CFPB applies consumer credit card protections to buy now, pay later plans

Buy Now, Pay Later (“BNPL”) payments are often presented by retailers and BNPL lenders to consumers as an alternative to traditional credit card payments. After close scrutiny of industry practices for several years, the Consumer Financial Protection Bureau (“CFPB”) has brought BNPL loans explicitly within the consumer protections that apply to credit cards under the Truth in Lending Act. The CFPB has published a Final Rule to explain how the Truth in Lending Act^[1](“TILA”) and its implementing Regulation Z^[2]apply to BNPL credit purchasing options (the “BNPL Rule”).^[3] Consequently, BNPL lenders must adhere to specific disclosure requirements, consumer liability limitations, transaction dispute procedures, and refund rights similar to those governing credit card transactions. The CFPB cites a lack of uniformity in the compliance measures that have been adopted by BNPL providers as its motivation for issuing the BNPL Rule. However, the CFPB’s high level approach might itself leave confusion regarding compliance requirements.

The CFPB positions the BNPL Rules as an interpretive rule that merely clarifies existing compliance obligations for BNPL lenders rather than imposing new ones. The BNPL Rule draws statutory support from provisions that define the term “creditor” to include a provider of “credit that is not subject to a finance charge and is not payable by written agreement in more than four installments.”^[4] The CFPB observed that some prominent BNPL providers currently offer consumer disclosures and remedies akin to those mandated for credit card purchases under Regulation Z. However, it found these measures frequently inadequate and non-compliant. In its 2021-22 assessment of BNPL lender practices, the CFPB identified “a lack of standardized disclosures and challenges in resolving disputes.”^[5] Additionally, a subsequent report highlighted “issues consumers faced with merchants regarding BNPL, such as non-receipt of items and challenges in cancelling loans.”^[6]In this light, the CFPB issued the BNPL Rule “so that BNPL providers understand their obligations.”^[7]The interpretive ruling will take effect 60 days after publication in the Federal Register

Effect of the BNPL Rule

The CFPB categorizes the most prevalent form of BNPL transactions as closed-end consumer loans for retail purchases on credit, repaid in four (or fewer) interest-free installments without imposing a finance charge. BNPL lenders typically derive revenue from merchant transaction fees and consumer late payment fees.  Before the BNPL Rule, it was widely believed that BNPL plans were exempt from Regulation Z, which applied to transactions with payments done in more than four installments or imposition of a finance charge.^[8]Regulation Z expressly excludes late payment fees from the definition of “finance charges.”^[9] However, the CFPB points out that TILA mandates applying open-end credit requirements “to the extent appropriate” to credit not subject to a finance charge and not payable in more than four transactions, “even though the requirements are by their terms applicable only to creditors offering open-end credit plans.”^[10] The CFPB argues that a digital account accessing a BNPL plan falls within the definition of “credit card” due to the broad definition that includes “any card, plate, or other single credit device that may be used from time to time to obtain credit.”^[11]

In determining which open-end credit requirements are “appropriate,” the BNPL Rule applies subpart B of Regulation Z to BNPL lenders, despite its title “Open-End Credit,” emphasizing “most importantly, provisions governing credit card dispute and refund rights.”^[12]Although the BNPL Rule states that BNPL digital accounts fall within the regulation’s definition of a credit card, BNPL accounts are “generally” not subject to Subpart G credit card provisions. It unhelpfully notes that Section 1226.60 provisions, requiring tabular format disclosures, “may apply.”^[13] The BNPL Rule does not specify which open-end credit requirements do or do not apply.  Guidance may be found in statute. The TILA points to specific provisions applicable to BNPL creditors “whether or not amount due is payable by agreement in more than four installments or the payment of a finance charge is or may be required. . .”^[14]

Compliance Requirements

While the BNPL Rule emphasizes dispute and refund rights, subpart B of Regulation Z also includes extensive disclosure, periodic statement requirements and limitations on “cardholder” liability. Ambiguously, the BNPL Rule also references the requirement that certain disclosures be provided in tabular format, as specified in subpart G of Regulation Z.

