Viewpoint: The CFPB’s Prepaid Rule Makes Positive Changes, but Compliance Challenges Remain

By Eli Rosenberg & Gray Derrick, Baird Holm LLP

After nearly two years, thousands of comment letters, numerous industry meetings and countless hours of speculation, on Oct. 5, 2016, the CFPB released its highly anticipated final rule governing prepaid accounts. The final rule and its commentary come in at nearly 1,700 pages and total more than 500,000 words. Still, despite its size, the attribute of the final rule most noted by industry participants is how little it changed from the CFPB’s proposed rule, which was released in November 2014.

In particular, industry participants have been quick to point out that the final rule maintains the proposed rule’s general structure and coverage. For instance, like the proposed rule, the final rule greatly broadens the common understanding of what constitutes a prepaid account, pulling in companies like PayPal and other digital wallet providers. The final rule also maintains the proposed rule’s basic short-form/long-form structure for disclosing fees and other material terms of a prepaid account before a consumer acquires it. Finally, the final rule largely keeps intact the proposed rule’s requirements for credit features offered as part of a prepaid account, imposing numerous requirements on providers seeking to offer such products—particularly overdraft—to consumers.

Nevertheless, despite differing little from the proposed rule in its overall structure and basic requirements, a number of smaller but important changes were made in the final rule that providers need to understand. Most of these changes can be characterized as positive ones that will make compliance with certain aspects of the final rule much easier. Other changes, by contrast, seem to raise more questions than they answer and present serious compliance challenges to the industry.

This article discusses some of the key changes the CFPB made to the final rule with respect to its coverage, disclosure requirements, Regulation E obligations and credit provisions, including the positive changes that should ease some of the compliance burden for providers as well as other changes that present distinct challenges for the industry.

Prepaid Accounts under the Rule

Much of the commentary around the proposed rule’s definition of “prepaid account” centered on how broad it was, encompassing not only consumer asset account substitutes like GPR cards, but other products as well, including nonreloadable cards, reload packs and disaster-relief cards. On the positive side of the column, the CFPB appears to have listened to many of the industry’s concerns on a number of these items. The final rule contains carveouts for qualified disaster-relief cards, dependent care and transit reimbursement programs. Further, the final rule incorporates a “primary function” concept into its definition of prepaid account, such that products are not covered where their “primary function” is not to conduct open-loop, ATM or person-to-person transactions. One impact of this clarification in the final rule is to remove reload packs from the definition of prepaid account.

Despite these positive changes, the final rule’s definition of prepaid account continues to be overly broad, which will no doubt present challenges to the industry moving forward. The final rule applies to certain nonreloadable, anonymous prepaid products, despite the fact that such products are not used by consumers as asset account substitutes, and applying Regulation E protections to these products will be difficult to manage.

Another notable aspect of the CFPB’s definition of prepaid account under the final rule is its ambiguous treatment of “checkless checking accounts” and whether such accounts would be either covered under the final rule or carved out as “checking accounts.” In the lead up to the final rule, checkless checking was oft-cited as an alternative product structure that providers might move to if the costs of complying with the final rule proved too onerous. The final rule’s treatment of this product type is ambiguous and while some industry participants continue to believe that checkless checking provides an alternative structure for certain prepaid platforms to move to, others caution that the alternative structure may nevertheless be covered under the final rule. Without additional guidance from the CFPB on this issue, the industry may be in a wait-and-see mode as to whether checkless checking presents a viable alternative.

Disclosure Requirements

With a few exceptions, the pre-acquisition disclosure requirements set forth in the proposed rule were broadly adopted, as proposed, in the final rule. Like the proposed rule, the final rule requires that consumers receive both short- and long-form disclosure prior to acquiring a prepaid card account.

The major difference from the proposed rule with respect to the short-form disclosure is the replacement of the “incidence-based fee” structure with an “additional fee type” structure. The proposed rule would have required providers to disclose up to three of the most frequently charged fees (known as “incidence-based fees”), to be assessed every 12 months. The final rule has replaced this requirement with a requirement to disclose up to two additional fees that generate the highest revenue from consumers for the prepaid account program. What’s more, providers now can assess the “additional fees” every 24 months, and can use information from all prepaid account programs that share a fee schedule. The additional fee disclosure is subject to a 5 percent de minimis revenue exclusion, whereby a provider has the ability to list one or even zero additional fees if there are fewer than two additional fees that generate 5 percent of revenue from consumers for the prepaid account program.

Subject to some exceptions, a financial institution must provide all of the pre-acquisition disclosures before a consumer acquires the prepaid account. The final rule provides an exception to the requirement to provide the long-form disclosure pre-acquisition for prepaid accounts acquired at a retail location, as long as (1) the prepaid account access device is contained in the packaging material, (2) the short-form disclosure is provided on or is visible through the packaging material, (3) the short-form disclosure provides a telephone number and Website address that a consumer may use to access the long-form disclosure, and (4) the long-form disclosure is provided after the prepaid account is acquired. The final rule provides a second exception to providing the long-form disclosure pre-acquisition if a consumer acquires the prepaid account by telephone, provided (1) the financial institution communicates to the consumer before acquisition of the prepaid account that the long-form disclosure is available by both telephone and Website, (2) the financial institution makes the long-form disclosure available by both telephone and Website, and (3) the long-form disclosure is provided after acquisition of the prepaid account.

Error Resolution Largely Mirrors Reg. E

Providers looking to the final rule for what error resolution and limitation on liability rights apply to covered products will be pleased to see that they are likely already familiar with most of the requirements contained in the final rule. Like the proposed rule, the final rule generally extends the requirements of Reg. E that apply to payroll card accounts today, with some modification, to prepaid accounts in general. For many products, the extension of Reg. E’s limitation on liability and error resolution requirements will not have a significant impact as providers have been offering these protections voluntarily on the majority of covered products for several years. For other products, most notably nonreloadable cards, the extension of Reg. E’s unauthorized transaction and error resolution requirements may prove more problematic as these protections generally have not been applied to these types of products in the past.

