CFPB Finalizes Rule for Federal Oversight of Popular Digital Payment Apps

On Nov. 21, 2024, the Consumer Financial Protection Bureau (“CFPB”) issued a final rule (“Final Rule”) that establishes its supervisory authority over nonbank covered entities identified as larger participants in the general-use digital payment applications market.[1] Covered entities will be subject to supervision to ensure compliance with Federal consumer financial laws, such as the Consumer Financial Protection Act (“CFPA”) and its prohibitions against unfair, deceptive, or abusive acts or practices (“UDAAPs”), the privacy provisions of the Gramm-Leach-Bliley Act and Regulation P, and the Electronic Funds Transfer Act and Regulation E.[2] This Alert provides an overview of the Final Rule and highlights key differences between the Final Rule and the previously released Proposed Rule, issued on Nov. 7, 2023 (“Proposed Rule”).[3]

What Is the Final Rule?

The Final Rule signifies another step in the CFPB’s continuous efforts to strengthen oversight of large nonbank entities that provide consumer financial products, with a specific focus on the most widely-used digital payment application companies, such as Apple, PayPal and Google. Notably, the Final Rule targets nonbank companies processing over 50 million transactions annually for supervision.[4] It authorizes the CFPB to conduct proactive examinations of these large technology firms concerning their digital payment activities. As highlighted in the CFPB’s press release, this expanded oversight aims to ensure stronger consumer protections across the digital payments sector.[5] The Final Rule is effective 30 days after its publication in the Federal Register. As of the publication date of this Alert, it has not yet been published in the Federal Register.

What Is the Final Rule’s Impact?

Providers designated as “larger participants” under the Final Rule should review and enhance their compliance management systems (“CMS”), including all applicable written policies and procedures, to prepare for supervision and examination by the CFPB. This preparation should include readiness to demonstrate their CMS. Larger participants should also proactively review their products, services, and related terms and conditions for potential risks of UDAAPs. Additionally, providers should be aware that the CFPB may examine other financial products and services beyond those directly tied to general-use digital consumer payment applications, which trigger larger participant status under the Final Rule. Separately, all providers (including smaller providers competing in the space) should monitor any forthcoming developments highlighted in the CFPB’s Supervisory Highlights, which the CFPB uses to publicize problematic conduct it identifies in covered markets.

Some industry participants have questioned—and continue to question—the CFPB’s authority to issue the Final Rule, in part because the CFPB has not clearly demonstrated the specific risks or harms that digital payment applications pose to consumers.[6] However, the CFPB clarified that its rulemaking authority is not based on identifying consumer harm but rather on its broad statutory ability to define “a larger participant of a market for other consumer financial products or services”[7] as well as its interpretation of the “financial data processing” prong of a covered “financial product or service” under the CFPA.[8]

Who Does the Final Rule Apply to?

The Final Rule applies to nonbank entities that qualify as larger participants in the general-use digital payment applications market. These are defined as entities that provide funds transfer or payment wallet functionalities through digital payment applications for consumers to make payments for personal, household or family purposes. Importantly, the Final Rule excludes certain transactions and entities that were initially included in the Proposed Rule, reflecting feedback from stakeholders during the rulemaking process.

• Modifications and Key Exclusions

Exclusion of Digital Assets: One of the most significant changes in the Final Rule is the exclusion of digital assets, such as cryptocurrencies, like Bitcoin and stablecoins, from the scope of “consumer payment transactions.” This marks a notable shift from the Proposed Rule, which initially included digital asset transactions under the definition of funds transfer activities.

