A Biden CFPB and the PayPal Decision

On December 30, 2020, the U.S. District Court for the District of Columbia issued an important ruling in PayPal v. CFPB.[1]

The Court struck down two provisions of the Consumer Financial Protection Bureau’s (“CFPB” or the “Bureau”) Prepaid Rule that (1) required providers of prepaid products to use CFPB-issued fee disclosure forms and (2) imposed a 30-day waiting period before allowing providers to link certain credit accounts to prepaid accounts.  The Court held that both provisions exceeded the CFPB’s rulemaking authority under the Electronic Fund Transfer Act (“EFTA”), the Truth in Lending Act (“TILA”), and the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”).

The decision may signal a larger role for the judiciary as a check on the CFPB, whose rules have largely been upheld over the past decade.  While the case will likely be appealed, the Court’s narrow reading of the Bureau’s rulemaking authority has the potential to curtail the CFPB’s regulatory reach in a number of areas, including under the Fair Debt Collection Practices Act.  The Biden CFPB is widely expected to take a more aggressive stance on enforcement and oversight, particularly in the lending industry.  The PayPal decision may create additional hurdles for the Biden Administration in promulgating new rules under federal consumer protection laws. 

Background

The CFPB’s “Prepaid Rule” governs “prepaid products,” i.e., financial products that allow consumers to load money onto the product for later use.[2]  Among the regulated products are so-called “digital wallets,” which enable consumers to electronically store their credit, debit, and checking account credentials and access them for purchases and payments.  A subset of digital wallets that are “capable of holding funds, rather than merely acting as pass-through vehicle[s]” qualify as “prepaid accounts” subject to the Rule.[3]

In December 2019, PayPal, a provider of digital wallets, brought suit against the CFPB under the Administrative Procedure Act (“APA”) and First Amendment, seeking to invalidate two provisions of the Prepaid Rule: (1) the mandatory short-form disclosure rule and (2) the 30-day credit linking restriction.[4]  

The short-form disclosure rule required providers to disclose seven of the most common fees associated with prepaid products using standardized forms issued by the CFPB.[5]  The provision was promulgated as an amendment to EFTA, which “provide[s] a basic framework establishing the rights, liabilities, and responsibilities of participants in electronic fund and remittance transfer systems.”[6]  Among other things, EFTA requires financial institutions to disclose the terms and conditions of electronic fund transfers,[7] and directs the Bureau to “issue model clauses for optional use by financial institutions to facilitate compliance with the disclosure requirements.”[8]  

PayPal argued that the Bureau overstepped its statutory authority under EFTA in making its disclosure forms mandatory, rather than optional.  The Bureau argued that its rule was independently authorized by both EFTA, under which the CFPB has general rulemaking authority to “prescribe rules to carry out [EFTA’s] purposes,”[9] and Dodd-Frank, under which the CFPB is broadly authorized to “prescribe rules to ensure that the features of any consumer financial product or service . . . are fully, accurately, and effectively disclosed to consumers.”[10] 

The 30-day credit linking restriction required credit issuers to wait 30 days after a consumer registers a prepaid account before linking credit to the prepaid account, in certain circumstances.[11]  This provision was promulgated as an amendment to TILA, which promotes the “informed use of credit” by “assur[ing] a meaningful disclosure of credit terms.”[12] 

Here, PayPal argued that the Bureau exceeded its statutory authority “by creating a substantive restriction on a consumer’s access to and use of credit under the guise of a disclosure rule.”[13]  The Bureau argued that it had broad authority under TILA to prescribe rules that are “necessary or proper” to “effectuate [its] purposes,” including to “facilitate compliance [with TILA],”[14] and that Dodd-Frank’s general grant of authority provided an independent, sufficient basis for adopting the 30-day credit linking restriction.[15] 

The Decision

Judge Richard J. Leon of the U.S. District Court for the District of Columbia invalidated both of the challenged provisions under the APA, finding that the CFPB had overstepped its statutory authority in both instances.[16] 

With respect to the mandatory short-form disclosure rule, the Court held that neither EFTA nor Dodd-Frank authorized the CFPB to make its model forms mandatory.  Applying Chevron, the Court found that Congress had unambiguously spoken on the issue by directing the Bureau to “issue model clauses for optional use” and not requiring providers to utilize a specific form.[17]  The Court pointed out that EFTA’s safe harbor provision, which protects providers who opt to use the CFPB’s models, would effectively be rendered inoperative by the Bureau’s reading of EFTA.[18]

Notably, the Court disagreed with the CFPB that its rule was permissible under the Bureau’s general rulemaking authority under EFTA or Dodd-Frank.[19]  Reasoning that the “specific governs the general,” the Court ruled that Dodd-Frank’s broad grant of authority could not override EFTA’s specific provisions regarding the manner in which the Bureau could issue disclosure models.[20]  The Court found the argument that Congress had not explicitly prohibited mandatory forms to be meritless, stating that an “agency’s general rulemaking authority plus statutory silence does not . . . equal congressional authorization.”[21]

