On October 5, 2016, the Consumer Financial Protection Bureau ("CFPB") issued its long-awaited final rule to further regulate prepaid card products, or "prepaid accounts" (the "Final Rule" or "Rule").1 The Final Rule follows the CFPB's December 2014 publication of a Notice of Proposed Rulemaking ("Proposed Rule") on prepaid accounts.2 As discussed below, the Rule generally takes effect on October 1, 2017 (the "Effective Date").

The Final Rule weighs in at nearly 1,700 pages, and we continue to work our way through the rule, the official staff interpretations of the Rule (the "Commentary"), and the supplementary information accompanying the Rule. This summary identifies key provisions of the Final Rule addressing scope, disclosures, error resolution and liability, and provisions regarding so-called "hybrid credit-prepaid cards." A more detailed analysis, including an analysis of the interrelationship between the amendments to Regulation E and Regulation Z, and how those amendments will impact existing prepaid card products and programs, is forthcoming.

The CFPB received approximately 150 unique, detailed comment letters in response to the Proposed Rule from consumer advocacy groups, trade associations, industry representatives, digital wallet providers, virtual currency companies, research and advocacy organizations, governmental officials and individual consumers. The CFPB reported receiving more than 65,000 total comments in response to the Proposed Rule, which included comments received from individual consumers.


Consistent with the Proposed Rule, the Final Rule covers prepaid products beyond conventional network-branded general-purpose reloadable prepaid cards. Specifically, the Final Rule revises the definition of "account" under Regulation E to include prepaid accounts, and the Final Rule restructures the definition of prepaid account from the Proposed Rule to enumerate four categories of prepaid accounts: (1) payroll card accounts currently subject to Regulation E; (2) government benefit accounts currently subject to Regulation E; (3) accounts that are "marketed or labeled as 'prepaid'" that are redeemable upon presentation at multiple unaffiliated merchants for goods or services, or that are usable at ATMs; and (4) accounts that are issued on a prepaid basis or capable of being loaded with funds, whose "primary function" is to conduct transactions with multiple unaffiliated merchants for goods or services or at ATMs, or to conduct P2P transfers, that are not otherwise accounts under Regulation E (i.e., accounts other than checking accounts, share draft accounts, or NOW accounts).

With respect to this fourth "functional" category of prepaid accounts, the Commentary provides guidance regarding the "primary function" test. Specifically, the Commentary provides that an "account's primary function must be to provide consumers with general transaction capability." Accounts that provide such capability only incidentally are excluded from the "functional" category of prepaid accounts. The Commentary provides examples of accounts that meet the primary function test (e.g., prepaid accounts that provide tax refunds or insurance proceeds to consumers, if the accounts can be used, for example, to purchase goods or services at multiple unaffiliated merchants) and accounts that do not meet the primary function test (e.g., brokerage accounts and savings accounts).

Nevertheless, the Final Rule provides for a number of exclusions from the definition of prepaid account, including the following account types:

  • Health Savings Accounts, Flexible Spending Accounts and similar accounts;
  • Accounts that are directly or indirectly established through a third party and loaded only with qualified disaster relief payments;
  • P2P functionality of an account established by or through the U.S. government whose primary function is to conduct closed-loop transactions at government facilities, including U.S. military installations or vessels;
  • Accounts governed by § 1005.20 (the "Gift Card Rule"), including gift certificates, store gift cards, loyalty, award or promotional gift cards, or general-use prepaid cards that are marketed and labeled as a gift card or gift certificate; and
  • Accounts established for distributing needs-tested benefits in a program established under state or local law or administered by a state or local agency.

As in the Proposed Rule, the definition of a prepaid account under the Final Rule is not limited to physical cards. The Final Rule also covers mobile and other electronic prepaid accounts, including digital wallets, that are capable of storing funds that can be used, for example, for purchases at multiple unaffiliated merchants or to conduct P2P transfers. However, a digital wallet that is only capable of storing a consumer's payment credentials (but not storing funds) is not covered by the Rule.


Pre-Acquisition Disclosures. The Final Rule establishes "Know Before You Owe" disclosure requirements, including short-form and long-form disclosures that the consumer must receive "before a consumer acquires a prepaid card account" (i.e., "pre-acquisition"), unless a particular exception exists. With certain exceptions, the pre-acquisition disclosures set forth under the Proposed Rule were broadly adopted, as proposed, in the Final Rule. The Final Rule also includes a series of model and sample forms for complying with these requirements.3

The content and delivery requirements for the pre-acquisition disclosures in the Final Rule differ slightly depending on the type of prepaid card (e.g., payroll card account or general purpose reloadable card account), the features of the prepaid account (e.g., whether it is a hybrid credit-prepaid card) and how the account is marketed (e.g., in retail stores or orally by telephone).

