Held to account: CFPB targets big tech

April 2025  |  FEATURE | BANKING & FINANCE

Financier Worldwide Magazine

April 2025 Issue

Consumer protection law is a core component of keeping consumer financial services markets fair and competitive. Across the globe, authorities work to combat fraudulent, deceptive and unfair trading practices.

In the US, the government agency responsible for ensuring fair and responsible treatment of financial consumers in their purchase and use of financial products and services is the Consumer Financial Protection Bureau (CFPB).

Once the responsibility of several agencies, the CFPB is the single point of accountability for enforcing federal consumer financial laws, supervising banks, lenders and large non-bank entities, such as credit reporting agencies and debt collection companies.

Of these entities, it is tech giants that have become a particular target for the CFPB in recent years, as the agency seeks to ensure larger participants – many of whom provide digital consumer payment applications such as digital wallets and payment apps without direct federal oversight – adhere to the same standards as traditional financial institutions (FIs).

“Under the Biden administration, the CFPB had a keen interest in supervising larger technology companies,” explains Keith Barnett, a partner at Troutman Pepper Locke. “For example, in 2021, the CFPB issued orders to big tech companies for information on their payment system plans as a precursor to attempting to supervise them.”

To that end, in late 2024, the CFPB finalised a new rule – ‘Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications’ – targeting companies such as Apple, PayPal and Zelle that collectively process billions of transactions each year.

“The CFPB claims that the rule is intended to create a level playing field between banks and non-banks,” continues Mr Barnett. “It enables the CFPB to conduct examinations of larger non-bank providers of payment services’ compliance with consumer financial services requirements, including the prohibition on unfair, deceptive and abusive acts or practices (UDAAP), and funds transfer requirements such as error resolution and privacy.”

Primary objectives

The new CFPB rule allows the bureau to examine large companies providing general-use digital consumer payment applications that facilitate at least 50 million transactions. Moreover, the CFPB can not only scrutinise companies for consumer compliance with payments-related business, but all aspects of business that are within the purview of the CFPB’s jurisdiction.

As outlined by Troutman Pepper Locke in its ‘CFPB Finalizes Rule on Federal Oversight of Digital Payment Apps’ analysis, the primary objectives of the new rule include those items outlined below.

First, personal financial data rights. The CFPB rule imposes requirements on how large technology companies collect and share data about individual transactions. It mandates that consumers be allowed to opt-out of certain data collection and sharing practices and prohibits misrepresentations about data protection practices.

Second, regulation E. The rule also establishes protocols for disputing incorrect or fraudulent transactions. The CFPB has highlighted concerns about the potential for digital payment apps to be used in fraudulent schemes, particularly targeting older adults and active-duty servicemembers. The rule seeks to ensure that these apps handle disputes directly rather than shifting responsibilities to banks and credit unions.

Third, unfair, deceptive or abusive acts or practices. The rule addresses issues related to consumers losing access to their payment apps without notice. It aims to prevent disruptions caused by account closures or freezes, which can significantly impact consumers who rely on these apps for daily transactions.

“While the rule does not explicitly expand the scope of the Fair Credit Reporting Act or its implementing regulation, Regulation V, it does broaden the CFPB’s supervisory reach to include large nonbank digital payment providers,” adds Christopher K. Friedman, a partner at Husch Blackwell. “This expansion allows the CFPB to conduct examinations and require reports from these entities to assess compliance with federal consumer financial laws.”

Progression or regression

Having taken effect on 9 January 2025, the CFPB’s new rule, expected to subject major digital payment platforms to increased regulatory scrutiny, is already at risk of being diluted if not erased. Some even contend that under a Trump administration, the bureau may be downsized or even abolished entirely.

“The Trump administration may view the rule as regulatory overreach and could seek to modify or rescind the rule,” suggests Mr Friedman. “Industry groups have already initiated legal challenges. For instance, the technology trade groups NetChoice and TechNet filed a lawsuit against the CFPB, arguing that the bureau lacks the authority to supervise nonbank payment providers and that the rule could stifle innovation.

Also challenging the CFPB’s supervisory authority in court is Google Payment Corp., similarly contending that the bureau’s actions constitute government overreach. “These legal challenges, coupled with potential policy shifts under the new administration, could impede or even derail the rule’s implementation,” concludes Mr Friedman. “However, given that the rule is final, reversal or modification will take some effort on the part of the CFPB.”

© Financier Worldwide

BY

Fraser Tennant