Please join Troutman Pepper Partner Chris Willis and colleagues Keith Barnett, Carlin McCrory, and Josh McBeain as they discuss the Consumer Financial Protection Bureau's (CFPB) larger participant rule for consumer payments mentioned in its 2023 semi-annual rulemaking agenda.
Please join Troutman Pepper Partner Chris Willis and colleagues Keith Barnett, Carlin McCrory, and Josh McBeain as they discuss the Consumer Financial Protection Bureau's (CFPB) larger participant rule for consumer payments mentioned in its 2023 semi-annual rulemaking agenda. During this podcast, they examine a myriad of topics concerning this rule, including the following:
We also invite you to listen and subscribe to our new podcast, Payments Pros – The Payments Law Podcast for insights into the legal and regulatory issues facing companies in the payments industry. Click here to listen!
The Consumer Finance Podcast: CFPB’s Larger Participant Rule for Consumer Payments
Host: Chris Willis
Guests: Keith Barnett, Carlin McCrory, Josh McBeain
Aired: July 6, 2023
Chris Willis:
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper's Consumer Financial Services Regulatory practice, and I'm really glad you've joined us today for a special crossover episode with my friends at the Payments Pros podcast to talk about the CFPB's recent surprise announcement of a forthcoming larger participant rule for consumer payments. But before we jump into that very important topic, let me remind you to visit and subscribe to our blogs. We have two of them now. We have consumerfinancialserviceslawmonitor.com, where we cover all of the consumer finance developments in both the litigation and the regulatory worlds of consumer finance. And we have troutmanpepperfinancialservices.com, where we cover the wider range of legal topics that financial services companies need to know even beyond consumer finance.
And don't forget about our other podcasts. Of course, we have Payments Pros, which is the subject of what we're going to be talking about today on this crossover episode, but we also have FCRA Focus, which is all about all things credit reporting. We have The Crypto Exchange about cryptocurrency, and we have Unauthorized Access, which is our privacy and data security podcast. All of those are available on all popular podcast platforms as well as on the Troutman Pepper Financial Services mobile app, which you can find in both the Apple and Google app stores. And finally, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and let us know how we're doing.
Now, as I said, today, I'm joined by three of my colleagues who are the ones responsible for our new Payments Pros podcast, Keith Barnett, Josh McBeain, and Carlin McCrory. So, Keith, Josh, Carlin, thanks for being on the podcast to talk about this really important development.
Keith Barnett:
Thanks, Chris.
Carlin McCrory:
Thank you.
Josh McBeain:
Thank you, Chris.
Chris Willis:
So, in kind of a surprise move, when the CFPB released its semi-annual rulemaking agenda for this year, there was an entry on there saying that the Bureau was working on a larger participant rule for consumer payments. There was not really any other detail put out just that the title of it was going to be that. And there was a suggestion that the proposed rule would be forthcoming in July 2023. And this isn't something that I saw it coming, and I think it was a surprise to a lot of people in the industry. And we're going to be talking on today's episode about what the implications of that announcement may be for the payments industry. But before I get into talking about that with Carlin, Keith, and Josh, let me just provide the audience with a little bit of background about everything that the Bureau is doing to more aggressively use its supervisory authority. For one thing, we've seen the Bureau in the first half of 2023 send out large numbers of inquiries to companies in the industry to find out whether they are larger participants under the existing larger participant rules.
And it looked to us like the volume of those requests was designed to usher in a larger population of companies under the existing non-bank rules who would be subject to future CFPB supervisory exams. The second thing that we've seen is that the Bureau made an announcement roughly a year ago saying that it was going to make more expansive use of its authority under Dodd-Frank to designate individual companies as subject to supervision because they pose risks to consumers. That announcement wasn't immediately followed by a lot of action, at least not that we knew about. But later on, sort of towards the tail end of 2022 and the beginning of 2023, we heard of maybe half a dozen companies who'd received notices that they were being considered for supervision under that special risks to consumers provision, which again, is the Bureau more expansively using its supervisory authority.
