Consumer finance refers to the saving, borrowing, and investment choices that households make over time.¹ These financial decisions can be complex and can affect households' financial well-being both now and in the future. Safe and affordable financial services are important tools for most American households as they avoid financial hardship, build assets, and work to achieve financial security over the course of their lives.

Fintech (short for financial technology) refers to advances in technology incorporated into financial products and services.² Fintech has the potential to continue to change the consumer finance landscape. For example, fintech products could improve consumer experiences and reduce costs for financial products and services. These benefits could help some consumers manage their finances better and access more affordable products. In addition, these new technologies may enhance consumer loan underwriting—when a lender evaluates the likelihood that a loan applicant will make timely repayment. These technological developments could facilitate more access to credit for some consumers. However, new technologies could also pose risks that could lead to unanticipated financial losses or other harmful outcomes.

Many companies—both traditional financial firms and new technology-focused entrants to the market—are developing fintech products, making it a subject of great interest for Congress and the public. Policymakers designed many financial laws and regulations before the most recent technological changes. This raises questions concerning whether the existing legal and regulatory frameworks, when applied to fintech, effectively mitigate risks without unduly hindering beneficial technology development. For example, some fintech products may be regulated differently depending on whether the company offering the product holds a bank charter. In addition, new technologies may introduce new consumer risks, such as increased privacy, security, or fraud risks. Recent Congresses have debated whether current consumer protection laws and regulations sufficiently protect consumers from these new risks while promoting innovation.

The 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act; P.L. 111-203) established the Consumer Financial Protection Bureau (CFPB) to implement and enforce federal consumer financial law while promoting fair, transparent, and competitive markets for consumer financial services and products.³ One of the CFPB's statutory objectives is to ensure that "markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation."⁴ The CFPB may issue and enforce rules that affect both bank and nonbank financial institutions. However, the CFPB's supervisory authority varies based on charter, activities, and size of institutions.

This report focuses on U.S. consumer fintech products related to consumer accounts, electronic payments, and lending. The first section of the report discusses consumer electronic payments and accounts, and the second section discusses consumer lending. Both of these sections include descriptions of selected new technologies, discussion of selected fintech financial products, and relevant laws in these consumer markets. The last section discusses selected policy issues relating to fintech and consumer finance.

Consumer Electronic Payments and Accounts

Electronic retail payment services allow consumers to pay merchants for goods and services without cash, frequently referred to as payment transactions or services. Payment services can be offered through many consumer financial products, including through consumer accounts. Consumer accounts, such as checking or savings accounts, allow consumers to deposit money and make payments.⁵ Consumers can use these services to pay bills, facilitate payments or transfers, or withdraw cash.

Over the past few decades, U.S. consumers have increasingly made payments using card-based devices such as debit and credit cards. Given the rise of internet shopping and the shift away from cash, electronic retail payment services account for a growing share of daily purchases. Retail payments tend to generate a large number of transactions that have a relatively small value per transaction. The U.S. financial system processes millions of transactions each day to facilitate purchases and payments. The most common methods of noncash payment are debit cards (including direct bank account payments such as automatic bill payments) and credit cards.⁶

In recent years, new fintech products in the payments, accounts, and personal finance management space have gained popularity among consumers. This section discusses new technologies that support these products, including internet access, mobile technology, and electronic payment technology. It then discusses selected fintech products—peer-to-peer (P2P) payments, digital wallets, and financial data aggregation services. Lastly, the section reviews related consumer protection and data security laws and regulations.

Significant Technologies and New Products

Internet access and electronic payment technology have impacted consumer account and payment services, facilitating the evolution of new products, such as P2P payments, digital wallets, and data aggregation services.

Internet Access and Mobile Technology

Online banking refers to "using a computer or tablet" to access bank services through the internet; mobile banking refers to "using an app, text messaging, or internet browser on a mobile phone" to access bank services.⁷ Internet-based and mobile financial products may be able to provide more affordable or convenient access to financial services for many consumers, creating opportunities for fintech products to attract consumers to their offerings. In recent years, the consumer financial services market has increasingly incorporated internet access and mobile technology to provide products and services to consumers. For example, a 2021 government survey found that mobile banking was the most common way consumers accessed their bank accounts, and online banking was another popular option—43.5% of consumers reported mobile banking and 22% reported online banking as their primary method to access their bank accounts.⁸ Moreover, as account information has increasingly become electronic, these technologies have been used to develop new fintech products—for example, to help consumers manage their money. However, internet and mobile technologies may also increase data security and fraud risks to consumers.

Electronic Payment Technology Changes

Electronic payments are a long-standing part of the financial system. For 60 years, Americans have been using payment cards (such as debit and credit cards) that send messages electronically to financial institutions to transfer funds from the purchaser to the seller. Today, noncash electronic payments predominate the marketplace.

