Ethan Ostroff, James Kim, and Carlin McCrory discuss the Consumer Financial Protection Bureau's (CFPB) proposed rule to supervise large tech companies and other providers of digital wallets and payment apps.
In this special joint episode of Payments Pros and The Crypto Exchange, Ethan Ostroff, James Kim, and Carlin McCrory discuss the Consumer Financial Protection Bureau's (CFPB) proposed rule to supervise large tech companies and other providers of digital wallets and payment apps. The proposed rule asserts that digital assets are "funds" subject to the Dodd-Frank Act and other federal consumer financial laws and regulations, which would expand the CFPB's supervisory powers to examine companies facilitating crypto and other digital asset transactions.
Our group discusses the legal basis for the CFPB's assertion of jurisdiction over digital assets, and observes that the CFPB's position lacks clear statutory authority and may violate the major questions doctrine. They also note that Congress is currently working on legislation related to digital assets, and that the CFPB should not preempt this process.
Lastly, the group highlights practical questions that companies face when assessing the proposed rule, such as whether NFTs are covered and how companies can monitor anonymous, blockchain transactions.
The final rule is anticipated to be released before year end, with examinations starting in 2025.
The Crypto Exchange and Payments Pros – The Payments Law Podcast: Understanding the CFPB's Proposed Digital Payments Larger Participants Rule and Its Implications for Digital Assets
Speakers: Ethan Ostroff, James Kim, Carlin McCrory
Ethan Ostroff:
Welcome to The Crypto Exchange, a Troutman Pepper Podcast focusing on the world of digital assets. I'm Ethan Ostroff, the host of the podcast and a partner at Troutman Pepper. Before we jump into today's episode, let me remind you to visit and subscribe to our blogs, consumerfinancialserviceslawmonitor.com and troutmanpepperfinancialservices.com. Don't forget to check out our other podcasts on troutman.com/podcast. We have episodes that focus on trends that drive the payments industry, consumer financial services, the Fair Credit Reporting Act, and more. Make sure to subscribe to hear the latest episodes.
Today, I'm excited to be joined by my colleagues, James Kim and Carlin McCrory for a special crossover episode, discussing the CFPB's proposed rule to supervise large tech companies and other providers of digital wallets and payment apps. This episode will also air on our Payments Pros and Consumer Finance Podcast.
The proposed rule asserts that digital assets are funds subject to consumer financial services, laws, and regulations, and would subject large players to the same supervisory exam processes as banks and other financial institutions. It effectively extends the CFPB's supervisory powers to companies that facilitate crypto asset transactions and takes the position that digital applications that facilitate certain transfers of crypto assets will be included in the market definition of larger participants.
I thought, maybe, we could start with James just talking a little bit about the CFPB's proposed digital payments rule and some of the background.
James Kim:
Sure. Thanks, Ethan. Thanks, Carlin. I'm happy to join this podcast. I think it's the first time I'm speaking in this particular podcast. I'm more of a regular in our Consumer Financial Services Podcast. I’m very happy to be here. Just to zoom out and give everybody some context, especially since, I think, this audience is less familiar generally with the CFPB than the audience that I typically would speak to. We always start with Dodd-Frank, that is the statute that created the CFPB, coming out of the Great Recession and gave it its powers.
Under Dodd-Frank, the CFPB has broad supervisory rulemaking and enforcement authority over companies that offer “consumer financial products and services.” Then there's statutory definitions to fill out what is a consumer financial product, or service. Now, that's the broader definition of the CFPB's jurisdiction. A subset within that broader jurisdiction is larger participants and larger banks that the CFPB can supervise. The difference being, the CFPB can generally enforce its laws against the broader universe of companies that offer consumer financial products and services. Then within that is a subset of larger banks, over 10 billion in assets, and then larger non-banks as defined by larger participant rules, like the one we're talking today to supervise them in the same way that the prudential regulators, the OCC, the SDIC supervise banks, traditional financial institutions. That's the context there.
The CFPB's rule that we're talking about today, it's really a procedural rule, right? Procedural in the sense of, it's defining these digital payments market and then identifying a threshold for larger participants in that market. If you were a non-bank that fits those two definitions, you're in the digital payments market defined by the rule and you're a larger participant in that market, then you would be subject to supervision.