And finally, we've seen a lot of use by the Bureau of Supervision in ways that go beyond and that are different from traditional full-on onsite exams, which is what the Bureau has done in the past. And really starting with the prioritized assessments that the Bureau did in 2020 relating to COVID, the Bureau has started doing this sort of exams by questionnaire where they don't physically come onsite to a supervised entity, but they just send some questions about a topic of interest to them. And we've seen the Bureau using those specialized questionnaires to target very specific issues with supervised entities that the Bureau already, I think has a feeling that it wants to take action on and then rapidly moving from those questionnaires to demands for process changes and/or customer restitution.
And so the overall picture that we see is that the Bureau is using its supervisory authority on a wider set of non-banks through the larger participant rules as well as in ways that accelerate the Bureau's ability to find and demand changes in industry practices through the use of these abbreviated exams that the Bureau has started to use. And so, this larger participant rule for payments that just was announced in the rulemaking agenda comes in the background of that heightened and faster use of supervision that we're seeing across the board with the Bureau. So, with me having given that little bit of background about what's going on generally in CFPB supervision, Josh, let me turn to you. I think nobody in the industry knew that these payments larger participant rule was coming before this announcement, but what's your thought about why the Bureau is proposing this larger participant rule?
Josh McBeain:
Thank you, Chris, and I think you allude to this in your opening remarks. I think the CFPB has wanted oversight over technology companies for some time. Back in 2021, the CFPB issued orders to collect information on the business practices of large technology companies in the payment space. And more recently, so we're recording this in June 2023 and just this month the CFPB published an issue spotlight. And in that, I think the CFPB highlighted what it perceives to be issues in the payments marketplace. I mean the CFPB noted that a majority of consumers are using payment apps and the volume of that use has continued to grow. And in a lot of instances, those agreements lack specific information about where the consumer's funds are being held and whether they're FDIC-insured. Most recently, the CFPB's Office of Servicemember Affairs published its annual report and it indicated an increase in payment-related complaints from service members.
It also indicated there was an increase in payment-related complaints from general consumers as well, but the increase for service members was larger. And the CFPB included in that report a list of recommendations for the payment industry to address complaints submitted by service members. These recommendations could apply to non-service members as well because they mostly address preventing and addressing fraudulent complaints. So, either preventing fraud on the front end or addressing fraudulent complaints on the back end. And I think the CFPB believes there's an issue with fraud and they don't have a great means. And again, I'm just guessing because we don't know this, you said this was a surprise. They don't have a great means to address these issues now, so this may be a reaction to those issues.
Chris Willis:
Thanks a lot, Josh. And I think you're right, the precursors were there with the 1022 orders to the large tech payment companies back in October of 2021, as well as the recent issue spotlights that the Bureau has put out about funds not being FDI insured and then the service member complaint report. But I am really eager to hear from Carlin and Keith about what they think the implications on the substantive law governing some aspects of payments may be. Carlin, let me turn to you, Reg E is obviously what jumps to mind most obviously when we think about payments. In terms of the regulatory environment, it's one of the most important pieces. What do you think the implications of the CFPB starting to do exams of payments companies will be for the development of the law or maybe regulatory expectations related to Reg E?
Carlin McCrory:
Yeah, I think we are seeing things finally come to fruition. There were so many rumors last year and a huge push from senators to amend Reg E due to what they called rampant fraud running through these payments platforms. Just as an example, gosh, in July of 2022, a group of senators wrote to the CFPB with regards to their concerns over payment app scams. And at present, Reg E currently doesn't protect any consumer who voluntarily sends money to a fraudster, it's only when a fraudster has received that account information, hacks the account otherwise. What the senator said in this letter to the CFPB was that the current system is antiquated. It's not suited for where a consumer can voluntarily send money just easily on their cell phone, and it's almost instantaneous. The rule was never issued or contemplated that consumers would voluntarily send money to a fraudster.
