CFPB Releases Long-Awaited Report on Buy Now Pay Later Industry

I. Introduction

On September 15, 2022, the US Consumer Financial Protection Bureau (“CFPB” or “Bureau”) issued its long-anticipated report on the Buy Now Pay Later (“BNPL”) industry (the “Report”). The Report describes the state of the BNPL market, including its recent growth, the impacts of BNPL on consumers, and potential legal issues.

The Report is based, in part, on an inquiry the CFPB initiated in December 2021 when it issued a series of orders to collect information from five BNPL companies. The orders were issued pursuant to Section 1022(c)(4) of the Consumer Financial Protection Act, the CFPB’s so-called market monitoring authority.¹ This section grants the CFPB the power “to gather information from time to time regarding the organization, business conduct, markets, and activities of covered persons and service providers.”² Notably, this procedure allows for compulsory process even when the agency does not suspect a particular law violation but, rather, where it simply wants to learn more about an industry.

The orders the CFPB issued to BNPL companies requested voluminous amounts of data and information, including gross merchandise volume data, information about late fees, policies and procedures related to credit underwriting, complaint data, copies of consumer-facing agreements and disclosures, information about credit reporting practices, and data relating to returns.³ In addition to the information submitted to the Bureau in connection with these orders, the CFPB explained that the Report is based on complaints consumers submitted through the Bureau’s consumer complaint database and on feedback the Bureau received in response to a notice and request for comment from the public on experiences with BNPL loans.

The Report makes clear that the CFPB is focused on the BNPL industry. BNPL lenders should expect additional scrutiny and ensure they are complying with applicable law. While Truth in Lending Act (“TILA”) and Regulation Z provisions are not applicable to many BNPL programs because their products require payment of the loan in four or fewer installments, do not involve a finance charge, and do not involve a “credit card” as that term is defined for Regulation Z purposes,⁴ other legal provisions are implicated by BNPL products including:

• The prohibition on unfair, deceptive, and abusive acts or practices (“UDAAPs”) with respect to consumer financial products and services and on unfair or deceptive acts or practices (“UDAPs”) with respect to non-financial aspects of BNPL providers’ services, such as any general marketing of retailers or retail goods in which they may engage⁵
• The Electronic Fund Transfer Act (“EFTA”) and Regulation E’s prohibition on requiring consumers to repay a loan through preauthorized (recurring) electronic fund transfers from their checking, savings, or other asset accounts⁶
• The Fair Credit Reporting Act (“FCRA”) and Regulation V requirements related to permissible purposes of consumer reports, marketing using consumer report information, accurate reporting, and dispute resolution procedures to the extent BNPL lenders use consumer reports or furnish consumer information to consumer reporting agencies⁷
• The Gramm-Leach-Bliley Act and Regulation P’s privacy provisions⁸
• Certain state licensing and registration requirements and consumer credit laws

As a next step, the CFPB indicated that it will identify potential guidance or rules to issue to ensure that BNPL lenders adhere “to the baseline protections that Congress has already established for credit cards.” The Bureau also stated that it will ensure that BNPL lenders are subject to appropriate supervisory examinations. In his remarks on the Report, Bureau Director Rohit Chopra asked companies that would welcome CFPB examination to self-identify. In addition to asking for volunteers to undergo CFPB examinations, the CFPB has the authority to supervise certain entities that are “larger participants” in markets for consumer financial products or services that it defines by rule.⁹ The CFPB also may expend enforcement resources to police BNPL lenders’ compliance with applicable law. In short, we can expect the CFPB to be increasingly active in the BNPL space, whether by issuing guidance, rulemaking, supervision, or enforcement.

This Legal Update provides background on the BNPL industry, identifies key trends in the industry, highlights the consumer risks and the legal issues that are implicated by BNPL, and discusses what the Report means for BNPL lenders.¹⁰

II. What Is Buy Now Pay Later?

The Report describes BNPL as a form of credit that allows a consumer to split a retail transaction into smaller, interest-free installments and repay over time. While BNPL products can vary, the typical BNPL product that forms the core of the current US BNPL industry divides a purchase into four equal installments, with the first installment paid as a down payment at the time of purchase and the next three installments paid in two-week intervals. According to the CFPB, most BNPL loans range from $50 to $1,000, and although BNPL typically is interest-free, consumers may be charged fees such as late fees. BNPL providers may offer this core product, by itself or alongside other more traditional products intended to finance purchases of goods or services, such as credit card accounts and longer-term installment loans. Additionally, BNPL providers may offer variants to the core BNPL product that, for example, have fewer than four installments or have payment cadences other than biweekly.

The Bureau views BNPL as a close substitute for a credit card, and data from the CFPB’s market monitoring orders indicates that BNPL usage has rapidly increased over the past few years.

