Troutman Pepper | Payments: A Year in Review

The payments landscape in 2023 saw many legal and regulatory developments that will impact the payments industry in 2024. In this Payments 2023: A Year in Review, we summarize many of those developments, with the goal of ensuring you are fully informed and better able to execute your business strategy.

Consumer Financial Protection Bureau (CFPB) Updates:

CFPB Report Highlighting Consumer Protection Issues in Medical Debt Collection November 16, 2023: The CFPB released its Fair Debt Collection Practices Act (FDCPA) Annual Report detailing the CFPB’s 2022 activities related to debt collection practices. The CFPB’s focus in 2022 was predominantly on medical debt, with 15% of 60,000 debt collection complaints forwarded by the CFPB to companies for review and response relating to attempts to collect a medical bill. The practice of medical debt collectors closing the account, returning the account to their client, or deleting the item upon a report of issues by consumers raised questions for the CFPB about potential deficiencies in the quality of information about medical bills received by collectors. The CFPB reemphasized that collection activity on debts that are not actually owed or collecting the wrong amount may violate prohibitions on unfair, deceptive, or abusive acts or practices (UDAAP).

CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps November 7, 2023: The CFPB issued a proposed rule with a request for public comments to amend existing regulations defining “larger participants” the CFPB supervises by adding a new section to define larger participants that offer digital wallets, payment applications, and similar services. Specifically, the CFPB seeks to supervise large nonbanks that provide peer-to-peer (P2P) payments, fund transfers, or wallet functionalities through a digital payment application. Interested parties had until January 8, 2024, to submit comments. The Troutman Pepper payments team worked with clients to draft comments on the proposed rule

CFPB Report Finds Credit Card Companies Charged Consumers RecordHigh $130 Billion in Interest and Fees in 2022 October 25, 2023: The CFPB released its biennial report to Congress on the consumer credit card market. The report found that in 2022, credit card companies charged consumers more than $105 billion in interest and more than $25 billion in fees, and that total outstanding credit card debt eclipsed $1 trillion for the first time since the CFPB began collecting this data. The report highlights several areas of concern, including that more consumers are carrying balances month to month, with many falling deeper into debt over time, while credit card company profits remained significantly above prepandemic levels.

CFPB Proposes Rule to Jump-Start Competition and Accelerate Shift to Open Banking October 19, 2023: The CFPB issued a proposed rulemaking aimed at increasing open banking. The proposed Personal Financial Data Rights Rule would require depository and non-depository entities to make available to consumers and authorized third parties certain data relating to consumers’ accounts, establish obligations for third parties accessing a consumers’ data, and provide basic standards for data access. The proposed rule only provides for narrow exceptions, including community banks and credit unions that have no digital interface with their customers. The CFPB accepted comments on the proposed rule until December 29, 2023, and is expected to issue the final rule in the fall of 2024.

CFPB Issues Guidance to Halt Large Banks from Charging Illegal Junk Fees for Basic Customer Service October 11, 2023: Following its June 2022 request for public input on customer service obstacles encountered when interacting with large financial institutions, the CFPB issued an advisory opinion regarding § 1034(c) of the Consumer Financial Protection Act, which requires large banks and credit unions to comply in a timely manner with consumer requests for information concerning their accounts. The CFPB indicated that impediments to customer requests for information may include requiring consumers to pay a fee to request account information, excessively long wait times to interact with a customer service representative, requiring consumers to submit the same request multiple times, requiring consumers to interact with a chatbot that does not understand or adequately respond to consumers’ requests, or directing consumers to obtain information that the institution possesses from a third party instead. The CFPB further advised that whether a response is “timely” pursuant to § 1034(c) will be a fact-specific determination informed by other federal laws. As for what constitutes an accurate and complete response pursuant to § 1034(c), the CFPB indicated that it expects financial institutions to provide consumers with the information they request to the extent it is in their control or possession.

