# Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-27836 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** December 10, 2024 - **Citation:** 89 FR 99582 ## Text CONSUMER FINANCIAL PROTECTION BUREAU 12 CFR Part 1090 [Docket No. CFPB-2023-0053] RIN 3170-AB17 Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications AGENCY: Consumer Financial Protection Bureau. ACTION: Final rule. SUMMARY: The Consumer Financial Protection Bureau (CFPB) issues this rule to define larger participants of a market for general-use digital consumer payment applications. Larger participants of this market will be subject to the CFPB's supervisory authority under the Consumer Financial Protection Act (CFPA). A nonbank covered person qualifies as a larger participant if it facilitates an annual covered consumer payment transaction volume of at least 50 million transactions as defined in the rule, and it is not a small business concern. DATES: This rule is effective January 9, 2025. FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory Implementation and Guidance Program Analyst, Office of Regulations, at 202-435-770. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@cfpb.gov. SUPPLEMENTARY INFORMATION: I. Overview Section 1024 of the CFPA, 1 codified at 12 U.S.C. 5514, gives the CFPB supervisory authority over all nonbank covered persons 2 offering or providing three enumerated types of consumer financial products or services: (1) Origination, brokerage, or servicing of consumer loans secured by real estate and related mortgage loan modification or foreclosure relief services; (2) private education loans; and (3) payday loans. 3 The CFPB also has supervisory authority over “larger participant[s] of a market for other consumer financial products or services, as defined by rule[s]” the CFPB issues. 4 In addition, the CFPB has the authority to supervise any nonbank covered person that it “has reasonable cause to determine by order, after notice to the covered person and a reasonable opportunity . . . to respond . . . is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.” 5 1 Consumer Financial Protection Act of 2010, title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 1955 (2010) (hereinafter, “CFPA”). 2 The provisions of 12 U.S.C. 5514 apply to certain categories of covered persons, described in section (a)(1), and expressly excludes from coverage persons described in 12 U.S.C. 5515(a) (very large insured depository institutions and credit unions and their affiliates) or 5516(a) (other insured depository institutions and credit unions). The term “covered person” means “(A) any person that engages in offering or providing a consumer financial product or service; and (B) any affiliate of a person described [in (A)] if such affiliate acts as a service provider to such person.” 12 U.S.C. 5481(6). 3 12 U.S.C. 5514(a)(1)(A), (D), (E). 4 12 U.S.C. 5514(a)(1)(B), (a)(2); see also 12 U.S.C. 5481(5) (defining “consumer financial product or service”). 5 12 U.S.C. 5514(a)(1)(C); see also 12 CFR part 1091 (prescribing procedures for making determinations under 12 U.S.C. 5514(a)(1)(C)). In addition, the CFPB has supervisory authority over very large depository institutions and credit unions and their affiliates. 12 U.S.C. 5515(a). Furthermore, the CFPB has certain authorities relating to the supervision of other depository institutions and credit unions. 12 U.S.C. 5516(c)(1). One of the CFPB's objectives under the CFPA is to ensure that “Federal consumer financial law is enforced consistently, without regard to the status of a person as a depository institution, in order to promote fair competition[.]” 12 U.S.C. 5511(b)(4). This rule (the Final Rule) is the sixth in a series of CFPB rulemakings to define larger participants of markets for consumer financial products and services for purposes of CFPA section 1024(a)(1)(B). 6 The Final Rule establishes the CFPB's supervisory authority over nonbank covered persons that are larger participants in a market for “general-use digital consumer payment applications.” In establishing the CFPB's supervisory authority over such persons, the Final Rule does not impose new substantive consumer protection requirements. In addition, some nonbank covered persons that would be subject to the CFPB's supervisory authority under the Final Rule also may be subject to other CFPB supervisory authorities, including for example under CFPA section 1024 as a larger participant in another market defined by a previous CFPB larger participant rule. Finally, regardless of whether they are subject to the CFPB's supervisory authority, nonbank covered persons generally are subject to the CFPB's regulatory and enforcement authority and to applicable Federal consumer financial law. 6 The first five rules defined larger participants of markets for consumer reporting, 77 FR 42874 (July 20, 2012) (Consumer Reporting Rule), consumer debt collection, 77 FR 65775 (Oct. 31, 2012) (Consumer Debt Collection Rule), student loan servicing, 78 FR 73383 (Dec. 6, 2013) (Student Loan Servicing Rule), international money transfers, 79 FR 56631 (Sept. 23, 2014) (International Money Transfer Rule), and automobile financing, 80 FR 37496 (June 30, 2015) (Automobile Financing Rule). The market described in the Final Rule includes providers of funds transfer and payment wallet functionalities through digital payment applications for consumers' general use in making payments to other persons for personal, family, or household purposes. Examples include consumer financial products and services that are commonly described as “digital wallets,” “payment apps,” “funds transfer apps,” “peer-to-peer payment apps,” “person-to-person payment apps,” “P2P apps,” and the like. Providers of consumer financial products and services delivered through these digital applications help consumers to make a wide variety of consumer payment transactions, including payments to friends and family and payments for purchases of nonfinancial goods and services. The CFPB is authorized to supervise nonbank covered persons that are subject to CFPA section 1024(a) for purposes of (1) assessing compliance with Federal consumer financial law; (2) obtaining information about such persons' activities and compliance systems or procedures; and (3) detecting and assessing risks to consumers and consumer financial markets. 7 The CFPB conducts examinations of various scopes of supervised entities. In addition, the CFPB may, as appropriate, request information from supervised entities prior to or without conducting examinations. 8 Section 1090.103(d) of the CFPB's existing larger participant regulations also provides that the CFPB may require submission of certain records, documents, and other information for purposes of assessing whether a person qualifies as a larger participant of a market as defined by a CFPB larger participant rule. 9 7 12 U.S.C. 5514(b)(1). The CFPB's supervisory authority also extends to service providers of those covered persons that are subject to supervision under 12 U.S.C. 5514(a)(1). 12 U.S.C. 5514(e); see also 12 U.S.C. 5481(26) (defining “service provider”). 8 See, e.g., 12 U.S.C. 5514(b)(1) (authorizing the CFPB both to “require reports and conduct examinations on a periodic basis” of nonbank covered persons subject to supervision). 9 12 CFR 1090.103(d). Consistent with CFPA section 1024(b)(2), the CFPB has established and implemented a risk-based supervisory program that is designed to prioritize supervisory activity among nonbank covered persons subject to CFPA section 1024(a) on the basis of risk. 10 The CFPB's prioritization process takes into account, among other factors, the size of each entity, the volume of its transactions involving consumer financial products or services, the size and risk presented by the market in which it is a participant, the extent of relevant State oversight, and any field and market information that the CFPB has on the entity. Specifically, as the CFPB Supervision and Examination Manual explains in greater detail, the CFPB evaluates risks to consumers at market-wide and the institution product line levels. At the market-wide level, the CFPB considers and compares risks to consumers across different types of products ( e.g., mortgage loans or debt collectors) along with the relative product market size in the overall consumer finance marketplace. At the institution product line level, the CFPB evaluates and compares risks across entities that, regardless of status as a nonbank or an insured depository institution or credit union, offer the same or similar products ( e.g., providers of mortgage loans). When evaluating risks across entities in an institution product line, the CFPB considers which entities have business models and market shares that pose greater risk of harm to consumers. The CFPB also places significant weight on “field and market intelligence,” which includes findings from prior examinations and other information about the strength of compliance management systems, metrics gathered from public reports, and the number and severity of consumer complaints the CFPB receives. 11 Taken together, this approach of assessing risks at the market-wide level and at the institutional level allows the CFPB to focus on areas where consumers have the greatest potential to be harmed, specifically, on relatively higher-risk institution product lines within relatively higher-risk markets. Finally, as described in CFPA section 1024(b)(3), the CFPB also coordinates its supervisory activities at nonbank covered persons with the supervisory activities conducted by Federal prudential regulators and State regulatory authorities. 12 10 12 U.S.C. 5514(b)(2). The CFPB notes that its prioritization process is not the subject of this rulemaking. 11 See id. For further description of the CFPB's supervisory prioritization process, see CFPB Supervision and Examination Manual (updated Sept. 2023), part I.A (pages 11-12 of Overview section), https://files.consumerfinance.gov/f/documents/cfpb_supervision-and-examination-manual_2023-09.pdf (last visited Nov. 10, 2024). 12 12 U.S.C. 5514(b)(3). The Final Rule further describes this coordination in response to general comments about existing oversight of the market below. As discussed there, the CFPB also coordinates its supervisory activity with the Federal Trade Commission. The CFPB notes that its coordination process is not the subject of this rulemaking. The specifics of how an examination takes place vary by market and entity. However, the examination process generally proceeds as follows. 13 CFPB examiners contact the entity for an initial conference with management and often request records and other information. CFPB examiners may review the components of the supervised entity's compliance management system. Based on these discussions and a preliminary review of the information received, examiners determine the scope of an on-site or remote examination and coordinate with the entity to initiate this portion of the examination. While on-site or working remotely, examiners discuss with management the entity's compliance policies, processes, and procedures; review documents and records; test transactions and accounts for compliance; and evaluate the entity's compliance management system. At the conclusion of that stage of an examination, examiners may review preliminary examination findings at a closing meeting. After the closing meeting, if examiners have identified potential violations of Federal consumer financial law, they also may provide the entity an opportunity to respond in writing to those potential findings. 14 Finally, examinations may involve issuing confidential examination reports, supervisory letters, and compliance ratings. In addition to the process described above, the CFPB also may conduct other supervisory activities, such as periodic monitoring. 15 13 For further description of the CFPB's examination process, see CFPB Supervision and Examination Manual, part I.A. 14 See, e.g., CFPB, Supervisory Highlights Issue 8, Summer 2015, sec. 3.1.3 (describing supervision process of sending a Potential Action and Request for Response (PARR) letter to a supervised entity), https://files.consumerfinance.gov/f/201506_cfpb_supervisory-highlights.pdf (last visited Nov. 5, 2024). 15 CFPB Supervision and Examination Manual, part I.A (page 12 of Overview section describing supervisory monitoring). II. Background On November 17, 2023, the CFPB published a notice of proposed rulemaking to define larger participants of a market for general-use digital consumer payment applications (Proposed Rule). 16 As described in part V below, the Proposed Rule would have defined a larger participant as any nonbank covered person that, in the previous calendar year, both facilitated at least five million consumer payment transactions by providing general-use digital consumer payment applications and was not a small business concern as defined in the Proposed Rule. The CFPB requested comment on the Proposed Rule. The CFPB received 59 comments from consumer advocate organizations (consumer groups), nonprofits, companies, industry associations, State attorneys general, Members of Congress, and other individuals. The comments are discussed in more detail below. 16 88 FR 80197 (Nov. 17, 2023). III. Summary of the Final Rule The CFPB is authorized to issue rules to define larger participants in markets for consumer financial products or services. Subpart A of the CFPB's existing larger-participant regulation, 12 CFR part 1090, prescribed procedures, definitions, standards, and protocols that apply to the CFPB's supervision of larger participants. 17 Those generally-applicable provisions will apply to the CFPB's supervision of larger participants in the general-use digital consumer payment application market described by the Final Rule. The definitions in § 1090.101 should be used to interpret terms in the Final Rule unless otherwise specified. 