CFPB Issues Interpretive Rule Designating BNPL Providers as Card Issuers Subject to Regulation Z

On May 22, 2024, the Consumer Financial Protection Bureau (CFPB) issued an interpretive rule stating that providers of “buy now, pay later” (BNPL) products that issue “digital user accounts” to access credit products to purchase goods and services are “card issuers” under Regulation Z. As a result, such BNPL providers will be subject to certain provisions of Regulation Z.

The interpretive rule highlights the CFPB’s expansive view of what constitutes a “credit card” for purposes of Regulation Z by likening the “digital user accounts” that consumers use to access BNPL credit products to traditional credit cards.

The CFPB’s coverage of BNPL providers has been anticipated since the CFPB first declared interest in the BNPL market in December 2021, when it issued a mandatory data collection order to five large BNPL providers. The CFPB subsequently issued several market reports (including one in September 2022and another in March 2023) on the BNPL industry based on these responses and other surveys, and the new interpretive rule is an extension of that work.

What BNPL products are covered?

For purposes of the interpretive rule, the CFPB defines BNPL credit as a “closed-end consumer loan for a retail transaction that is repaid in four (or fewer) interest-free installments and does not otherwise impose a finance charge.” Accordingly, the interpretive rule should be read in the context of that specific BNPL product design.

The CFPB does not address how or whether Regulation Z would apply to other types of BNPL products. It does note that there are other types of BNPL products, such as loans that have a finance charge, and that depending on the product design, other provisions of Regulation Z may apply.

How does the CFPB determine that a ‘digital user account’ is a ‘credit card’?

The CFPB’s interpretation that BNPL providers are subject to Regulation Z hinges on its determination that a “digital user account” is a “credit card” as defined under Regulation Z.

The CFPB first notes that “credit card” covers not just physical cards, but also nonphysical credit devices, like account numbers and virtual credit cards.

It points out that, under Regulation Z, a “credit card” means “any card, plate, or other single credit device that may be used from time to time to obtain credit,”¹ while the definition of “credit” under the Truth in Lending Act (TILA) includes “other credit device.”²

Although “other credit device” and “other single credit device” are not defined in the TILA or Regulation Z, the CFPB relies on dictionary definitions, historical context and Federal Reserve Board interpretations to conclude that these terms should be read broadly and were meant to be flexible.

As a result, the CFPB interprets these terms to include “a BNPL digital user account that a consumer can use through websites, mobile apps, browser extensions, or integrations with merchant websites or mobile apps to access BNPL credit, to the extent the user account is used to draw, transfer, or authorize the draw or transfer of credit … ."

Further, the CFPB explains that for a device to be deemed a credit card under Regulation Z, it must be “usable from time to time to obtain credit,” which “involves the possibility of repeated use of a single device” under Regulation Z commentary.

The CFPB notes that “the BNPL business model is designed around the repeat use of a digital user account to make real-time purchases on credit” and concludes that “credit cards” include digital credit devices for purposes of Regulation Z.

Who is covered by the interpretive rule?

The CFPB concludes that BNPL providers that issue “digital user accounts” in the context of BNPL products are “card issuers” subject to Regulation Z, because they “issue[] a credit card … .”³

Further, because a provider of a BNPL product is a “card issuer,” it also is a “creditor” for purposes of subpart B of Regulation Z – and therefore is subject to the credit card requirements of subpart B.

The CFPB explains that while subpart B generally covers open-end credit, many of its provisions also apply to card issuers that extend credit with no associated finance charge and that is payable in four or fewer installments.⁴ Specifically, the CFPB notes that a “card issuer” that issues this type of closed-end credit is considered a “creditor” for purposes of subpart B – and therefore is subject to the requirements of subpart B.⁵

Note that the CFPB specifies that any entity that issues a credit card – banks and nonbanks – may be covered by the rule, and in a situation where a BNPL provider partners with another party to extend credit, it is possible that both parties may be deemed card issuers.

What are the compliance requirements for BNPL providers?

Pursuant to the interpretive rule, providers of BNPL products will need to comply with various credit card requirements of Regulation Z. Specifically, BNPL providers will be required to comply with provisions concerning cost of credit disclosures and dispute resolution, including completing investigations into consumer-initiated billing disputes and pausing payment requirements during an investigation – and, if applicable, the issuance of credit. In addition, BNPL providers must provide users with periodic statements and comply with provisions concerning consumer refund rights.

The CFPB notes that BNPL providers are “generally not subject to the credit card regulations appearing in subpart G of Regulation Z (e.g., penalty fee limits and ability-to-repay requirements),” but does indicate that the credit card application and solicitation disclosure requirements in subpart G “may” apply to such BNPL providers.

What’s next?

Not surprisingly, the timing of the CFPB’s issuance of the interpretive rule appears to align with the Biden administration’s broader strategy to expedite the implementation of new regulations before a potential 2025 change in administration and Congress. Specifically, the Congressional Review Act (CRA) gives Congress the ability to review and potentially rescind new federal rules issued by government agencies, including interpretive rules. A key component of the CRA in this context is the 60-day “lookback” window. The lookback window opens 60 legislative days from the final adjournment of the 118th Congress. During the lookback window, the rules that are finalized by a government agency are subject to review by the next session of Congress, which will begin in January 2025. This lookback period allows the new Congress to review and potentially disapprove rules made at the end of the previous administration to prevent so-called midnight regulations that may be unfavorable to the incoming administration. Under the CRA, Congress can move to rescind regulations with a simple majority vote in both chambers on a resolution of disapproval. If Congress passes the resolution, and it is signed by the president, the agency is prohibited from issuing a “substantially similar” rulemaking without further Congressional action.

The interpretive rule will become effective 60 days after its publication in the Federal Register. While the CFPB claims that it is not required to provide a public comment period for the interpretive rule under the Administrative Procedure Act, it is accepting comments until August 1, 2024.

Note that the CFPB indicated that it “may” make revisions to the interpretive rule based on public comment. While some BNPL providers may already comply with the applicable portions of Regulation Z – particularly if they operate in states that have similar requirements – other applicable Regulation Z requirements may provide new operational and logistical challenges.

Notes

1. 12 CFR 1026.2(a)(15(i)).
2. 15 USC 1602(l).
3. 12 CFR 1026.2(a)(7).
4. 12 CFR 1026.2(a)(17)(iii).
5. Id.