On October 5, 2016, the Consumer Financial Protection Bureau (the Bureau) released its long-awaited final rule for prepaid accounts under the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z). The rule, which checks in at nearly 1700 pages, establishes sweeping consumer protections that impact all aspects of the prepaid industry.
The rule, which generally becomes effective on October 1, 2017, will require prepaid providers to include detailed "know before you owe" disclosures in packaging, provide easy and free access to account information, limit consumers' losses when funds are stolen or cards lost, and follow rules designed for credit cards when offering credit in connection with a prepaid account. The final rule largely tracks the Bureau's proposed rule (released in November 2014), notwithstanding the more than 65,000 comments submitted, including 150 comments from consumer advocacy groups, trade associations, the payments industry, and digital wallet providers, among others.
The Bureau's rule represents a significant shift in the regulatory framework for prepaid products. For many providers of these popular products, addressing the new requirements will require significant investments in resources, new internal controls, and comprehensive compliance policies and procedures.
Summary of the Final Rule for Prepaid Accounts
Scope. The final rule defines prepaid accounts to encompass a diverse group of products, including traditional general-purpose reloadable cards; non-reloadable prepaid cards; payroll cards; student financial aid disbursement cards; tax refund cards; government benefit cards; mobile wallets; person-to-person payment products; and other electronic prepaid accounts that can store funds. The rule excludes from coverage gift cards and gift certificates; accounts used for savings or reimbursements related to certain health, dependent care, and transit or parking expenses; and certain limited government program accounts.
Disclosures. A prepaid product must include "Know Before You Owe" disclosures with standard, easy-to-understand information about the product. The rule requires financial institutions to provide both a "short form" and a "long form" disclosure before a consumer acquires a prepaid account, such as by purchasing, opening, or choosing to be paid via a prepaid account. The rule imposes content, form, and formatting requirements for the short and long form disclosures.
- Short Form - The short form disclosure sets forth the prepaid account's most important fees and certain other key terms. If provided in writing, it must be in a format the consumer can keep, such as on the product's packaging or on a separate written statement visible through the packaging. The final rule includes several model short form disclosures that provide a safe harbor if used accurately and appropriately.
- Long Form - The long form disclosure provides a table listing all of the fees associated with the prepaid account and detailed information on how those fees are assessed, as well as certain other information about the prepaid program. Unless acquired through a retail transaction or orally by telephone, the long form must be provided prior to the consumer acquiring a prepaid account. For retail transactions, the long form may be provided after the consumer acquires the prepaid account if the short form is provided on or is visible through the packaging materials for the prepaid account. For transactions by telephone, the long form may be provided after the consumer acquires the account if the long form is disclosed orally to the consumer and is available by telephone and on a website.
Access to Account Information. The final rule adopts an alternative to Regulation E's periodic statement requirement by permitting issuers to make available to consumers certain methods for accessing information about their prepaid accounts in lieu of sending periodic statements.
Limited Liability and Error Resolution. The rule extends Regulation E's limited liability and error resolution requirements to all prepaid accounts. As a result, financial institutions must cooperate with consumers who find unauthorized or fraudulent charges, or other errors, on their accounts by investigating and resolving these incidents in a timely way and, where appropriate, restore missing funds. If the financial institution cannot do so within a certain period of time, it will generally be required to provisionally credit the disputed amount to the consumer while it finishes its investigation. The rule limits a consumer's liability for unauthorized charges to $50, provided the consumer promptly notifies his or her financial institution of the unauthorized charges.
Submission and Posting of Prepaid Account Agreements. Prepaid account issuers will be required to submit their agreements to the Bureau for posting on the Bureau's website. Issuers will also be required to post agreements on their own websites, but this requirement does not take effect until October 2018.
Overdraft and Credit. The rule applies Regulation Z's credit rules to credit features offered with a prepaid account where (1) the credit feature is offered by the prepaid account issuer, its affiliate, or its business partner; and (2) the credit can be accessed in the course of a transaction conducted with the prepaid card to obtain goods or services, obtain cash, or conduct P2P transfers. The rule generally requires that such credit features be distinct from the asset portion of the prepaid account to facilitate transparency and compliance with various Regulation Z requirements. The final rule uses the term "hybrid prepaid-credit card" to refer to a prepaid card that can access both a credit feature that is subject to the Regulation Z credit card rules and the asset portion of a prepaid account.
- Credit Solicitations - The final rule requires issuers to wait at least 30 days after a prepaid account is registered before soliciting a consumer to link a covered credit feature to the prepaid account, and issuers must obtain consumer consent before linking such a credit feature to a prepaid account.