In recent years, new payment technologies have broadened the universe of retail payment providers and facilitators. Technological advances in digitization and data processing and storage have significantly increased the availability and convenience of electronic payments. New products and services offer faster, more convenient payment for individuals and businesses, and the numerous options on offer foster competition and innovation among service providers. Currently, many new payment services are layered on top of existing electronic payment systems, which may limit their speed.⁹

Today, consumers have several options to make electronic, noncash transactions. One of the byproducts of the COVID-19 pandemic is an increase in internet shopping that has encouraged demand for electronic payments. Perhaps not coincidentally, the universe of electronic payment options has increased substantially, with new payment technologies emerging for consumers, further facilitating electronic payments. For instance, consumers can make purchases by swiping, inserting, or tapping their cards to payment terminals; they can store their preferred payment information in digital wallets; or they can use apps to scan barcodes on their mobile phones that link to payments of their choice. Further, merchants also enjoy electronic payment innovations that allow them to accept a range of payment types while limiting the need to manage cash.¹⁰ However, new electronic payment technologies may also introduce consumer protection risks, such as the risk of unauthorized transfers or data security risks.

Peer-to-Peer (P2P) Payments

P2P payments allow a consumer to send funds directly to another consumer from a consumer account. For example, PayPal, Venmo, Cash App, and other technological platforms allow consumers to store payment information for credit and debit cards, hold balances in digital wallets, and even access credit products for certain purchases. Payment platforms that facilitate P2P payments have increased in popularity in the past few years. In 2021, almost half of all households reported using nonbank online payment services, such as PayPal, Venmo, and Cash App.¹¹ Another form of P2P payment that has grown in popularity is cross-border remittances. (See text box.)

Digital Wallets

A digital wallet is a software application that stores payment or account details to facilitate traditional payments that use bank and credit card details and/or cryptocurrency transactions.¹³ Wallets are not themselves accounts or payments but are a vehicle for accessing traditional accounts or P2P fintechs for the purposes of making payments or transfers. Digital wallets are generally used for (1) payments to merchants through the use of near-field communication or QR codes for in-person purchases; (2) P2P transfer of funds through an app, text message, or QR code; (3) storing value from a linked bank account or debit card on an app-based account; or (4) storing, providing access to, and transacting in cryptocurrency.¹⁴ While consumers may use digital wallets for purposes similar to a bank account, digital wallet providers are generally not chartered banks. Digital wallets generally require internet-connected hardware, such as a smartphone. Some, including Apple Pay and Google Pay, may work only with certain devices and associated operating systems. Others, such as PayPal and Cash App, can be downloaded and accessed from a range of devices irrespective of operating system.

Financial Data Aggregation Services

The proliferation of electronic consumer data—for example, from digital account and payment information—have affected financial services. Financial products and services that rely on new sources of consumer data can provide improved and innovative offerings to consumers.¹⁵ Some companies provide data aggregation services, wherein consumers give the aggregator permission to access information across their financial accounts and put it into a standardized summarized form to help consumers manage their money. In addition, some companies enable other application services to connect to consumers' financial accounts in order to provide new services, such as P2P transfers and other payment services. New financial products that take advantage of data aggregation could enable consumers to better manage their personal finances, automate or set goals for saving, receive personalized product recommendations, apply for loans, and perform other tasks. Some companies that provide personal finance and money software include Intuit (Mint and Credit Karma) and Envestnet (Yodlee).¹⁶ Market reports suggest that these types of products have benefited from an increased use of mobile and online banking.¹⁷ Younger adults tend to be more likely to use these products, and market reports forecast that the industry may grow as younger people enter the workplace and adopt these products.¹⁸

Selected Relevant Laws and Regulations

This section highlights laws and regulations relating to consumer accounts and payments. It includes consumer protections for unauthorized transfers, data security protections, and deposit insurance. As discussed in the policy issues section of this report, questions exist about whether and how these types of consumer protections should apply to various fintech products.

Unauthorized Transfers and Related Payments Consumer Protections

Sometimes, transactions do not get accounted for properly. For example, a consumer may experience a fraudster or someone else using his or her card without permission. A consumer using a debit, credit, or prepaid card is protected by the Electronic Funds Transfers Act (EFTA; P.L. 95-630) and the Truth in Lending Act (TILA; P.L. 90-321), implemented through CFPB Regulations E and Z, respectively. Among other things, these regulations establish procedures for resolving errors and limiting consumer liability for unauthorized transactions. Generally, in cases where there is an unauthorized transaction, the consumer's liability is limited to $50, provided the consumer promptly notifies the financial institution.¹⁹ Consumer liability limits under Regulation E are shown in the Appendix.

Some fintech payment services, such as P2P payments, may not be subject to these laws or similar consumer protections. The consumer protections covering unauthorized transactions apply to the payment device (e.g., a debit, credit, or prepaid card), not the place where account information is stored. So while a consumer may use a digital wallet to store a variety of payment instruments—such as card account numbers, cash balances from P2P services (e.g., PayPal or Venmo), or crypto accounts—Regulations E and Z would apply only to transactions using covered payment devices (in this case, debit, credit, or prepaid cards). In other words, transfers of funds using a wallet may not be protected if the consumer does not fund the transaction with money from a covered account.