In striking down the 30-day credit linking restriction, the Court stressed that the CFPB “reads too much into its general rulemaking authority,” and that its broad grants of authority are “not without limitations.”[22]  Although the Court acknowledged that TILA provides the Bureau with broad rulemaking authority, it found that Congress limited this authority to regulating the disclosure of credit terms¾not the underlying terms themselves.[23]  Having construed the 30-day waiting period as a substantive limitation on consumers’ access to credit rather than merely a disclosure requirement, the Court concluded that it could not be justified under the TILA.[24]

As with the mandatory short-form disclosure rule, the Court refused to interpret Dodd-Frank’s grant of authority¾or the lack of an explicit prohibition from Congress¾as a sufficient basis for the rule, reasoning that the CFPB could not simply cite to Dodd-Frank to override Congress’s legislative directive in limiting TILA to the disclosure of credit terms.[25] 

Takeaways

The PayPal Court’s decision represents a notable departure from the judiciary’s historical tendency to uphold rules issued by the CFPB.  The decision will likely be appealed, and may carry much broader implications for the Bureau’s regulatory reach if affirmed.

The CFPB has often relied on its general rulemaking authority under Dodd-Frank in promulgating various rules within the consumer protection sphere.  For example, the CFPB recently issued a final rule regarding disclosure requirements, among other things, under the Fair Debt Collection Practices Act.[26]  As with the Prepaid Rule, the Bureau stated that it “may prescribe rules containing disclosure requirements [under Dodd-Frank] even if other Federal consumer financial laws do not specifically require disclosure of such features.”[27]  

The PayPal decision’s principle of limiting the Bureau’s general grants of authority in light of more specific provisions calls this broad reading into question, and could potentially be applied to many other areas within the Bureau’s purview.  If PayPal’s approach is widely accepted, the CFPB may find itself defending against similar challenges to its rulemaking authority in the future.  Such a development would be a setback for the Bureau, in particular as it seeks to take a more active role under the new Biden Administration.

---

[1]      PayPal, Inc. v. Consumer Financial Protection Bureau, CV 19-3700 (RJL), 2020 WL 7773392 (D.D.C. Dec. 30, 2020).

[2]      Prepaid Accounts Under the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z) (“Prepaid Rule” or “Rule”), 81 Fed. Reg. 83934 (Nov. 22, 2016); 83 Fed. Reg. 6364 (Feb. 13, 2018) (AR1 743).

[3]      12 C.F.R. pt. 1005, Supp. I, ¶ 2(b)(3)(i)-6.

[4]      Paypal, 2020 WL 7773392 at *1.

[5]      Id. at *2.

[6]      15 U.S.C. § 1693(b).

[7]      Id. § 1693b(c).

[8]      Id. § 1693c(a)–(b).

[9]      Id. § 1693b(a)(1).

[10]     12 U.S.C. § 5532(a); Paypal, 2020 WL 7773392 at *3.

[11]     Providers like PayPal, which offers separate asset accounts, were required to wait 30 days before linking a credit account to the separate asset account, but not before linking credit to a separate digital wallet.  Paypal, 2020 WL 7773392 at *2 (citing 12 C.F.R. § 1026.61(c)(1)(iii)).  Providers that offered digital wallets that included an asset account were subject to the 30-day waiting period where (1) the prepaid and credit card accounts were issued by the same institution (or an affiliate), or (2) the issuers had a business relationship and varied certain costs or other characteristics based on account linkage.  Id.

[12]     15 U.S.C. § 1601(a).

[13]     Paypal, 2020 WL 7773392 at *7.

[14]     Id. at *3 (citing 15 U.S.C. § 1604(a)). 

[15]     Id. at *8.

[16]     Id. at *1.

[17]     Id. at *4 (citing 15 U.S.C. § 1693b(b)) (emphasis in original).

[18]     Id. at *6.

[19]     Id. at *5.

[20]     Id.

[21]     Id. (citing Merk & Co. v. HHS, 385 F.Supp.3d 81, 92 (D.D.C. 2019), aff’d, 962 F.3d 531 (D.C. Cir. 2020)).

[22]     Id. at *7.

[23]     Id.  In a footnote, the Court recognized that some of TILA’s provisions establish discrete, substantive obligations or restrictions on credit, but reasoned that Congress had not provided any specific provisions concerning restrictions on consumers’ access to credit or delegated the ability to create such provisions to the CFPB.  Id. at *7 n.6.

[24]     Id. at *9.

[25]     Id. at *8.

[26]     Debt Collection Practices (Regulation F), 12 C.F.R. § 1006 (2020).

[27]     Id.; Prepaid Rule, 12 C.F.R. §§ 1005, 1026 (2018)