17 12 CFR 1090.100 through 103. The CFPB includes relevant market descriptions and associated larger-participant tests, as it develops them, in subpart B. 18 Accordingly, the Final Rule defining larger participants of a market for general-use digital consumer payment applications is codified in § 1090.109 in subpart B. 18 12 CFR 1090.104 (consumer reporting market); 12 CFR 1090.105 (consumer debt collection market); 12 CFR 1090.106 (student loan servicing market); 12 CFR 1090.107 (international money transfer market); 12 CFR 1090.108 (automobile financing market). The CFPB is finalizing the Proposed Rule largely as proposed, with certain changes described below, including changes to increase the transaction threshold that the CFPB will use as part of the test to assess when a nonbank covered person is a larger participant of a market for general-use digital consumer payment applications. The Final Rule defines larger participants of a market for general-use digital consumer payment applications. That market encompasses specific activities. The market definition generally includes nonbank covered persons that provide funds transfer or payment wallet functionalities through a digital payment application for consumers' general use in making consumer payments transactions as defined in the Final Rule. The Final Rule defines “consumer payment transactions” to include payments to other persons for personal, household, or family purposes, excluding certain transactions as described in more detail in the section-by-section analysis in part V below. The Final Rule also identifies a limited set of digital payment applications that do not fall within the proposed market definition because they do not have general use for purposes of the Final Rule. The Final Rule sets forth a test to determine whether a nonbank covered person is a larger participant of the general-use digital consumer payment applications market. As further explained below, a nonbank covered person is a larger participant if it satisfies two criteria. First, the nonbank covered person (together with its affiliated companies) must provide general-use digital consumer payment applications with an annual volume of at least 50 million consumer payment transactions denominated in U.S. dollars. Second, the nonbank covered person must not be a small business concern based on the applicable Small Business Administration (SBA) size standard. As prescribed by subpart A of the CFPB's general larger participant regulation, any nonbank covered person that qualifies as a larger participant would remain a larger participant until two years from the first day of the tax year in which the person last met the larger-participant test. 19 19 12 CFR 1090.102. As noted above, § 1090.103(d) of the CFPB's existing larger participant regulation provides that the CFPB may require submission of certain records, documents, and other information for purposes of assessing whether a person is a larger participant of a market as defined by a CFPB larger participant rule. 20 As with the CFPB's other larger participant rules codified in subpart B, this authority will be available to facilitate the CFPB's identification of larger participants of the general-use digital consumer payment applications market. In addition, pursuant to existing § 1090.103(a), a person will be able to dispute whether it qualifies as a larger participant in the general-use digital payment applications market. The CFPB will notify an entity when the CFPB intends to undertake supervisory activity; if the entity claims not to be a larger participant, it will then have an opportunity to submit documentary evidence and written arguments in support of its claim. 21 20 12 CFR 1090.103(d). 21 12 CFR 1090.103(a). IV. Legal Authority and Procedural Matters A. Rulemaking Authority The CFPB is issuing the Final Rule pursuant to its authority under the CFPA, as follows: (1) sections 1024(a)(1)(B) and (a)(2), which authorize the CFPB to supervise nonbanks that are larger participants of markets for consumers financial products or services, as the CFPB defines by rule; 22 (2) section 1024(b)(7), which, among other things, authorizes the CFPB to prescribe rules to facilitate the supervision of covered persons under section 1024; 23 and (3) section 1022(b)(1), which grants the CFPB the authority to prescribe rules as may be necessary or appropriate to enable the CFPB to administer and carry out the purposes and objectives of Federal consumer financial law, and to prevent evasions of such law. 24 22 12 U.S.C. 5514(a)(1)(B), (a)(2). 23 12 U.S.C. 5514(b)(7). 24 12 U.S.C. 5512(b)(1). B. Consultation With Other Agencies In developing the Final Rule and the Proposed Rule, the CFPB consulted with the Federal Trade Commission (FTC), as well as with the Board of Governors of the Federal Reserve System, the Commodity Futures Trading Commission (CFTC), the Federal Deposit Insurance Corporation (FDIC), the Financial Crimes Enforcement Network, the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Securities and Exchange Commission (SEC), on, among other things, consistency with any prudential, market, or systemic objectives administered by such agencies. 25 25 Specifically, 12 U.S.C. 5514(a)(2) directs that the CFPB consult with the FTC prior to issuing a final rule to define larger participants of a market pursuant to CFPA section 1024(a)(1)(B). In addition, 12 U.S.C. 5512(b)(2)(B) directs the CFPB to consult, before and during the rulemaking, with appropriate prudential regulators or other Federal agencies, regarding consistency with objectives those agencies administer. The manner and extent to which provisions of 12 U.S.C. 5512(b)(2) apply to a rulemaking of this kind that does not establish standards of conduct are unclear. Nevertheless, to inform this rulemaking more fully, the CFPB performed the consultations described in that provision of the CFPA. Some commenters questioned whether the CFPB met its consultation obligations based on the statement in the proposal that it “consulted with or provided an opportunity for consultation and input to” the FTC and certain other agencies. 88 FR 80197 at 80199. The CFPB clarifies that it did meet during the rulemaking process with the FTC and other agencies listed above to consult about the rule. Some commenters also suggested that the CFPB is specifically required to consult with the FTC's Bureau of Competition, in line with those commenters' view that the CFPB must apply antitrust principles when defining a market for a larger participant rule. However, the relevant statutory provision, 12 U.S.C. 5514(a)(2), by its terms requires the CFPB to consult with the FTC, and not with specific divisions of the FTC. The CFPB addresses comments regarding the applicability of antitrust principles in discussion of general comments in part V further below. V. Section-by-Section Analysis Part 1090 Subpart B—Markets Section 1090.109 General-Use Digital Consumer Payment Applications Market Proposed Rule As described further below, the CFPB proposed to establish CFPB authority to supervise nonbank covered persons that are larger participants in this market because: (1) the market has grown dramatically and become increasingly important to the everyday financial lives of consumers; (2) CFPB supervisory authority over its larger participants would help the CFPB to promote compliance with Federal consumer financial law; (3) that authority would help the CPFB to detect and assess risks to consumers and the market, including emerging risks; and (4) that authority would help the CFPB to ensure consistent enforcement of Federal consumer financial law between nonbanks and insured banks and credit unions. To accomplish these goals, the Proposed Rule would have added to existing subpart B of part 1090 of the CFPB's rules a new § 1090.109 establishing CFPB supervisory authority over nonbank covered persons who are larger participants in a market for general-use digital consumer payment applications. 26 26 As explained in the Proposed Rule and discussed further below, the general-use digital payment applications described in this Final Rule are “financial products or services” under the CFPA. 12 U.S.C. 5481(15)(A)(iv), (vii). Nonbanks that offer or provide such financial products or services to consumers primarily for personal, family, or household purposes are “covered persons” under the CFPA. 12 U.S.C. 5481(5)(A), (6). As the Proposed Rule explained, many nonbanks provide consumer financial products and services that allow consumers to use digital applications accessible through personal computing devices, such as mobile phones, tablets, smart watches, or computers, to transfer funds to other persons. Some nonbanks also provide consumer financial products and services that allow consumers to use digital applications on their personal computing devices to store payment credentials they can then use to purchase goods or services at a variety of stores, whether by communicating with a checkout register or a self- checkout machine, or by selecting the payment credential through a checkout process at ecommerce websites. Subject to the definitions, exclusions, limitations, and clarifications discussed in the Proposed Rule, the proposed market definition generally would have covered these consumer financial products and services. The Proposed Rule explained that the CFPB proposed to establish supervisory authority over nonbank covered persons who are larger participants in this market because this market has large and increasing significance to the everyday financial lives of consumers. 27 Consumers are growing increasingly reliant on general-use digital consumer payment applications to initiate payments. 28 Recent market research indicates that 76 percent of Americans have used at least one of four well-known P2P payment apps, representing substantial growth since the first of the four was established in 1998. 29 Even among consumers with annual incomes lower than $30,000 who have more limited access to digital technology, 30 61 percent reported using P2P payment apps. 31 And higher rates of use by U.S. adults in lower age brackets may drive further growth well into the future. 32 Across the United States, merchant acceptance of general-use digital consumer payment applications also has rapidly expanded as businesses seek to make it as easy as possible for consumers to make purchases through whatever is their preferred payment method. 33 27 The Proposed Rule explained that, in proposing a larger participant rule for this market, the CFPB was not proposing to determine the relative risk posed by this market as compared to other markets. It noted that, as explained in its previous larger participant rulemakings, “[t]he Bureau need not conclude before issuing a [larger participant rule] that the market identified in the rule has a higher rate of non-compliance, poses a greater risk to consumers, or is in some other sense more important to supervise than other markets.” 88 FR 80197 at 80200 (citing Consumer Debt Collection Larger Participant Rule, 77 FR 65775 at 65779). 28 See CFPB, Issue Spotlight: Analysis of Deposit Insurance Coverage Through Payment Apps (June 1, 2023) (CFPB Deposit Insurance Spotlight), https://www.consumerfinance.gov/data-research/research-reports/issue-spotlight-analysis-of-deposit-insurance-coverage-on-funds-stored-through-payment-apps/full-report/ (last visited Oct. 23, 2023); see also McKinsey & Company, Consumer digital payments: Already mainstream, increasingly embedded, still evolving (Oct. 20, 2023) (describing results of consulting firm's annual survey reporting that for the first time, more than 90 percent of U.S. consumers surveyed in August 2023 reported using some form of digital payment over the course of a year), https://www.mckinsey.com/industries/financial-services/our-insights/banking-matters/consumer-digital-payments-already-mainstream-increasingly-embedded-still-evolving (last visited Oct. 30, 2023); J.D. Power, Banking and Payments Intelligence Report (Jan. 2023) (reporting results of a survey of Americans that found that from the first quarter of 2021 to the third quarter of 2022, the number of respondents who had used a mobile wallet in the past three months rose from 38 percent to 49 percent), https://www.jdpower.com/business/resources/mobile-wallets-gain-popularity-growing-number-americans-still-prefer-convenience (last visited Oct. 23, 2023); PULSE, PULSE Study Finds Debit Issuers Focused on Digital Payments, Mobile Self-Service, Fraud Mitigation (Aug. 17, 2023) (reporting that nearly 80 percent of debit card issuers reported increases in consumers' use of mobile wallets in 2022), https://www.pulsenetwork.com/public/insights-and-news/news-release-2023-debit-issuer-study/ (last visited Oct. 30, 2023); FIS, The Global Payments Report (2023) (FIS 2023 Global Payments Report) at 175 (industry study reporting that in 2022 digital wallets became the leading payment preference of U.S. consumers shopping online), https://www.fisglobal.com/-/media/fisglobal/files/campaigns/global-payments%20report/FIS_TheGlobalPaymentsReport_2023.pdf (last visited Nov. 5, 2024) ; Digital Payment Industry in 2023: Payment methods, trends, and tech processing payments electronically, eMarketer (formerly known as Insider Intelligence) (Jan. 9, 2023) (projecting 2023 transaction volume by U.S. P2P mobile payment app providers to reach over $1.1 trillion), https://www.emarketer.com/insights/digital-payment-services/ (last visited Nov. 5, 2024); Consumer Reports Survey Group, Peer-to-Peer Payment Services (Jan. 10, 2023) (Consumer Reports P2P Survey) at 1 (reporting results from a survey finding that four in ten Americans use P2P services at least once a month), https://advocacy.consumerreports.org/wp-content/uploads/2023/01/P2P-Report-4-Surveys-2022.pdf (last visited Oct. 23, 2023); Kevin Foster, Claire Greene, and Joanna Stavins, 2022 Survey and Diary of Consumer Payment Choice: Summary Results (Sept. 17, 2022) at 8 (reporting results of survey conducted by Federal Reserve System staff finding that, as of 2022, two thirds of consumers reported adopting one or more online payment accounts in the previous 12 months—a share that was nearly 20 percent higher than five years earlier), https://www.atlantafed.org/-/media/documents/banking/consumer-payments/survey-diary-consumer-payment-choice/2022/sdcpc_2022_report.pdf (last visited Oct. 30, 2023); FDIC, FDIC National Survey of Unbanked and Underbanked Households (2021) at 33 (Table 6.4 reporting finding that nearly half of all households (46.4 percent) used a nonbank app in 2021), https://www.fdic.gov/analysis/household-survey/2021report.pdf (last visited Oct. 23, 2023). 29 See, e.g., Monica Anderson, Pew Research Center, Payment apps like Venmo and Cash App bring convenience—and security concerns—to some users (Sept. 8, 2022) (Pew 2022 Payment App Article), https://www.pewresearch.org/short-reads/2022/09/08/payment-apps-like-venmo-and-cash-app-bring-convenience-and-security-concerns-to-some-users/ (last visited Oct. 23, 2023). 30 Emily A. Vogels, Pew Research Center, Digital divide persists even as Americans with lower incomes make gains in tech adoption (June 22, 2021) (reporting results of early 2021 survey by Pew Research Center, finding 76 percent of adults with annual household incomes less than $30,000 have a smartphone and 59 percent have a desktop or laptop computer, compared with 87 percent and 84 percent respectively of adults with household incomes between $30,000 and $99,999, and 97 percent and 92 percent respectively of adults with household incomes of $100,000 or more), https://www.pewresearch.org/short-reads/2021/06/22/digital-divide-persists-even-as-americans-with-lower-incomes-make-gains-in-tech-adoption/ (last visited Oct. 23, 2023). 