The Final Rule defines “consumer payment transactions” as payments made to other persons for personal, household, or family purposes. However, when determining whether a nonbank entity qualifies as a larger participant, only transactions denominated in US dollars are considered under the calculation of “annual covered consumer payment transaction volume.” Specifically, the Final Rule defines “annual covered consumer payment transaction volume” to mean “the sum of the number of consumer payment transactions denominated in US dollars that the nonbank covered person and its affiliated companies facilitated in the preceding calendar year by providing general-use digital consumer payment applications.”[9]

By excluding digital assets from this calculation, the CFPB has limited the scope of its expanded oversight to traditional payment transactions. In its commentary, the CFPB explained that it “intends to continue to gather data and information regarding the nature of [digital asset] transactions and the impact of digital asset transactions on consumers, and to take further action as appropriate.”[10] This exclusion reflects the CFPB’s measured approach to regulating digital assets, acknowledging their unique characteristics and evolving role in the consumer financial ecosystem. The decision leaves open the possibility of future regulatory action specifically tailored to digital asset products and services as more data becomes available. However, the likelihood of such action will be influenced by the incoming Trump administration’s approach to financial regulation, which is likely to promote a less burdensome regulatory environment for the cryptocurrency industry. Nonetheless, nonbank entities should remain vigilant as federal and state regulators continue to assess the consumer implications of digital assets.

Checkout Processes and Marketplaces: The Final Rule excludes merchants and marketplaces that conduct payment transactions solely for sales through their own platforms. These activities are treated as distinct from the market for general-use digital consumer payment applications, which is the focus of the Final Rule. This exclusion applies to transactions confined within a merchant’s or marketplace’s ecosystem and does not extend to those facilitating payments between unaffiliated third parties outside the marketplace’s ecosystem. Importantly, the CFPB clarifies in the Final Rule that the marketplace exclusion still applies even where a marketplace facilitates payments to unaffiliated third-party sellers or merchants operating on the marketplace’s platform.[11]

Compared to the Proposed Rule, which tied the exclusion to marketplaces operating prominently under their own name, the Final Rule broadens the scope by removing branding requirements. Specifically, “the Final Rule treats a merchant or marketplace conducting payment transactions for sales through its own platform as distinct from the activity included in the market defined in this rule.”[12] The CFPB explained that it dropped the branding qualification because it could create confusion regarding the scope of the exclusion.[13]

• Refinements to Key Terms

The Final Rule introduces important clarifications to several key terms, refining the scope of the CFPB’s oversight. These refinements address stakeholder feedback and provide greater clarity compared to the Proposed Rule.

“Market”: In its “market” definition, the Final Rule defines “providing a general-use digital consumer payment application” to mean “providing a covered payment functionality through a digital application for consumers’ general use in making consumer payment transaction(s).”[14] This definition emphasizes that the market consists of payment applications facilitating transactions between multiple unaffiliated parties. The focus on “general use” ensures that applications confined to a single merchant or affiliated entities are excluded.

“General Use”: The term “general use” in the Final Rule refers to payment functionality that enables consumers to transfer funds to multiple, unaffiliated persons.[15] However, the Final Rule excludes from this definition payment functionalities provided solely for accounts excluded under Regulation E, such as prepaid payroll cards, government benefits accounts or payments for specific debts. The Final Rule adopts this refined definition to clarify the types of payment functionalities that qualify as “general use” and those that do not. This change aligns the Final Rule with its intended scope of overseeing broader payment networks rather than activities confined to specific use cases.

The CFPB opted for this alternative definition, rather than the Proposed Rule’s “absence of significant limitations on the purpose” standard, because it is clearer, more administrable, and reduces uncertainty. The Final Rule also aligns more closely with similar concepts in Regulation E, which defines prepaid cards as having “general use” when redeemable at multiple, unaffiliated merchants for goods and services. While the Final Rule adopts this framework, it broadens the concept to include consumer payment applications that facilitate payments to entities beyond merchants, such as family, friends or sole proprietors, unless an exception applies. This refined definition clarifies the types of payment functionalities that qualify as “general use” and ensures the Final Rule targets broader payment networks rather than activities confined to specific use cases.

“Covered Payment Functionality”: The Final Rule, generally adopting the Proposed Rule’s definition, classifies “covered payment functionality” into two main categories: funds transfer functionality and payment wallet functionality.

