Today, the Consumer Financial Protection Bureau (CFPB) issued its final rule that increases federal oversight on the largest nonbank companies offering digital payment and wallet apps to protect personal data — specifically, those handling more than 50 million transactions per year.
The most convenient alternative to carrying around cash, digital payment apps have become alarmingly popular, according to the agency, challenging traditional payment methods like credit cards and debit cards for online and in-store purchases. The CFPB notes the strong adoption of these apps among middle- and lower-income consumers, who use them for daily spending and transferring funds at rates that exceed the use of cash.
"Digital payments have gone from novelty to necessity and our oversight must reflect this reality,” said CFPB Director Rohit Chopra. "The rule will help to protect consumer privacy, guard against fraud, and prevent illegal account closures."
Although banks and credit unions are subject to supervisory examinations, many of the large technology firms handling billions of digital transactions are not. In October 2022, the CFPB began monitoring the emerging market by ordering six big technology companies and peer-to-peer platforms that operate payment services (Amazon, Apple, Facebook, Google, PayPal and Square) to provide information about their business practices. The CFPB estimates that the most widely used apps covered by the rule collectively process over 13 billion consumer payment transactions annually.
The final rule enables the CFPB to supervise these nonbank fintech companies in key areas, including:
Privacy and Surveillance: Large technology companies are collecting vast quantities of data about an individual’s transactions. Federal law allows consumers to opt-out of certain data collection and sharing practices, and also prohibits misrepresentations about data protection practices.
Errors and Fraud: Under longstanding federal law, consumers have the right to dispute transactions that are incorrect or fraudulent, and financial institutions must take steps to look into them. The CFPB is particularly concerned about how digital payment apps can be used to defraud older adults and active duty servicemembers. Some popular payment apps appear to design their systems to shift disputes to banks, credit unions, and credit card companies, rather than managing them on their own.
Debanking: Given the volume of payments made through many popular payment apps, consumers can face serious harms when they lose access to their app without notice or when their ability to make or receive payments is disrupted. Consumers have reported concerns to the CFPB about disruptions to their lives due to closures or freezes.
The final rule furthers the CFPB’s mission to secure consumer financial data and protect privacy. In Oct. 2024, CFPB finalized a rule to allow consumers to transfer personal financial data from one provider to another at zero cost. Then in November, a CFPB report noted how lenders are collecting large quantities of consumers’ financial data and selling it to third parties.
CFPB Supervision has also created a supervision technology program which assesses, among other things -- technology and its impact on compliance with Federal consumer financial law.