31 Consumer Reports P2P Survey at 2 (55 percent reported ongoing use and six percent stated they used to use this kind of service). 32 See id. (85 percent of surveyed consumers aged 18 to 29 and 85 percent of surveyed consumers aged 30 to 44 reported using a digital payment application, compared with 67 percent of consumers aged 45 to 59 and 46 percent of consumers aged 60 and over); see also Ariana-Michele Moore, The U.S. P2P Payments Market: Surprising Data Reveals Banks are Missing the Mark (AiteNovarica 2023 Impact Report) at 6, 24 (Figure 13 reporting 94 percent and 86 percent adoption of P2P accounts and digital wallets among the youngest adult cohort born between 1996 and 2002, compared with 57 percent and 40 percent among the oldest cohort born before 1995), https://aite-novarica.com/report/us-p2p-payments-market-surprising-data-reveals-banks-are-missing-mark (last visited Oct. 23, 2023) and https://datos-insights.com/reports/us-p2p-payments-market-surprising-data-reveals-banks-are-missing-mark/ (last visited Nov. 5, 2024). 33 See Geoff Williams, Retailers are embracing alternative payment methods, though cards are still king (Dec. 1, 2022) (National Retail Federation article citing its 2022 report describing a Forrester survey indicating that 80 percent of merchants accept Apple Pay or plan to do so in the next 18 months, 65 percent of merchants accept Google Pay or plan to do so in the next 18 months, and, online, 74 percent accept PayPal or plan to do so), https://nrf.com/blog/retailers-are-embracing-alternative-payment-methods-though-cards-are-still-king (last visited Oct. 23, 2023); see also The Strawhecker Group (TSG), Merchants respond to Consumer Demand by Offering P2P Payments (June 8, 2022) (TSG: Merchants Offering P2P Payments) (reporting results of TSG and Electronic Transactions Association survey of over 500 small businesses merchants finding that 82 percent accept payment through at least one digital P2P option), https://thestrawgroup.com/merchants-respond-to-consumer-demand-by-offering-p2p-payments/ (last visited Oct. 23, 2023). The Proposed Rule described how consumers rely on general-use digital consumer payment applications for many aspects of their everyday lives. In general, consumers make payments to other individuals for a variety of reasons, including sending gifts or making informal loans to friends and family and purchasing goods and services, among many others. 34 Consumers can use digital applications to make payments to individuals for these purposes, as well as to make payments to businesses, charities, and other organizations. According to one recent market report, nonbank digital payment apps have rapidly grown in the past few years to become the most popular way to send money to other individuals other than cash, 35 and are used for a higher number of such transactions than cash. 36 For many consumers, general-use digital consumer payment applications offer an alternative, technological replacement for non-digital payment methods. 37 Consumers increasingly have adopted general-use digital consumer payment applications 38 as part of a broader movement toward noncash payments. 39 Amid growing merchant acceptance of general-use digital consumer payment applications, consumers with middle and lower incomes use digital consumer payment applications for a share of their overall retail spending that rivals or exceeds their use of cash. 40 Such applications now have a share of ecommerce payments volume that is similar to or greater than other traditional payment methods such as credit cards and debit cards used outside of such applications. 41 Such applications also have been gaining an increasing share of in-person retail spending. 42 34 AiteNovarica 2023 Impact Report at 8-9 (Figure 1 reporting 66 percent of 5,895 consumers surveyed reported making at least one domestic P2P payment in 2022 whether via digital means or not, and Figure 2 reporting that, of consumers who made P2P payments in 2022, among other purposes, 70 percent did so for birthday gifts, 64 percent for holiday gifts, 49 percent for other gift occasions, 46 percent to lend money, 41 percent to make a charitable contribution, 39 percent paid for services, 39 percent purchased items, 31 percent provided funds in an emergency situation, and 18 percent provided financial support). 35 Id. at 25 (Figure 14 reporting that, among other payment methods or sources, 74 percent of consumers made P2P payments in cash, 69 percent used alternative digital P2P payment services, defined as services offered by nonbank providers via mobile app, web service, or digital wallet, and 27 percent used Zelle through a bank's mobile application). 36 Id. at 27-28 (Figure 15 reporting that, compared with 20 percent of P2P transactions made in cash, 37 percent of P2P transactions made through alternative P2P payment services). 37 See Marqueta, 2022 State of Consumer Money Movement Report (May 26, 2022) at 1 (summary of report describing results of industry survey finding that 56 percent of US consumers felt comfortable leaving their non-digital wallet at home and taking their phone with them to make payments), https://www.marqeta.com/resources/2022-state-of-consumer-money-movement (last visited Oct. 23, 2023). 38 AiteNovarica 2023 Impact Report at 24 (Figure 13 reporting 81 percent of U.S. adults surveyed held one or more P2P accounts and 69 percent had one or more digital wallets). 39 The Federal Reserve Payments Study: 2022 Triennial Initial Data Release (indicating a rapid increase in core non-cash payments between 2018 and 2021 and a rapid decline in ATM cash withdrawals during the same period), https://www.federalreserve.gov/paymentsystems/fr-payments-study.htm (last visited Nov. 19, 2024). 40 PYMNTS, Digital Economy Payments: The Ascent of Digital Wallets (Feb. 2023) at 16-17 (December 2022 survey finding 6.1 percent of overall consumer spending by consumers with lower incomes made using digital consumer payment applications, compared with 9.9 percent of consumer spending by consumers with middle-level incomes), https://www.pymnts.com/study/digital-economy-payments-ecommerce-shopping-retail-consumer-spending/ (last visited Oct. 23, 2023). 41 See FIS 2023 Global Payments Report at 176 (reporting 32 percent share of ecommerce transactions, by value, made using a digital wallet, compared with 30 percent by credit card and 20 percent by debit card). 42 See, e.g., 2023 Pulse Debit Issuer Study (Aug. 17, 2023) at 11 (reporting that mobile wallet use at point of sale nearly doubled in 2022, representing nearly 10 percent of total debit card purchase transactions in 2022), https://content.pulsenetwork.com/2023-debit-issuer-study/2023-pulse-debit-issuer-study-white-paper (last visited Nov. 5, 2024); Digital Economy Payments: The Ascent of Digital Wallets at 12 (December 2022 survey finding 7.5 percent of in-person consumer purchase volume made with a digital consumer payment application). See also CFPB Issue Spotlight, Big Tech's Role in Contactless Payments: Analysis of Mobile Devices Operating Systems and Tap-to-Pay Practices (Sept. 7, 2023) (CFPB Contactless Payments Spotlight) (describing market report by Juniper Research forecasting that the value of digital wallet tap-to-pay transactions will grow by over 150 percent by 2028), https://www.consumerfinance.gov/data-research/research-reports/big-techs-role-in-contactless-payments-analysis-of-mobile-device-operating-systems-and-tap-to-pay-practices/full-report/ (last visited Oct. 23, 2023). The Proposed Rule would have brought nonbanks that qualified as larger participants in a market for general-use digital consumer payment applications under the CFPB's supervisory jurisdiction. 43 The Proposed Rule explained that supervision of larger participants, who engage in a substantial portion of the overall activity in this market, would help to ensure that they are complying with applicable requirements of Federal consumer financial law, such as the CFPA's prohibition against unfair, deceptive, and abusive acts and practices, the privacy provisions of the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P, 44 and the Electronic Fund Transfer Act (EFTA) and its implementing Regulation E. 45 The Proposed Rule also explained that, as firms increasingly offer funds transfer and wallet functionalities through general-use digital consumer payment applications, the rule would enable the CFPB to detect and assess new risks to both consumers and the market. 46 As stated in the Proposed Rule, the CFPB's ability to detect and assess emerging risks is critical as new product offerings blur the traditional lines of banking and commerce. 47 43 12 U.S.C. 5514(a)(1)(B). 44 See generally 12 CFR part 1016—Privacy of Consumer Financial Information (CFPB's Regulation P implementing 15 U.S.C. 6804). 45 15 U.S.C. 1693 et seq., implemented by Regulation E, 12 CFR part 1005. See, e.g., 12 CFR 1005.11 (Procedures for financial institutions to resolve errors). 46 88 FR 80197 at 80201 & n.43 (citing CFPB, The Convergence of Payments and Commerce: Implications for Consumers (Aug. 2022) (CFPB Report on Convergence of Payments and Commerce) at sec. 4.1 (highlighting the potential that consumer financial data and behavioral data are used together in increasingly novel ways), https://files.consumerfinance.gov/f/documents/cfpb_convergence-payments-commerce-implications-consumers_report_2022-08.pdf (last visited Oct. 27, 2023)). 47 See generally id. The Proposed Rule explained that the CFPB regularly supervises depository institutions that provide general-use digital consumer payment applications. 48 As the Proposed Rule noted, greater supervision of nonbanks in this market therefore would further the CFPB's statutory objective of ensuring that Federal consumer financial law is enforced consistently between nonbanks and depository institutions in order to promote fair competition. 49 48 For example, as the Proposed Rule noted, some depository institutions and credit unions provide general bill-payment services and other types of electronic fund transfers through digital applications for consumer deposit accounts. Id. at n.45. 49 12 U.S.C. 5511(b)(4). The Proposed Rule also recognized that States have been active in regulation of money transmission by money services businesses and that many States actively examine money transmitters. 50 The Proposed Rule stated that the CFPB would coordinate with appropriate State regulatory authorities in examining larger participants. 50 88 FR 80197 at 80198 n.12, 80214 n.108 (citing CSBS, Reengineering Nonbank Supervision, Ch. 4: Overview of Money Services Businesses (Oct. 2019) (CSBS Reengineering Nonbank Supervision MSB Chapter), https://www.csbs.org/sites/default/files/other-files/Chapter%204%20-%20MSB%20Final%20FINAL_updated_0.pdf (last visited Nov. 5, 2024)). General Comments Received 51 51 Some commenters provided additional recommendations that are outside the scope of this rulemaking, such as increasing education of consumers who use general-use digital consumer payment applications, promulgating new consumer protections for these consumers, or imposing information collection requirements such as collecting the legal entity identifier (LEI) of larger participants. The Final Rule does not address these comments, which are outside the scope of a rulemaking under CFPA section 1024(a)(1)(B) to define and establish supervisory authority over larger participants in a market for consumer financial products and services. In addition, a consumer group suggested that the CFPB the CFPB expressly clarify that meeting the definition of a larger participant does not automatically cause application of exclusions in State privacy laws for GLBA compliance and that the CFPB coordinate with States to avoid risk of preempting State privacy laws when the CFPB supervises for compliance with the GLBA and its implementing Regulation P. This rulemaking does not establish or interpret substantive consumer protection requirements and thus does not interpret Regulation P (including its provision describing its relationship with State laws in 12 CFR 1016.17); it also does not itself govern State coordination, which occurs separately when the CFPB carries out nonbank supervision. In this part of the section-by-section analysis, the Final Rule summarizes and responds to comments about general aspects of the proposal, including the rulemaking process, the CFPB's general reasons for issuing the proposal, and certain other general topics. Comments on Rulemaking Process Some comments addressed the rulemaking process. First, some commenters suggested that the CFPB should not have issued, and should not finalize, the Proposed Rule during the pendency of a Supreme Court case concerning the constitutionality of the CFPB's funding structure under the Appropriations Clause. 52 Second, some industry commenters, a nonprofit commenter, an individual commenter, and some Members of Congress asked the CFPB to extend the comment period, such as by an additional 30 or 45 days. These commenters cited various reasons for their request, including the number of holidays during the comment period, the complexity of the proposed market including coverage of digital assets, the complexity of the proposed larger-participant test that included multiple steps, a need for more specifics regarding which products and services were encompassed in the market and the risks the CPFB believed they pose that justify the need for the Proposed Rule, and overlap between the comment period for the Proposed Rule, the comment period for the CFPB's proposal regarding personal financial data rights, and the CFPB's new market-monitoring orders covering some of the same entities. One industry commenter added that the decision not to extend the comment period formed part of the basis for their view that the CFPB should withdraw the Proposed Rule. 52 See CFPB v. Cmty. Fin. Servs. Ass'n of Am., Ltd., 601 U.S. 416 (2024) (U.S. argued Oct. 3, 2023). Comments on the Large and Growing Market Commenters agreed that the market for general-use digital consumer payment applications has grown substantially in recent years. For example, consumer groups, several nonprofits, a payment network, an industry association, two banking industry associations, and a credit union association agreed (and an industry provider acknowledged 53 ) that there has been rapid growth and widespread consumer adoption of general-use digital consumer payment applications. In support of their view, these commenters cited data in the Proposed Rule as well as other public information. An industry association stated that digital consumer payment applications have helped millions of U.S. consumers to send money to friends and family and make retail payments more efficient. A group of State attorneys general noted that a significant portion of consumers with lower incomes frequently rely upon general-use digital consumer payment applications. Two nonprofit commenters also agreed that adoption by younger individuals may drive further growth. 