- Ability to Repay - Prepaid companies, like credit card issuers, must determine consumers have the ability to repay the debt before offering credit by considering at least one of the following: the consumer's debt-to-income ratio, debt-to-assets ratio, or residual income after making minimum payments.
- Monthly Credit Billing Statement - Prepaid companies must give consumers regular statements with details on fees, and, if applicable, the interest rate, what they have borrowed, how much they owe, and other key information about repaying the debt.
- Offsets and Late Fees - The final rule prohibits prepaid companies from automatically pulling funds from a prepaid account to repay debts on a linked credit feature. Issuers may deduct all or a part of the cardholder's debt automatically from the prepaid account or other deposit account held by the card issuer once per month, and only pursuant to a signed, written authorization by the cardholder. The rule requires that issuers allow consumers to have at least 21 days to repay any debt incurred in connection with using such features. Late fees must be "reasonable and proportional" to the violation of the account terms.
- Compulsory Use - The final rule amends the compulsory use provision under Regulation E so that prepaid account issuers (like other creditors) are prohibited from requiring consumers to set up preauthorized electronic fund transfers (EFTs) to repay credit extended through an overdraft credit feature accessible by a hybrid prepaid-credit card.
Insights and Implications for the Prepaid Industry
The prepaid rule is one of the Bureau's first rulemakings that was not mandated by Dodd-Frank or inherited from another federal agency, and, as such, provides insight into the Bureau's priorities and its approach to rulemaking. In terms of priorities, the prepaid rule is closely aligned with a number of other pending Bureau rulemakings and public statements relating to small-dollar lending, overdraft, "know before you owe" disclosures, and other related issues. In terms of approach, the Bureau took its time in researching the industry and developing a proposed rule (over 870 pages), and then took more time to issue a final rule (1,698 pages) that largely adopts its initial proposal. The Bureau appears to be taking a similar approach in the rulemakings for debt collection, small-dollar lending, and arbitration, and it will be interesting to see whether the Bureau will do more in those rulemakings to accommodate public comments.
For the prepaid industry, there will be significant challenges in ensuring compliance prior to the effective date. The scope of the rule covers all manner of prepaid products that differ substantially in form and use and will present unique challenges for each company. These challenges will continue as products in this space evolve with the development of new digital and mobile technologies. In particular, the broad definition of prepaid account (which includes mobile wallets) and P2P products will cover companies that have not previously been subject to this type of comprehensive consumer protection regulation.
Compliance and Practical Challenges
- The rule will likely create significant compliance headaches for prepaid companies that will need to be addressed in policies and procedures. The new disclosure requirements, for example, will require changes to established internal workflows, new product packaging, coordination with manufacturers, and updates to computer systems and software to ensure compliance. All of these changes will need to be coordinated with a prepaid company's compliance management system.
- Mobile and digital prepaid account providers will need to address how to make disclosures electronically.
- The prepaid industry will need to work closely with banks, lenders, and other related industries to coordinate in developing compliant products and services.
- The new regulations will likely require issuers to work with legal counsel to revise agreements to account for the new requirements.
- The proposed rules on error resolution and fraud protection may require some prepaid issuers to hire and train additional staff, which will require significant time and effort. Issuers that sell prepaid accounts over the phone will need to update call center scripts.
- Issuers that decide to offer overdraft and similar credit features will need to review their products and services for compliance with the Bureau's detailed regulations relating to credit issuance, ability to repay, and fee limitations, among other requirements.
Get Ready for Heightened Scrutiny through Enforcement and Examinations
- Although the final rule is not effective until October 7, 2017, the prepaid industry should expect the Bureau to keep a close eye on the prepaid industry and compliance with existing laws and regulations. For example, the Bureau opened an investigation into UniRush, issuer of the RushCard, following an October 2015 incident in which consumers were unable to access funds in their prepaid accounts for more than two weeks. Although the Bureau has not taken further action at this point, UniRush agreed to pay $20.5 million to affected cardholders as part of a May 2016 settlement with consumers.
- Prepaid issuers with upcoming scheduled examinations should expect the Bureau to inquire about efforts to develop appropriate compliance procedures ahead of the rule's effective date. Issuers should be prepared to highlight their progress in developing new disclosures, error resolution mechanisms, and other necessary additions to their compliance management systems. The key to passing a CFPB examination lies in careful preparation – preferably before the Bureau targets your company for scrutiny.
Related Articles
How to Prepare for and Survive a CFPB Examination
A Look Inside the Official CFPB Enforcement Policies and Procedures Manual
On the CFPB's Fifth Anniversary, a Refresher