Exacerbating this problem is the final rule’s extension of these protections to prepaid accounts where the provider has not yet finished its registration and verification process. While the final rule provides some protection to providers in the form of waiving Reg. E’s provisional crediting requirements for unverified accounts, in the case of nonreloadable and anonymous prepaid cards, it’s unclear how providers are expected to investigate claims of unauthorized use and this may lead to providers simply re-crediting accounts any time a complaint is made, which, in turn, could lead to greater instances of fraud and the potential elimination of these products from the market.

Overdraft and Force-Pay Transactions

One of the most talked about issues in the proposed rule was its treatment of credit offered in association with a prepaid account. The industry’s issues with this aspect of the proposed rule were twofold. First, the proposed rule would have applied its requirements for prepaid accounts with credit features to “force-pay” transactions, which occur when a consumer has sufficient funds in his account to cover a transaction when it’s authorized but insufficient funds to cover the same transaction when it’s paid. The result of applying the requirements of the proposed rule to these force-pay transactions could have effectively removed all prepaid products from the marketplace, whether such products offered intentional overdraft services or not.

Second, the CFPB’s proposed rule moved the needle too far in an effort to protect consumers, creating compliance requirements so onerous—triggering Regulation Z (Truth in Lending) requirements—that they effectively would have banned from the marketplace any short-term loan capability associated with a prepaid account.

The CFPB addresses each of these issues in its final rule with mixed results. With respect to force-pay transactions, the final rule appears to address industry concerns by including three exceptions from the final rule’s requirements for credit offered in conjunction with prepaid accounts. The exceptions are:

1. where a provider has a policy and practice of declining to authorize transactions where a consumer has insufficient funds and does not charge credit-related fees;
2. where a provider has a practice of declining to authorize transactions where a consumer has insufficient funds except when the transaction will not overdraft the account by more than $10 (a “purchase cushion”) and does not charge credit-related fees; or
3. a provider has a practice of declining to authorize transactions where a consumer has insufficient funds except where incoming deposits to the account are pending and does not charge credit-related fees.

Taken together, these exceptions should alleviate industry concerns that force-pay transactions would trigger Reg. Z requirements.

By contrast, the CFPB retained much of the proposed rule’s requirements with respect to credit services formally offered as part of a prepaid account. Like the proposed rule, the final rule amends Reg. E and Reg. Z to regulate overdraft credit features offered in connection with prepaid accounts. The final rule retains many of the proposed rule’s obligations with respect to these covered products, including imposing a 30-day waiting period after an account is registered before soliciting a consumer to add an additional credit feature and requiring providers to conduct ability-to-repay analysis in evaluating an application for an additional credit feature with a prepaid account. The end result of these new requirements is that it will be very difficult and costly for prepaid providers to offer credit features like overdraft to consumers. Providers already are indicating they will end their overdraft programs in light of the final rule’s requirements. Such a result is particularly frustrating for providers given that, as many in the industry have pointed out, the CFPB’s overdraft requirements for prepaid accounts differ significantly from the requirements imposed on providers of traditional overdraft services offered in connection with checking accounts. In contrast to the requirements of the final rule, the rules governing overdraft offered with checking accounts remain far less onerous. Such differing treatment, however, may be short lived as the CFPB lists “overdraft services on checking accounts” as an initiative in the “pre-rulemaking” stage in its current rulemaking agenda.

More Time to Comply, but Still not Enough

While the proposed rule included a nine-month effective date, the final rule extends this period to nearly a year, with the final rule going into effect on Oct. 1, 2017. Providers may be able to comply with the rule without doing a full-scale inventory swap of prepaid account packaging materials prior to the effective date provided that updated disclosures are provided to consumers within 30 days if the provider has received a consumer’s contact information. Although this provision is written into the rule and may, in theory, save millions of dollars and pounds of plastic from the trash heap, it’s unclear whether issuers will be comfortable having outdated terms and conditions in the marketplace.

The effective date may be particularly difficult for providers of products and services that previously were not considered to qualify as prepaid accounts. For example, mobile wallet or P2P providers may not have the infrastructure in place that traditional prepaid card providers do, making it more difficult for them to extend full Reg. E protections to their products and services.

Conclusion

Despite the amount of time and attention paid by both industry insiders and consumer groups in trying to predict the outcome, in the end, the CFPB’s final rule governing prepaid accounts strongly resembles what it proposed in November 2014. The final rule generally keeps the structure and requirements of the proposed rule, extending the scope of what constitutes a prepaid account, requiring providers to disclose all fees to consumers before they acquire a prepaid account through a dual short-form/long-form format, generally extending Reg. E protections to prepaid accounts, and imposing new requirements under Reg. E and Reg. Z for providers seeking to offer credit features as part of a prepaid account. While the final rule does incorporate a number of important changes to these basic requirements that may ease the cost and time necessary to comply, important challenges still remain and providers will need to work with counsel to understand their obligations under the final rule and to design and implement the processes and procedures necessary to comply.

Eli Rosenberg and Gray Derrick are members of Baird Holm’s payments group and are Pay Gov contributing editors. They assisted members of the NBPCA in drafting the NBPCA’s comment letter in response to the CFPB’s proposed rule. Eli and Gray may be reached at [email protected] and [email protected].

In Viewpoints, payments professionals share their perspectives on the industry. Paybefore presents many points of view to offer readers new insights and information. The opinions expressed in Viewpoints are not necessarily those of Paybefore.