  • Short Form. The short-form disclosure must clearly and conspicuously inform consumers of the following fees and other information:
  • Periodic fees, such as monthly or annual fees;
  • Per purchase fees, such as point-of-sale fees;
  • ATM withdrawal fees, including the difference between an in-network fee and an out-of-network fee;
  • ATM balance inquiry fees, including the difference between an in-network fee and an out-of-network fee;
  • Cash reload fees;
  • Customer service fees;
  • Inactivity fees;
  • A statement regarding the number of additional fee types charged;
  • Up to two "additional fees" (i.e., under the Proposed Rule "incidence-based fees"), discussed further below;
  • A statement regarding the availability of an overdraft credit feature and, if available, whether fees would apply;
  • A statement regarding account registration and FDIC or NCUSIF insurance;
  • A link to the CFPB's website where the CFPB will post information about prepaid cards;
  • A statement directing the consumer to the long-form disclosure to find details and conditions for all fees and services; and
  • Additional content for payroll card accounts, as applicable.
  • Incidence-Based Fees. One material difference from the Proposed Rule is the required disclosure of up to two "additional fees" (i.e., fees other than those required to be included in the short-form disclosure). The Proposed Rule would have required disclosure of the three most frequently charged "incidence-based fees," to be reassessed on an annual basis. The CFPB has modified this requirement to require disclosure of up to two "additional fees" that generate the highest revenue from consumers for the prepaid account program (as opposed to the three fees charged most frequently), to be reassessed on a biannual basis (as opposed to an annual basis). Moreover, the additional fee disclosure is subject to a 5 percent de minimis revenue exclusion, whereby the issuer may disclose fewer than two additional fees (i.e., one or zero additional fees) if there are fewer than two additional fees that generate 5 percent of revenue from consumers for the prepaid account program.
  • Long Form. The long form requires disclosure of the same information required under the short form, except that the long form must include "all fees that may be imposed" by the issuer in connection with a prepaid card. And, for each fee type, the disclosure must include the amount of the fee, and the conditions, if any, under which the fee may be imposed, waived or reduced. Any third-party fees that may be imposed, to the extent known, must also be disclosed. If third-party fees may be imposed, but the amounts of those fees is not known, the issuer must disclose this fact without specifying the fee amounts.
  • Delivery of Pre-Acquisition Disclosures. The Final Rule clarifies the circumstances under which accounts are "acquired in foreign languages" and, therefore, the delivery of pre-acquisition disclosures is required to be provided in such foreign languages. For example, the prepaid card would be determined to be acquired in a foreign language if "the financial institution principally uses a foreign language on the prepaid account packaging material."

The CFPB also provides clarifications regarding the delivery of pre-acquisition disclosures for prepaid accounts acquired electronically. Specifically, the Final Rule states that for prepaid accounts acquired electronically, the pre-acquisition disclosures "must be provided in electronic form," "must be viewable across all screen sizes," and "must be provided in a manner which is reasonably expected to be accessible in light of how a consumer is acquiring the prepaid account, in a responsive form, and using machine-readable text that is accessible via Web browsers or mobile applications, as applicable, and via screen readers." In explaining the "reasonably expected to be accessible" standard, the Commentary states, by way of example, that it would be "reasonable to expect" that a consumer should be able to access the pre-acquisition disclosures on the first page (or via a direct link from the first page) of the website or mobile app or on the first page that discloses the details about the specific prepaid account program. The Final Rule also states that the pre-acquisition disclosures, for accounts acquired electronically, need not meet the requirements of the E-SIGN Act.

Finally, the CFPB has expanded the Proposed Rule's retail store exception for providing the long-form disclosure prior to acquisition to cover all retail locations (rather than just retail stores) that sell prepaid accounts in person, without regard to whether the location is operated by a financial institution's agent.

Billing Statements. The Final Rule requires either periodic statements or, alternatively, that the prepaid card issuer make available, at no cost to the consumer, the consumer's account balance by telephone, an electronic account history and, upon request, a written account history. While the Proposed Rule would have required both the electronic and written account history to cover at least 18 months of account history, the Final Rule requires that electronic account histories cover 12 months of account transactions, and that written account histories cover 24 months of account transactions. In this regard, the Final Rule expands the burden on prepaid card issuers from the current 60-day account history requirement under the Payroll Card Rule (12 C.F.R. § 1005.18). The Final Rule, however, exempts from the written account history requirement, prepaid accounts for which the prepaid card issuer has not yet completed its consumer identification and verification processes. The Rule also accommodates prepaid card issuers that do not have sufficient data to provide 12 or 24 months of electronic and written account histories by the Effective Date.