Data Privacy and Data Protections²⁰

As many fintech products track and use financial data, an especially pertinent law related to data security and financial data is the Gramm-Leach-Bliley Act (GLBA; P.L. 106-102).²¹ Enacted in 1999, GLBA provides a framework for regulating the privacy practices of a number of financial institutions.²² This framework is built upon two pillars: limiting when a financial institution may disclose a consumer's information and establishing standards for safeguarding records and information. The two major rules for implementing this framework are known as the Privacy Rule (Regulation P)²³ and the Safeguards Rule.²⁴ These rules are promulgated, supervised, and enforced by different government agencies, leading to different implementation by entity.²⁵ GLBA applies to individuals who obtain financial products for personal, family, or household use from a financial institution.²⁶

Other data security laws and regulations may also apply to consumer fintech products. The Federal Trade Commission Act (FTCA; 15 U.S.C. §45(a)) and the Consumer Financial Protection Act (Dodd-Frank Act, Title X; 12 U.S.C. §5531(a)) created broad authorities that may be applied to consumer data in financial services. The FTCA is broad and covers various individuals and entities, generally prohibiting "unfair or deceptive acts or practices" (UDAP) in or affecting commerce. The Federal Trade Commission (FTC) has brought UDAP cases against companies that fail to live up to their stated privacy policies or fail to safeguard consumer data. In addition, the FTC recently issued an advance notice of proposed rulemaking relating to "harmful commercial surveillance and lax data security."²⁷ Similarly, the Dodd-Frank Act provided the CFPB with authorities to police "unfair, deceptive, and abusive acts or practices" (UDAAP) in consumer financial products and services. Recently, the CFPB published guidance asserting that insufficient data protection or information security of sensitive consumer data could be considered an unfair act or practice under the Consumer Financial Protection Act.²⁸

Deposit Insurance and Bankruptcy Protections

Some companies offering fintech products are chartered as banks, and others are not. When fintech companies are not chartered as banks, they may not be subject to the range of consumer protection laws that bank customers enjoy. For example, funds stored on a digital wallet are not deposits and are generally not eligible for deposit insurance.²⁹ However, some wallets and certain registered pre-paid cards provide "pass-through insurance" if a consumer transfers money from a direct deposit to a wallet account. In this scenario, the wallet provider would act as a custodial agent and deposit the money into an insured bank account. Where insurance is not offered, policymakers may consider whether wallet users are under the false impression that their wallet balances are insured.

Consumer Lending

Households borrow money for a variety of reasons: for example, to finance investments—such as a home or education—and to build future wealth and for consumption smoothing (e.g., paying later to consume things now) and emergency expenses. Most households rely on credit to finance some of these expenses, because they do not have enough money saved to pay for them in full.³⁰

Consumer loan underwriting—when a lender evaluates whether to extend credit to a loan applicant and under what terms—can potentially be enhanced by these new technologies. In the past few decades, consumer loan underwriting has become more automated, as credit scores have increasingly become a part of the process for many types of consumer credit.³¹ In recent years, new technological changes in consumer lending have been used to update automated credit underwriting processes beyond traditional numeric credit scores, including in some cases, the use of the internet to accept applications, alternative data, and artificial intelligence (AI). These new technologies are used more frequently in fintech products than more traditional consumer lending products, particularly alternative data and AI.

This section of the report discusses these new technologies, highlights two new fintech consumer lending products (marketplace lending and buy now, pay later), and reviews related consumer lending laws and regulations.

Significant Technologies and New Products

New technologies may continue to change the consumer lending market. A new data environment and new technologies enable underwriting to be performed online using a greater variety of more current data sources, potentially allowing for greater speed, accuracy, and confidence in loan decisions.³² This section highlights two important technology changes in consumer loan underwriting—alternative data and machine learning (ML).

Alternative Data³³

Alternative data generally refers to information used to determine a consumer's creditworthiness that the national consumer reporting agencies—Equifax, Experian, and TransUnion—do not traditionally use to calculate a credit score.³⁴ New technology makes it possible for financial institutions to gather other information, including financial and nonfinancial data, from a variety of sources. In a 2017 Request for Information, the CFPB included examples of alternative data, such as payments on telecommunications; rent or utilities; checking account transaction information; educational or occupational attainment; how consumers shop, browse, or use devices; and social media information.³⁵

These data could be used either in credit reports or by lenders directly to underwrite a loan. Alternative data could increase access to—and lower the cost of—credit for consumers without extensive credit histories, as lenders using alternative data are able to find new creditworthy consumers.³⁶ At the same time, in cases where the alternative data includes negative or derogatory information, it could harm some consumers' existing credit scores.

Recent findings suggest that some types of alternative data—such as education, employment, and cash-flow information—might expand access to credit or make credit cheaper for some consumers.³⁷ For example, results from the Upstart Network's credit model, which uses alternative data to make credit and pricing decisions, showed that the model expanded the number of consumers approved for credit; lowered the rate consumers pay for credit on average; and did not increase disparities based on race, ethnicity, gender, or age.³⁸ Another study suggests that cash-flow data may more accurately predict creditworthiness and that its use would expand credit access to more borrowers while meeting fair lending rules.³⁹

The collection and use of alternative data raise policy concerns related to data security and consumer protection.⁴⁰ For example, some alternative data may be considered unfair to use to make a lending decision, even if the data is predictive of future credit performance, particularly if it is not related to a consumer's financial situation.⁴¹ Potential policy issues related to alternative data are discussed more in the policy issues section of the report.

Automated Decisionmaking and Artificial Intelligence

Financial firms have used algorithms—precoded sets of instructions and calculations executed automatically—to enable computers to make decisions for years, notably in loan underwriting. Faster computing power, cheaper data storage, and internet-based products have increased the prevalence of algorithms.⁴² Such automation may produce benefits if algorithmic analysis is better able to assess risks and predict outcomes than traditional human assessments are. The use of algorithms also raises concerns, particularly if automated programs do not perform as intended, possibly resulting in higher loan losses in new market environments or discrimination against protected groups.