And notably within the letter, they proposed a couple of suggested remedies, which we're assuming here that the Bureau considered and decided to take this alternative route instead. But I'll quickly go over the two alternatives that the letter posed. The first being that a payment could be deemed a quote, error, when a customer is defrauded into initiating a transfer to that fraudster. The second would be that the CFPB issued guidance that a fraudulently induced transaction would fall within the definition of an unauthorized EFT, which could then shift that liability from consumers to the financial institutions.
The letter also states interestingly enough that there shouldn't be concerns about the bank being the victim because EFTA already protects banks against transfers initiated with fraudulent intent by the consumer. But if you think about it, as a consumer, if I know that any transfer I make could be potentially reimbursed if I claim it's fraudulent, the implications to financial institutions there are huge. And ultimately, rather than trying to amend Reg E and get tied up into a host of litigation, this is essentially a backdoor way to regulate these P2P platforms.
Chris Willis:
And it seems to me Carlin that with due respect to members of the Senate, in order to achieve what that letter suggests, it seems to me an amendment of Reg E wouldn't quite cut the trick because I think you'd have to amend actually the EFTA in order to make that happen. Because my personal view is, the EFTA is clear that a transaction initiated by the customer is not an error and is not unauthorized. I think the senators are inviting the CFPB to do something that would be an excess of its statutory authority. What do you think?
Carlin McCrory:
I completely agree with you, Chris. There are so many implications here to that amendment that was proposed, and this is likely the Bureau's best alternative to the solution that they want to have, to regulate these P2P platforms.
Chris Willis:
Yeah, and let's talk about that for a second, Carlin, because one of the things about CFPB supervision... Well, there's really two things about it. One is that it is the Bureau's really most powerful tool for finding out what goes on within a company. And it allows the Bureau to find things that are not evident from the outside, things that they won't see through complaints, or things that aren't sort of visible on a public-facing website. And so, their ability to discover issues that they may identify as problematic is massively higher when they have the opportunity to do a supervisory exam than when they're just relying on consumer complaints and other public information.
But the other thing that I think is more apropos to your point is that the Bureau has historically used supervisory exams as a way to exert pressure on supervised entities to make business process changes. And that pressure can be exerted in a completely confidential way where there's not like a judge or a court or anything like that, and the Bureau doesn't even have to publicly state what it's doing, and it can push for industry changes with presumably cooperative supervised entities wanting to preserve the relationship with their regulator and change the law through that supervisory context. Do you think that might be what's on the Bureau's mind in proposing this larger participant rule?
Carlin McCrory:
Absolutely. There's going to be a ton of pressure on these companies to comply with Reg E, not only giving the initial disclosures that you're required to give but also the proper responses when a customer claims that an error occurred and conducting your investigation within the proper time frame.
Chris Willis:
Speaking of pressure, Carlin, it makes me want to now talk to Keith about another tool that the Bureau uses in supervision to exert pressure on supervised entities. When they don't have a specific law that prohibits something, the old standby is UDAP. And so Keith, I'm really interested to hear your comments and thoughts about how the Bureau might use UDAP in the payments space to drive industry changes or remediations that it may be looking for.
Keith Barnett:
Well, that's a great point, Chris. Here's what I think we're going to see. I think generally we're going to see a greater expansion of UDAP into payments. And I believe that the CFPB over the past dozen or however many years it's been in existence, in the enforcement actions, they've actually given us sort of a blueprint. In particular, the Bureau has done two novel things that payments companies should be wary of during supervisory examinations. First, in the past, the Bureau has said it's a UDAP violation when it believes that a state law has been violated. So it's a state law that is not even within the Bureau's jurisdiction. So they bring it within the Bureau's jurisdiction by attaching UDAP.
So what we might see here is, what if, for example, the CFPB believes that a payments company should have been licensed as the money transmitter or an escrow services company or something like that, and does not have a state law license in connection with what it does? They may say, "Oh, that's a UDAP violation." Or if they see that a payments company failed to follow state privacy laws, "Oh, hey, we have another potential UDAP violation here." So that's one instance. And then the second instance is, we've seen in the past that the CFPB, and actually quite frankly the FTC as well, they've alleged UDAP violations against payment processors when the payment processors have not acted in accordance with the CFPB's interpretation of private industry rules. And what I am talking about here in particular is NACHA rules, right?
