1 Client Alert | Financial Institutions / Regulatory & Compliance CFPB Finalizes Prepaid Card Rule …and the Clock is Ticking October 2016 Authors: Kevin Petrasic, Benjamin Saul, Jolina Cuaresma, Helen Lee, Joshua Garcia, Katherine Lamberth On October 5, 2016, the Consumer Financial Protection Bureau (the “CFPB” or the “Bureau”) released its long-awaited final rule on prepaid cards (the “Final Rule”). The 1689-page Final Rule will fundamentally change how consumers interact with certain prepaid cards and mobile wallets. The Final Rule imposes a comprehensive regulatory regime that, for the first time, imposes broad consumer protections on large portions of the prepaid market. It does so by amending Regulation E, issued under the Electronic Fund Transfer Act (“EFTA”), and Regulation Z, issued under the Truth in Lending Act (“TILA”) and the Credit Card Accountability Responsibility and Disclosure Act (the “CARD Act”). In addition, insofar as the CFPB treats certain overdraft features as an extension of credit, this may, for the first time, subject prepaid accounts with overdraft features to federal fair lending rules under the Equal Credit Opportunity Act and Regulation B.1 Companies offering products that fall under the Final Rule will have until October 1, 2017, to provide the required consumer protections. Companies in the prepaid space face difficult decisions in light of the Final Rule. Most importantly, they will have to assess how costly the rules are not only with respect to internal operational costs, but also with respect to customer acquisition. For example, the Final Rule will likely impact various innovative mobile prepaid products, given that it will require additional steps to existing customer sign-up processes. As a result, there will be pressures to identify creative solutions and/or develop partnerships that will need to be implemented by October 2017. To help businesses understand the broader implications for compliance, following is a summary and analysis of the Final Rule. Financial Institutions Advisory Bank Advisory Broker-Dealer Consumer Financial Services Cybercurrency Cybersecurity Data Privacy & Protection EU and WTO FinTech Investment Advisory & Management Payments Sanctions, Bank Secrecy and Export Controls Securities Trust and Fiduciary 2 Scope of the Final Rule The Final Rule provides consumers using prepaid cards and mobile wallets with protections similar to those available for credit and debit cards, especially where consumers use prepaid accounts as substitutes for credit cards or checking accounts. The amendments to Regulation E provide a new definition of the term “prepaid account” that sweeps in a range of prepaid products, so long as they are established primarily for personal, household, or family (and not commercial) purposes.2 At a high level, the new definition of “prepaid account” determines the scope of the Final Rule,3 and can be segmented as such: • Accounts marketed and labeled as prepaid. Accounts are subject to the Final Rule if they are “marketed or labeled as ‘prepaid’ and” are open-loop, or “redeemable upon presentation at multiple, unaffiliated merchants” or at ATMs.4 This definition covers general purpose reloadable cards (whether store-bought or virtual), which normally have all of those features. It also applies where a company contracts with another party to promote or advertise an account using the label “prepaid.”5 • Prepaid and reloadable accounts with general transaction capabilities. The Final Rule covers certain accounts if they are (i) either issued on a prepaid basis in a specified amount or can be loaded with funds after issuance and (ii) have as their primary function some general transaction capability, such as redemption for goods and services at multiple, unaffiliated merchants, redemption at ATMs, or ability to conduct person-to-person (“P2P”) transfers.6 According to the CFPB, this definition focused on function and is agnostic as to form, and includes mobile wallets.7 It also draws in student prepaid cards attached to an open-loop account, even if the student card is used as a form of identification or has an additional closed-loop account connected to it.8 • Special purpose accounts. Recognizing that consumers may have many sources of funds, ranging from government benefits to their paychecks, delivered to prepaid accounts, the Final Rule provides additional consumer protections to both “payroll card accounts” and “government benefit accounts.” The Final Rule does not change the prior scope of Regulation E or Regulation Z regarding such prepaid accounts.9 The Final Rule does not apply to checking