The recent failure of three banks and crypto companies has generated uncertainty for banks, fintechs, payments companies, cryptocurrency exchanges, and various other financial services providers. From the regulatory perspective, despite being subject to a number of existing federal and state laws, fintechs face uncertainty as the federal government considers how best to apply additional regulation to such a dynamic and innovative industry. The federal banking, securities, and consumer protection agencies have indicated they are watching fintechs and their bank partners closely, yet there have been few concrete regulatory developments. As outlined in this article, the lack of a certain regulatory environment places additional pressure on fintechs to manage compliance challenges.
The Consumer Financial Protection Bureau (CFPB) has raised concerns about fintechs, with a particular focus on the payments and lending industries. Back in 2021, the CFPB issued a series of document production orders to six of the largest tech companies demanding information on their products, including how they use payments and other data. In 2022, the CFPB issued reports on perceived risks in buy-now-pay-later services and embedded finance applications. And throughout this time, the CFPB issued various statements and reports flagging concerns about the charging of “junk fees” in areas such as deposit accounts, credit card, loan servicing, and other lending products. These developments make clear that the CFPB is focused on what it perceives as potential consumer protection and competition risks in the fintech industry.
Notwithstanding this scrutiny, the CFPB faces its own challenges. In late 2022, the Fifth Circuit held that the CFPB’s funding mechanism is unconstitutional. The Supreme Court has agreed to review the decision, which means that the CFPB’s fate could be decided later this year. If the decision is upheld, then the Bureau’s recent rulemakings, examinations, and enforcement actions may be subject to challenge and invalidation, and the Bureau’s continuation would require the passage of legislation by Congress. Thus, while the CFPB has demonstrated an interest in the fintech industry, uncertainty remains about the Bureau’s future.
Across town, the Federal Trade Commission (FTC) has also scrutinized fintechs and payments companies. But like the CFPB, the FTC has experienced setbacks that have limited (at least to a degree) its ability to execute an aggressive enforcement agenda. In 2021, the Supreme Court’s decision in AMG Capital Management imposed limits on the FTC’s ability to obtain equitable monetary relief when filing for injunctions under Section 12(b) of the FTC Act, a process that had become the FTC’s favorite tool for targeting payments companies alleged to have aided or abetted fraudulent merchants. In response, the FTC has developed new enforcement approaches and continues to bring actions against payment processors, payment facilitators, and similar companies. In November 2021, for example, the FTC banned a payment processor from processing debt relief payments, and in March 2022, the FTC forced a payment processor to agree to injunctive relief to settle allegations. Expect the FTC to continue to bring these types of actions in 2023 and beyond.
For their part, the federal banking regulators have been active in policing bank partnerships that involve fintech companies, especially in higher-risk areas such as cryptocurrency. With the recent collapse of a number of high-profile cryptocurrency firms, the Office of the Comptroller of the Currency (OCC) and other federal banking regulators have indicated a tighter regulatory environment for bank support of cryptocurrency and other high-risk digital assets. In January 2023, the banking regulators issued a joint bulletin highlighting key risks to banks associated with crypto-assets and crypto-asset sector participants. This scrutiny complements similar developments taking place in the securities world, where the Securities and Exchange Commission and Commodity Futures Trading Commission have been ramping up pressure on cryptocurrency exchanges. Still, each of these regulators continues to operate in a world in which they are struggling to apply their existing legal authorities to the fast-developing world of cryptocurrency, blockchain, and non-fungible tokens (NFTs).
All of these developments have taken place as part of a larger trend in which regulators are taking a closer look at bank and fintech partnerships. In late 2022, for example, it was reported that the OCC had entered into an agreement with a bank because of concerns with the bank’s compliance programs for managing risks posed by its banking as a service (BaaS) partnerships with fintechs. The OCC identified the bank’s practices related to board accountability and involvement, third-party risk management, Bank Secrecy Act (BSA) / Anti-Money Laundering (AML) risk management, suspicious activity reporting, and information technology (IT) control and risk governance as sources of concern. The agreement provides a blueprint for how banks should be thinking about their BaaS partnership programs, and the expectations that partners should be prepared to meet. Against this backdrop, it’s worth noting that the banking regulators are working to publish interagency guidance on third-party relationships and risk management. That guidance may be released later this year.
Taken as a whole, these developments demonstrate that federal regulators in the areas of consumer protection are keenly focused on the fintech industry and its potential impact on consumers, businesses, and the economy. While this scrutiny creates risk for fintechs and suggests that they take a cautious approach to compliance, there remains a fair degree of uncertainty in the regulatory framework, as the CFPB and FTC continue to face challenges to their legal authorities, and the banking and security regulators work to apply their legal authorities to govern the development of new technologies and services. Perhaps the only certainty is that 2023 will continue to present a challenging regulatory and uncertain environment for fintechs companies.