Just to give some color about what being supervised means, imagine 20, 30, 40 CFPB examiners going to Amazon's offices for months to audit policies and procedures, compliance management system, transaction testing, you name it, right? Imagine that happening at Apple, or Google, or any of the large tech companies that the CFPB is seeking to supervise. Just to paint a picture, that's what the rule is about. I'll just pause there. Ethan.
Ethan Ostroff:
Okay. With that general background in mind, right, thinking we could perhaps focus on the intersection of this proposed rule and digital assets, right? A couple of things that have stuck out to me, and I'm curious about your thoughts when we talk about why is this relevant for companies in the crypto asset space, right? As I see it, a few things, right? A consumer payment transaction would be defined to include digital assets that have monetary value and are readily usable for financial purposes.
We can think there about P2P, or consumer and merchant transactions where there's the use of a digital asset being within the rule, unless some exclusion applies, right? It will also, presumably, encompass stablecoins as well, which is clearly something that's been relevant and increasingly important into digital asset space is the use of stablecoins and the expectation that at some point, potentially, sooner than later, Congress will step in and pass some law regarding stablecoins in particular.
Another thing I thought about looking at this was the definition of funds transfer functionality and wallet functionality, being very broad. Potentially, so broad to include non-custodial wallet services, right? Accepting and transmitting payment instructions could be viewed to include transmitting payment instructions to a blockchain, right? Wallet functionality could be interpreted to include storage of account credentials, processing such credentials to facilitate a consumer payment transaction, which could be viewed to include storage and processing of private keys.
If I remember correctly, the proposal even states that the covered person does not actually need to ever hold funds, in addition to the idea of the definition of funds being so broad that all of a sudden, digital assets are brought, for example, within the Electronic Funds Transfer Act and Regulation E within the GLBA, and other types of laws.
Can you give our listeners a sense of what the legal basis is for the CFPB's positions that its jurisdiction would cover all of these things that intersect in our own going in the digital asset space?
James Kim:
Yeah. No, happy to talk about that. Carlin will definitely get into the details about the proposed rule and what products, services and functionality specifically might fall under the rule. I think your question goes to, at the foundational level, what is the legal predicate to give the CFPB jurisdiction at all over crypto assets? The CFPB in a rulemaking that's, you know, many pages in a few sentences without any real, I think, applicable legal authority takes the position that crypto assets, generally, digital assets are “funds.”
The significance of that is, again, under Dodd-Frank, the CFPB has many different legal hooks for its jurisdiction. One of which is, and I'm reading, “Engaging in deposit-taking activities, transmitting, or exchanging funds, or otherwise, acting as a custodian of funds, or any financial instrument for use by, or on behalf of a consumer.” The keyword there is funds. The CFPB is equating crypto assets, generally, without really parsing out the various different types, and there are many different types, and you know that better than me, but conflating the entire broader universe of crypto assets to be “funds under Dodd-Frank.” That's the jurisdictional hook.
As I said, Carlin will get into the particulars of the rule. But fundamentally, the CFPB is asserting jurisdiction by saying, crypto assets are funds. Therefore, it is a covered consumer financial product or service under Dodd-Frank.
Ethan Ostroff:
Got you. Listeners of our podcast will know we had a podcast last year talking about Carlin, which Carlin was a part of, talking about two decisions out of the same federal court in New York that were specifically dealing with the question of whether or not digital assets constitute funds under the Electronic Funds Transfer Act. Those judges actually disagreed with each other. Came to different conclusions.
A trend in an issue that's going to be increasingly coming into focus, not only from regulatory activity, but from actual consumer litigation, as we see more and more of these types of cases, involving EFTA and Reg E. Do you think the CFPB's theory holds water, and what are some of the takeaways that might be key for our audience about the CFPB's position?
James Kim:
Bottom line, I think the answer is no for a number of reasons. I would encourage people to look at the comments to the CFPB proposed rule. It's only 60. I think you could quickly identify the ones that are most relevant, right? We, the Troutman team, including Carlin, were fortunate enough to work with two important trade associations, the Financial Technology Association, FTA, and also, TechNet to draft and submit their comment letters.
Other relevant comment letters on the crypto issue are the Blockchain Association, which is another trade association, and then Coinbase. I applaud those two sets of folks, Blockchain Association and Coinbase for writing what I think are very thoughtful and substantive comment letters. I'm going to basically summarize, I think, the arguments in our letters and in their letters, right? Very quickly.