CFPB Exams Return $140 Million to Consumers Hit by Illegal Junk Fees in Banking, Auto Loans, and Remittances October 11, 2023: The CFPB released a special edition of its Supervisory Highlights focused on its efforts to protect consumers from illegal junk fees, including fees for fake paper statements and addon products for auto loans. As a result of the CFPB’s supervisory work, the companies in the report are refunding $140 million to consumers, $120 million of which is for surprise overdraft fees and doubledipping on non-sufficient funds fees. The CFPB also issued a separate report finding that most financial institutions have eliminated non-sufficient funds fees, saving consumers an estimated $2 billion every year

CFPB Issues Guidance on Credit Denials by Lenders Using Artificial Intelligence September 20, 2023: The CFPB released guidance emphasizing that lenders cannot rely solely on the checklist of reasons provided in Regulation B sample forms for adverse action notices, even when using artificial intelligence or complex credit models. Rather, a creditor’s adverse action notification requirements are satisfied only if the reasons disclosed are specific and indicate the principal reason(s) for the action taken. The CFPB makes clear in this guidance both that adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or “black-box” algorithmic models, or other technology that creditors may not understand sufficiently to meet their legal obligations, and that as data use and credit models continue to evolve, creditors have an obligation to ensure that these models comply with existing consumer protection laws. Creditors should be aware of the CFPB’s regulatory pressure to require more-specific reasons on adverse action notices now than previously — whether or not those reasons are related to machine learning models.

CFPB Report Finds College Tuition Payment Plans Can Put Student Borrowers at Risk September 14, 2023: The CFPB released a report on tuition payment plans in higher education, noting that 98% of colleges now allow students to pay for their education in installments using tuition payment plans. Typically, tuition payment plans are interest-free, but, according to the CFPB, many charge enrollment fees, late fees, and returned payment fees, which can all create a high cost of credit. This report, along with the CFPB’s September 29, 2022, Supervisory Highlights, are part of the CFPB’s continued focus on schools’ in-house lending programs — a trend that should put schools, especially nontraditional and vocational schools, and their service providers on notice to prepare for heightened scrutiny by assessing their products, services, and operations for the kinds of risks highlighted by this CFPB report.

CFPB Report Highlights Role of Big Tech Firms in Mobile Payments September 7, 2023: The CFPB released an issue spotlight on the role that mobile device operating systems play in determining consumers’ payment options. Key findings of the report include that consumers’ usage of tap-to-pay options in the U.S. has grown considerably in recent years, with continued growth anticipated, and that dominant mobile operating systems impose different regulations on contactless payments. According to the CFPB, policies that impose restrictions on competition and raise consumer switching costs must be carefully scrutinized, as restrictions on the use of tap-to-pay reduce consumer choice and inhibit progress toward a more robust openbanking ecosystem, while interoperability can generate substantial benefits for consumers by promoting choice and reducing barriers to entry for new firms. The CFPB is currently undertaking a rulemaking under Section 1033 of the Consumer Financial Protection Act as part of the financial services industry’s movement toward “open banking”.

CFPB Exams Find Unfair, Deceptive, and Abusive Practices Across a Wide Array of Consumer Financial Product Lines July 26, 2023: The CFPB released a Supervisory Highlights report that covered findings from CFPB supervisory examinations completed from July 2022 to March 2023. The report includes highlevel overviews of alleged UDAAPs identified by the agency during examinations. The findings included in the report cover examinations in the areas of auto origination, auto servicing, consumer reporting, debt collection, deposits, fair lending, information technology, mortgage origination, mortgage servicing, payday and small-dollar lending, and remittances. For the most part, the UDAAP examples in this edition of Supervisory Highlights fall into well-understood issues that the CFPB has commented on in the past. But the finding related to powerbooking in the indirect auto industry is brand new and represents the CFPB’s effort to impose an unprecedented duty on auto finance companies to make adjustments to a principal balance based on the existence of a misrepresentation made by the dealer to the lender about the vehicle

CFPB Report Identifies Issues with Increased Servicemember Use of Digital Payment Apps June 20, 2023: The CFPB released its annual report on the top financial concerns facing military families, highlighting the growth of digital payment app usage in the servicemember community, the unique risks to servicemembers from these services, and the potential abuse from bad actors. In 2022, servicemembers, veterans, and their families submitted more than 1,100 complaints about digital payment apps, one of the fastestgrowing complaint types submitted to the CFPB. Servicemember complaints about scams and fraud when using these services suggest digital payment app providers often fail to provide timely and substantive resolutions.

