After more than four years of anticipation and speculation from the financial services community, the Consumer Financial Protection Bureau (CFPB) unveiled its final prepaid rule on October 5 (accompanied by an animated video explaining highlights of the rule).
The final rule amends Regulation E, which implements the Electronic Fund Transfer Act, and Regulation Z, which implements the Truth in Lending Act. The rule will bring prepaid cards and similar products—including some that are not associated with a physical card—under Regulation E. This means that prepaid accounts will now be legally covered by consumer protections such as those relating to lost or stolen cards, although many of those provisions already applied by contract pursuant to card network rules. The rule also will expand Regulation Z’s scope to cover overdraft credit features on prepaid accounts.
Many of the provisions of the final rule are substantially the same as proposed in 2014 (after issuing an Advance Notice of Proposed Rulemaking in 2012), but the agency did make certain changes based on public comments received and other information, such as consumer focus group testing commissioned by the CFPB.
Key provisions of the final rule—running 1689 pages in Word format—include the following:
- Scope of Coverage/Definition of “Prepaid Account:” The final rule brings under Regulation E “a prepaid account,” defined to include general-purpose reloadable (GPR) cards—cards that function much like debit or credit cards, in that they are “open-loop” (redeemable at multiple, unaffiliated merchants for goods or services) and/or usable at automated teller machines (ATMs). The rule also covers payroll cards, student financial aid disbursement cards, tax refund cards, and certain government benefit cards. Gift cards are excluded from this definition but remain covered by certain existing provisions of Regulation E.
Notably, the final rule does cover certain types of digital wallet and payment app providers. Payment app providers, including PayPal and Google, had objected to the inclusion of their products in the final rule after the CFPB said in the 2014 proposal that digital wallets capable of person-to-person transfers and storing funds also might be covered. Other products that could be covered by the rule include Square Inc.'s Square Cash and Dwolla's payment tool. In responding to objections from digital wallet and payment app providers, the CFPB said in the final rule that it was not “persuaded” by the objections to being included in the rule. “The Bureau believes that consumers who transact using digital wallets deserve the same protections as consumers who use other prepaid accounts,” the agency said. “Indeed, as with other prepaid accounts, a consumer’s digital wallet could fall victim to erroneous or fraudulent transactions.”
The final rule does not, however cover all forms of digital wallets. Those that simply store payment credentials such as consumer bank account and credit card information, as in the case of Apple Inc.’s ApplePay, are excluded from the final rule.
- Regulation E Coverage: Many of the consumer protections under Regulation E—such as those restricting liability for unauthorized transactions—are already offered for prepaid cards pursuant to card network rules, but those protections will now be required through explicit coverage by Regulation E. The final rule provides that prepaid cards are generally covered by Regulation E’s requirements, with certain abridged requirements related to periodic statements, similar to the existing Regulation E provisions for payroll cards—sometimes referred to informally as “Reg E lite.” Specifically, prepaid providers (including providers of payroll cards) may provide account information online rather than sending periodic statements. Providers must give access to account balances and transaction histories by telephone and online without charge. The rule does not, however, prohibit fees for balance inquiries at ATMs.
- Payroll Cards: Payroll cards already were covered by Regulation E, since the Federal Reserve’s amendments to Regulation E in 2006. The final rule explicitly provides that employers are not permitted to automatically enroll employees in payroll cards to receive their pay.
- Credit Features: While consumer advocates had urged the CFPB to ban credit features—the ability to spend more than the balance on the account—from prepaid cards altogether, the CFPB declined to do so. Instead, it has created a new concept known as a “hybrid prepaid-credit card,” which essentially means that offering credit on a prepaid card results in that aspect of the card being treated as a credit card for Regulation Z purposes, including triggering requirements regarding analysis of the consumer’s ability to repay. The rule also prohibits late fees from being charged in connection with a credit feature until the consumer has had at least 21 days to repay their debt and requires prepaid card companies to wait 30 days before offering a credit feature to a new prepaid consumer. Currently, only a very small minority of prepaid cards offer credit features. It remains to be seen whether the burden posed by dual coverage from Regulations E and Z will discourage providers from introducing, or continuing to offer, such features.
- Disclosure Requirements: The rule requires “short form” and “long form” disclosures at different points in the life cycle of a prepaid account. The first part of the short form contains “static” fees, setting forth standardized fee disclosures that must be provided for all prepaid account programs, even if such fees are $0 or if they relate to features not offered by a particular program. The second part provides information about some additional types of fees that may be charged for that prepaid account program. This includes a statement regarding the number of additional fee types the provider may charge consumers; the provider must also list the two fee types that generate the highest revenue from consumers (excluding certain fees, such as those that fall below a de minimis threshold) for the prepaid account program or across prepaid account programs that share the same fee schedule. This may raise a practical compliance challenge as providers will presumably need to monitor which fees are generating the highest revenue from consumers and then update the disclosure text accordingly. The long form disclosure sets forth in a table all of the prepaid account’s fees and their qualifying conditions, as well as certain other information about the prepaid account program.
- Model Disclosures: The final rule provides model short-form disclosures that offer a safe harbor for compliance and a sample long-form disclosure as an example of how a prepaid provider might choose to structure this disclosure. The CFPB made certain changes to the substance of these disclosures in the final rule from the proposed version. One notable change relates to deposit insurance disclosures; funds on a prepaid account may be eligible for deposit insurance coverage, provided that certain criteria are met. These criteria are not necessarily easy to explain to consumers, and the CFPB’s consumer focus group testing had shown that this was one area of confusion for consumers. The final rule provides model disclosure language about the availability of deposit insurance and where to find further information about deposit insurance coverage on the FDIC’s website. (Consumer advocates had urged the CFPB to affirmatively require GPR cards to offer deposit insurance—despite unclear authority on the CFPB’s part to do so—and the CFPB again declined.)
- Submission and Posting of Prepaid Account Agreements: As is currently required with credit card agreements, the CFPB will require prepaid account providers to submit their account agreements to the CFPB, as well as to post their prepaid account agreements on their own websites. The CFPB states that this will allow the CFPB to monitor the prepaid market, as well as “increase transparency in the terms of these agreements and the types and amounts of the fees imposed in these programs. The increased transparency will allow the public, including consumers, to become better informed about these accounts, which will likely encourage competition and improve fees in the various markets.”
Most of the provisions of the final rule will take effect on October 1, 2017, except that the requirement to submit prepaid account agreements to the CFPB will take effect October 1, 2018.