AI technologies—which are generally considered computerized systems that work and react in ways commonly thought to require intelligence, such as solving complex problems in real-world situations—have advanced rapidly in recent decades. ML is often referred to as a subfield of AI in which algorithms automatically improve their performance through experience with little or no human input.⁴³ In particular, financial institutions may use ML models and other AI technologies to (1) flag unusual transactions for fraud detection and financial crime monitoring, (2) personalize consumer services, (3) make credit decisions, (4) inform risk management forecasting and auditing, and (5) identify potential cybersecurity threats.⁴⁴

ML models could improve efficiency and performance and reduce costs for financial institutions, potentially reducing prices and increasing access to financial services.⁴⁵ AI technologies could make consumer lending models more accurate by identifying new patterns, such as changing credit conditions, and by automatically updating the models to make more accurate underwriting assessments.

ML models can also introduce risks. In particular, AI may cause risks due to a lack of explainability, which is when it is difficult to explain why programs make particular decisions, and due to dynamic updating, which is when models evolve over time without oversight.⁴⁶ Potential policy issues with ML models are discussed more in the "Policy Issues" section of the report.

Marketplace Lending

Marketplace lending refers to certain online lending that relies on fintech.⁴⁷ The industry is rapidly growing and evolving, and companies are continually developing new variants of existing business models.⁴⁸ In addition, incumbent lenders—including banks and nonbanks—are increasingly adopting some of the technologies and practices of marketplace lending to varying degrees. Not all lending neatly divides into either marketplace or not marketplace. In this report, marketplace lending will refer to lending with the following characteristics:

• Loans are made to individuals;
• Marketplace lenders operate almost entirely online, with no physical customer retail space;
• Underwriting is almost entirely automated and algorithmic;
• Marketplace lenders are funded by issuing equity or selling loans to investors;
• Loan origination involves the marketplace lender, funding providers, and sometimes banks; and
• Some of these lenders may use alternative data to underwrite loans.

Marketplace lending is small relative to total personal credit outstanding in the United States. Alternative finance including P2P and marketplace lending in the United States reached nearly $74 billion in 2020, up by 43% from $51.5 billion in 2019.⁴⁹ However, this figure accounted for little more than 1% of the total consumer and small business loan market.⁵⁰ One report noted that there are 46 domestic marketplace lending firms in the United States.⁵¹ Many of these marketplace lenders are still small, but a few prominent companies originate billions of dollars of loans. For example, in the personal loan market, Lending Club originated more than $10 billion in loans⁵² and Upstart originated nearly $11.7 billion in loans in 2021.⁵³

"Buy Now, Pay Later" (BNPL)⁵⁴

BNPL is a form of point-of-sales financing in which a consumer can purchase an item now and pay for it later on an agreed-upon payment schedule. BNPL financing is often offered online and has generally been developed by nonbank fintech companies. BNPL financing allows consumers to pay for purchases in payments over time, generally without accruing interest. For example, some BNPL financing services may require four installment payments ("Pay in 4") in two-week intervals. Other services may have regular payments over a shorter six-week period. The companies also charge affiliate fees to retailers that advertise on their websites or apps.⁵⁵

BNPL financing has been growing rapidly in recent years. Reports suggest that BNPL financing may have nearly tripled in 2021 compared to the previous year, rising from $8.3 billion in 2020 to $24.2 billion 2021.⁵⁶ Moreover, according to the CFPB, the quarterly usage rate, which logs repeated use of BNPL services by discrete consumers, has also increased steadily from an average of nearly two purchases per BNPL user in the first quarter of 2019 to nearly three purchases at the end of 2021.⁵⁷ More recently, BNPL companies' business models have been tested with the shifting economic climate and the potential for increasing consumer defaults, and these factors may impact consumers' ability to access BNPL financing in the future.⁵⁸ Companies operating in the BNPL space include Klarna, Afterpay, Affirm, Splitit, and Sezzle.

BNPL financing aims to help consumers with their personal cash flow. Compared to other traditional financial products, BNPL financing is often lower cost and more flexible. BNPL financing may be attractive to younger consumers who may be more fluent with technology and not have robust credit histories.⁵⁹ A consumer may use BNPL financing through a merchant that embeds it as a payment option in the checkout process or directly on BNPL companies' platforms. BNPL companies determine consumer terms through a soft credit check and a consumer's past performance on the platform.⁶⁰

While BNPL companies generally do not charge interest or fees at the time of purchase, they charge a late fee if a customer does not make payment on time. BNPL financing services earn most of their revenue by charging merchants, who are willing to pay to attract new consumers to their merchandise. While some BNPL companies operate independently, others work with banks. In these instances, a company may buy the loans back from a bank or sell them to third parties.

In December 2021, the CFPB announced that it had issued a market monitoring inquiry to collect information on BNPL loans from five companies: Affirm, Afterpay, Klarna, PayPal, and Zip.⁶¹ In January 2022, it published a notice and request for comments from the public about the BNPL market.⁶² In 2021 and 2022, the CFPB also published financial education materials advising consumers about the potential risks of BNPL loans⁶³ and published research reports monitoring the BNPL market.⁶⁴

Selected Relevant Laws and Regulations

This section of the report highlights selected relevant laws and regulations related to consumer lending, including consumer protections related to fair lending, credit reporting, and consumer disclosures. It also discusses the CFPB's nonbank authorities in consumer lending markets. As discussed in the "Policy Issues" section of this report, questions exist about whether and how these types of consumer protections should apply to various fintech products.