CFPB Issue Spotlight Analyzes “Artificial Intelligence” Chatbots in Banking June 6, 2023: The CFPB issued a report analyzing the use of chatbots in consumer finance and their impact on customer service, noting that financial institutions are increasingly using chatbots and moving toward more-sophisticated technologies, such as large language models and generative chatbots and others marketed as artificial intelligence (AI). According to the CFPB, while the use of chatbots has increased, so have consumer complaints, and thus, the CFPB warns that financial institutions may risk not only dissatisfied customers but also violations of federal consumer protection law when deploying chatbot technology. This report is likely the first regulatory statement about the use of chatbots by financial services companies and it follows the now-familiar theme of hostility to AI and algorithms.

CFPB Says Billions of Dollars Stored on Popular Payment Apps May Lack Federal Insurance June 1, 2023: The CFPB published an issue spotlight on digital payment apps heavily used by consumers and businesses, finding that funds stored on these apps may not be safe in the event of financial distress, since the funds may not be held in accounts with federal deposit insurance coverage. The CFPB also issued a consumer advisory for customers holding funds in these apps. Many states are enacting policies to ensure that these digital payment apps can meet their obligations; however, state laws generally do not require that customer funds be stored in or automatically swept into insured accounts. The CFPB is coordinating with other state and federal regulators to monitor and take appropriate steps, however, until payment apps are designed to automatically sweep balances into a user’s insured account, consumers may need to take action to move their balances stored in payment apps.

CFPB Issues Guidance to Rein in Creation of Fake Accounts to Harvest Fees May 10, 2023: The CFPB issued a circular confirming that it may be an unfair act or practice for a bank to reopen a deposit account to process transactions — and assess overdraft, non-sufficient funds, and maintenance fees — after the consumer has closed the account. The CFPB noted that these are considered fake accounts, and the practice of reopening such accounts may enable third parties to access a consumer’s funds without consent or result in the bank furnishing negative information to consumer reporting companies if negative balances are not settled quickly. Such injuries are especially acute because consumers often lack knowledge of the account reopening and cannot control the timing of debits and credits to their accounts. The circular indicates that regulators will be closely watching this issue and enforcing related rules.

CFPB Report Highlights Costly Credit Cards and Loans Pushed on Patients May 4, 2023: The CFPB published a report on highcost specialty financial products, such as medical credit cards, that are sold to patients as a means to pay for their medical care. The report notes that these products are often more expensive than other forms of payment, including conventional credit cards. The report highlights that specialty financing may feature deferred interest plans, which can be particularly expensive and unaffordable for patients when all accrued interest becomes due at the end of a defined period. The CFPB also found that healthcare providers are usually the ones offering the products to their patients but may be unable to explain complex terms and even disincentivized to inform patients of other less-expensive options. The report built on the CFPB’s prior work on medical billing and collections, including nursing home debt collection and the effect of medical debt on military families.

CFPB Heightens Scrutiny of Unlawful Collection of Payments on Discharged Student Loans March 16, 2023: The CFPB released a bulletin warning servicers of private student loans that collection activity must cease when such loans are discharged in bankruptcy. The issue surfaced after CFPB examiners found that certain servicers were returning loans to collections even after they had been discharged in a bankruptcy proceeding. The bulletin notes that the CFPB will continue to examine servicer handling of these types of loans and puts the servicing industry on notice that the CFPB intends to take action when it finds that servicers are collecting on debts that have been discharged.