54 An industry association observed that the proposed market has experienced rapid increases in consumer adoption that likely will continue. As a consequence, this commenter described this market as still in what industry lifecycle literature describes as a stage of market growth as opposed to market maturity. 53 As discussed further below, this commenter stated that growth alone was insufficient to justify the Proposed Rule, and that the CFPB must make certain specific findings regarding market risk. The Final Rule responds to those comments further below in the discussion of general comments about the relevance of risks to consumers to the rulemaking. 54 While not disputing the rapid growth in the market, some other industry commenters suggested that the broader consumer payments sector should be considered, including when defining the market and setting the threshold for the larger-participant test, as discussed in the section-by-section analysis of those provisions further below. Several of these commenters stated that these general-use digital consumer payment applications increasingly are accepted by retailers and embedded into in-person and online commerce, which is itself growing. They pointed to this as one trend driving existing growth and future growth in the market. A comment from several consumer groups stated that as merchants seek to avoid interchange fees, they will increasingly rely upon digital payment applications as a payment method at the point of sale. A banking association and consumer group stated that they also expected the lines between banking, commerce, and technology to further converge and blur. 55 A comment from several consumer groups stated that nonbank providers of consumer financial products and services have greater latitude under U.S. law to integrate those products into commercial platforms, and that large technology firms' business models depend on data collection. 56 55 One of these commenters pointed to an industry white paper describing a trend in the market toward “embedding financial services into nonfinancial apps and other digital experiences.” Google LLC White Paper, Embedded finance: The new gold rush in financial services (2021) (Google LLC Embedded Finance White Paper) at 4 (“These embedded experiences will soon permeate all aspects of our lives that involve money—and they'll feel so frictionless that users won't be aware of the underlying work financial institutions are doing to support these transactions.”), at 6 (“Embedded finance means, simply, embedding your financial services in the non-financial products, services or technologies consumers already use and love. Since they spend much of their time in non-financial applications in their everyday lives—but only a fractional amount of time in financial applications—the growth opportunity for financial services companies is considerable.”), https://cloud.google.com/resources/financial-services-embedded-finance-whitepaper (last visited Nov. 5, 2024). 56 One consumer group commenter added that in its view, Big Tech firms have a business model that seeks to maximize data collection based on different goals from publicly-chartered and regulated financial institutions. Another nonprofit commenter suggested in general terms that CFPB supervision of larger participants in the general-use digital consumer payment applications market could help the CFPB to detect and assess risks to the U.S. financial system. It stated that the market may present such risk, given how general-use digital consumer payment applications facilitate a high volume of transactions, including flows of funds through stored value accounts that are not FDIC-insured. However, some industry and nonprofit commenters stated that the rapid growth in the market and widespread consumer adoption merely indicates that the market is successful and popular among consumers. In their view, as discussed further below, the fact that the market is large and growing market is not an adequate basis for subjecting its larger participants to supervision, absent findings of risks to consumers or markets or market failures. 57 57 The Final Rule further summarizes and responds to those comments in the discussion below of general comments on detecting and assessing risks (including emerging risks) to consumers and markets. Comments on Promoting Compliance With Federal Consumer Financial Law The Proposed Rule stated that CFPB supervision of larger participants would promote compliance with applicable requirements of Federal consumer financial law. A group of State attorneys general, consumer groups, some nonprofit and individual commenters, a banking association, and a comment from a payment network and an industry association generally agreed that the proposal would serve this purpose, as described below. However, as described further below, some industry and nonprofit and other commenters disagreed or stated that the proposal did not provide sufficient support for the claim that it would serve this purpose. 58 58 Some commenters also suggested that existing State and Federal oversight of some market activities, including for compliance with Federal consumer financial law, was adequate. The Final Rule separately addresses comments on those general topics further below. Several commenters expressed concern that larger participants may be violating or inadequately incentivized to comply with one or more of the Federal consumer financial laws cited in the Proposed Rule. A joint comment from consumer groups stated that consumers are exposed to unfair, deceptive and abusive practices in the payments area, and stated that oversight of this market is needed to ensure market participants comply with the prohibition against unfair, deceptive, and abusive acts and practices. 59 This comment assessed the risk of abusive practices as high due to what the comment described as lack of competition and consumer choice with respect to the larger participants defined in the Proposed Rule. A comment from a group of State attorneys general stated that the Proposed Rule, coupled with existing State consumer protection statutes, would allow the Federal and State governments to work together to prevent and abate unfair, deceptive, and abusive acts and practices in the market. A consumer group and a nonprofit commenter stated that the Proposed Rule would be especially useful in promoting compliance with the prohibition against unfair, deceptive, and abusive acts and practices by companies that provide financial services to incarcerated and recently incarcerated persons. And a consumer group and nonprofit commenter stated that it was common sense that unfair, deceptive, and abusive acts and practices protections be applied to new entrants and technologies like those described in the Proposed Rule. 59 See 12 U.S.C. 5531, 5536 (prohibiting unfair, deceptive, and abusive acts and practices in connection with the offering or provision of consumer financial products and services). As an example of how supervision of larger participants would promote compliance, a banking association noted that the CFPB's publication Supervisory Highlights 60 communicates CFPB expectations of compliance to the overall market and encouraged its use in this market, and stated that the proposal should enable the CFPB to publish Supervisory Highlights identifying problematic conduct in this market. A comment from several consumer groups pointed to findings in Supervisory Highlights related to violations of Regulation E and other provisions of Federal consumer financial law violations at banks. The comment stated that the CFPB also should supervise larger nonbank companies handling consumer payments, including payment apps, because such violations at nonbanks are just as likely if not more so. 60 The CFPB periodically publishes Supervisory Highlights to share key examination findings in order to help industry limit risks to consumers and comply with Federal consumer financial law. Each Supervisory Highlights publication shares recent examination findings, including information about recent enforcement actions that resulted, at least in part, from the CFPB's supervisory activities. These reports also communicate operational changes to the CFPB's supervision program and provide a convenient and easily-accessible resource for information on the CFPB's recent guidance documents. Supervisory Highlights does not refer to any specific institution in order to maintain the confidentiality of supervised entities. See https://www.consumerfinance.gov/compliance/supervisory-highlights/ (last visited Nov. 5, 2024). Regarding EFTA and Regulation E, a comment from consumer groups stated that oversight is needed to ensure payment app and digital wallet providers comply with the EFTA's consumer protections for electronic fund transfers, highlighted payment fraud as a significant risk, and stated that violations of the EFTA related to digital payments are extremely common, even among banks that are closely supervised by regulators. The commenter cited to several findings of EFTA violations from CFPB examinations in this area that the CFPB has published in Supervisory Highlights. A credit union association commenter stated that nonbanks that offer consumer payment services have error resolution responsibilities under Regulation E which the CFPB cannot effectively assess without exercising supervisory authority. Commenters also addressed risks posed to consumers associated with potential violations of the GLBA and Regulation P. 61 A comment from a group of State attorneys general supported the Proposed Rule in part because it would allow the CFPB to examine digital payment applications for compliance with the privacy provisions of the GLBA. The comment stated the Proposed Rule would permit the CFPB to address the critical data privacy issues posed by digital payment applications by allowing the CFPB to assess how applications are storing, using, and sharing their collections of sensitive consumer data as well as changes to larger participants' privacy policies. A consumer group commenter stated that its review had identified multiple risks associated with peer-to-peer payment application companies. The commenter stated that more than 25,000 consumers had signed a petition urging the CFPB to take action with respect to various risks posed by payments applications, including risks associated with fraud and collection and storage of consumer information. 62 61 Title V, subtitle A of the GLBA and its implementing regulation, Regulation P, govern the treatment of nonpublic personal information about consumers by financial institutions. 62 Similarly, other commenters emphasized potential risks with respect to use of consumer data and risks to consumer privacy that may be associated with payment application and digital wallet providers, including the risk of losing money through fraud or mistakes or having personal data collected and shared. Other commenters such as a company, nonprofits, and an industry association stated that the Proposed Rule did not adequately assess the degree of existing compliance or otherwise explain how it would promote compliance. For example, one commenter criticized the statement in the proposal that CFPB supervision would incentivize compliance as circular, given what it viewed as inadequate discussion in the Proposed Rule of the level of existing non-compliance or risks of non-compliance. 63 In addition, several industry comments suggested that EFTA/Regulation E, GLBA/Regulation P, or both do not apply to certain market participants, which they viewed as undermining the notion that the Proposed Rule would promote compliance with Federal consumer financial law. A company commenter added that the proposal did not explain how the prohibition against unfair, deceptive, or abusive acts or practices applied to market participants, or why supervision is the appropriate mechanism to identify and prevent any anticipated violations of Federal consumer financial law more broadly. Further, an industry commenter stated that State supervision by itself is more effective and better at enforcing the law than CFPB supervision. 63 Further below, the Final Rule summarizes and responds to comments more broadly addressing the general topic of risks to consumers in the market. Comments on Detecting and Assessing Risks to Consumers and Markets, Including Emerging Risks Comments from a group of State attorneys general, a payment network, a banking association, consumer groups, and nonprofits agreed that CFPB supervision of larger participants in this market would help the CFPB to detect and assess risks to consumers and markets, including emerging risks, in this rapidly growing and evolving market. For example, an industry association generally described the potential for CFPB supervision to promote maturity in the market, which it described as immature and rapidly evolving. 64 In addition, these comments pointed to several reasons why the CFPB supervision and examination process is well suited to this goal. A consumer group stated that supervisory authority is one of the most basic tools regulators have to identify new risks in the market as early as possible, before market failures with wide-ranging implications occur. Several consumer groups added that CFPB should not rely only on third-party sources of information to assess market activity, which would lead to delayed responses to problems, compared with supervision. 65 A nonprofit commenter stated that because supervision occurs outside of the adversarial legal process, it is an especially effective tool for rapidly gathering information that can prevent dubious practices before they develop. 64 In its view, the Proposed Rule may result in development of a robust, consumer-protected market, given how previous larger participant rules had helped to ensure consumer protection remains a prominent concern among participants in those markets. 