Number one, Dodd-Frank, the enabling statute for the CFPB expressly excludes from CFPB jurisdiction companies that are regulated by either the Securities Exchange Commission, SEC, or the Commodities Future Trade Commission, CFTC. If you are regulated by either, or both of those agencies under Dodd-Frank, you are expressly carved out of CFPB jurisdiction. Now footnote, very nuanced point here, there's a give back to the CFPB if the company that's subject to SEC, or CFTC supervision are service providers for CFPB regulated companies. That's complicated, but setting that, give back aside, I think Dodd-Frank expressly carves out companies regulated by the SEC, or CFTC. Both of those agencies, I think, unambiguously have asserted that various, certain types of crypto assets are under their jurisdiction. That's number one.
Number two is outside of Dodd-Frank, I'm unaware of any statutory authority, or case law holding that crypto assets are funds under Dodd-Frank. You mention those two cases, they're just district court opinions. They're not analyzing Dodd-Frank, so I would say they're not necessarily – they're relevant, perhaps, but not controlling for sure and perhaps, not applicable at all. Because there's no clear statutory authority, either in Dodd-Frank or any other statute, there's a very strong argument that the CFPB's position violates the major questions doctrine, which is the constitutional doctrine, right?
The expression that I've seen in some key federal cases is that Congress does not hide elephants in mouse holes. Meaning, if Congress had intended to delegate to the CFPB jurisdiction over any type of digital asset, or crypto asset, it would have expressly said so. It doesn't hide something important through some tortured, or unclear, or unambiguous, or implied reading of a statute, right? Dodd-Frank was passed in 2010. I think, crypto assets were in their infancy. The idea that Congress intended for the CFPB to cover crypto assets in 2009 and to 2010, I think is highly unlikely and unsupported in the plain language of any statute, including Dodd-Frank.
The certain final thing, and this is more of a policy point, is that Congress is already working on the issue and the CFPB should not get ahead of Congress, right? You guys and this audience probably know congressional activity relating to crypto and digital assets better than I do, but there's a lot of activity, most of it is pending. The two big ones I can think of are in the House, you have the Financial Innovation and Technology for the 21st Century Act, which passed the committee by a partisan vote. Then in the Senate, you have the Lummis Gillibrand Act, right?
The point is, Congress is working on the issue. They're doing it the right way. Stakeholder input, the public, transparent legislative process. The CFPB should unilaterally, without any statutory authority, assert jurisdiction, and get ahead of Congress.
Ethan Ostroff:
That's great, James, and super helpful background and information. I mean, I would go a step farther and say, that Gensler with the SEC has been unambiguous in saying, basically, anything in the digital asset space is regulated by the SEC. But it's interesting now that there is a further turf war going on amongst federal regulators over the digital asset space. I mean, there's been this ongoing debate between the CFTC and the SEC about the limits of each other's jurisdiction and overlap, and particularly, focused on the issue of whether or not a digital asset qualifies as a security, or a commodity. Now, you have the CFPB further stepping into that and trying to carve out its own area of supervision.
Carlin, I guess, some potential legal deficiencies in your view about the proposed rules analysis and how it overlaps with digital assets?
Carlin McCrory:
Yeah. I mean, I think, James just laid out all of the legal arguments that can be made for the proposed rule not covering digital assets. The only thing that I'd like to just briefly mention now is that it seems as if the CFPB's analysis as it relates specifically to digital assets and the costs and benefits of the proposed rule for digital asset companies was a little thin. The CFPB goes through a cost benefit analysis, which is legally required, but it really focuses on fiat currency, rather than that of digital assets. I think that's a point there, where the CFPB didn't fully consider some of the implications that the proposed rule may have on digital asset companies.
Ethan Ostroff:
Okay, cool. Appreciate that. Are there any practical questions in your mind that companies face in assessing the proposed rule? I guess, as part of that, interested to hear from either or both of you about the timing. My understanding is that comment period is closed. What can we think about and our audience be aware of as far as upcoming milestones, or timeframes for further activity about this rule? Is there a SBREFA panel, for example, that they'll have to convene?