CFPB Launches Inquiry into the Business Practices of Data Brokers March 15, 2023: The CFPB issued a request for information (RFI) seeking public comment on the business practices of data brokers and how these practices impact the daily lives of consumers. Details about the types of data that data brokers collect and sell, as well as the sources they rely upon, will be used to inform the CFPB’s planned rulemaking under the Fair Credit Reporting Act (FCRA). The CFPB previewed its legal position in an accompanying press release by saying that the FCRA broadly applies to data brokers like credit reporting companies and background screening firms, as well as those that report information to those firms. The prevailing industry view is that not all the data uses enumerated by the CFPB in its RFI are regulated by the FCRA, and the CFPB may well encounter judicial resistance to its proposed amendment to Regulation V.

CFPB Uncovers Illegal Junk Fees on Bank Accounts, Mortgages, and Student and Auto Loans March 8, 2023: The CFPB released a special edition of its Supervisory Highlights report on “Junk Fees.” The release of this edition of Supervisory Highlights continues the CFPB’s scrutiny and challenging of fees across the consumer financial services industry. The CFPB seems to be indicating that it is not just taking aim at what it considers excessive or surprise fees but is instead taking on all fees in all instances. However, as is always the case with Supervisory Highlights, the underlying facts and circumstances remain largely unknown, so it is difficult to assess wether the findings are the result of violations of ehxisting law or reflect more aggressive regulatory interpretations.

CFPB Publishes New Findings on Financial Profiles of Buy Now, Pay Later Borrowers March 2, 2023: The CFPB issued a report exploring the financial profiles of Buy Now, Pay Later (BNPL) borrowers, following up on its plan to increase scrutiny of the BNPL industry. BNPL products are a form of credit that allows a consumer to split a retail transaction into smaller, interest-free installments and repay over time. The report claimed that BNPL borrowers were much more likely to be highly indebted, revolve on their credit cards, have delinquencies in traditional credit products, have lower credit scores, and use high-interest financial services such as payday, pawn, and bank account overdrafts compared to non-BNPL borrowers. However, the report concluded by noting that the majority of BNPL users have access to traditional credit, and zero-interest BNPL loans could be a less expensive borrowing option for some borrowers. The CFPB made clear its intention to regulate BNPL products with the same rigor that it has applied to more traditional products.

New CFPB Issue Spotlight Examines High Fees That Chip Away at Public Benefits March 1, 2023: The CFPB issued an issue spotlight highlighting concerns about prepaid card programs for accessing public assistance benefits, particularly “specific recurring issues” related to cash assistance benefits including Social Security, Temporary Assistance for Needy Families (TANF), and unemployment benefits that are provided on prepaid cards. The spotlight focuses on two areas that it claims limit recipients’ access to funds: fees and inadequate customer service. In 2020, prepaid card issuers administering public assistance benefits collected around $1.3 billion in fees, which the CFPB finds troubling because even low-dollar fees can pose “outsized harm” to those who rely on public assistance benefits. Further, inadequate customer service harms consumers because if issues are not resolved in a timely manner, recipients may wait weeks or months for access to their funds. Despite acknowledging the benefits of prepaid card programs, the CFPB stresses that it intends to monitor public-benefit prepaid card programs and take action when appropriate to protect consumers.

CFPB Proposes Rule to Limit Excessive Credit Card Late Fees February 1, 2023: The CFPB published a proposed rule with request for public comment that would amend Regulation Z to 1) decrease the safe harbor for credit card late fees to $8 and eliminate altogether a higher safe harbor amount for subsequent late payments 2) eliminate the annual inflation adjustments for the late fee safe harbor amount, and 3) mandate that late fees not exceed 25% of the required minimum payment. Regulation Z requires late charges to be “reasonable and proportional to the omission or violation” and currently provides credit card issuers “safe harbor” late fee amounts, which, if charged, allow issuers to avoid regulatory scrutiny. In addition to the three proposed amendments listed above, the CFPB solicited comment on whether card issuers should be prohibited from imposing late fees on consumers who make the required payment within 15 days of the due date and whether, as a condition of using the safe harbor, card issuers should be required to offer automatic payment options and/or provide notification of the payment due date within a certain number of days prior to the due date.

