The CFPB reached for payment apps while the customer’s money sat at partner banks

The week

On November 21, 2024, the Consumer Financial Protection Bureau finalized a rule defining larger participants in the market for general-use digital consumer payment applications. It allowed the Bureau to supervise nonbank firms whose apps handled at least 50 million consumer payment transactions a year, a much higher bar than the 5 million in the 2023 proposal. It covered only transactions denominated in U.S. dollars, leaving most crypto activity outside its scope. Supervision would let CFPB examiners review these firms for compliance with existing federal consumer financial law, including electronic fund transfer, privacy and unfair, deceptive or abusive practices rules. The rule created no new substantive obligations and was expected to reach a small number of large technology and payment firms. It arrived months after the bankruptcy of the fintech middleware firm Synapse had left many end users of partner apps unable to reach their funds.

The larger-participant rule was narrow by design. It did not tell payment apps to do anything new. It let the CFPB examine the largest of them for compliance with laws that already applied, as it already examined large banks. The timing made a gap visible. For months, consumers who had kept money in apps built on Synapse had been unable to get it back, and the dispute was over records held across a middleware firm and several banks. Supervising the app layer would not have reached that problem.

Consumer exposure in app-based payments sits in three places, and only one of them depended on the new rule. The first is the substantive law that governs the app’s conduct toward customers. The second is the supervisory access the rule added. The third is the partner bank layer, where customer funds are actually held and recorded. Together they cover the obligations, the oversight and the money.

The substantive law: in force regardless

Apps that let consumers send money, pay merchants or store balances were already subject to federal consumer financial law. The Electronic Fund Transfer Act and Regulation E govern error resolution and liability for unauthorized transfers. The Gramm-Leach-Bliley Act governs privacy. The prohibition on unfair, deceptive or abusive acts or practices applies broadly. State money transmitter laws add licensing, safeguarding of customer funds and examinations of their own.

The questions that matter most to consumers, such as whether a hacked customer recovers the money and how fast a dispute is resolved, were already answered by this law. The CFPB could already bring enforcement actions. Scam losses, where a customer is tricked into authorizing a payment, were and remain the hardest category. Regulation E generally does not treat an authorized payment as an error. The debate over who bears those losses was therefore playing out in Congress, in network rules and in individual company policies, outside this rule.

Supervisory access: the part the rule added

Supervision differs from enforcement. Examiners request documents, sample dispute files, review complaint handling and test whether written procedures match practice. They can find problems before they become violations. For large banks this has long been routine. For large payment apps it would have been new at the federal level.

The practical effect would have fallen on governance and evidence. Compliance management systems, complaint handling, error resolution timelines and fraud controls would all have been examined. Firms that had grown fast under lighter scrutiny often have reasonable outcomes but thin documentation of how decisions are made. Building that documentation is worthwhile in any case. State regulators, courts, card networks and bank partners ask for the same evidence.

Two areas would likely have drawn early examiner attention. One is account freezes and closures. Apps freeze accounts to stop fraud, but a freeze that holds a customer’s balance for weeks without explanation generates complaints and possible unfairness claims. Written criteria, time limits and a customer notice for each freeze are the evidence that answers the question. The other is the error resolution clock. Regulation E sets deadlines for investigating disputes and for provisional credit, and examiners test them by sampling files. Firms that measure their own on-time rate monthly find late cases before an examiner does.

The partner bank layer: where the money sits

Most payment apps rely on banks to hold customer funds, issue cards or reach payment networks. Those banks are supervised, and the 2023 interagency guidance on third-party relationships made clear that they must manage partners’ risks, including consumer protection risk. Synapse showed what happens when that management fails at the ledger level. Customer balances were pooled in custodial accounts at several banks, the middleware firm kept the record of who owned what, and when it failed, nobody could quickly reconcile the two.

For a partner bank, this layer has three distinct exposures. Compliance exposure: if a partner mishandles Regulation E disputes on accounts held at the bank, the bank may share responsibility. Ledger exposure: the bank must be able to identify the beneficial owner of every dollar in a custodial account, on any given day, without relying solely on a partner’s system. In September 2024 the FDIC proposed a recordkeeping rule for custodial accounts with transactional features to address exactly that. Reputational exposure: customers rarely distinguish the app from the bank behind it.

The controls follow. Daily reconciliation of the bank’s custodial balances against the partner’s customer-level ledger, with breaks escalated within a set time. A contractual right to receive the full ledger, in a usable format, on demand and on the partner’s failure. A tested plan for paying customers directly if the partner disappears. Counsel should review how partnership agreements allocate these duties.

Seen together, the three layers explain why the rule mattered less than its headlines suggested. It extended oversight to the app layer, where the law already applied. The layer that had just failed consumers sat with the banks.

With hindsight

In May 2025 Congress used the Congressional Review Act to overturn the larger-participant rule, and the president signed the resolution. The CFPB’s capacity and supervisory activity fell sharply over the same period. The substantive law did not change, and state regulators continued to license and examine money transmitters. The partner bank layer stayed in focus. In August 2025 the CFPB sued Synapse over its handling of consumer funds and recordkeeping, seeking a nominal penalty that opened access to its Civil Penalty Fund. In November 2025 it approved about $46 million from that fund for affected users, roughly half of the estimated shortfall. The episode underlined the argument here: the consumer harm in that case sat in the records layer, beyond the reach of app supervision.