65 These commenters also stated supervision of larger participants would allow the CFPB to respond more quickly to emerging problems affecting servicemembers who are especially vulnerable to identity theft and fraud in the market. Several comments also identified various existing and emerging risks in the market that the commenters believed the CFPB would be able to effectively detect and assess though supervision, including risks with respect to consumers' loss of funds and loss and misuse or abuse of data. The Final Rule summarizes these comments below. In addition, a group of State attorneys general stated that the rule will allow the CFPB to detect and assess risks that emerge not only from the existing products and services, but also as a result of future technological advancements in the market. With respect to the potential for consumers to lose funds or access to funds, a group of State attorneys general noted that research cited in the proposal indicated that almost a third of digital payment application users with lower incomes reported one or more problems related to funds being sent to the wrong person or not receiving funds that were sent to them. 66 These commenters stated that a lack of regulatory oversight has significantly contributed to those problems. A nonprofit commenter stated that larger participants pose unique risks to consumers related to what the commenter characterized as the lack of consumer protections associated with these applications, as well as the possible systemic risks they may present to the financial markets. The commenter raised specific concerns about the risk of consumer loss of funds from uninsured entities and lack of consumer awareness of such matters. The commenter also stated that CFPB supervision of these nonbank payment applications would, among other things, help to identify and mitigate systemic financial risk and enhance consumer protection. An individual commenter stated that the market had diverse participants but that there are common areas of risk with payment apps linked to a stored value product, including a risk of losing access to funds to pay for food or bills due to a technical glitch. Additional commenters raised various concerns about what they often described as fraud in the market and lack of related consumer protections, and a nonprofit commenter cited complaints submitted to the FTC regarding peer-to-peer payment fraud. At the same time, several industry commenters suggested that certain consumer protections such as EFTA/Regulation E or GLBA/Regulation P do not apply to some market participants, as described further above, and that consumers often are adequately protected by other parties to the transaction such as banks and credit unions, as described in the discussion of general comments about existing oversight of the market further below. 66 Consumer Reports P2P Survey at 7 (also indicating that of all respondents who have used a P2P service, 22 percent reported one or more such problems). See also 88 FR 80197 at 80200 n.25 (proposal's discussion of other data in this report, noted above). With regard to uses of consumer payments data, a banking association, a payment network, a nonprofit commenter, and several consumer groups stated that the way in which nonbanks can exploit the convergence of payments and commerce poses risk to consumers with respect to this market, such as through aggregation and monetization of consumer financial data. A group of State attorneys general added that supervision of larger participants would help the CFPB to detect and assess emerging risks in the use of consumer financial data as technology continues to evolve. And an individual commenter and several industry comments stated that consumer payments data is often used for purposes beyond initiation of the consumer payment transaction. 67 Several consumer groups described the level and use of consumer data collected by large technology firms as unreasonable and potentially dangerous. Several other commenters including individuals noted that the collection of such data also raises data security risks, including what a nonprofit commenter described as novel security risks raised by digital wallets. At the same time, other comments from industry suggested that data security risks to consumers were particularly low given the security and anti-fraud enhancements from market participants' reliance on features such as tokenization. 68 And a nonprofit commenter stated that government regulators generally are not effective at preventing data breaches as some of the largest have occurred at heavily-regulated institutions. 67 The Final Rule discusses and responds to these comments in more detail in the section-by-section analysis of the exclusion for certain marketplace activities described further below. 68 In addition, digital assets industry comments described what they viewed as additional security that digital assets provide. As discussed in the section-by-section analysis of the larger-participant test further below, the Final Rule does not count those transactions toward the larger-participant test. Some commenters disagreed that the goal of detecting and assessing risks including emerging risks warrants the proposed expansion of CFPB's supervisory authority in this market. For example, two nonprofit commenters stated that the rationale of detecting and assessing emerging risks was not supported by evidence, and instead only by the theoretical possibility of harm in an innovative, successfully-growing and popular market. Another nonprofit commenter stated that the proposal did not examine the nature of the emerging risks, whether by mentioning novel security risks posed by digital wallets or other harms. Another nonprofit commenter stated its belief that market participants' responses to the CFPB's previous market-monitoring orders generated adequate information for the CFPB to determine the level of risks posed by this emerging market. 69 Two industry associations stated that they agreed in principle that regulation needed to evolve along with new technology, but they stated that the CFPB first must identify harms it perceives in the market before proposing to supervise its larger participants. Another industry association agreed, stating that the Proposed Rule merely described the possibility of “new risks” from “new product offerings” and did not state what the “new risks” might be. It pointed to market reports that, in its view, indicated that nonbanks' multi-sided business models in the digital economy provide new benefits to consumers and promote competition. 70 A nonprofit commenter characterized the proposal as referring to hypothetical risks that may occur in the future, and described this reference as a mere pretext to support an agenda to target large technology firms. An industry commenter added that the goal of detecting and assessing new and emerging risks is inadequate as a foundation for a larger participant rule. In its view, the CFPB can only engage in larger participant rulemakings when it identifies risks that supervision would mitigate. The commenter also asserted that, because the CFPB must consider risks to consumers in exercising its supervisory authority under section 1024(b)(2), the CFPA also requires that the CFPB establish the existence of specific risks to consumers that would be mitigated by supervision when issuing a larger participant rule under section 1024(a)(1)(B) and (2). The industry commenter also claimed that principles of administrative law likewise require the rule to target identified risks. 71 69 However, this commenter also recommended that the CFPB continue to gather information on the market before expanding its supervisory authority as proposed. 70 Separately, this commenter observed that the financial technology sector that encompasses the proposed market often uses advanced technologies including artificial intelligence, block chain technology, and data mapping to create new financial products and services that are beneficial in various ways. This commenter did not state that such products posed any risk or could pose any emerging or new risks. 71 The commenter also stated in a footnote that if the rule does not need to identify meaningful risks to consumers then the CFPA would violate the non-delegation doctrine in constitutional law. The commenter did not explain the basis for that view, and the CFPB disagrees with that view. Through the CFPA, Congress has provided guidance to the CFPB on how to exercise its rulemaking authority under 12 U.S.C. 5514(a)(1)(B) and has imposed limits on that authority, including rules of construction for defining larger participants and policy considerations, which the CFPB has addressed in this Final Rule. More broadly, many of the industry commenters and other commenters stated that the Proposed Rule did not adequately consider whether market activity currently poses risks to consumers and if so how and to what degree. Other commenters similarly stated that the proposal failed to establish that certain provisions of Federal consumer financial law apply to market participants; that the proposal failed to identify potential violations of law or other specific harms that the Proposed Rule would seek to address, or any relevant market failures; and that the CFPB should first issue a report articulating the risks it sees in the proposed market or otherwise identify such risks prior to issuing a final rule. 72 Certain commenters also stated that the CFPB should evaluate risk separately with respect to various subcomponents of the market described in the Proposed Rule, and argued for the exclusion of various market participants, as discussed in more detail in the section-by-section analysis of the corresponding component of the market definition further below. 73 Finally, a nonprofit commenter stated that the CFPB should provide greater clarity to market participants as to how the CFPB would assess risk in its prioritization process in this market, including what risks it would consider. 72 A nonprofit commenter stated that the unique data security risks that digital wallets pose should be addressed through public education rather than regulation. As noted above, consumer education is outside the scope of this rule and, for the reasons explained in the response to general comments, education is not a substitute for supervision. 73 Some commenters suggested that CFPB supervision itself would increase risk such as by reducing examinees' resources available for fraud prevention, or exposing the supervised entity's data to breaches. For the reasons explained in the impacts analysis in part VII, the CFPB has not determined the Final Rule will reduce fraud prevention. With regard to the risk of data breaches, the CFPB's information security system mitigates those risks as further discussed in part VII. Comments on Ensuring Consistent Enforcement of Federal Consumer Financial Law Between Banks and Nonbanks Some comments addressed the Proposed Rule's statement that the rule would further the CFPB's statutory mandate to ensure consistent enforcement of Federal consumer financial law between nonbanks and banks and credit unions, in order to promote fair competition. Several consumer groups, banking and credit union industry associations, a payment network, some nonprofits, and an industry provider generally agreed that the Proposed Rule would have that benefit. For example, a community banking association stated that community banks have long expressed concerns that financial technology and large technology firms are offering financial products and services traditionally provided by banks, without the same level of regulatory oversight. A banking association stated that consumers are best protected when banks and nonbanks offering similar financial products and services are subject to the same oversight, which mitigates the potential for consumer harm and improves consumer trust and confidence. This commenter and another banking association added that establishing parity in supervision will help to ensure that nonbanks provide the same consumer protections when they provide the same services as banks. A payment network and a nonprofit commenter agreed that the proposal would help to ensure that entities engaged in the same functional activities are subject to the same functional regulation. Some comments described nonbanks as deriving a competitive advantage due to their lesser supervisory oversight, and banks and credit unions as disadvantaged. For example, the credit union industry association commenter stated that the lesser supervisory oversight of nonbank peer-to-peer payment apps increases burdens on credit unions responding to consumer disputes of transactions conducted in those apps due to the app providers' underinvestment in compliance and customer service and consumer preferences for contacting the credit union. The community banking association also stated that this gap in oversight erodes consumer trust. One of the banking industry associations agreed, noting that its 2022 survey found that an overwhelming majority of consumers were concerned about a gap in regulatory oversight between fintech firms (including cryptocurrency firms) and banks, and believed that the CFPB and Congress should do more to protect consumers from harm and abuse in these areas. 74 74 Consumer Bankers Ass'n, Press Release, NEW POLL: Nearly Ninety Percent Of Americans Concerned That Fintech & Crypto Firms Do Not Have Appropriate Level of Federal Regulation (Dec. 12, 2022) (describing 56 percent of respondents that want greater oversight compared to 24 percent who are satisfied with existing oversight), https://consumerbankers.com/press-release/new-poll-nearly-ninety-percent-of-americans-concerned-that-fintech-crypto-firms-do-not-have-appropriate-level-of-federal-regulations/ (last visited Nov. 18, 2024). At the same time, some industry and nonprofit commenters challenged the potential for Proposed Rule to promote consistent enforcement of Federal consumer financial law as between nonbanks and depository institutions, and thereby promote fair competition, as well as the appropriateness of that consideration in the rulemaking. For example, some of these commenters described the proposed objective as an illegitimate form of “mission creep . . . outside of [the CFPB's] core jurisdiction” or further suggested that the Proposed Rule would place the CFPB in the role of market gatekeeper for nonbanks, which would frustrate competition and innovation (which one of these commenters described as the effect that banking regulation already has on banks). Some industry commenters also suggested the objective failed to account for the structure of nonbank market activity vis-à-vis banks and credit unions. For example, an industry association stated that many nonbank market participants either complement banks and credit unions by making it easier for consumers to use payment methods provided by those financial institutions, or partner directly with the banks and credit unions. Some banking associations also expressed concern that the rule would increase indirect burden on banks and may create confusion about differences between banks and nonbanks. As another example, an industry provider stated that banks provide deposit accounts (and associated funds transfer functionalities), not pass-through payment wallets allowing consumers to access payment methods issued by third-party financial institutions. 