Consumer Financial Protection Bureau (CFPB) Final Rule Expands Oversight to Larger Digital Payment App Providers

Section 1024 of the Dodd-Frank Act of 2010 authorizes the Consumer Financial Protection Bureau (CFPB) to define markets for consumer financial products and services and supervise the larger participants within those markets through reporting requirements and examinations. To date, the CFPB has exercised this authority to identify and supervise larger participants in five other markets: consumer reporting, debt collection, student loan servicing, international money transfers, and car financing.

On November 21, 2024, the Bureau finalized a rule (Final Rule) to define a market for “general-use digital consumer payment applications,” expanding the agency’s supervisory scope to include Larger Participants providing digital wallets, payment apps, funds transfer apps, peer-to-peer payment apps and other digital payment services. The Bureau cites as the policy drivers for the regulation the dramatic growth of this market and the need to ensure consistent enforcement of federal consumer financial protection laws.

The rule takes effect 30 days from the publication of the Final Rule in the federal register on December 10.

Who Is Affected?

The rule applies to nonbank companies providing general-use digital payment applications that meet both criteria:

1. Facilitate at least 50 million consumer payment transactions annually in USD
2. Exceed the applicable SBA small business size standard for their primary industry classification (typically $35 million to $41.5 million in annual receipts, depending on the specific NAICS code)

The CFPB estimates that seven nonbank companies will initially meet these criteria.

What Constitutes a “General-Use Digital Payment Application”?

The rule covers applications that provide:

• Funds transfer functionality
• Payment wallet capabilities
• Software accessible through personal computing devices
• Capability for transfers to multiple, unaffiliated persons

Notable exclusions:

• Digital asset transactions (including cryptocurrencies and stablecoins)
• International money transfers
• Foreign exchange transactions
• Securities transactions
• Merchant/marketplace payment processing for their own sales
• Certain prepaid card products
• Certain debt service tools

Larger Participant Designation and the Challenge Process

Under the Final Rule, the CFPB can assess larger participant status by requiring entities to submit relevant records and information as well as by relying on other public filings such as money transmitter call reports.

When the CFPB intends to undertake supervisory activity over a covered person, it will give written notice. The covered person then has 45 days to challenge its designation as a larger participant by submitting documentary evidence and written arguments.

Any nonbank covered person that qualifies as a larger participant will retain larger participant status until two years from the first day of the tax year in which the person last met the larger-participant test.

What Does Supervision Mean?

While the rule doesn’t create new substantive requirements, designated Larger Participants will be subject to

• Regular compliance examinations to assess adherence to consumer protection laws
• Periodic reporting requirements
• Supervisory information requests

Strategic Considerations for Growing Companies

Companies in the consumer payments market that are experiencing rapid growth may want to consider measures to prepare for potential designation as a Larger Participant.

1. Prepare Early: Begin developing compliance infrastructure well before reaching the threshold, particularly if growth trajectories suggest future qualification as a Larger Participant
2. Transaction Counting:
   
   • Establish clear methodologies for identifying in-scope transactions
   • Document calculation methods
3. Examination Readiness:
   
   • Review existing compliance programs
   • Assess resource needs for CFPB supervision
   • Consider how CFPB oversight may differ from existing state-level supervision
4. Designation Process: Familiarize yourself with the 45-day window to challenge Larger Participant designation and the types of evidence needed to support such challenges.

Looking Ahead

Companies approaching the threshold should consider seeking counsel to:

• Assess their qualification status
• Develop supervision readiness plans
• Review compliance programs
• Establish transaction counting methodologies

For more information about how this rule may affect your business, please contact our Fintech Regulatory team.

Key Takeaways

• The Final Rule represents an expansion of the CFPB’s supervisory reach into the consumer payments and fintech landscape.
• Companies that are likely to become larger participants in the market for general-use consumer payment applications will likely need to devote greater resources to interfacing with and responding to CFPB supervision. Companies experiencing rapid growth should begin preparing for potential CFPB oversight well before reaching the threshold.
• Cryptoasset transactions will not count towards the volume-based threshold that would make a company subject to supervision.