“Funds transfer functionality” is defined as the receipt of funds for the purpose of transmitting them or accepting and transmitting payment instructions (commonly referred to as peer-to-peer or P2P transfers) and clarifies that funds transfer functionality involves funds received or instructions accepted from market activities.^[16] The Final Rule clarifies that funds transfer functionality applies to market activities where funds or instructions are received directly from a consumer.

“Payment wallet functionality” is defined as a product or service that stores account or payment credentials and transmits, routes or processes these stored credentials to facilitate consumer payments.^[17] The Final Rule refines this term from “wallet functionality” to “payment wallet functionality” to enhance precision and address concerns about whether the rule might inadvertently apply to digital wallets or portions of their features that store and transmit data not directly related to consumer payments.”^[18] Additionally, this term is further clarified to specify that account or payment credentials must be stored “for a consumer.” This clarification ensures the definition applies only to consumer-focused payment activities, excluding functionalities tied to business purposes or non-payment-related data storage, such as loyalty points or other non-monetary credentials. By narrowing the scope, the Final Rule aligns “payment wallet functionality” with its intended focus on consumer payment applications.

“Consumer Payment Transaction”: The Final Rule defines a “consumer payment transaction” as “the transfer of funds by or on behalf of a consumer who resides in a State to another person primarily for personal, family or household purposes.”[19] It expressly excludes: (i) international money transfers; (ii) funds transfers either linked to (a) the consumer’s receipt of a different form of funds, such as a currency exchange transaction, or (b) securities and commodities transfers;^[20] (iii) payment transactions for the sale or lease of goods or services that a consumer selects from an online or physical store or marketplace; (iv) extensions of consumer credit made using a digital application provided by a person (or its affiliated companies) who is extending, brokering, acquiring or purchasing the credit; and (v) payments conducted by individuals for donations to fundraisers selected from a person’s (or its affiliated company’s) platform.^[21]

One key refinement in the Final Rule is the shift from focusing on the consumer’s location at the time of the transaction to instead determining whether the consumer is a US resident. This change addresses feedback received during the rulemaking process that assessing a consumer’s physical location at the time of payment—especially for mobile transactions—would be impractical and burdensome for payment application providers. By focusing on residency, the CFPB aligns the Final Rule’s requirements with operational realities for covered entities.

What Is the Test?

The Final Rule establishes a two-pronged test, set forth below, to determine whether a nonbank entity qualifies as a larger participant in the market for general-use digital consumer payment applications, subjecting it to CFPB supervision. This test refines the framework originally proposed, incorporating feedback to better align with market realities. Entities meeting both criteria remain designated as larger participants for up to two years, even if their transaction volume subsequently falls below the threshold.

• Annual Consumer Payment Transaction Volume: To qualify as a larger participant, a nonbank entity (together with its affiliated companies) must facilitate at least 50 million consumer payment transactions in a calendar year. This threshold represents a significant increase from the 5 million transaction threshold set forth in the Proposed Rule, reflecting the CFPB’s response to concerns that the initial threshold risked sweeping smaller entities into supervision unnecessarily. The CFPB explained that the higher threshold ensures that only entities with substantial market impact fall under supervision. The agency estimates that the 50 million threshold captures approximately 98% of all consumer payment transactions in the market, while excluding smaller entities with minimal risk to consumers.
• Business Size: The nonbank entity must not qualify as a small business concern under the US Small Business Administration size standards. This criterion ensures that the Final Rule targets entities with sufficient operational and financial capacity to warrant federal supervision.

How Will the Recent Election Impact the Final Rule?

The recent election of Donald Trump introduces uncertainty about the Final Rule’s future. Historically, Trump’s administration prioritized deregulation, particularly in financial services, and reduced the CFPB’s enforcement actions under his first-term leadership. A similar approach is anticipated, with the new administration likely deprioritizing the Final Rule’s enforcement or defending it in court. This aligns with broader expectations that Trump’s CFPB will focus on high-visibility issues, such as credit card fees or fraud, rather than on regulating large technology companies.