CFPB Seeks Public Input on Consumer Credit Card Market January 24, 2023: The CFPB announced it is seeking public comment on how the consumer credit market is functioning as part of its biennial review required by the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act). The CARD Act directs the CFPB to undertake a comprehensive review of the credit card industry to determine whether regulatory adjustments are needed. The CFPB specifically requested feedback on the terms of credit card agreements, the effectiveness of disclosures, the adequacy of protections against unfair or deceptive acts, the cost and availability of consumer credit cards, the use of risk-based pricing, and any product innovation.

CFPB Issues Guidance to Stop Charging People for Subscriptions They Don’t Want January 19, 2023: In its recent circular, the CFPB said that “negative option” subscription services might constitute unfair or deceptive practices under the Consumer Financial Protection Act, particularly when a seller 1) misrepresents or fails to clearly disclose the material terms of the program; 2) fails to obtain consumers’ informed consent; or 3) misleads consumers who want to cancel, erects unreasonable barriers to cancellation, or fails to honor cancellation requests. A “negative option” subscription service refers to a situation where a seller may interpret a consumer’s silence, failure to take an affirmative action to reject the service, or failure to cancel an agreement as acceptance of the subscription. The CFPB’s stated impetus for targeting “negative option” subscriptions is in response to consumer complaints and is part of a bigger initiative by the CFPB and the Federal Trade Commission to combat “dark patterns,” or website design features allegedly used to trick or trap consumers.

 

Federal Trade Commission (FTC) Updates

FTC Amends Safeguards Rule to Require Nonbanking Financial Institutions to Report Data Security Breaches October 27, 2023: The FTC announced a final rule amending the Standards for Safeguarding Customer Information (Safeguards Rule) under the Gramm-Leach-Bliley Act. The Safeguards Rule requires nonbanking financial institutions to develop, implement, and maintain a comprehensive information security program to keep their customers’ information safe. The amendment will require financial institutions to notify the FTC no later than 30 days after discovery of a security breach involving the information of 500 or more consumers. The amendment applies to “notification events,” which are defined as the “acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.” Notably, the FTC final rule requires notification when customer information has been acquired rather than when misuse is considered likely.

FTC Proposes Rule to Ban Junk Fees October 11, 2023: The FTC announced a new proposed rule to prohibit so-called junk fees. The proposed rule would prohibit businesses from advertising prices that hide or leave out mandatory fees, and it would prohibit sellers from misrepresenting fees, instead requiring them to disclose upfront the amount and purpose of the fees and whether they are refundable. The rule would also allow the FTC to secure refunds for harmed consumers and seek monetary penalties against companies that do not comply with its provisions.

FTC Approves Final Order Requiring Mastercard to Stop Blocking the Use of Competing Debit Payment Networks May 30, 2023: Following a public comment period, the FTC finalized a consent order settling charges that Mastercard used illegal business tactics to force merchants to route debit card payments through its payment network. The FTC alleged that Mastercard prevented merchants from using competing networks to process certain e-commerce debit payments in violation of the Durbin Amendment, which requires banks to enable at least two unaffiliated networks on every debit card. The Durbin Amendment gives merchants a choice of which network to use for a given debit transaction and also bars payment card networks from inhibiting merchants from using other networks.

FTC Warns About Misuses of Biometric Information and Harm to Consumers April 25, 2023: The FTC, the Civil Rights Division of the DOJ, the CFPB, and the EEOC (together, the Agencies) issued a joint statement warning against the potential for automated systems, including AI, used in credit decisions, housing, and employment opportunities to “perpetuate unlawful bias,” “automate unlawful discrimination,” and produce other “harmful outcomes.” Although the joint statement did not announce any new policies by any of the Agencies, it reiterated the Agencies’ “pledge to vigorously use our collective authorities to protect individuals’ rightsregardless of whether legal violations occur through traditional means or advanced technologies” and that “[e]xisting legal authorities apply to the use of automated systems and innovative new technologies just as they apply to other practices.”

FTC Proposes Rule Provision Making It Easier for Consumers to “Click to Cancel” Recurring Subscriptions and Memberships March 23, 2023: The FTC issued a notice of proposed rulemaking with the stated intent to make it easier for consumers to cancel recurring subscriptions and memberships. The proposed modification to the Negative Option Rule would expand on its only current requirement, which is a prenotification plan. The proposed rule would add numerous requirements to sellers pursuing this option, including requiring certain disclosures, obtaining affirmative consent, and providing cancellation through the same medium used by the consumer to enroll. The proposed rule applies to all forms of “negative option” marketing, including prenotification and continuity plans, automatic renewals, and free trial offers, whether they are made on the Internet, over the telephone, in person, or through printed material.

New FTC Data Show Consumers Reported Losing Nearly $8.8 Billion to Scams in 2022 February 23, 2023: Newly released FTC data shows that consumers reported losing nearly $8.8 billion to fraud in 2022. Consumers reported losing the most money to investment scams, totaling more than $3.8 billion, which is double the losses reported in 2021. The second highest reported loss amount came from imposter scams, in the amount of $2.6 billion, up from $2.4 billion in 2021. Online shopping scams; scams involving prizes, sweepstakes, and lotteries; and business and job opportunity scams rounded out the top five scams most commonly reported to the FTC’s Consumer Sentinel Network.

FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2023 January 6, 2023: The FTC has adjusted the maximum civil penalty dollar amounts for violations of 16 provisions of law the FTC enforces, as required by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. The act directs agencies to implement annual inflation adjustments based on a prescribed formula. The FTC increased the maximum civil penalty amount for violations of Sections 5(l), 5(m)(1)(A), 5(m)(1) (B), and 10 of the FTC Act; Section 7A(g)(l) of the Clayton Act; Section 525(b) of the Energy Policy and Conservation Act; and Section 814(a) of the Energy Independence and Security Act of 2007, in addition to other provisions of the law that the FTC enforces.

 

FedNow Updates

August 17, 2023: FedNow is an instant-payment service built by the Federal Reserve. It allows banks and credit unions to offer instant payment transfers for their customers. FedNow allows financial institutions to improve the customer experience by granting account holders instant access to transfers of money without having to wait. However, FedNow offers another avenue that fraudsters can pursue, and financial institutions should beware the new unique risks the FedNow service might bring.

 

Money Transmission Modernization Act (MTMA) Updates

In 2023, the following states voted to enact all the major provisions of the MTMA to expressly include payroll processing within the definition of “money transmission” along with an “agent of the payee” exemption: • Georgia • Iowa (moratorium on enactment until July 1, 2024) • Maryland • Minnesota • Nevada • North Dakota • Tennessee • Texas • West Virginia
The following states implemented major portions of the MTMA, including agent of the payee, but they did not include payroll processing in the definition of money transmission: • Arkansas • Hawaii • New Hampshire • South Dakota

 

Nacha Updates

On September 22, 2022, Nacha released “A New Risk Management Framework for the Era of CreditPush Fraud.” The objectives of the framework are:
• Increasing awareness of fraud schemes that utilize credit-push payments
• Reducing the incidence of successful fraud attempts
• Improving the recovery of funds after frauds have occurred

As part of implementing the objectives, Nacha requested comment on seven proposals related to ACH credit risk management:
1. Expand commercially reasonable fraud detection
2. RDFI monitoring of received credits
3. Expand the use of return reason code R17
4. Expand the use of reversals for fraud recovery
5. Additional exemption from funds availability requirement
6. Standard company entry descriptions
7. Standard use of individual name field.

Nacha also requested comment on two proposals related to ACH debit risk management:
1. Timing of written statement of unauthorized debit.
2. RDFI must promptly return unauthorized debit.

Lastly, Nacha in addition asked for answers to four additional risk topics.
1. Should the Nacha rules implement a new return threshold for ACH credit returns?
2. Should the Nacha rules identify and define “third- party receivers” as a type of participant in the ACH network, and apply rules accordingly?
3. Should the Nacha rules require that when an RDFI provides early funds availability, it must employ a risk-based approach to determining eligibility?
4. Would a new notification of change NOC be useful to identify when there is a mismatch between the SEC code and the account type (e.g., a CCD payment to a consumer account)? Comments were due in June 2023.

 

Compliments of Troutman Pepper – A Presidential Circle Member of the EACCNY