Posting of Cardholder Agreements. Similar to the credit card agreement database maintained by the CFPB pursuant to the Credit Card Accountability Responsibility and Disclosure Act, the Final Rule requires prepaid card issuers to post their account agreements on their websites and, on a rolling basis, submit those account agreements to the CFPB. The Rule sets forth procedures for prepaid card issuers to submit and withdraw account agreements on a rolling basis, and requires a prepaid card issuer to post and update account agreements on its website as frequently as the issuer is required to submit the account agreement to the CFPB. Notably, the Final Rule incorporates exceptions to the submission requirement for product testing and for issuers with a de minimis number of accounts and certain accounts not offered to the general public.


Prohibition on Compulsory Use. The Final Rule carves out of the compulsory use exception for overdraft credit plans a "covered separate credit feature accessible by a hybrid prepaid-credit card." The Commentary clarifies, however, that the exception also will cover "incidental credit" where the prepaid account issuer does not generally charge credit-related fees for the credit.

Payroll and Government Benefit Accounts. The Final Rule requires issuers of payroll cards and government benefit cards to state at the top of the short form disclosures that cardholders are not required to receive their wages or benefits on the card. The Proposed Rule would have required an issuer to state: "You do not have to accept this payroll card. Ask your employer about other ways to get your wages." Industry commenters justifiably contended that this statement would be perceived as implicitly encouraging consumers not to use the card. The Final Rule retains this negative disclosure, but also adds a second, more neutral disclosure alternative: "You have several options to receive your wages [payments]: [list of options available to the consumer]; or this payroll [benefits] card. Tell your employer [benefits office] which option you choose." One challenge for issuers with this alternative disclosure is that it could be read to require program managers, through employers or government agencies, to obtain "opt in" consent from a consumer before loading wages or benefits on a card, as opposed to requiring a consumer to "opt out" of receiving wages or benefits on a card. Clarification from the CFPB is needed on this matter.


Dispute Resolution. With some modifications of the provisions of the Proposed Rule, the Final Rule extends the requirements for dispute resolution under Regulation E to prepaid accounts. Issuers of prepaid cards subject to the Rule are generally required to investigate and resolve disputes within 10 business days of receiving notice from a consumer regarding an alleged error. If a prepaid card issuer is unable to complete an investigation within that time frame, the issuer can have up to 45 days to complete the investigation, so long as the issuer provides the consumer with a provisional credit for the disputed amount while the issuer completes its investigation. Apparently, under the Final Rule, the issuer is not required to provide the consumer with provisional credit if the issuer has not completed its consumer identification and verification process or if the issuer could not verify the identity of the consumer by the time the issuer would otherwise be required to provisionally credit the consumer's account.

By adopting Regulation E's current dispute resolution framework with few modifications, the CFPB declined to heed industry comments advocating for greater flexibility based on important distinctions between checking accounts and certain types of prepaid accounts. For example, certain prepaid accounts are intended to be temporary and used only until the balance on a card has been spent. Issuers also may have less information about a cardholder's use history than a bank might have regarding its checking account customers. As a result, some industry commenters recommended extending error resolution time frames or providing flexibility to issuers if there is reasonable evidence of fraud so that provisional credit would not be extended to fraudsters. The CFPB's decision to keep the traditional dispute resolution framework in the Final Rule means that issuers must be prepared to extend provisional credit to registered accounts even if the issuer believes there may be fraud associated with the account.

Consumer Liability. The consumer liability rules under the Final Rule generally parallel the existing limitations and thresholds under Regulation E for debit cards. Specifically, the Final Rule retains three tiers of liability for unauthorized transfers, depending on when the consumer learned of the loss or theft of a prepaid card, when the financial institution received notice of such loss or theft, and when the financial institution transmitted or made available to the consumer the periodic statement showing the unauthorized transaction. Prepaid card issuers also must comply with the error resolution procedures of Regulation Z in certain situations, such as when an unauthorized transaction accessed an overdraft credit feature of a prepaid account.


The CFPB sets forth sweeping and broad consumer protections, including requirements pertaining to the structuring of a prepaid account, in connection with any so-called "credit feature" available in connection with a prepaid card. Specifically, with some exceptions, the Regulation Z credit card protections will apply if the prepaid product allows consumers to pay for "the option of spending more money than they have deposited into the prepaid account."4 By departing from the treatment of overdraft services associated with ATM cards and debit cards, the CFPB appears to have made a policy choice to effectively limit overdraft services and credit features associated with prepaid cards. In the supplementary information accompanying the Final Rule, the CFPB points to historical and substantive differences between overdraft services associated with checking accounts and overdraft services associated with prepaid cards to support this policy choice. Notwithstanding numerous commenters emphasizing that application of the credit card rules to prepaid cards offering credit features is inappropriate and possibly confusing to consumers, the Final Rule includes amendments to fundamental definitions and terms under Regulation Z. For instance, the Rule adds a new section to Regulation Z under the heading "hybrid prepaid-credit cards" setting forth definitions and the framework for prepaid cards that, in the CFPB's view, provide access to credit.