Legal challenges to the Final Rule are another key factor. Industry groups have already signaled their intention to litigate, arguing that the CFPB exceeded its statutory authority. The Supreme Court’s recent elimination of Chevron deference adds weight to these arguments, as courts may now scrutinize the agency’s authority more rigorously.

While the Final Rule is also subject to the Congressional Review Act, early indications suggest that its repeal is unlikely to be a legislative priority given the new Congress’s crowded agenda. Instead, the opposition to the Final Rule is expected to play out primarily through litigation. Meanwhile, a reduced federal role in enforcement may lead state regulators to step up their oversight of digital payment applications, creating potential compliance challenges for businesses operating across jurisdictions.

The interplay of these factors—shifting federal priorities, legal vulnerability and active state regulators—means that businesses should monitor developments closely and prepare for a potentially fragmented regulatory environment.

Schulte Roth & Zabel’s lawyers are available to assist you in addressing any questions you may have regarding these developments. Please contact the Schulte Roth & Zabel lawyer with whom you usually work, or any of the following attorneys:

Donald J. Mosher – New York (+1 212.756.2187)

Kara A. Kuchar – New York (+1 212.756.2734)

Betty Santangelo – New York (+1 212.756.2587)

Melissa G.R. Goldstein – Washington, DC (+1 202.729.7471)

Adam J. Barazani – New York (+1 212.756.2519)

Jessica Romano – New York (+1 212.756.2205)

Jesse Weissman – New York (+1 212.756.2460)

Julianna R. Pasquarello – New York (+1 212.756.2055)

Jonice Q. Jackson – Washington, DC (+1 202.729.7479)

---

[1] The Final Rule, including the CFPB’s commentary and Supplementary Information, is available here.

[2] Final Rule at 3.

[3] The Proposed Rule is available here.

[4] Final Rule at 1.

[5] The Press Release is available here.

[6] Final Rule at 52. The Supplementary Information to the Final Rule includes extensive discussion of potential risks of harm to consumers as well as public comments the CFPB received on these issues.

[7] See 12 U.S.C. § 5514(a)(1)(B), (a)(2).

[8] See 12 U.S.C. § 5481(15)(A)(vii) (“The term ‘financial product or service’ means … providing payments or other financial data processing products or services to a consumer by any technological means, including processing or storing financial or banking data for any payment instrument, or through any payments systems or network used for processing payments data, including payments made through an online banking system or mobile telecommunications network, except that a person shall not be deemed to be a covered person with respect to financial data processing solely because the person [is subject to one of two exceptions].”)

[9] Final Rule at 258.

[10] Final Rule at 106.

[11] Final Rule at 118 (“This change will make the larger-participant test more administrable by avoiding the need to evaluate the form or extent of name branding when evaluating which entities qualify for the exclusion.”).

[12] Final Rule at 108.

[13] Final Rule at 108, n. 225 (“Under the terms of the proposed exclusion, when a consumer selects goods or services from an online marketplace and the marketplace operator conducts the consumer payment transaction, that would have been excluded by paragraph (C) even if a third-party seller was involved in the sale.”).

[14] Final Rule at 256.

[15] Final Rule at 257.

[16] Final Rule at 139.

[17] Final Rule at 257.

[18] Final Rule at 139.

[19] Final Rule at 257.

[20] See 12 CFR § 1005.3(c)(4) (to be excluded, the security or commodity must be (i) regulated by the Securities and Exchange Commission or the Commodity Futures Trading Commission; (ii) purchased or sold through a broker-dealer regulated by the Securities and Exchange Commission or through a futures commission merchant regulated by the Commodity Futures Trading Commission; or (iii) held in book-entry form by a Federal Reserve Bank or Federal agency).

[21] Final Rule at 116-119.