Fair Lending

The Equal Credit Opportunity Act (ECOA; 15 U.S.C. §§1691-1691f) generally prohibits discrimination in credit transactions based upon certain protected classes, including sex, race, color, national origin, religion, marital status, age, and "because all or part of the applicant's income derives from any public assistance program."⁶⁵ New technologies, such as alternative data and ML, raise questions about how lenders comply with ECOA and other fair lending laws. For example, alternative data may pose fair lending risks if they are correlated with ECOA-protected characteristics, such as race or ethnicity. In addition, ML models may contain training or historical data biases, potentially creating models that discriminate against protected classes. Questions exist about how to comply with fair lending laws when using these new technologies for consumer loan underwriting.

Credit Reporting

The Fair Credit Reporting Act (FCRA; 15 U.S.C. §1681) is the main statute regulating the credit reporting industry. The FCRA establishes consumers' rights in relation to their credit reports as well as permissible uses of credit reports. Under the FCRA, a consumer must be told when information from a credit bureau has been used after an adverse action (generally a denial of credit) has occurred, and disclosure of that information must be made free of charge. Consumers also have the right to dispute inaccurate or incomplete information in their credit reports. The FCRA also imposes certain responsibilities on those who collect, furnish, and use the information contained in consumers' credit reports. The FCRA may have implications for firms using alternative data for credit reporting or underwriting consumer loans.

Disclosure Regulation

Enacted in 1968, TILA is intended to ensure that consumers are provided with meaningful disclosure of credit terms, among other things.⁶⁶ The CFPB implements TILA through Regulation Z.⁶⁷ When TILA was originally enacted, the Federal Reserve Board had rulemaking authority over TILA, but the Dodd-Frank Act transferred this authority to the CFPB in 2011. Nine agencies have TILA enforcement authority, including the CFPB, the FTC, and the banking regulators.⁶⁸ In general, TILA disclosure requirements apply to consumer credit that is subject to a finance charge or payable in more than four installments.⁶⁹ For some fintech lending products, such as some BNPL financing services, TILA disclosure requirements may not apply, depending on how the financial product is structured.

Nonbank Authorities

Nonbank financial companies and traditional banking institutions provide fintech lending products. While nonbank financial companies are generally not regulated as banks for safety and soundness, they generally need to comply with federal consumer protection and data security laws. Some consumer finance companies or debt agreements must also comply with relevant state laws, depending on their business models and where they operate.

At the federal level, the CFPB has the authority in nonbank consumer financial markets to write regulations, enforce the law, and supervise companies in certain cases. The Consumer Financial Protection Act created the CFPB and provided it with authorities to police UDAAP in consumer financial product or service, as described earlier in this report.⁷⁰ Dodd-Frank gives the CFPB authority to enact rules related to UDAAP. Generally, these authorities would apply to fintech consumer lending products, including when nonbank financial companies offer these products.⁷¹ The CFPB's supervisory authority varies based on charter, activities, and size of institutions. For example, Dodd-Frank expressly authorizes the CFPB to supervise nonbank institutions that the CFPB determines are "larger participants" in consumer financial markets or "has reasonable cause to determine … is engaging, or has engaged in, conduct that poses risks to consumers," subject to exemptions.⁷² Although the CFPB has this authority, it is discretionary and applies only to larger market players, and therefore some nonbank fintech companies might currently have fewer or no supervisory exams compared to traditional banks.

Policy Issues

Questions exist about how fintech products affect consumers in consumer electronic payments, accounts, and lending markets. While fintech products may provide benefits for consumers, such as cheaper or more accessible financial products, they could also pose new risks and raise new policy issues. Fintech products or new technology-focused entrants to the market may face uncertainty about how existing legal and regulatory frameworks apply, and depending on the product or company, consumers may not enjoy some of the same consumer protections as with traditional consumer financial products. In addition, new technologies may introduce new consumer risks, such as increased privacy, security, fraud, or fair lending risks.

This section of the report discusses selected consumer protection policy issues relating to fintech and consumer finance: (1) the appropriate regulatory treatment of new fintech products, (2) consumer data security, (3) the impact of fintech innovations on market competition, (4) fintech's impact on underserved consumers and access to financial products, (5) algorithmic bias and explainability, and (6) payment scams and fraud.

Appropriate Regulatory Treatment and Regulatory Uncertainty

A general issue underlying many of the policy questions involving fintech in lending is whether the current regulatory framework appropriately fosters these technologies' potential benefits while mitigating the risks they may present. Most of the federal financial regulatory framework was created prior to the development of new fintech products. For this reason, fintech products or new technology-focused entrants often face uncertainty over how—or whether—existing federal laws and regulations may apply. In some cases, fintech products may be designed to try to avoid legal or regulatory jurisdiction. In cases where there is uncertainty or evasion of financial regulation, consumers may be exposed to increased risks. Some examples include