III. The CFPB BNPL Report

We highlight some of the key findings from the Report below.

a. Key Industry Trends

The Report highlights that the five BNPL lenders surveyed originated $24.2 billion in loans in 2021, which was nearly triple the amount originated in 2020 ($8.3 billion) and more than 12 times the amount originated in 2019 ($2 billion).¹¹ The apparel and beauty industries made up 58.6 percent of originations in 2021, while BNPL usage for “everyday” or “necessity” purchases (gas, groceries, and utilities) was $229.2 million in 2021, up 434 percent from $42.9 million in 2020 and 1,207 percent from $3.3 million in 2019.¹²

The Report also notes that 73 percent of applicants were approved for credit in 2021, up from 69 percent in 2020. Approximately 89 percent of loan repayments were made on a debit card in 2021, which is consistent from the previous two years of data collection.¹³ Approximately 10 percent of borrowers were charged at least one late fee in 2021, and late fees accounted for 6.9 percent of revenues in 2021 (up from 4.8 percent in 2020).¹⁴ Nearly 14 percent of individual loans in 2021 involved a purchase that was returned or disputed, up from 12.2 percent in 2020, and 3.8 percent of borrowers had a loan that was charged off in 2021, up from 2.9 percent in 2020.¹⁵

b. CFPB Focus

The Report identifies what it calls the two most popular BNPL customer-acquisition strategies. The first, the merchant-partner acquisition model, is the method that the majority of BNPL providers use, in which providers sign contracts with specific online retailers to embed their product on the retailers’ checkout pages. Consumers shopping on those retailers’ websites and apps see the option to use BNPL and may choose to split their purchase into four equal, interest-free installments.¹⁶ The second, called the “app-driven acquisition model,” is the method to which some BNPL providers are shifting.¹⁷ In the app-driven acquisition model, consumers complete the credit application process with the BNPL provider in the provider’s proprietary app. Once approved, consumers receive access to a virtual shopping mall of merchants to shop at within the app. This method often entails a single-use, bank-issued virtual card associated with a major card network that an approved applicant uses to complete a purchase and a consummate an individual BNPL loan, which allows nearly any merchant who engages in ecommerce to accept BNPL—even if the merchant has not signed a specific contract with the BNPL lender. It also allows BNPL providers to share in a portion of the interchange fees that are collected from the virtual card transaction.¹⁸ The Report states that the app-driven model strengthens the consumer’s relationship with the BNPL provider “by driving the consumer to begin (and often end) their purchase journey within the lender’s ‘self-contained app ecosystem.’”¹⁹

c. Consumer Risks and Legal Issues

The Report highlights consumer risks in three categories: discrete consumer harms, data harvesting, and overextension.

With respect to discrete consumer harms, the Report identifies:

• Lack of standardized disclosures: BNPL providers typically do not currently provide standard cost-of-credit disclosures required by TILA/Regulation Z for credit subject to those requirements (although at least one of the “sample” lenders did at the time of the Report). The CFPB highlighted that the key information included in these disclosures includes the amount financed, total number of payments, finance charge, annual percentage rate, and potential late fee disclosures that provide transparency to consumers.²⁰
• Dispute resolution challenges: The top-ranking BNPL-related complaint category in the CFPB’s consumer complaint database is dispute resolution. The Report highlights that the lack of uniform billing dispute rights lead to operation hurdles and financial harms to consumers. Regulation Z requires creditors of open-end credit and credit card issuers to provide billing dispute and error resolution rights, which provide consumers with the right to withhold payment while the dispute is being resolved.²¹ While these requirements do not apply to closed-end credit not accessible by a credit card or to other credit outside of the scope of Regulation Z, the CFPB’s focus on “parity” in the regulatory treatment of similar products may suggest attempts to make these limitations more broadly applicable. The CFPB, however, does not have the authority to impose new requirements that are not authorized by applicable law.
• Compulsory use of autopay: The EFTA prohibits creditors from requiring consumers to repay debts via autopay from their deposit account (e.g., via preauthorized recurring charges on a debit card). The Report notes that most BNPL providers require consumers to use autopay, using either debit or credit cards (with the latter not subject to the EFTA prohibition) and that some providers make removing autopay “challenging or impossible.” The Report highlights that requiring the use of autopay may adversely limit consumer choice and flexibility to elect or change payment methods or to skip a BNPL payment to satisfy other financial obligations.²²
• Multiple payment re-presentments: All the BNPL lenders subject to the Bureau’s orders re-present failed payments, in some instances up to eight times for a single installment.²³ Consumers can experience harm from multiple attempted re-presentments in the form of non-sufficient funds (“NSF”) fees charged by the consumer’s bank or other payment account provider.
• Late fees: Many BNPL lenders charge late fees, often around $7 per missed payment on an average loan size of $135.²⁴ The Report signals that, while industry-specific and broader macroeconomic factors may put pressure on BNPL lenders to impose more aggressive late fee strategies, Regulation Z prohibits credit card issuers from assessing multiple late fees for the same missed payment, and the Credit Card Accountability Responsibility and Disclosure Act requires late fees on an open-end credit card account to be “reasonable and proportional.”²⁵ As with dispute resolution procedures, any CFPB push toward regulatory parity between typical BNPL products and credit cards could involve seeking to apply these, or similar, fee limitations to a broader set of consumer financial products. As mentioned above, the CFPB does not have the authority to impose new requirements that are not authorized by applicable law.

