US consumer digital payments under the spotlight: Key CFPB initiatives to target crypto, video games and more

The US Consumer Financial Protection Bureau (CFPB or Bureau) has recently taken significant steps to strengthen consumer protections in the digital payments sector, including by launching several key regulatory initiatives that will have big impacts on digital wallet providers, crypto market participants and video game companies (in respect of in-game payments).

Although the CFPB has clearly signaled its regulatory focus for the coming months, the CFPB has been an embattled agency for years now and the subject of often-partisan attacks, particularly from certain republicans. We expect that, under the incoming republican Presidential administration, we are likely to see additional developments in the Bureau’s approach and priorities, including because the new administration has voiced strong support for digital assets.

Supervision of Big Tech’s digital wallets and payment apps 

In November 2024, the CFPB released a final rule aimed at enhancing its supervisory oversight authority over large nonbank entities that provide high levels annually of digital funds transfer services, as well as payment wallet applications that facilitate more than 50 million transactions per year. 

The final rule extends the CFPB’s existing supervisory authority by expressly providing the CFPB with authority to conduct examinations on certain large entities to test compliance with federal consumer financial law. It aims to ensure that large nonbanks and digital wallet providers adhere to consumer protection standards similar to those currently required for traditional financial institutions. 

Consumers’ rights extended to crypto firms and video games payments

Days before Trump’s return to the White House, in January 2025, the CFPB proposed an interpretive rule (the Proposed Rule) regarding electronic fund transfers (EFTs) made through accounts established primarily for personal, family, or household purposes, where such EFTs use emerging payment mechanisms, including digital assets. If approved, the proposed rule likely would increase crypto market participants’ regulatory burdens at a time when the digital asset industry is anticipating a shift to a more favorable US government policy stance on crypto.

The Proposed Rule would also materially impact the video game sector, whose payment systems have recently come under the Bureau's scrutiny. A 2024 report by the CFPB highlighted the emergence in video games and virtual worlds of products and services resembling financial products and services. That report also noted an increase in malicious attacks to players’ accounts – accounts that do not currently have the same customer protections that apply in the case of traditional banking and payment systems.

A goal of the Proposed Rule is to ensure that the Electronic Fund Transfer Act (EFTA) applies consistently to all entities that provide digital payment services, and to specifically cover accounts held by nonbank entities. Essentially, consumers using digital assets for personal transactions would receive similar protections as consumers using traditional EFTs.  Examples of such protections would include, among others, error resolution rights and liability limits for unauthorized transactions.

In addition, the Proposed Rule would define “funds” as “assets that act or are used like money, in the sense that they are accepted as a medium of exchange, a measure of value, or means of payment.” This would include stablecoins and other similar types of fungible assets, when such assets are used like money.

Among other things, the Proposed Rule clearly intends to capture video game currency and other similar digital payment mechanisms that may be utilized to pay for goods or services. In effect, the expansion of the definition of “funds” could subject a broad range of entities, including nonbank entities offering novel payment systems, to compliance requirements and increased regulatory scrutiny. Entities that fall within the scope of the Proposed Rule will be required to provide customers with initial disclosures of the terms and conditions of the EFT services and to investigate and resolve errors of which they are notified – adding to such entities’ regulatory burden.

Comments on Proposed Rule are due by March 31, 2025. 

State of consumers’ personal financial data 

The CFPB is also actively seeking public comment, in the form of a Request for Information, to gain deeper insights into how large consumer finance companies collect, share, and safeguard personal financial data. The CFPB aims to use such information to assess potential issues associated with new and advancing financial products. 

The CFPB’s request for public input indicates a focus on potentially strengthening existing privacy protections for financial and other personal data and for increasing industry responsibility to prevent fraud and other harmful behaviors associated with digital asset transactions, including, for example, the hacking of consumer accounts. From an antitrust perspective, the CFPB is also concerned with “personalized pricing,” whereby companies can determine price based on factors specific to an individual consumer. 

Comments on the Request for Information are due by April 11, 2025. 

CFPB under scrutiny

The CFPB has long been at the center of partisan debate, often under attack from certain conservative circles that have argued that the agency lacks sufficient accountability to Congress. 

Several court cases filed in 2021 challenged the CFPB’s funding structure, arguing that the CFPB’s ability to receive its funding from the Federal Reserve was unconstitutional. However, that legal battle ended in 2024, with a US Supreme Court decision upholding the constitutionality of the CFPB’s funding structure. 

The agency has also drawn the attention of Elon Musk, who has voiced support for dismantling the CFPB once he assumes his role in the incoming Presidential administration as co-head of the new Department of Government Efficiency.

Recent decisions taking aim at federal agencies’ rulemaking powers might also impact the Bureau’s agenda and the success of its regulatory initiatives. Following the demise last summer of the longstanding Chevron deference doctrine (under which federal courts generally had deferred to an agency's own determination of the scope of such agency’s authorizing statute), a growing number of US regulators have been the subject of lawsuits from private plaintiffs alleging that such regulators exceeded the scope of their authorizing statutes or otherwise violated the Administrative Procedures Act (APA). And those plaintiffs have met with some success, including in the digital assets space. The 3rd Circuit’s January 2024 decision in favor of Coinbase, which found that the SEC violated the APA when denying Coinbase's petition for rulemaking concerning the application of securities laws to digital assets, or the 5th Circuit's (December 2024) ruling in favor of the Blockchain Association and other plaintiffs, which invalidated the SEC’s Dealer Rule, are notable examples of US federal court  decisions curbing regulators' powers. In late December 2024, plaintiffs (including the Blockchain Association) similarly brought suit against the IRS, concerning the IRS’s recently announced Broker Rule.

It is possible that the CFPB's proposed expanded rules could be subject to similar attacks. 

Looking ahead

The CFPB’s recent moves focus on increasing consumer protections on modern and novel digital payment platforms and regulating digital asset providers. Although the change in US Presidential administration could reframe the CFPB’s priorities when it comes to digital asset-related transactions, as digital asset functionality and other payment methods develop and evolve, we anticipate continuing regulatory developments in this space.