• Some nonbank fintech products may not have the same consumer protections as traditional bank products. For example, nonbank fintech payment services such as P2P transfers may not be subject to EFTA (15 U.S.C. §§1693 et seq.), which, among other things, establishes procedures for resolving errors with unauthorized transactions. In addition, some nonbank account services may not be eligible for deposit insurance (for example, digital wallets, unless "pass-through insurance" is provided, as discussed earlier in the report), unlike bank accounts.
• For products with unclear disclosure regimes, there is a risk that consumers may not understand the terms of these products before they use them. TILA disclosure requirements may not apply for some products (e.g., BNPL), depending on how the financial product is structured.⁷³ In addition, some of these products might not have consumer protections similar to more traditional financial products. For example, if merchandise is faulty or a scam, a BNPL consumer may still be responsible for paying the merchandise cost, unlike what may be the case with credit card dispute protections.⁷⁴
• Fintech lenders' use of alternative data or other new technologies to make credit decisions could result in consumer protection violations or discriminatory impacts.⁷⁵ For example, some prospective borrowers may be unaware that alternative data has been used in credit decisions, raising privacy and consumer protection concerns. Questions exist about how to comply with existing fair lending and other consumer protection regulations. In December 2019, the CFPB and federal banking regulators released a policy statement on the appropriate use of alternative data in the underwriting process in order to provide guidance to lenders on these questions.⁷⁶
• Some nonbank fintech companies may be monitored less by financial regulators than traditional banks are. While the CFPB has the authority in consumer financial markets to write regulations and enforce the law, the CFPB's supervisory authority varies based on charter, activities, and size of institutions. New technology-focused entrants that are nonbanks might have fewer or no supervisory exams compared to traditional banks that are examined regularly, even if both types of financial companies are providing similar fintech products to consumers.

Relevant laws and regulations may need to be reconsidered or updated in response to these technological developments. Policymakers, therefore, debate whether existing regulations can accommodate financial innovation or whether a new regulatory framework is needed to reduce regulatory uncertainty and integrate new fintech products. This often involves balancing efforts to encourage innovation while protecting consumers.

Likewise, some companies might choose not to offer certain fintech products if they are concerned about regulatory uncertainty and compliance risks, even if consumers may be interested in those fintech products. Therefore, in order to promote innovation, some federal financial regulators have implemented or proposed programs to address fintech regulatory uncertainty, sometimes called a "sandbox," "greenhouse," or "single point of entry." These programs may include increased regulator outreach, regulator information gathering and study, tailored regulation, limiting enforcement actions, and/or specific fintech regimes.⁷⁷ The CFPB's history with these types of innovation programs can be found in the textbox below.

Data Security

The financial industry is increasingly collecting data digitally. Both traditional and fintech products often collect sensitive consumer financial data such as income or checking account information. Alternative data, which may include information on consumer shopping behavior or employee payroll information, may be arguably even more personal. The increase in digital data collection raises greater privacy and cybersecurity concerns.⁸⁹ Consumer financial data collected from fintech products can be valuable to companies that want to understand consumer behavior and market new products and services to consumers. Companies may use this data to make money beyond the original fintech product purpose, such as for future marketing to the consumers.

The GLBA data protections cover only nonpublic personal information held by financial institutions significantly engaged in financial activities. As data use has grown, some have debated whether the law covers all sensitive individual financial information or whether the scope of these laws should be expanded.⁹⁰ For example, data brokers compile both public and private data from different sources. Combining the data might reveal sensitive information about a consumer. However, much of this data may not be subject to GLBA's protections.

Questions about how other laws and regulations should apply to data in financial services is an area of active policy debate as well. For example, a debated issue is whether the CFPB should supervise larger participants in the data aggregator market.⁹¹ In addition, some consumers may not understand how alternative data is being used for credit decisions or for other purposes.⁹² These consumers may have a limited ability to control or correct it, which can make it difficult to protect their privacy, obtain redress for data breaches, or avoid other negative consequences from a company's use of their data.⁹³ These concerns raise the question of whether the FCRA and other consumer protections should be applied to a wider range of data in consumer financial markets.

Competition and New Technologies

Reports suggest that in recent years fintech firms are increasingly competing with traditional lenders in consumer financial markets.⁹⁴ This competition may manifest in different ways and at different times. For example, the accepted narrative of the relationship between banks and nonbank fintech firms in the early years after their entry into consumer finance was one of direct competition.⁹⁵ More recently, banks and fintechs have identified areas where they complement each other, which has led to partnerships among traditional banks and newer firms.⁹⁶ This dynamic could lead to market power concerns if valuable consumer data or other technological advantages are concentrated among only a few firms. In contrast, these technological changes could benefit consumers through increased competition and new and affordable financial products and services, especially if these technological developments lead to more consumer data sharing.

This section discusses the potential impacts of new technologies and fintech products on consumer financial market competition. First, it discusses potential concerns about systemic risk and market power. Then, it discusses open banking technologies and the CFPB's 1033 rulemaking.