75 And for that reason, in its view, increased oversight of those activities would not serve the CFPB's stated purpose. However, another industry association stated that banks have been introducing their own digital wallets, both directly and through affiliates, in an effort to compete with nonbank incumbents that have embedded their digital wallets into merchant checkout processes. 75 As discussed below in the section-by-section analysis of the definition of “covered payment functionality,” the preamble uses the phrase pass-through payment wallet to describe this type of functionality discussed by commenters. Finally, an industry association also suggested that in some ways the Final Rule may not promote consistent enforcement of Federal consumer financial law. It stated that the CFPB should explain why larger participants in the proposed market should be subject to what it viewed as significantly more CFPB supervisory authority than exists over other persons that facilitate consumer payment transactions, such as banks and credit unions providing physical payment cards and providers of payment applications that do not have “general use” as defined in the Proposed Rule such as automobile purchase applications and food delivery applications. 76 76 The commenter also stated the Proposed Rule excluded from “general use” bill-payment applications and applications used to purchase financial assets including securities. However, the Proposed Rule specifically acknowledged the existence in the market of “a general-use bill-payment function.” 88 FR 80197 at 80206. In addition, the Proposed Rule did not list applications for purchase of securities among the examples of activities that do not have “general use” because it already excluded those transaction from the proposed definition of “consumer payment transaction” as discussed in the section-by-section analysis of that term further below. Comments on Other Regulators' Existing Oversight Authority Some commenters suggested the rule would help existing regulatory oversight efforts in the market, while others stated that the Proposed Rule did not adequately consider whether the CFPB supervisory authority was needed in light of existing regulatory oversight mechanisms of other regulators. A group of State attorneys general stated that the Proposed Rule would allow Federal and State authorities to coordinate to prevent and abate unfair, deceptive, and abusive acts and practices in the market. They indicated that violations of Federal law detected through CFPB's supervisory examinations could assist State enforcement, including in States such as California, New Jersey, and New York, where a commercial practice that violates Federal law is deemed or presumed to violate the State's consumer protection laws. On the other hand, some other commenters stated that the Proposed Rule did not adequately consider the degree to which the market already is overseen by other regulators, including State oversight of nonbank market participants that are money transmitters, Federal prudential regulators' oversight with respect to banks and credit unions that provide accounts, hold funds, and process payments facilitated by nonbank market participants, and FTC enforcement of consumer protection laws including competition laws. 77 Several industry associations stated that the rulemaking generally must better account for the potential for CFPB supervision to duplicate the oversight by those other regulators, and the unnecessary burdens and diverging regulatory expectations that such duplicative supervision can create. 78 One of these commenters stated that the CFPB should clarify the scope and requirements of the rule to prevent these outcomes, and stated that close coordination by the CFPB with other regulators is needed before the CFPB pursues oversight of larger participants. 77 A few industry comments also mentioned Federal oversight of money transmitters by FinCEN in the U.S. Treasury. These commenters did not describe any nexus between that oversight and compliance with Federal consumer financial law, or otherwise suggest that supervisory activity by FinCEN and the CFPB would have overlapping subject matter related to compliance with Federal consumer financial law. 78 Some commenters also discussed Federal prudential regulators' existing oversight of banks and credit unions as relevant due to the inclusion in the market of nonbanks that partner with banks and credit unions, and of pass-through payment wallets that facilitate the use of accounts provided by banks and credit unions. The Final Rule summarizes and responds to those comments in more detail in the section-by-section analysis of “covered payment functionality” below. With respect to existing State oversight, an industry association stated that State financial regulators supervise various aspects of the market and the CFPA requires the CFPB to account for oversight by State authority when exercising its supervisory authority. Two other industry associations indicated that in their view the Proposed Rule did not consider how the CFPB would address overlap in scope with State examinations on the same subject matter particularly at money transmitters. A nonprofit commenter suggested that State oversight is sufficient because States are better at enforcing the law because they have a better understanding of local conditions. 79 79 This commenter also stated that States generally occupy the field of consumer protection law, that Federal supervisory oversight by the CFPB would “preempt” State law, and that the proposal did not provide compelling evidence for doing so. The CFPB disagrees that a larger participant rule, which establishes CFPB supervisory authority and does not impose substantive consumer protection obligations, preempts such State consumer protection laws. Comments on CFPB Enforcement and Market-Monitoring Authorities An industry association stated that the Proposed Rule did not explain how supervisory authority would promote additional compliance with Federal consumer financial law beyond compliance the CFPB ensures through its enforcement function and aided by its market-monitoring function. A nonprofit suggested that CFPB enforcement is sufficient to address risks to consumers, and that supervision would only impose unnecessary burden. Comments Raising “Major Questions” Doctrine Another area of comment related to the “major questions doctrine.” Those commenters who addressed the doctrine generally were critical of the Proposed Rule and took an expansive view of the circumstances in which the doctrine applies. First, one nonprofit commenter stated that the major question doctrine precludes the CFPB from defining larger participants in a digital wallet market generally. This commenter stated that, despite the existence of digital wallets at the time of adoption of the CFPA, Congress did not expressly include them within the scope of CFPB supervisory authority and therefore chose to foster innovation free from the CFPB's supervisory oversight. Further, in its view, the market has vast economic and political significance given both the aggregate dollar value of transactions on digital wallets (nearly $1 trillion) and references by the CFPB to payment systems as “critical infrastructure” and to “Big Tech” companies. 80 Second, some commenters stated that the CFPB's interpretation of the merchant payment processing exclusion in CFPA section 1002(15)(A)(vii)(I) also is impermissible under the major questions doctrine. 81 Third, some commenters stated that the major questions doctrine voids the CFPB's interpretation of CFPA section 1024(b) as authorizing supervision of all consumer financial products and services provided by a larger participant for compliance with Federal consumer financial law and related risks. 82 80 CFPB Press Release (Nov. 7, 2023) (announcing Proposed Rule), https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-new-federal-oversight-of-big-tech-companies-and-other-providers-of-digital-wallets-and-payment-apps/ (last visited Nov. 8, 2024). 81 In addition, some commenters stated that the inclusion of certain digital assets transfers in the proposed definition of consumer payment transactions raised a “major question.” As discussed further below, the CFPB has decided, for purposes of this Final Rule, not to define larger participants in the general-use digital consumer payment applications market by reference to activity involving digital assets. This Final Rule therefore does not address these major questions comments further. 82 As discussed further above in the general comments on how the rule would enable the CFPB through its supervisory activity to detect and assess risks to consumers and markets, a nonbank commenter claimed that the larger participant rule itself must identify meaningful risk, or it would violate the major questions doctrine. For the reasons described below in the response to these general comments above, the CFPB disagrees with both claims. The CFPB also disagrees that this rule implicates the major questions doctrine for reasons discussed below. Comments on Potential Scope of CFPB Examinations of Larger Participants Relatedly, the CFPB received several other comments on the proposal's statement that the CFPB's supervisory authority is not limited to the products or services that qualified a person for supervision, but also includes other activities of such a person that involve other consumer financial products or services or are subject to Federal consumer financial law. 83 Four commenters (representing the banking industry) expressed agreement with the CFPB's description of its supervisory authority over larger participants. They stated that the CFPB's position is consistent with how the CFPB supervises large banks, where every consumer financial activity that the bank engages in is subject to CFPB jurisdiction. Several other commenters (several industry trade groups, an individual company, and a law firm) disagreed with the CFPB's description of its supervisory authority. These commenters generally interpreted CFPA section 1024 to limit the scope of nonbank supervisory authority over larger participants to specific consumer financial products and services included in the market covered by the corresponding larger participant rule. One of these commenters asserted that the rule could not be used by the CFPB to scrutinize the digital assets business lines of entities, including those already subject to supervision. One commenter also suggested that even if the CFPA's view of its authority is correct, it would be unreasonable for the CFPB to actually exercise that authority because the costs of such supervision would exceed the benefits. Another said the exercise of such authority would discourage innovation and competition. 83 88 FR 80197 at 80198 n.7 (quoting 77 FR 42874 at 42880). Response to General Comments Received After first responding to comments on rulemaking process issues, the Final Rule provides a response below to other general comments. For the reasons described below, the CFPB continues to believe that issuance of this larger participant rule is warranted because: (1) the market has grown dramatically and become increasingly important to the everyday financial lives of consumers; (2) CFPB supervisory authority over its larger participants would help the CFPB to promote compliance with Federal consumer financial law; (3) that authority would help the CPFB to detect and assess risks to consumers and the market, including emerging risks; and (4) that authority would help the CFPB to ensure consistent enforcement of Federal consumer financial law between banks and nonbanks. Rulemaking Process While the CFPB was considering comments on the Proposed Rule, the Supreme Court issued a decision ruling that the CFPB funding mechanism is constitutional under the Appropriations Clause. 84 The CFPB disagrees with commenters' suggestion that it should have forgone larger participant rulemaking activity during such a challenge. 84 CFPB v. Cmty. Fin. Servs. Ass'n of Am., Ltd., 601 U.S. 416 (2024). The CFPB also disagrees with those commenters suggesting that an extension of the comment period was necessary to allow for meaningful input on the Proposed Rule. The Proposed Rule would have a narrow impact, establishing CFPB supervisory authority over a group of nonbank covered persons who already are subject to CFPB enforcement and market-monitoring authority, and at least some of whom already are subject to CFPB supervisory authority on other grounds. Despite this, the CFPB received timely comments from a wide array of commenters, as described above, and all but one of the commenters described here filed timely comments after requesting more time. The CFPB disagrees that an extension of the comment period is warranted based on the proposal of a market definition that commenters viewed as complex or a larger-participant test with more than one criterion. As discussed below, commenters provided numerous useful comments about the proposed market definition and the CFPB is making several adjustments to the market definition in the Final Rule in response including to improve clarity. With regard to the larger-participant test, the CFPB proposed a test that was based on two criteria (consumer payment transaction volume and the entity's size by reference to SBA size standards) that were explained in the proposal and are not especially complicated. Proposed rules often include small entity exclusions, and many commenters provided substantive comments on the proposed exclusion, as discussed further below. 85 Further, it was unnecessary to extend the comment period with an accompanying notice of the risks the CFPB believes market participants pose to consumers because, as explained in the Proposed Rule and discussed below, the CFPB is not required to make findings about relative risks in a market to justify issuing (or proposing) a larger participant rule. Finally, the CFPB notes that the Proposed Rule set a January 8, 2024, deadline for filing of comments, about two months after the rule was issued on November 7, 2023, and 52 calendar days after its November 17, 2023, publication in the Federal Register . Commenters had well over 30 days to prepare comments even accounting for the end-of-year holiday season. 86 Indeed, several of the requests for an extension cited their own substantive comments on the Proposed Rule as the reasons for requesting an extension. For these reasons, the CFPB also disagrees with the industry comment suggesting that the lack of extension of the comment period supports a conclusion that the CFPB should withdraw the Proposed Rule. 85 With respect to the proposed coverage of digital assets, commenters from the digital asset sector provided extensive and detailed comments, demonstrating that those commenters were able to provide meaningful input on the Proposed Rule during the comment period. In any event, as discussed below, the CFPB has decided, for purposes of this Final Rule, not to define larger participants in the general-use digital consumer payment applications market by reference to activity involving digital assets. 