The Consumer Financial Protection Bureau (CFPB) has finalised a rule that means the largest non-bank companies that offer digital funds transfer and payment wallets, including Big Tech firms, will be subject to the same federal oversight as large banks and credit unions.
The new rule has been introduced in a bid to protect personal privacy, reduce fraud and crack down on illegal “debanking”.
The rule will specifically apply to those companies handling in excess of 50 million transactions per year.
According to the CFPB, the most-widely used apps covered by its new rule collectively process more than 13 billion consumer payment transactions annually.
“Digital payments have gone from novelty to necessity and our oversight must reflect this reality,” said CFPB director Rohit Chopra.
“The rule will help to protect consumer privacy, guard against fraud, and prevent illegal account closures.”
The CFPB observed that digital payment apps have gained “strong adoption” among middle and lower-income consumers in particular, who use them for daily spending and funds transfers “at rates that rival or exceed the use of cash”, citing their evolution into “a critical financial tool”.
The final rule will enable the CFPB to supervise these companies in areas such as privacy and surveillance, given that large technology companies collect “vast quantities” of data about an individual’s transactions.
Consumers will be able to opt out of certain data collection and sharing practices, under federal law, which also prohibits “misrepresentations” about data collection practices.
The CFPB has said it is concerned about how digital payment apps can be used to defraud older adults and active duty service members, and pointed to some payment apps shifting disputes to banks, credit unions and credit card companies, rather than managing those disputes themselves.
However, under federal law, consumers have the right to dispute transactions that are incorrect or fraudulent, and financial institutions must take steps to look into them.
Finally, the new rule will tackle “debanking”, which is when consumers lose access to their app without notice or when their ability to make or receive payments is disrupted, causing “serious harms”.
The final rule has undergone some changes since the CFPB published its draft proposal in November 2023, namely the transaction threshold determining which companies require supervision is now “substantially higher”, at 50 million annual transactions.
The CFPB has also limited the rule’s scope to count only transactions conducted in US dollars.
In October, the CFPB finalised the Personal Financial Data Rights rule, which “moves” the US closer to “a competitive, safe, secure, and reliable” Open Banking ecosystem.