Big Tech and Market Power

New payment networks and fintech products, with valuable data on consumers, may quickly gain scale and market power.⁹⁷ Big Tech companies (i.e., large technology companies such as Amazon, Apple, Google, and Facebook) have demonstrated interest and possess the scale and financial capacity to increase their range of offerings of consumer financial products and quickly capture market share.⁹⁸ While Big Tech may participate in different consumer financial markets to varying degrees, participation among Big Tech in payments is common. Other offerings include credit cards, lines of credit, and mobile wallets. These companies possess traditional economic advantages such as economies of scale and network effects as well as unique advantages of the Big Tech business model, which relies on access to large amounts of consumer data and insight into consumers' behavioral preferences. Combined, these factors may allow them to offer competitive rates and gain market share.⁹⁹

Questions exist about how these market developments might impact consumers in the future. In October 2021, the CFPB ordered Amazon, Apple, Facebook, Google (a subsidiary of Alphabet), PayPal, and Square to submit information about their payment products to monitor risks to the public and determine whether the operators will "engage in invasive financial surveillance and combine the data they collect on consumers with their geolocation and browsing data" and "use this data to deepen behavioral advertising, engage in price discrimination, or sell to third parties."¹⁰⁰

Open Banking and the CFPB's Section 1033 Rulemaking¹⁰¹

Open banking refers to the practice of giving financial services firms access to customer banking and other financial data to facilitate the development of new types of products and services for consumers. While new innovations, such as data sharing, can benefit consumers through increased competition and new and affordable financial products and services, increasing access to consumer data can also pose data security and privacy risks to consumers.

One technology commonly used to collect account data is web scraping, a technique that scans websites and extracts data from them and in general can be performed without a direct relationship with the website or financial firm maintaining the data.¹⁰² As an alternative to web scraping, the financial institution managing the account may provide customer account information through a structured data feed or application program interface (API).¹⁰³ Open banking can also include using API banking standards to facilitate data sharing among financial firms.

An ongoing CFPB rulemaking may impact the development of fintech products that use consumer data. Section 1033 of the Dodd-Frank Act (P.L. 111-203) provides consumers with a right of access to their financial information. This could include, for example, information relating to consumer transactions or account usage.¹⁰⁴ To implement this section of the law, the CFPB is currently working on a new regulation to clarify standards around consumer-authorized access to financial data.¹⁰⁵ In November 2020, the CFPB published an advanced notice of proposed rulemaking to solicit information from the public to inform this rulemaking.¹⁰⁶ In October 2022, the CFPB published an outline of proposals and alternatives under consideration for a small business advisory review (SBREFA) panel, which is part of the process to move forward with the rulemaking.¹⁰⁷

Data access could facilitate competition and innovation in consumer financial services, depending on how data sharing practices develop and how the regulatory framework is structured. In July 2021, the Biden Administration put out an executive order on promoting competition in the American economy.¹⁰⁸ Among its provisions, the order encouraged the CFPB director to consider "commencing or continuing a rulemaking under section 1033 of the Dodd-Frank Act to facilitate the portability of consumer financial transaction data so consumers can more easily switch financial institutions and use new, innovative financial products." CFPB Director Rohit Chopra has emphasized how the 1033 rulemaking can promote competition in consumer financial markets.¹⁰⁹

Questions exist about the extent to which the CFPB should be determining standards to facilitate data sharing among financial firms. These types of standards might affect market competition in different ways. For example, standardized file formats and processes for consumer-accessed data could make it easier to create new products and services for consumers. While this could benefit consumers, developing and maintaining an online portal to export financial institutions' data, as well as potentially meeting other accuracy or timeliness requirements, could burden industry.

The development of consumer-authorized data systems raises a number of consumer protection concerns, including the security of consumer data, unauthorized access issues, and how to ensure that consumers are informed of their access rights and how their data is used when shared. Questions exist about the extent to which the CFPB should be facilitating certain authentication or cybersecurity standards to protect consumers from fraud or illegal conduct. In addition, some have concerns that consumers may authorize the use of their data for purposes beyond what is understood by the consumer, such as for marketing purposes.

Underserved Consumers and Access to Financial Products¹¹⁰

Financial inclusion refers to the idea that individuals "have access to useful and affordable financial products and services that meet their needs—transactions, payments, savings, credit, and insurance—delivered in a responsible and sustainable way."¹¹¹ Access to financial products allows households to better manage their financial lives, such as storing funds safely, making payments in exchange for goods and services, and coping with unforeseen financial emergencies, such as medical expenses or car or home repairs. In the United States, robust consumer credit markets allow most consumers to access financial services and credit products to meet their needs in traditional financial markets. However, some consumers—who tend to be younger adults, low- and moderate-income consumers, or those who possess imperfect credit repayment histories—can find gaining access to these products and services difficult. These consumers may find managing their financial lives expensive and difficult.

New technology could lower the cost of providing financial products and expand access to underserved consumers. For example, internet-based or mobile financial products may be able to provide more affordable or convenient access to financial services for some underserved consumers with access to the internet or mobile phones.¹¹² In addition, alternative data may be able to better price default risk for lenders, which could expand credit access or make credit less expensive for some consumers. A recent government report suggests that households without bank accounts may be using nonbank online payment services such as PayPal, Venmo, and Cash App to substitute for bank products.¹¹³ In addition, some households may be using fintech credit products to substitute for nonbank "alternative" credit products, such as payday loans.¹¹⁴ A few recent studies suggest that fintech lenders are more likely to provide credit to some nonprime consumers at lower interest rates than banks do.¹¹⁵ In particular, fintech products have the potential to increase financial inclusion for younger consumers, who may have less access to credit and be more interested in adopting new technologies in financial services.¹¹⁶ However, these new fintech products may not reach all underserved consumers, particularly those without internet access or fluency with technology.