Data Harvesting: The Report identifies the harvesting and monetizing of consumer data in the “payments and lending ecosystems” generally as a possible threat to “consumers’ privacy, security, and autonomy.” It highlights concerns of consolidation of market power with few large tech platforms that will reduce competition.²⁶ With respect to the BNPL industry in particular, the Report describes the kind of data collected by BNPL providers and notes that the collection and use of data may increase with the shift to the app-driven customer acquisition model.

Overextension: The Report also pinpoints concerns with consumers potentially overextending as a result of using BNPL products. The Report identifies two types of possible overextension: loan stacking (where a borrower takes out multiple BNPL loans from different BNPL providers at the same time) and sustained usage (which results from habitual use of BNPL and might lead to defaulting on other credit obligations).²⁷

d. CFPB Next Steps

The Report and accompanying statements by Director Chopra identify several likely actions forthcoming from the CFPB:

• The CFPB has indicated that it will identify potential interpretive guidance or rules with the goal of ensuring that BNPL firms adhere to many of the baseline protections that Congress has already established for credit cards. Some of the issues the CFPB identifies, however, are not addressable without legislative changes or other more significant changes to the regulatory environment beyond the CFPB’s sole control.
• The CFPB is identifying data surveillance practices that BNPL providers engage in that may need to be curtailed. Director Chopra explicitly stated the Bureau will examine the types of demographic, transactional, and behavioral data that is collected for uses outside of the lending transaction, including for the purpose of sponsored ad placements, sharing with merchants, and developing user-specific discounting practices.
• The CFPB will continue to monitor and assess how the BNPL industry and consumer reporting companies can develop appropriate and accurate credit reporting practices.
• The Bureau aims to ensure that BNPL companies are subjected to appropriate supervisory examinations, just as credit card companies are.

IV. What Does This Mean for My Business?

For any company in, or investing in, the rapidly growing BNPL industry, the CFPB Report and Director Chopra’s comments indicate that the CFPB is paying close attention.

The Federal Trade Commission (“FTC”) is also paying attention to the BNPL industry. Shortly after the CFPB published its report on the industry, the FTC released a blog post that lists three principles that it suggests BNPL companies keep in mind:

• Claims, including claims about fees associated with BNPL products, must be true for the typical consumer.
• It is important to consider the transaction from a consumer’s perspective.
• The presence of multiple actors in the transaction, such as the merchant that sells the goods, does not shield a BNPL company from liability.

Companies in this space should take note and consider their business practices in light of the issues discussed above.

***

Note: Two of our authors have particular knowledge of how the CFPB and FTC approach issues such as those emerging with BNPL: Ori Lev served as a CFPB deputy enforcement director, and Christopher Leach was an attorney in the FTC’s Division of Financial Practices.

¹ 12 U.S.C. § 5512(c)(4).

² Id.

³ Last fall, the CFPB issued similar orders to six tech companies that operate payment services. Consumer Financial Protection Bureau, “CFPB Orders Tech Giants to Turn Over Information on their Payment System Plans” (Oct. 21, 2021), available at: https://www.consumerfinance.gov/about-us/newsroom/cfpb-orders-tech-giants-to-turn-over-information-on-their-payment-system-plans/.

⁴ 15 U.S.C. § 1602(g); 12 C.F.R. § 1026.2(17).

⁵ 12 U.S.C. § 5536(a)(1)(B).

⁶ 12 C.F.R. § 1005.10(e).

⁷ 15 U.S.C. §§ 1681, et seq.; 12 C.F.R. Part 1022.

⁸ 15 U.S.C. §§ 6801, et seq.; 12 C.F.R. Part 1016.

⁹ 12 U.S.C. § 5514(a)(1)(B). The Bureau also has the authority to supervise certain entities that it has reasonable cause to determine are engaging, or have engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services. Id. § 5514(a)(1)(C). The Bureau may base this determination on complaints collected through the Bureau’s complaints portal or information from other sources. In addition, the Bureau must give the covered person at issue a reasonable opportunity to respond to this determination.

¹⁰ For more on the fast-growing BNPL industry, listen to Mayer Brown’s half-hour webcast on “Emerging Issues in the Buy Now, Pay Later Industry,” available at: https://www.mayerbrown.com/en/perspectives-events/events/2021/09/emerging-issues-in-the-buy-now-pay-later-industry.

¹¹ Consumer Financial Protection Bureau, “Buy Now, Pay Later: Market Trends and Consumer Impacts” (Sept. 15, 2022), available at: https://files.consumerfinance.gov/f/documents/cfpb_buy-now-pay-later-market-trends-consumer-impacts_report_2022-09.pdf, p. 3 (hereinafter “Report”).

¹² Report at 10.

¹³ Report at 4.

¹⁴ Id.

¹⁵ Id.

¹⁶ Report at 12.

¹⁷ Id.

¹⁸ Report at 15.

¹⁹ Id.

²⁰ Report at 72.

²¹ Report at 73.

²² Report at 73-4.

²³ Report at 74.

²⁴ Report at 3.

²⁵ Report at 74-5.

²⁶ Report at 75.

²⁷ Report at 76.