accounts, share draft accounts, NOW accounts, or various other accounts related to certain benefits (e.g., health savings account, flexible spending arrangement), third partyestablished disaster relief payment accounts, or the P2P function of accounts for closed-loop transactions on U.S. military installations (or similar facilities).10 It also does not apply to closed-loop gift cards only usable in specific stores, gift certificates, loyalty, award or promotional gift cards, or general use cards both marketed and labeled as gift cards or gift certificates.11 In addition, easing the worries of the virtual currency industry, the CFPB specifically states that “application of Regulation E and [the Final Rule] to [virtual currency] products and services is outside the scope of this rulemaking."12 Summary of Consumer Protection Provisions The CFPB generally requires companies subject to the Final Rule to comply with the provisions of Regulation E. However, certain Regulation E requirements have been slightly modified by the Final Rule, and we recommend close review of the rules to ensure proper compliance with the Final Rule.13 At a high level, the Final Rule would have companies provide the following consumer protections in conjunction with the prepaid account: • Standardized short- and long-form disclosures.14 Some consumers must receive designated short-form disclosures prior to signing up for the account, with all consumers required to receive, at some point, a written long-form disclosure. These disclosures inform the consumer of various fees (periodic fee for holding the account or for inactivity, per purchase fee, ATM withdrawal or balance inquiry fees, cash reloading fee, customer service fee, along with a statement disclosing additional types of fees), overdraft features triggering the potential for more fees,15 federal deposit insurance eligibility, and contact information for the CFPB and the company. • Notice of changes.16 Before implementing a change in terms and conditions for a prepaid account, the company must notify the consumer 21 days in advance. • Free account monitoring.17 The company must provide a periodic statement, which is uncommon for the industry, or as an alternative, provide all of the following: the consumer’s account balance via telephone, 12 months of account transaction history online, and 24 months of history upon request. • Error resolution for lost, stolen, or wrongly charged accounts.18 Where a consumer discovers an error on the account, the company must work to investigate and resolve the issue within, in most cases, 90 days of receiving notice of the error. If an investigation takes longer than ten (or for new customers, 20) days, consumers may receive provisional credit while the company investigates. In addition, consumers who have their card lost or stolen will have their liability for unauthorized charges limited to $50. Companies will also have to submit prepaid account agreements to the CFPB by October 1, 2018 to be made publicly available on the Bureau’s website. Summary of Overdraft Protection Provisions While Regulation E provides protections for the asset account of a prepaid account, the Bureau established separate protections under Regulation Z for certain overdraft credit features in connection with prepaid accounts. Thus, the Final Rule also includes several requirements under Regulation Z specifically applicable to prepaid accounts that provide overdraft services. The Bureau aims to regulate these “overdraft credit features” in a manner similar to credit cards. In this regard, the Final Rule imposes restrictions on certain fees charged in the first year after account opening, including limitations on penalty fees, and requires assessment of a consumer’s ability to pay. In addition, the Final Rule sets forth restrictions regarding a company’s ability to collect repayment for overdrafts. Under the Final Rule, prepaid cards with an overdraft option are referred to as “hybrid prepaid-credit cards.”19 This term encompasses cards that provide consumers access to credit by allowing the prepaid account to acquire a negative balance or offering a linked line of credit from which funds are automatically drawn to cover transactions that would otherwise result in a negative balance (referred to as a “separate credit feature”). Importantly, a prepaid card is not treated as a credit card under the Final Rule when the prepaid card (i) only accesses credit incidental to certain transactions in the form of a negative balance on the asset account, and (ii) there are no credit-related fees for the credit. This exception exempts credit related to “force pay” transactions, provides for a de minimis $10 payment cushion, and establishes a delayed load cushion where credit is extended while a load of funds from an asset account is pending.20 According to the CFPB, prepaid accounts that extend credit in these limited types of situations would be considered incidental credit and not “hybrid prepaid credit-cards” features that trigger the following compliance obligations under Regulation Z, although the credit would generally be subject to certain provisions in Regulation E: • General provisions.21 The Final Rule generally requires overdraft credit features accessible by hybrid prepaid-credit cards to be structured in the form of a separate credit feature instead of allowing prepaid accounts to incur a negative balance. As a result, prepaid accounts with overdraft features will generally have to comply with Regulation Z. In addition, companies are prohibited from opening, and soliciting consumers to apply for, a separate credit feature within 30 days of the registration of the prepaid account. • Ability to repay.22 Companies issuing hybrid prepaid-credit cards must assess a consumer’s ability to pay prior to extending a separate credit feature and must comply with special rules regarding extensions of credit to persons under the age of 21. Companies that extend credit to consumers in the form of overdraft credit features are required to assess consumers’ creditworthiness in much the same manner as do credit card issuers. • Monthly statements. 23 Companies are also required to provide written periodic statements for prepaid accounts linked to hybrid prepaid-credit cards not more often than once per month. Periodic statements must itemize any overdraft fees assessed against the consumer’s prepaid account and underlying transactions, provide a summary of the amount owed, and provide disclosure information about repaying the debt. • Fee limitations.24 Under the Final Rule, consumers must have at least 21 days from the date of the periodic statement to repay any debt incurred in connection with using a credit feature before the company may charge a late fee. In addition, during the first year a prepaid account is open, any fees related to the credit feature cannot exceed 25 percent of the initial credit line. Companies are also prohibited from raising interest rates on outstanding balances except under certain circumstances, such as when the consumer has missed consecutive payments or upon providing the consumer with at least 45 days advance notice. • Segregation of prepaid account and credit feature.25 Unless a consumer has provided signed written authorization, a company cannot automatically collect payment on a debt incurred through the use of an overdraft credit feature once the prepaid account is reloaded with funds. However, companies may deduct from the consumer’s prepaid account debt incurred through the use of an overdraft credit feature under a plan that is authorized in writing by the consumer, so long as such deductions are not made more frequently than once per month. In effect, where prepaid cards allow consumers to spend more money than they have deposited in their prepaid account, the Final Rule treats the overdraft as an extension of credit and regulates it as such. As a result, companies offering overdraft services on prepaid accounts must view consumers as potential borrowers and comply with Regulation Z provisions similar to those imposed on issuers of credit cards. Prepaid account versus checking accounts The Bureau states that the provisions addressing credit features in connection with a prepaid account in the Final Rule are not intended to alter treatment of overdraft services or products on checking accounts under Regulation Z.26 In doing so, the CFPB acknowledged that it is “regulating prepaid overdraft services on a largely blank slate,” since most prepaid account programs do not have associated credit features.27 In its Spring 2016 Rulemaking Agenda, the CFPB stated that it is engaged in pre-rule making activities to consider potential regulation of overdraft services on checking accounts. The CFPB stated that it would regulate overdraft credit features offered in connection with prepaid accounts as extensions of credit covered by Regulation Z, as opposed to “overdraft services” subject to Regulation E, in part due to the fact that rules governing “overdraft services” under Regulation E “generally provide fewer protections for consumers on an ongoing basis than does Regulation Z.”28 In particular, the CFPB noted the historical justification for the regulatory treatment of checking account overdraft services, i.e., the benefit of avoiding fees imposed for bouncing a check, did not extend to prepaid accounts. However, as fewer consumers write checks, it is possible that the CFPB could choose to regulate overdraft services provided in connection with certain checking account transactions, namely those made online or with debit cards, in a similar manner to prepaid accounts. Operational and Compliance Costs Implementing the Final Rule within a year will no doubt cause companies to incur operational costs, such as the cost of system upgrades and employee training, as well as compliance costs, including consultation with legal counsel and compliance experts. While much of the legal analysis involved in implementing the Final Rule will track existing or similar provisions of Regulation E and Regulation Z, there are significant compliance and operational challenges for companies to consider. Certainly, the nuances of the Final Rule will require careful consideration. For instance, one wrinkle in the Final Rule’s disclosure framework requires companies that charge additional fees to disclose fees in an order that places higher-revenue-producing fees first.29 In calculating fee revenue, the Final Rule requires companies to make an assessment of revenue based on fees generated in a 24-month period starting after October 1, 2014 (or, in the alternative, to predict revenues for the next 24 months).30 If a company has not been tracking fee revenue closely, it may have to enlist the assistance of a third party expert to estimate fees, which will increase the cost of compliance. In addition, the new disclosure framework and protections for prepaid accounts with overdraft features are highly tailored to the industry. These provisions have yet to be tested and may result in unexpected tension and produce significant challenges for companies attempting to comply with the requirements of the Final Rule. Further, integrating the requirements of the Final Rule into already-existing systems will take time, testing, and money. Employees will have to be trained and systems upgraded. Often, because the changes fundamentally alter how consumers are initially exposed to the prepaid account, some companies may have to rethink their customer acquisition models. Ultimately, these rules threaten to increase the cost of innovative retail products. It is possible that nonbank providers of prepaid accounts will seek partnerships with banks in order to help with the looming operational costs. If this occurs, there will likely be consolidation in the market towards larger players that have the overhead and experience with the compliance requirements imposed by the Final Rule. However, consolidating through partnerships will take time, and given that the Final Rule goes into effect in October 2017, this may not be a viable route forward for some companies. Conclusion Companies looking to implement the requirements of the Final Rule should work expeditiously to take the necessary steps required to comply by next year’s October implementation deadline. Although some provisions will be easier to comply with than others, especially given the model forms provided by the CFPB, several requirements will require thoughtful consideration of, among other things, the user experience, how modifications will affect customer acquisition, how to educate and train employees on the new requirements, and how to integrate the Final Rule into existing compliance systems. Perhaps most challenging will be that some companies may need to develop compliance systems from scratch. At any rate, the Final Rule will prove burdensome for all companies offering overdraft as a feature, and will likely spur a sea change in how consumers interact with the prepaid industry overall going forward. 6 AMERICAS New York Ian Cuillerier Partner T +1 212 819 8713 E firstname.lastname@example.org John Donovan Partner T +1 212 819 8530 E email@example.com David Johansen Partner T +1 212 819 8509 E firstname.lastname@example.org Ernie Patrikis Partner T +1 212 819 8200 E email@example.com Duane Wall Partner Of Counsel T +1 212 819 8453 E firstname.lastname@example.org Francis Zou Partner T +1 212 819 8733 E email@example.com Glen Cuccinello Counsel T +1 212 819 8239 E firstname.lastname@example.org Washington, DC Kevin Petrasic Partner T +1 202 626 3671 E email@example.com Benjamin Saul Partner T +1 202 626 3665 E firstname.lastname@example.org Jolina Cuaresma Counsel T +1 202 626 3589 E email@example.com Helen Lee Counsel T +1 202 626 6531 E firstname.lastname@example.org EMEA Frankfurt Benedikt Gillessen Partner T +49 69 29994 0 E