Carlin McCrory:
I'll take your first question, Ethan. Some practical questions that I think the proposed rule did not address, and that's worth flagging are first, it's not clear, at least to me, whether NFTs are covered. NFTs have some monetary value and can be used for financial purposes, but they're not typically used as a form of fungible currency. I think there's still an outlying question there. Does this cover NFTs for certain purposes when they're used in certain circumstances? That's the first question.
The second thing that comes to mind is the purpose is that these transactions are anonymous. For a company that's providing a wallet, they may have little to no information, or insight on a user's transaction. If that's consumer to consumer, or what the transaction is for, in which case, these companies would need to ask for and somehow, verify information and monitor user transactions. What comes along with this are the added costs, obviously, hiring new people, consultants, and even a whole product change as well, right? Since this is a different model of business, that is not required.
Stemming from that is also, how can some of these companies tell whether a transaction is actually for personal family, or household purposes? That's not always readily available information. Lastly, I'll round out here with a thought that some of these companies don't currently count transactions, or may not count transactions to see if they fall within the purview of the rule, which would require them to build software, to monitor and track their number of transactions, to see if they do fall within the proposed rule, which again, that's additional costs for these companies that is separate and apart from other fiat companies that typically know their transaction volume. They know and count the transaction, and that's easy data that they have readily available. Some of these digital asset companies may not have that as readily available.
Ethan Ostroff:
Just to dovetail with that, the threshold here that the CFPB is talking about is at least five million consumer payment transactions annually, right?
Carlin McCrory:
That's right, Ethan. Then on the second hand, just to address the second part of your question, and James, feel free to pop in here. The comment period closed on January 8th. What we expect is that the final rule would come out at some point this fall. We would expect and we predict that it would come out likely before the election. Then, we think that exams would actually start in 2025.
James Kim:
Yeah, just adding on the timing aspect. It's pretty clear that the current director wants to push out and accomplish a bunch of things, this, well, being one of them, will making, being one of them before the election. Even if the Democrats keep control of the White House, I don't think Director Chopra is interested in staying beyond his one term. He may have his people continue at the CFPB, but I think he's probably got greater aspirations, Senate or governor. Either way, he wants to get it done before a change in administration.
Ethan Ostroff:
Very interesting. This is going to be coming at people real fast over the next 12 months. That's what we're expecting, right?
James Kim:
Yeah. Just a point that I want to emphasize, since we're, I think, getting toward the end, is Carlin did a good job of summarizing some of the contours of the rule. How does the CFPB define the market for digital payments and are you a larger participant? That's the 5 million annual transactions threshold. People should consider that part. Will you be covered potentially under the rule and therefore, supervised?
I think the other point, and this is going back to my initial point here, is even if you are not covered by the rule and therefore, not initially supervised by the CFPB, to me, the headline here is the CFPB has taken a position that crypto assets are funds. The CFPB put its marker down to say, even if you don't qualify under the rule and therefore, may not be supervised, you're still subject to the CFPB's broader and jurisdiction. What does that mean? They could send you a civil investigative demand, their version of a subpoena and conduct an enforcement investigation. They could collect consumer complaints about the crypto industry, and they post those complaints, albeit anonymized on their website.
They could do a number of things, other rulemakings, because they've established the predicate that crypto assets are funds under their statute and other statutes that they own and enforce, but primarily Dodd-Frank.
Ethan Ostroff:
That's super helpful. Carlin and James, thank you so much for that. I think, a big takeaway for our audience is that they may not be used to thinking about the CFPB and the impacts the CFPB could have on their businesses in the digital asset space, but the CFPB is clearly throwing down a marker and indicating very clearly, they want to exercise supervisory and likely, enforcement authority in this space. That is coming down the pipeline. Coming down the pipeline at a rather quick pace. Companies should be keenly aware of the CFPB's activities in the next, particularly, in the next 12 months.
I wanted to thank our audience for joining us today. As always, don't forget to visit our blogs, consumerfinancialserviceslawmonitor.com and troutmanpepperfinancialservices.com. Subscribe, so you can get the latest updates. We're certainly going to be following these developments with the CFPB very closely and look forward to talking to our listeners about it as it develops over the course of the next 12 months.
Finally, if you like what you hear, we'd appreciate you subscribing to our podcast, via Apple Podcast, Google Play, Stitcher, or whatever platform you use. We look forward to speaking with you next time.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.