CFPB Finalizes Rule to Oversee Digital Payment Apps, Strengthen Fraud Protections, and Address “Debanking” Risks

The Consumer Financial Protection Bureau (CFPB) has finalised a rule to regulate major non-bank companies that operate digital payment and fund transfer apps. This regulation targets companies managing over 50 million transactions annually, ensuring they adhere to federal laws similar to banks, credit unions, and other financial institutions already under CFPB supervision.

According to the CFPB, the leading payment apps affected by this rule collectively handle over 13 billion consumer transactions each year.

Digital payment apps have become an integral part of daily financial activities, rivalling traditional payment methods like credit and debit cards for both online and in-store transactions. Many of these apps, owned by major tech companies, have gained widespread popularity, particularly among middle- and lower-income consumers. For countless users, these apps are now essential for everyday spending and transferring funds, often outpacing the use of cash.

What started as a straightforward alternative to cash has evolved into a crucial financial tool, enabling over a trillion dollars in payments across consumer, business, and personal transactions.

Banks and credit unions offering consumer payment services have long been subject to CFPB regulation, but many large tech companies handling billions of transactions were not. Recognising this gap, the CFPB has closely monitored the sector, addressing consumer complaints and investigating major tech firms and peer-to-peer platforms behind popular payment apps.

The newly finalised rule grants the CFPB the authority to actively supervise these companies in critical areas such as privacy, surveillance, error resolution, fraud prevention, and “debanking.” While the CFPB could previously enforce laws affecting these companies, the rule now enables the agency to conduct systematic examinations to ensure compliance.

This supervision plays a critical role in mitigating potential harm by identifying issues early and evaluating risks that can escalate rapidly, such as system outages that might leave millions of consumers unable to access their funds.

The new rule is set to take effect 30 days after its publication in the Federal Register.