Chris Willis:
Or the Card Network Rules.
Keith Barnett:
Or the Card Network Rules, right? So these are private industry rules that govern payments that the CFPB has bootstrapped in the past into UDAP violations. And as Carlin mentioned earlier, we have seen increased incidents of peer-to-peer payment fraud. And Reg E, as both you and Carlin have mentioned, has not been amended. Well, the NACHA rules will be amended next year governing what banks are required to do under the NACHA rules to reduce the incidents of peer-to-peer payments fraud. So query whether the CFPB will incorporate the NACHA rules into their examinations by asking payments companies what if anything they've been doing to ensure that the banks that they're working with are following NACHA rules and whether they have been responsive when there's a large percentage of returns concerning peer-to-peer payments.
So that is a brave new world. It's going to be very interesting to see what the CFPB does going forward. And also, as Josh mentioned earlier, the CFPB has come up with different types of highlights on different issues. Josh mentioned payment-related complaints for service members, and they included a list of recommendations, but the list of recommendations are not Reg E says this, it is, we think this. Those thoughts turn into UDAP violations during these supervisory examinations.
Chris Willis:
Yeah, I think that's a great point, Keith, and I think your prediction and Carlin's predictions and Josh's too are all right on the money. This is exactly what we'd expect the Bureau to use as supervisory authority to do in connection with the payments industry. And so this is an incredibly important development that we're watching. And I'd also like to point out to our listeners that this is the latest in a series of larger participant rules by which the Bureau exerted supervisory authority over a bunch of different parts of the consumer finance marketplace. And some of them came years ago, like credit reporting agencies and debt collectors, and auto finance companies. And one of the challenges for a newly supervised industry or a newly supervised company is to make sure your compliance management system is sort of up to snuff from a regulatory standard standpoint.
And the good news is we've got a lot of experience in watching the Bureau examine compliance management systems in all those other consumer reporting, debt collection, remittance transfers, student loan servicing, auto finance, et cetera so that we have a pretty good sense of what those regulatory expectations are. We'll be watching, of course, carefully and probably working with clients to assist them in bringing their compliance management systems into regulatory expectations so that they can successfully navigate their first CFPB exams that'll come when this larger participant rule is finalized.
And speaking of that timing, I guess the last point that I'd want to make is, if we look historically at the Bureau's larger participant rules, typically the time period between the proposed rule coming out and the rule being finalized has been roughly a year. We don't know when the proposed rule is coming out. The regulatory agenda suggests it may be July of 2023. If that holds true, then we'd expect the final rule to be roughly July of the next year, July of 2024. But we think that these rules generally take about a year to finalize. So that's a year within which payments companies have the opportunity to look at their internal compliance efforts as well as to look at their practices on the merits and put themselves in as solid a position as they can be prior to their first CFPB exam. And I know that Keith, Carlin, and Josh will all join me in suggesting that that will be a very, very worthwhile use of the year that we have before this rule becomes final.
Carlin, Keith, Josh, thanks so much for being on The Consumer Finance Podcast. We're also going to be posting this to the Payments Pros podcast as well. And, of course, thanks to our audience for tuning in as well. Don't forget to visit and subscribe to our two blogs, consumerfinancialserviceslawmonitor.com and troutmanpepperfinancialservices.com. And while you're at it, why don't you visit us at troutman.com and add yourself to our Consumer Financial Services email list? That's where we put out industry alerts as well as invitations to our industry-only webinars. And of course, take a look at our new Troutman Pepper Financial Services mobile app where you can see all of our thought leadership, as well as listen to all four of our podcasts that's available under Troutman Pepper in both the Apple and Google Play app stores. And stay tuned for a great new episode of this podcast every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.