Under the Final Rule, the following are examples of prepaid cards that would be considered "hybrid prepaid-credit cards" and therefore covered by the credit card provisions of Regulation Z:

  1. Prepaid cards that provide access to credit because such prepaid cards are linked to a separate credit account or feature; and
  2. Prepaid cards that provide access to credit by establishing a negative balance on the account.

Exemption for incidental overdraft, including force-pay transactions. The Proposed Rule would have covered incidental overdraft services, such as force-pay transactions, which can occur, for example, when a network is offline or where a stand-in balance is used when a merchant does not seek authorization for the full amount of a transaction. Coverage of force-pay transactions could have effectively impacted all prepaid accounts because of the inability to control force-pay transactions.

Based on concerns from the prepaid industry, the CFPB has attempted to address incidental overdraft, including force-pay transactions through a narrow exception in the Final Rule. The Final Rule generally provides that incidental overdraft services are not "hybrid prepaid-credit cards" when: (1) the prepaid card accesses incidental credit in the form of a negative balance on the asset account; (2) the amount of the transaction will not cause the prepaid account balance to become negative by more than $10 at the time of the authorization or a delayed load cushion where credit is extended while a load of funds from an asset account is pending; and (3) the prepaid account issuer does not generally charge credit-related fees for the credit.

Other exemptions from credit card requirements. The Final Rule also exempts prepaid cards when there is a separate credit feature that cannot be accessed by the prepaid card for purchases or P2P transactions or when the credit feature is offered by a related party, such as an affiliate or business partner.

Separate credit features must be structured as separate sub-accounts. The Final Rule adds a new section to Regulation Z that generally requires overdraft credit features to be structured as separate sub-accounts or accounts that are distinct from the prepaid asset account. The CFPB explains in the supplementary information accompanying the Rule that this structuring requirement is intended to "facilitate transparency and compliance with various Regulation Z requirements."

Credit card requirements for prepaid accounts with overdraft services or credit features. The credit provisions under the Final Rule, which in some respects exceed existing Regulation Z protections applicable to credit card accounts, include:

  • Performing an ability-to-repay analysis;
  • Providing monthly periodic statements;
  • Requiring at least 21 days to repay amounts associated with a credit feature prior to assessing any late fees, together with a requirement that such fees be "reasonable and proportional" to the account violation;
  • Limiting total fees in the first year to no more than 25 percent of the initial credit limit;
  • Restricting increases on interest rates applicable to use of a credit feature, unless the cardholder has missed two consecutive payments; and
  • Requiring 45-day advance notice of any interest rate increases so that the consumer may cancel the credit feature.

In addition, the Final Rule:

  • Requires prepaid card issuers to wait 30 days from the time that the consumer registers the prepaid account before offering credit features to the consumer;
  • Limits the ability of an issuer to use prepaid funds to repay amounts due on the credit feature; and
  • Prohibits issuers from requiring payment within 21 days from the time the periodic statement is mailed.


The Final Rule generally takes effect on October 1, 2017 (the "Effective Date"), with certain notable exceptions.

The Final Rule provides an accommodation for prepaid card issuers that do not have sufficient data to provide 12 or 24 months of electronic and written account histories by the Effective Date. After the Effective Date, financial institutions using this accommodation must make available only such account histories for which they have data until they have accumulated enough data to comply with the account history requirement in full.

In addition, in response to industry comments about the burden imposed under the Proposed Rule, the Final Rule does not require issuers to pull and replace existing access devices and packaging materials that do not meet the disclosure requirements on the Effective Date. Instead, any access device or packaging materials that are manufactured in the normal course of business prior to October 1, 2017 are exempt from the disclosure requirements. However, the Rule does require that issuers provide notice of certain changes and updated initial disclosures to consumers who acquire prepaid accounts after October 1, 2017 via non-compliant packaging materials.

Finally, the requirement in the Final Rule to submit prepaid account agreements to the CFPB has a delayed effective date of October 1, 2018. However, the requirement to post agreements on the issuer's website and the requirement to submit credit card agreements to the CFPB for hybrid prepaid-credit cards still take effect on the October 1, 2017 Effective Date.


1 The Final Rule has not yet been published in the Federal Register. All citations herein are to the unformatted version of the Final Rule at the link provided above.

2 79 Fed. Reg. 77,102 (Dec. 23, 2014).

3 The Model Forms are available at pp. 1481-1486 of the Final Rule.

4 Press Release, "CFPB Finalizes Strong Federal Protections for Prepaid Account Consumers" (Oct. 5, 2016), available at http://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-strong-federal-protections-prepaid-account-consumers/.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved