives of big tech companies have taken a different stance. Penny Lee, president and CEO of the Financial Technology Association said the rule "is deeply flawed" Lee noted that consumers have "positive experiences" with payment companies that already operate under state and federal regulations. She also noted that the CFPB's annual complaints database indicated that just 1 percent of the 1.3 million complaints it fielded last year involved money transfer and payment services.

The FTA's membership includes Amazon Pay, Block, eBay, Intuit, PayPal, Plaid, and Stripe, among other big tech and payment firms.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.