86 The extensive comments in the rulemaking record demonstrate that the presence of Federal holidays (Veteran's Day after issuance of the proposal and Thanksgiving, Christmas, and New Years after publication in the Federal Register ) and a concurrent proposal and ongoing market monitoring in this market did not preclude commenters from offering detailed substantive comments. In any event, the CFPB sent the market-monitoring inquiries to a limited number of firms and issued the parallel proposal (which, unlike this rulemaking, proposed substantive consumer protections) almost three weeks earlier with a 60-day comment period. Establishing CFPB Supervisory Authority Over the Large and Growing Market As described above, commenters agreed with the findings in the Proposed Rule that the market has grown rapidly to achieve a significant size with high levels of adoption and broad reliance by consumers on general-use digital consumer payment applications. As the proposal explained in detail, the market for general-use digital consumer payment applications has large and increasing significance to the everyday financial lives of consumers, who are growing increasingly reliant on such applications to initiate payments. 87 Further growth can be anticipated. 88 For example, as the proposal stated, nonbank digital payment applications have rapidly grown in the past few years to become the most popular way to send money to other individuals other than cash, and are used for a higher number of such transactions than cash. 89 The proposal also cited various market research publications indicating that most merchants in the United States accept general-use digital consumer payment applications as a means or method of payment. Given the extent of consumer adoption and reliance, the extent of the consumer payment transaction volume (approximately 13.5 billion annually) and value (approximately $1.2 trillion annually), and the breadth of associated consumer data collected, it is important for the CFPB to establish Federal supervisory oversight of larger participants. 87 See 88 FR 80197 at 80200-80201. 88 Id. 89 Id. The CFPB also has considered the industry association commenter's observation that the market for general-use digital consumer payment applications as defined in the Proposed Rule may not have reached the maturity stage in the industry lifecycle. The CFPB acknowledges that, compared to the markets covered by previous larger participant rulemakings, 90 this market has developed more recently, fueled by technological change. In the years after a large nonbank financial technology firm developed the first well-known digital payment app in the late 1990s, 91 other large fintech firms including BigTech firms 92 entered and expanded the market by leveraging new digital consumer technologies, such as smartphones that support digital applications (which proliferated starting in the late 2000s) 93 and smartphone near-field communication (NFC) technologies that support in-store payments (which proliferated in the 2010s). 94 More recently, well-known market participants have been bundling consumer financial products and services to help consumers to make payments to friends and family and payments to merchants together in the same digital application. Although the market is newer than some other consumer finance markets, consumer adoption for these types of consumer payment transactions already has reached very high levels. As described in the Proposed Rule and explained above, general-use digital consumer payment applications already play a fundamental role in facilitating the payments that many consumers in the United States make every day. Therefore, the CFPB believes it is an appropriate time for it to issue a rule to establish the authority of the CFPB to supervise larger participants in this market. The CFPB reaches that conclusion in the Final Rule not solely due to the size of the market and its growth, but in conjunction with its goals described below of promoting compliance with Federal consumer financial law, detecting and assessing risks to consumers and markets, and ensuring consistent enforcement of Federal consumer financial law. 90 Following significant growth in the 1980s, by 1990, personal remittances from the United States had reached over US$10 billion. See World Bank Group, Personal remittances, paid (current US$)—United States, https://data.worldbank.org/indicator/BM.TRF.PWKR.CD.DT?locations=US (last visited Nov. 5, 2024). Nearly two decades earlier, consumer reporting agencies and consumer debt collection markets had already grown to the point that Congress adopted substantive consumer protection legislation to regulate them. See Public Law 91-508 (Oct. 26, 1970) (title VI adopting Fair Credit Reporting Act); Public Law 95-109 (Sept. 20, 1977) (Title VIII adopting Fair Debt Collection Practices Act). By that time, following adoption of the Higher Education Act of 1965, Public Law 89-329 (Nov. 8, 1965), student lending and student loan servicing had already been expanding. And largescale consumer automobile financing dates back to at least the 1920s. See Buy Now Pay Later: A History of Personal Credit, Harv. Bus. School Library (section titled “Cards on time” noting that “[i]n the 1920s, auto financing took a giant leap forward when the car manufacturers entered the game”), https://www.library.hbs.edu/hc/credit/credit4d.html (last visited Nov. 5, 2024). 91 PayPal Editorial Staff, Alternative and digital payment methods: Shaping the payment industry and preparing for the future (Dec. 18, 2023) (stating that “[t]he first digital solution in the alternative payment industry was PayPal, developed in 1998 to enable people to make payments via an email address”), https://www.paypal.com/us/brc/article/alternative-payment-method-trends (last visited Nov. 5, 2024). 92 Consistent with its use by the Financial Stability Board, the Final Rule uses the term “BigTech” to refer to large technology companies with extensive customer networks. See, e.g., Financial Stability Board Report P091219-1, BigTech in finance—Market developments and potential financial stability implications (Dec. 9, 2019) at 3 (“BigTech firms are large technology companies with extensive established customer networks. Some BigTech firms use their platforms to facilitate provision of financial services. Those that do so can be seen as a subset of FinTech firms—a broader class of technology firms (many of which are smaller than BigTech firms) that offer financial services.”), https://www.fsb.org/wp-content/uploads/P091219-1.pdf (last visited Nov. 5, 2024). 93 Apple Press Release, Apple Reinvents the Phone with iPhone (Jan. 9, 2007), https://www.apple.com/newsroom/2007/01/09Apple-Reinvents-the-Phone-with-iPhone/ (last visited Nov. 5, 2024); Michael DeGusta, Are Smart Phones Spreading Faster than Any Technology in Human History? MIT Technology Review (May 9, 2012) (citing data that smart phones, which represented only six percent of U.S. mobile phone sales as of 2006, had grown to a two-thirds share as of 2012, with use by nearly 40 percent of the U.S. population), https://www.technologyreview.com/2012/05/09/186160/are-smart-phones-spreading-faster-than-any-technology-in-human-history/ (last visited Nov. 5, 2024). 94 CFPB Contactless Payments Spotlight, supra. Promoting Compliance With Federal Consumer Financial Law As described in the proposal, supervision of larger participants in a market for general-use digital consumer payment applications will help ensure those companies are complying with applicable requirements of Federal consumer financial law. 95 One of the primary purposes of supervision under CFPA section 1024(b)(1) is “assessing compliance with the requirements of Federal consumer financial law,” and the Final Rule will further the CFPB's ability to assess compliance by larger participants with the requirements of those laws. 96 95 88 FR 80197 at 80201, 80212. 96 See 12 U.S.C. 5514(b)(1)(A). As identified by several commenters and described further above, the larger participants defined in the Rule engage in activities that are subject to applicable Federal consumer financial law such as the prohibition against unfair, deceptive, and abusive acts and practices set forth in the CFPA; the EFTA and its implementing Regulation E; and the data privacy protections of the GLBA and its implementing Regulation P. The CFPB disagrees with the comments suggesting that certain larger participants would not be subject to any Federal consumer financial laws. 97 The larger participants defined by the rule are covered persons under the CFPA and would at a minimum be subject to the CFPA's prohibition against unfair, deceptive, and abusive acts and practices. 98 Assessing compliance with the prohibition against unfair, deceptive, and abusive acts and practices is itself important, because such practices can cause significant harm to consumers. 99 Many of these commenters also acknowledged that some of the other Federal consumer financial laws would apply to at least a subset of the larger participants defined by the Proposed Rule. 100 97 As discussed further below, the CFPB disagrees with industry commenter suggestions that pass-through payment wallets are excluded from the scope of the CFPA as “electronic conduit services.” 98 See 12 U.S.C. 5481(5) (defining the term “covered person”), 5531 (applying prohibition against unfair, deceptive, and abusive acts and practices to all “covered persons” as well as other persons), 5536 (same). The CFPB also can supervise larger participants for other Federal consumer financial laws that apply, including laws that take effect or for which compliance is mandatory in the future. For example, the CFPB recently finalized a personal financial data rights rule under its CFPA authority that is part of Federal consumer financial law and that generally applies to market participants. CFPB, Final Rule, Required Rulemaking on Personal Financial Data Rights, 89 FR 90838 (Nov. 18, 2024) (CFPB Personal Financial Data Rights Rule). As another example, the CFPB's nonbank registration regulation imposes requirements on covered nonbanks related to the registration of covered orders including, for covered nonbanks that are supervised registered entities, written-statement requirements. See 12 CFR 1092.201(q), 1092.204. 99 For example, under the CFPA, an unfair act or practice must cause or be likely to cause “substantial injury” to consumers. 12 U.S.C. 5531(c)(1); see also, e.g., Supervisory Highlights Issue 18, Winter 2019 at 13-14 sec. 3.1.2, https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-18_032019.pdf (last visited Nov. 13, 2024) (noting that CFPB supervisory activities resulted in or supported the public enforcement action resolved in 2019 by consent order In re: Enova International, Inc., Admin. Proc. File No. 2019-BCFP-0003 (Jan. 25, 2019) ¶¶ 9-33 (describing unfair acts and practices including repeat debiting of consumer accounts without valid authorization), https://files.consumerfinance.gov/f/documents/cfpb_enova-international_consent-order_2019-01.pdf (last visited Nov. 13, 2024); Supervisory Highlights Issue 21, Winter 2020 at 16 sec. 4.1 (noting that CFPB supervisory activities resulted in or supported the public enforcement action resolved in 2019 against Maxitransfers Corporation including deceptive acts and practices in statements in terms and conditions regarding company's responsibility for errors by their agents), https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-21_2020-02.pdf (last visited Nov. 13, 2024); Issue 32, Spring 2024, supra, at 14 sec. 4.1 (noting that CFPB supervisory activities resulted in or supported the public enforcement action resolved in 2023 against Toyota Motor Credit Corporation finding several unfair acts and practices). 100 For a discussion of comments suggesting that the market should be confined to entities that receive or hold the funds being transferred in consumer payment transactions, or that the market should cover consumer payment transactions that transfer funds from nonbank accounts but not from bank accounts, see the section-by-section discussion below of Final Rule § 1090.109(a)(2) regarding the term “consumer payment functionality.” The CFPB agrees with the commenters that stated that this rule will help the CFPB to ensure compliance with Federal consumer financial laws, and disagrees with those that stated that it would not. The CFPB's supervisory authority will promote compliance with applicable legal requirements in multiple ways. As described in the proposal, under the CFPA, the CFPB shall use its supervisory authority to “assess[ ] compliance with the requirements” of Federal consumer financial laws 101 and to “obtain[ ] information about the activities and compliance systems of procedures” of market participants. 102 The CFPB may review the entity's activities and compliance systems or procedures and issue supervisory findings or criticisms as appropriate. 103 101 See 12 U.S.C. 5514(b)(1)(A). 102 See 12 U.S.C. 5514(b)(1)(B). 103 See also discussion below regarding 12 U.S.C. 5514(b)(1)(C) in connection with the use of CFPB supervisory authority for the purpose of “detecting and assessing risks to consumers and markets for consumer financial products and services,” including the CFPB's use of its authority under the Final Rule to better understand how the Federal consumer financial laws apply to larger participants defined by the rule and the products and services they offer and to review and mitigate risks related to noncompliance. Supervision is one of the CFPB's most important and powerful tools to protect consumers by promoting compliance with Federal consumer financial law. As discussed in the proposal and as a nonprofit commenter emphasized, the prospect of the CFPB exercising supervisory authority over such firms may cause them to allocate additional resources and attention to compliance and to take steps to mitigate any noncompliance. 104 In addition, based on the CFPB's supervisory experience in other markets, the CFPB's supervisory activities authorized under the Final Rule are likely to help entities to identify issues before they become systemic or cause significant harm. Through its supervisory activity, the CFPB detects and addresses legal violations. In some instances, the CFPB uses enforcement actions to address violations that it originally identified through supervision. The CFPB also uses supervision to help ensure that supervised entities develop and maintain systems and procedures to prevent and remedy violations. CFPB supervisory reviews and related compliance ratings promote the development of compliance risk management practices designed to manage consumer compliance risk, support compliance, and prevent consumer harm. 105 Through supervision, CFPB examiners may articulate supervisory expectations to supervised larger participants in connection with supervisory events. 