Credit Reporting and Fintech Products

The credit reporting industry significantly affects consumer access to financial products, because lenders and other financial firms use consumer data or a credit score when deciding whether to provide credit or other products to an individual and under what terms.¹¹⁷ Consumers who find it challenging to enter the traditional credit reporting system face challenges accessing many consumer credit products, such as mortgages or credit cards, because creditors are unable to assess their creditworthiness. Limited credit history is correlated with age, income, race, and ethnicity, and many of these consumers are young. During young adulthood, most consumers enter the credit reporting system and begin to establish credit histories. Most young adults transition into the credit reporting system in their early 20s. Eighty percent of consumers transition into the credit reporting system before age 25, and 90% do so before age 30.¹¹⁸

Unlike traditional credit products that may be routinely reported, some fintech lending products may not report information regularly to consumer credit bureaus. While some consumers may prefer to exclude these products from their credit reports, others might miss out on the opportunity to build their credit histories, particularly those who pay their fintech loans on time and have limited credit histories. By contrast, consumers are likely to damage their credit scores if they become delinquent on fintech lending products, because debts in collection can be reported to consumer credit bureaus. For example, one study finds that almost three-quarters of consumers who have missed BNPL payments report credit score declines due to their late payments.¹¹⁹ Recently, the three nationwide consumer credit bureaus have announced plans to accept BNPL payment data, allowing positive payment information to help build these consumers' credit records, although the CFPB has expressed concerns about inconsistent reporting of this information.¹²⁰

Algorithmic Bias and Explainability¹²¹

The use of ML algorithms by the financial sector has raised a number of policy issues of interest for financial regulators and Congress. One issue is that ML models can introduce fair lending and consumer protection risks. ML models may have training data biases, which is when a model has biases due to the limited or flawed dataset it was developed on.¹²² In addition, historical data can reflect historical biases, potentially creating models that discriminate against protected classes, such as race or sex or proxies of these variables.¹²³ The use of ML models on alternative data, discussed above, may also introduce ML inputs that may be proxies for race or other protected categories that might also bias ML decisions.

The ability of regulators or other outside parties to understand what an ML program did, and why, may be limited or nonexistent. This poses a significant challenge for companies using AI programs to ensure that they will produce outcomes that comply with applicable laws and regulations and for regulators to effectively carry out their oversight duties.¹²⁴ Generally, when a lender denies a loan application, the lender must send an adverse action notice to the applicant explaining the reason for the denial.¹²⁵ Some question how well lenders will understand and be able to explain the reasons for adverse actions resulting from decisions made by ML algorithms. In order to address this problem, some observers assert that regulators should set standards for how AI programs are developed, tested, and monitored, although debate exists about what these standards should include.¹²⁶ Concerns exist about AI model fairness; the ability to provide more algorithm transparency; and developing processes to assess AI models, for example, for fairness, reliability, privacy, and security.¹²⁷ Until regulatory standards are set, some financial institutions, particularly banks or other highly regulated parts of the financial system, may choose not to use ML programs, even if they are more accurate or efficient, due to regulatory risks.¹²⁸

Federal financial regulators have been monitoring ML developments in lending. In March 2021, the bank and credit union federal regulators, along with the CFPB, requested information on financial institutions' use of AI, including ML.¹²⁹ In May 2022, the CFPB issued guidance clarifying that lenders using "complex algorithms" still need to comply with adverse action notice requirements.¹³⁰ In August 2022, the CFPB released an interpretive rule stating that digital marketers materially involved in marketing financial services, including those using ML models, must comply with consumer protection regulations.¹³¹ In addition, the CFPB is currently working on a rulemaking around algorithms in home valuations.¹³²

Payment Scams and Fraud

In recent years, government agencies have documented increasing reports of payment scams and fraud.¹³³ According to FTC consumer reports, consumer fraud losses in 2021 were 70% greater than the previous year.¹³⁴ This included over 2.8 million consumers who reported fraud to the FTC in 2021.¹³⁵ The most common fraudulent payment methods reported were credit cards, payment apps or services, debit cards, and gift cards. However, the methods with the largest consumer losses were bank transfers or payments, cryptocurrencies, and wire transfers.¹³⁶ Many of these payment methods are "traditional," although fintech products, such as payment apps and cryptocurrencies, are included as common fraudulent payment methods as well. While the EFTA and the TILA provide some protection for unauthorized transactions for financial products such as bank transfers, debit cards, and credit cards, it is unclear whether these types of protections apply for different fintech products. In addition, questions exist about who should be liable for fraudulent payments authorized by consumers.

In addition to potential regulatory gaps, changes in technology may make it easier to commit fraud. For example, CFPB Director Chopra stated that "if you look across the developed world, when real-time payments becomes ubiquitous, you do see a dramatic increase in scams and fraud."¹³⁷ Faster payment systems may make it harder or give consumers less time to correct or stop transactions. In particular, fintech payment products—such as P2P payment and cryptocurrency platforms—may be vulnerable to scam and fraud issues for these reasons. Questions exist about how to reduce fraudulent payments on these types of platforms.

The CFPB reports that it has received consumer complaints about fintech companies not giving consumers responses or support when there is fraudulent activity or other customer service issues.¹³⁸ In particular, consumer complaints about mobile or digital wallets in 2021 more than doubled from the previous year, and fraudulent activity was a common complaint.¹³⁹ Likewise, consumer complaints to the CFPB about crypto-assets have also increased in the past few years, and the most common issue is fraud and scams.¹⁴⁰

Appendix. Consumer Liability Limits Under Regulation E