Alert

CFPB’s Designation of Large Digital Wallets Subject to Supervision: Game Changer or Much Ado About Nothing?

December 18, 2024

The Consumer Financial Protection Bureau (CFPB) recently finalized a rule that will subject the country’s most active digital wallets to ongoing supervision by the agency. Will the CFPB’s new supervisory authorities be a game changer, or is this action much ado about nothing?

Overview of the Digital Wallet Larger Participant Rule

The rule identifies “general-use digital consumer payment applications” subject to supervision as any nonbank that provides 50 million consumer payment transactions, in U.S. dollars, to multiple unaffiliated persons in a year, regardless of the payment method used to fund the payment.

Consumer payment transactions: these include any transfer of funds by a consumer to another person for personal, family, or household purposes, whether the funds belong to the consumer or are made by extending credit, e.g., from a deposit account or credit card, respectively.

Payment functionality includes both:

• Funds transfer functionality: receiving funds from a consumer in order to transmit them to a third party, e.g., a “staged wallet” where funds are obtained and then remitted; or accepting from a consumer and transmitting payment instructions; and

• Payment wallet functionality: when payment account details or credentials are stored and transmitted to facilitate a consumer payment transaction, e.g., when a digital wallet stores tokenized payment credentials and passes them to a merchant in a tap-to-pay transaction.

Excluded payment transactions include:

• Payments solely to repay a debt
• International money transfers and securities and commodities transfers
• Payments to purchase goods or services from the wallet provider, i.e., first-party payments, or when making donations to a fundraiser selected from a wallet provider
• Certain pre-paid accounts, e.g., health savings accounts and gift certificates

Consequences of the CFPB’s Supervision of Digital Wallets

In the end, this will leave roughly seven companies subject to ongoing supervision by the CFPB, covering 98% of the digital wallet market.

This could be a game changer for a few reasons:

Full visibility for digital wallets. In the short term, companies subject to supervision for offering digital wallets will be subject to exams that evaluate all their activities related to consumer financial products and services, e.g., data access and use activities subject to new Section 1033 personal financial data rights obligations, data security and sharing activities under the Gramm-Leach-Bliley Act, lending activities under the Truth in Lending Act, marketing, and other activities subject to the general prohibition on unfair, deceptive, or abusive acts and practices. While the CFPB will likely focus on payment activities, the broad scope of services provided in digital wallets today – think driver licenses, boarding passes, concert tickets, student IDs, and more – could directly or indirectly involve financial products or services, and the commingling of these data within a single wallet could be an area of focus.

Increased visibility of known problem areas. Over the longer term, the CFPB will gain a better understanding of the full range of digital wallet activities and other developing practices of digital wallet providers, including details of their relationships with third parties. Risks highlighted in the final rule relate to Regulation E error resolution obligations of digital wallets and the commingling of financial data with other data for marketing (e.g., email, calendar, health, fitness, and other data stored on a mobile device), among others. The supervision of larger participants could cause the CFPB to search for those risks throughout the industry, creating a trickle-down effect on the broader market. In fact, the CFPB stated in the final rule that supervisory highlights will be published periodically to share insights from examinations of these larger participants with the broader market.

Leaving open the potential for action on digital currency. In limiting the final rule to only cover U.S. dollar transactions, the CFPB sidestepped its potential exertion of supervisory jurisdiction over digital currency or digital asset wallets, leaving open the possibility that digital currency or digital asset transactions could be subject to the CFPB’s jurisdiction over the transmission or exchanging of “funds” under the Dodd-Frank Act. See 88 Fed. Reg. 80197, 80202 (November 17, 2023).

On the other hand, this larger participant rule could be much ado about nothing for a few reasons:

Top wallets are already well known to the CFPB. The seven companies now subject to supervision have been on the CFPB’s radar and have likely been subject to requests for information in the past, both directly (see the CFPB’s 1022 order requesting information about digital wallet activities and the resulting report highlighting the role of big tech firms in mobile payments) and indirectly (e.g., banks could already be required to share information about their digital wallet arrangements with their supervisors, including the CFPB and other federal regulators).

Supervisory activities are slow, isolated, and largely confidential. Supervisory activities are a long slog. Supervision will be limited to a handful of large digital wallet providers, conducted in a deliberately slow and carefully structured way. This supervision shouldn’t directly impact the many third parties that interact with those wallets, though some trickle-down effects are possible in the medium- to long-term.

Change in administration could slow-roll implementation. With the coming change in administration, the final larger participant rule could be subject to rejection by Congress under powers granted to it under the Congressional Review Act, though it’s unclear if there’s support for such a move in Congress at this time. Assuming the final rule survives such a challenge, the CFPB’s budget is likely to come under scrutiny, and its limited resources might not be directed towards newer areas such as this, where risks are less apparent or aren’t clearly defined.