106 The CFPB also notes that, following the issuance of its five prior larger participant rules, it has successfully used its supervisory authority to detect violations and promote compliance in each of the markets covered by those rules, as the CFPB has documented in its periodic publication Supervisory Highlights. 107 Thus, the CFPB disagrees with comments criticizing the proposal's statement that CFPB supervision will help to ensure that larger participants are complying with applicable requirements of Federal consumer financial law. 108 Moreover, by authorizing the CFPB to supervise larger participants, the Rule will promote strong compliance risk management practices in this market. 109 The CFPB also disagrees with commenters stating that CFPB supervision generally harms consumers by reducing the resources available to those companies. Instead, CFPB supervision as provided under the rule will, as intended by Congress, promote compliance with Federal consumer financial law and otherwise facilitate the CFPB's statutory objectives. For the reasons discussed above, the CFPB concludes that the rule will help the CFPB to promote compliance with Federal consumer financial law in the market. That, in turn, will reduce risks of harm to consumers, as also discussed in the impacts analysis in part VII below. 104 See 88 FR 80197 at 80211-12. 105 See, e.g., Federal Financial Institutions Examination Council, Uniform Interagency Consumer Compliance Rating System, 81 FR 79473, 79474 (Nov. 14, 2016) (discussing assessment by agency examiners of consumer compliance), https://www.ffiec.gov/press/pr110716.htm (last visited Nov. 5, 2024). 106 See CFPB, Bulletin 2021-01: Changes to Types of Supervisory Communications (Mar. 31, 2021), https://files.consumerfinance.gov/f/documents/cfpb_bulletin_2021-01_changes-to-types-of-supervisory-communications_2021-03.pdf (last visited Nov. 5, 2024). 107 The CFPB publishes Supervisory Highlights on its website several times each year at https://www.consumerfinance.gov/compliance/supervisory-highlights/ (last visited Nov. 5, 2024). Since its first larger participant rules took effect in late 2012 and early 2013, these publications have highlighted findings of violations of Federal consumer financial law and compliance management weaknesses from examinations in markets subject to its larger participant rules. See, e.g., Issue 4, Spring 2014 at 8-10 (consumer reporting market), at 11-14 (consumer debt collection market); Issue 10, Winter 2016 at 11-14 (international money transfer market). For the most recent examples, see, e.g., Issue 35, Fall 2024 (automobile finance market); Issue 34, Summer 2024 (consumer debt collection market); Issue 32, Spring 2024 at 4-7 (consumer reporting market); Issue 31, Fall 2023 at 13-14 (international money transfer market); Issue 30, Summer 2023 at 4-8 (automobile financing market), at 8-9 (consumer reporting market), at 12-13 (consumer debt collection market), at 29-30 (international money transfer market); Issue 29, Winter 2023 at 14-15 (student loan servicing market); Issue 28, Fall 2022 at 4-7 (automobile financing market), at 7-8 (consumer reporting market), at 16-17 (consumer debt collection market); Issue 27, Fall 2022 at 14-25 (student loan servicing market); Issue 26, Spring 2022 at 5-11 (consumer reporting market), at 14-16 (consumer debt collection market), at 22-25 (international money transfer market), at 25-27 (student loan servicing market). 108 See 88 FR 80197 at 80201. Further, the CFPB disagrees that it is required to make findings of noncompliance in the market in order to issue this rule, for generally the same reasons (discussed below) that it is not required to make findings regarding the level of risk in the market or market failure. 109 For example, as discussed in the impacts analysis further below in part VII, entities may improve their compliance management either in response to the possibility of an examination or in response to an examination finding regarding compliance management weaknesses. See also CFPB Supervision and Examination Manual, part II.A (describing how CFPB examinations conduct compliance management reviews). Detecting and Assessing Risks to Consumers and Markets, Including Emerging Risks The CFPB concludes that this rule will help the CFPB to detect and assess risks to consumers and markets from the provision of general-use digital consumer payment applications. As explained in the Proposed Rule and for the reasons elaborated further below, the CFPB agrees with comments suggesting that CFPB supervision of larger participants in this rapidly-growing and evolving market will be especially useful to the detection and assessment of emerging risks. As discussed below, the CFPB disagrees with the commenters that stated that the CFPB must first make a risk determination before establishing supervisory authority over larger participants by rule. The CFPB concludes that establishing its supervisory authority over larger participants in this market would help it to detect and assess emerging risks for several reasons. First, the CFPB shares the view of the group of State attorneys general and other commenters that this highly-concentrated market will continue to grow and evolve rapidly as the technology that has fueled its rapid growth also continues to evolve. As with other markets the CFPB now supervises, it is important for the CFPB to be able to closely assess whether pressure to sustain high growth in this market will drive nonbank firms to develop new and increasingly risky products. 110 110 Cf. Financial Crisis Inquiry Commission Report (Feb. 25, 2011) at 104 (“The refinancing boom was over, but originators still needed mortgages to sell to the Street. They needed new products that, as prices kept rising, could make expensive homes more affordable to still-eager borrowers. The solution was risker, more aggressive, mortgage products that brought higher yields for investors but correspondingly greater risks for borrowers.”), at 414 (also noting that “high-risk, nontraditional mortgage lending by nonbank lenders flourished in the 2000s and did tremendous damage in an ineffectively regulated environment, contributing to the financial crisis”), https://www.govinfo.gov/content/pkg/GPO-FCIC/pdf/GPO-FCIC.pdf (last visited Nov. 6, 2024). In addition, the CFPB agrees with the comments expecting that the market will continue to grow, including by expanding how general-use digital consumer payment applications help consumers to make payments in other ways. As the proposal explained, it is critical for the CFPB to be able to detect and assess emerging risks as new product offerings blur the traditional lines of banking and commerce. 111 This blurring was noted by several commenters that described a trend toward “embedded finance” described above and is illustrated in industry comments discussed below describing various ways that nonbanks' general-use digital payment applications serve as intermediaries between consumers and merchants. 112 Such applications also can facilitate payments from many different types of accounts consumers hold across multiple financial institutions. Supervision can detect and assess risks that may arise from a single application establishing connections that can cause payments to be made from many different consumer accounts. 113 In addition, as noted in the industry report cited by a consumer group commenter, consumers also can use payment functionalities embedded in digital applications, such as text messages, to make payments, including peer-to-peer payments. 114 111 For example, the proposal noted how in its 2022 market-monitoring report on the convergence of payments and commerce, the CFPB described the potential for consumer financial data and behavioral data to be used together in increasingly novel ways. 88 FR 80197 at 80201 and n.43. 112 See section-by-section analysis of § 1090.109(a)(1) and of “covered payment functionality” in 1090.109(a)(2). See also Google LLC Embedded Finance White Paper at 7 (“Embedded finance also offers a bonus for financial services companies: The data you collect from each transaction can help enhance customer service experience and innovate new products and experiences. The possibilities are endless for these kinds of partnerships, with high revenue and business growth potential. Before embarking on the embedded finance journey, however, you'll need to prepare” by, among other steps, “[p]lan[ning] to manage and analyze the vast trove of data you'll be collecting.”); CFPB Report on Convergence of Payments and Commerce, supra, at sec. 3.3 (“Embedded commerce”). 113 Today, a general-use digital consumer payment application can initiate payments from multiple credit cards, prepaid accounts, and checking accounts. A general-use digital consumer payment application can facilitate payments from accounts that the provider offers through depository institution partners, or from linked accounts issued by other institutions (sometimes referred to as pass-through payments). 114 Google LLC Embedded Finance White Paper at 3; Apple Cash website (“Send and Receive Money in Messages. With Apple Cash, you can send and receive money with just a text, in Messages. So it's easy to tip your dog walker, request funds from your roommate, or chip in for a coworker's gift.”), https://www.apple.com/apple-cash/ (last visited Nov. 6, 2024). The CFPB also agrees with the group of State attorneys general that new risks may emerge as the relevant technologies in this market evolve. In this market, by using its supervisory activity as general-use digital consumer payment applications incorporate new technology, the CFPB can inform its assessment of risks to consumers and to markets. 115 115 In the CFPB's experience, for some financial institutions, even the rollout of relatively conventional digital technologies can pose significant risks to consumers, including in the area of digital payments. Cf. CFPB, In re: VyStar Credit Union, Admin Proc. File No. 2024-CFPB-0013 (Oct. 31, 2024), ¶ 20 (describing how outage in the establishment of a new online banking platform of large credit union left consumers unable to engage in certain banking activities, and that “[s]ome members' previously scheduled recurring payments were delayed or even deleted.”), https://files.consumerfinance.gov/f/documents/cfpb-vystar-credit-union-consent-order_2024-10.pdf (last visited Nov. 16, 2024). Supervision can be effective at detecting and assessing such risks. As a nonprofit commenter noted, supervision allows for rapid exchange of information outside of the adversarial legal process. The supervisory process also generally is confidential, which also facilitates the exchange of information. 116 For example, when examiners conduct a compliance management review, they can assess the strength of larger participants' compliance management as applied to the development and marketing of new products. 117 In addition, as illustrated by its work during the COVID-19 pandemic, examiners who are familiar with supervised entities can review activities across a market to identify emerging risks of consumer harm in a time of macroeconomic stress or shock. 118 As another example, through its supervisory tool, the CFPB can respond rapidly to reports of any widespread outages at larger participants by gathering information through an established supervisory relationship. 119 116 The CFPB treats CFPB confidential supervisory information consistent with applicable regulation; see 12 CFR part 1070. As noted above, even when Supervision highlights its findings to the public through Supervisory Highlights, it generally does not identify individual firms (outside of highlighting any associated enforcement actions). 117 See, e.g., CFPB Supervision and Examination Manual, part I.A (page 6 of compliance management review section explaining how examiners' compliance management review includes a review of the “processes for development and implementation of new consumer financial products or services and distribution channels or strategies, to determine degree of compliance function participation.”); see also id. at 4-5 (describing how examiners review product development as a component of the review of board and management oversight of compliance); id. at 9 (review of training of staff responsible for product development); id. at UDAAP Examination Procedures at 2 (review of product development documentation in connection with examiner's assessment of compliance with the prohibition against unfair, deceptive, and abusive practices). 118 See, e.g., CFPB, Prioritized Assessment FAQs (July 20, 2020) at 1 (“The Bureau is adapting its supervision program to meet the needs of the current national emergency . . . . Through Prioritized Assessments, the Bureau will expand its supervisory oversight to cover a greater number of institutions than our typical examination schedule allows, gain a greater understanding of industry responses to pandemic-related challenges, and help ensure that entities are attentive to practices that may result in consumer harm.”), https://files.consumerfinance.gov/f/documents/cfpb_prioritized-assessment_frequently-asked-questions.pdf (last visited Nov. 7, 2024); Supervisory Highlights Issue 23, Jan. 2021 (secs. 3.3, 3.5, and 3.6 of COVID-19 special edition describing supervisory observations in prioritized assessments in student loan servicing, consumer reporting, and consumer debt collection markets subject to larger participant rules), https://files.consumerfinance.gov/f/documents/cfpb_supervisory-highlights_issue-23_2021-01.pdf (last visited Nov. 7, 2024). 119 See CFPB, What happens if my payment app has an outage and I can't access my account? (Dec. 21, 2023) (describing consumer complaints as one way the CFPB collects information about outages at payment apps), https://www.consumerfinance.gov/ask-cfpb/what-happens-if-my-payment-app-has-an-outage-and-i-cant-access-my-account-en-2145/ (last visited Nov. 8, 2024); FEDS Notes, Offline Payments: Implications for Reliability and Resiliency in Digital Payment Systems (Aug. 16, 2024) (describing how “several recent high-profile outages have highlighted the need for building more reliability and resiliency in digital payment systems”), https://www.federalreserve.gov/econres/notes/feds-notes/offline-payments-implications-for-reliability-and-resiliency-in-digital-paym [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-27836. Public record. Not legal advice.