Disclosures

1. Account opening disclosures: the following must be provided before opening an account:
   • charges other than finance charges and the periodic rate;^[15]
   • where credit is secured, the property in which a security interest is taken;^[16]
2. Statement of billing rights.^[17]
3. Periodic Statements.^[18]

Tabular Format

Regulation Z requires that certain information be disclosed in a specific table format along with a consumer solicitation or application for credit.^[19]As noted above, the BNPL Rule states only that these requirements “may apply.” At least one circumstance in which the “tabular” disclosures likely would not apply is provided in the exception to the regulation for consumer-initiated requests for a card account, “even if the request is made in response to a card issuer’s invitation to apply for a card account.”^[20]

Cardholder Liability Limitations

The BNPL Rule clarifies that a BNPL digital user account falls within the definition of a “credit card,” asserting that the term is “not limited to a plastic or metal embossed physical card” and includes “virtual credit cards where the account number itself is the ‘credit card.’”^[21]Therefore, BNPL providers are deemed “card issuers,” subject to subpart B provisions regardless of the credit type, including those covering cardholder liability.^[22]These rights include:

• A “cardholder’s” liability for unauthorized use is limited to the lesser of $50 or the amount obtained by the unauthorized user before notification to the card issuer.
• The cardholder’s right to assert claims and defenses, allowing customers to avoid repaying an extension of credit if a merchant fails to resolve the customer’s dispute satisfactorily.^[23]

Correction of Billing Errors

The CFPB identifies as the BNPL Rule’s most significant impact its clarification that credit card dispute and refund rights apply to BNPL transactions. TILA specifies these provisions as applicable “whether or not the amount due is payable by agreement in more than four installments or the payment of a finance charge is or may be required, . . . even though the requirements are by their terms applicable only to creditors offering open-end credit plans.”^[24]The provisions of Regulation Z implementing correction of billing errors stated in 12 CFR 1026.13 provide (among other requirements):

• Seven types of errors that may be asserted on a periodic statement, including documentation obtainable only from the merchant.
• Notices from consumers of the error.
• Time limits and procedures for resolving billing errors.
• The consumer’s right to withhold payments pending resolution of the error, including pausing automatic withdrawals from the consumer’s deposit account.
• Specific procedures for correcting errors that have occurred, if a different error occurred, or if no error occurred.
• Limitations on reporting disputed amounts to credit reporting agencies.

Fee Limitations

The BNPL Rule explicitly states that limitations on late payment fees for open-end credit card accounts do not apply to BNPL accounts:

“Lenders that issue digital user accounts to access BNPL credit are generally not subject to the credit card regulations appearing in subpart G of Regulation Z (e.g., penalty fee limits and ability-to-repay requirements).”^[25]

Separately, the CFPB has adopted a final rule amending Regulation Z to limit late payment fees on open-ended credit card accounts to $8 for large card issuers (i. e., card issuers with one million open card accounts).^[26] As noted above, such limitations would significantly impact BNPL firms’ revenues, which are heavily reliant on these fees.

Conclusion

This interpretive ruling will likely disrupt BNPL providers’ operations, especially those who have not implemented or planned to implement these Regulation Z provisions. This is especially so given the 60-day effective date. Most challenging and costly may be the application of Regulation Z’s “claims and defenses” provisions if providers have not provided for recourse to merchants for “chargebacks” by consumers exercising these rights, similar to card processors’ chargeback rights.  Consequently, the BNPL Rule may indirectly expose merchants to claims and defenses chargebacks to the extent that they have not yet, if BNPL providers are successful in providing for such recourse provisions in merchant contracts.  

The high-level nature of the BNPL Rule will likely cause confusion and uncertainty regarding specific compliance obligations. Noting that “the Administrative Procedure Act does not require it,” the CFPB is collecting comments and may revise the BNPL Rule.^[27]Comments are due by August 1, 2024. At a minimum, BNPL providers may wish to request a longer implementation period to accommodate substantial procedural and technological changes that may be necessary to comply with Regulation Z’s detailed requirements. The CFPB acknowledges that existing procedures for compliance are not uniformly implemented by industry participants. Additionally, there may be a significant opportunity for clarification as to which aspects are “appropriate” for the BNPL business model and how they might be tailored to the differences between BNPL and credit card consumer experiences. BNPL providers will undoubtedly have numerous questions on applying Regulation Z’s open-end credit requirements to their closed-end credit products.

The CFPB also notes that the BNPL Rule is designated a “major rule” under the Congressional Review Act and will be reported to Congress.^[28]This process allows Congress, by joint resolution, and the President, by veto, to override the rule.^[29]

By designating the BNPL Rule as interpretive of existing obligations under TILA and Regulation Z, the rule might expose BNPL providers to liability for TILA violations before the regulation’s effective date. The CFPB notes that “any act done or omitted in good faith conformity with the interpretive rule” would be shielded from civil liability despite any subsequent amendment, rescission or judicial invalidation of the rule.^[30] However, this may offer little comfort to BNPL providers who, in good faith or otherwise, have not strictly complied with all of subpart B’s requirements of Regulation Z to date.