email@example.com Dennis Heuer Partner T +49 69 29994 0 E firstname.lastname@example.org Matthias Kasch Partner T +49 69 29994 0 E email@example.com Andreas Wieland Partner T +49 69 29994 1164 E firstname.lastname@example.org Hamburg Kai-Michael Hingst Partner T +49 40 35005 364 E email@example.com London Francis Fitzherbert-Brockholes Partner T +44 20 7532 1400 E firstname.lastname@example.org Stuart Willey Partner T +44 20 7532 1508 E email@example.com Carmen Reynolds Counsel T +44 20 7532 1421 E firstname.lastname@example.org ASIA Hong Kong Baldwin Cheng Partner T +852 2822 0405 E email@example.com Sharon Hartline Partner T +852 2822 8733 E firstname.lastname@example.org Singapore David Barwise Partner T +65 6347 1345 E email@example.com In this publication, White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. This publication is prepared for the general information of our clients and other interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice. 1 As noted in Official Interpretation to 12 C.F.R. 1002.2(j), “Regulation B covers a wider range of credit transactions than Regulation Z. Under Regulation B, a transaction is credit if there is a right to defer payment of a debt— regardless of whether the credit is for personal or commercial purposes, the number of installments required for repayment, or whether the transaction is subject to a finance charge.” 2 Regulation E only covers accounts established primarily for personal, family, or household purposes. 12 C.F.R. 1005.2(b)(1). Regulation E does not cover accounts held under a bona fide trust agreement. 12 C.F.R. 1005.2(b)(3). 3 Note that the amendment to Regulation Z simply references Regulation E’s definition of “prepaid account” without elaboration. Final Rule § 1026.61(a)(5)(v) (“Prepaid account means a prepaid account as defined in Regulation E, 12 CFR 1005.2(b)(3).”). 4 Final Rule § 1005.2(b)(3)(i)(C). 5 Official Interpretation to Final Rule § 1005.2(b)(3)(i), ¶ 3. 6 Final Rule § 1005.2(b)(3)(i)(D). 7 CFPB Press Release, October 5, 2016, available at http://www.consumerfinance.gov/about-us/newsroom/cfpbfinalizes-strong-federal-protections-prepaid-account-consumers/. 8 Official Interpretation to Final Rule § 1005.2(b)(3)(i), ¶ 8(ii)-(iii). 9 Final Rule § 1005.2(b)(3)(i)(A)-(B). Regulation E and Regulation Z had protections for such cards prior to issuance of the Final Rule. A summary of changes specific to payroll card accounts is available at http://s3.amazonaws.com/files.consumerfinance.gov/f/documents/Prepaid_payrollcard_v1_10052016.pdf. A summary of changes specific to government benefit accounts is available at http://s3.amazonaws.com/files.consumerfinance.gov/f/documents/Prepaid_governmentbenefitcard_v1_10052016.pdf. 10 Final Rule §1005.2(b)(3)(ii)(A)-(C), (E). 11 Final Rule § 1005.2(b)(3)(ii)(D)(1)-(4). 12 Final Rule p. 164. 13 For example, Final Rule § 1005.18(d) discusses various modifications to Regulation E’s initial disclosure requirements. 14 Final Rule § 1005.18. 15 The short-form disclosure should not disclose finance charges required to be disclosed under Regulation Z. Final Rule § 1005.18(b)(3)(vi). 16 Final Rule § 1005.18(h)(2)(iii). 17 Final Rule § 1005.18(c)(1). 18 Final Rule § 1005.18(e). 19 Final Rule § 1026.61; A prepaid card is not a credit card with respect to a credit feature that either (1) cannot be accessed in the course of a prepaid card transaction to obtain goods or services, obtain cash, or conduct P2P transfers; or (2) is offered by an unrelated third party (i.e., that is not the prepaid account issuer, its affiliate, or its business partner). Final Rule § 1026.61(a)(2)(ii). These “non-covered separate credit features” are not subject to the hybrid prepaid-credit card rules, but will typically be separately subject to Regulation Z depending on their terms and conditions. 20 Final Rule § 1026.61(a)(4). 21 Final Rule § 1026.61(a)(3)(i),(b)-(c). Under the Final Rule, prepaid accounts may only incur a negative balance if account issuer does not credit-related fees as a result of the negative balance and the issuer has a policy and practice of declining to authorize transactions where the consumer has insufficient funds, the amount of the transaction will not cause the account to be negative by more than $10, or the transaction is conducted when incoming deposits to the prepaid account are pending. 22 Final Rule § 1026.51. 23 Final Rule § 1005.18. 24 Final Rule §§ 1026.52(b), 1026.55 and 1026.59. 25 Final Rule §§ 1026.12(d)(3). 26 Final Rule p. 825. 27 Final Rule p.833-834. 28 Final Rule p. 82. 29 Final Rule § 1005.18(2)(b)(2)(ix)(D). 30 Final Rule § 1005.18(2)(b)(2)(ix)(D).