CFPB Payment App Rule Repealed: What It Means for Merchants

On this page 6 sections

1. The CFPB Digital Payment App Rule, From Final Rule to Repeal
2. PayPal, Cash App and Five Others: Who Faced Supervision
3. What Still Applies After the Larger Participant Rule Was Overturned
4. Personal vs. Business P2P Accounts for Merchants
5. Risk Considerations for Small Businesses Using P2P Apps
6. Better Options for Accepting Mobile and Online Payments

Key takeaways

• The repealed rule only let the CFPB examine about seven big payment apps. It never set rules for the merchants who accept them.
• Regulation E, the privacy rules and the ban on unfair or deceptive practices still apply to payment apps. The CFPB can still enforce them.
• For merchants, the bigger risk is unchanged: taking business payments into a personal P2P account, which the apps' terms generally restrict.
• Because Congress used the Congressional Review Act, new federal exam authority over the big apps would most likely need new legislation.

Congress repealed the CFPB digital payment app rule in May 2025, and for most merchants the direct effect is small. The rule would have let the Consumer Financial Protection Bureau examine the largest nonbank payment apps, including PayPal, Venmo and Cash App, much as it examines big banks. It never set rules for the businesses that accept those apps, and the consumer protection laws it was meant to police are still in force. What changed is who checks on the apps. That matters if your shop, salon or food truck runs real money through a personal P2P account.

The CFPB Digital Payment App Rule, From Final Rule to Repeal

The CFPB issued the rule, formally titled "Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications," on November 21, 2024. It was published in the Federal Register on December 10, 2024, and took effect January 9, 2025. Under it, a company counted as a "larger participant" if it met three tests. It was a nonbank. It was not a small business under Small Business Administration size standards. And it handled at least 50 million covered consumer payment transactions a year in U.S. dollars. The November 2023 proposal had set the bar at 5 million, so the final version reached far fewer companies.

The rule lasted about four months. Congress used the Congressional Review Act (CRA), a fast-track law that lets Congress and the President cancel recent agency rules with a joint resolution. The record on Congress.gov for S.J.Res. 28 shows the timeline:

The same day, the President also signed a resolution repealing the CFPB's overdraft rule for banks and credit unions with more than $10 billion in assets. A CRA repeal also lasts. The CFPB cannot reissue the rule in substantially the same form, or adopt a substantially similar one, unless Congress passes a new law authorizing it.

PayPal, Cash App and Five Others: Who Faced Supervision

The rule named no companies. According to the Congressional Research Service summary, the CFPB estimated it would cover seven providers: Google Pay, Apple Pay, Samsung Pay, Venmo, PayPal, Cash App and Facebook. Together they handled about 98% of the roughly 13.5 billion transactions a year in the nonbank consumer payment app market. Transactions in digital assets, including stablecoins, did not count toward the threshold.

"Supervision" means routine examinations like the ones banks and credit unions already get. Examiners would have checked whether the apps followed existing federal law:

• the ban on unfair, deceptive or abusive acts or practices (UDAAP)
• the privacy rules of the Gramm-Leach-Bliley Act and its Regulation P
• the Electronic Fund Transfer Act and its Regulation E

The CFPB's own press release framed the goals as protecting personal data, reducing fraud and stopping what it called illegal "debanking," meaning sudden account closures.

This is the part that gets lost. The rule added no new consumer protection requirements, as the law firm Skadden noted in its December 2024 analysis. The CFPB already had enforcement power over these apps; the rule added exam authority on top. So the repeal took away the check-ups. The underlying rules stayed.

What Still Applies After the Larger Participant Rule Was Overturned

For a merchant, four things are unchanged.

Federal consumer law still binds the apps. The Electronic Fund Transfer Act, Regulation E, the Gramm-Leach-Bliley privacy rules and the UDAAP ban apply to payment apps regardless of the repeal. The CFPB's enforcement authority did not come from this rule, so the repeal did not remove it. How actively the Bureau uses that authority is a separate policy question.

Regulation E is a consumer rule. Its protections, such as error resolution and limits on liability for unauthorized transfers, are written for consumer accounts. When you take payments into a business account, your rights come mostly from the app's user agreement. Confirm how this applies to your accounts with an attorney or your app provider.

The app's terms of service still run your account. Holds, transaction limits, fees and account closures are all set by the contract you clicked through. So is the question of whether a personal account may accept business payments at all. The repeal did not loosen any of it.

Tax reporting is a different law. The CFPB rule had nothing to do with IRS reporting, despite talk of the IRS "taxing Venmo." Whether an app sends you a Form 1099-K depends on tax law and the app's reporting, and the thresholds have changed more than once in recent years. Our guide to reconciling Form 1099-K against your books covers what to do with one, and a tax professional can confirm the current rules for your business.

Personal vs. Business P2P Accounts for Merchants

The repeal does not change the biggest risk P2P apps pose for small businesses: taking business payments into a personal account. Personal accounts are built for things like splitting rent with friends. The major apps generally offer separate business profiles with their own fees and terms, and their user agreements typically restrict business use of personal accounts. Read the current terms of each app you use, because they change.

The pattern looks different by industry:

• Salons and spas: A client sends a color-appointment deposit or a tip to a stylist's personal handle. The money never touches the salon's books. If the client later disputes a no-show charge, the salon has no record of the policy the client agreed to.
• Food trucks: A QR code for the owner's personal account is taped to the window to keep the lunch line moving. That can work until the app's monitoring treats a steady stream of payments from strangers as business activity.
• Retail stores: A P2P sale rung up on a phone skips the POS, so it misses inventory counts, sales tax reports and the end-of-day reconciliation.
• Professional services: A bookkeeper or consultant asks clients to pay invoices and retainers to a personal handle. Larger amounts mix with household money, which complicates taxes and makes it harder to show a lender clean books.

Illustrative Example: The Food Truck QR Code

These numbers are illustrative, not data from any app or processor. Assume a food truck sells $9,000 a month and 30% of that comes in through the owner's personal P2P account. That is $2,700 a month, or about $1,350 every two weeks. Now assume the app flags the account for business use and limits it while it reviews, holding a two-week balance of $1,350. The truck can't touch that cash until the review ends, and the next day's P2P customers have no way to pay.

Now compare moving the same $2,700 to card acceptance at an illustrative blended cost of 3%: $2,700 × 0.03 = $81 a month. Your actual cost depends on your pricing, card mix and how you take the payment. The question is whether $81 a month is worth it to avoid a terms-of-service problem and a frozen balance. If an app has already shut you down, our guide on what to do when a payment app deactivates your account explains how to appeal and how to recover held funds.

Risk Considerations for Small Businesses Using P2P Apps

Your recourse depends on the app's contract. With the larger participant rule gone, no federal examiner reviews how the biggest apps handle account closures and holds. If your account is limited, your options are the app's own appeal process, a complaint to a regulator, or a lawyer.

Disputes work differently. Card payments run under Visa and Mastercard network rules, with a set chargeback process and deadlines on both sides. P2P payments follow each app's own policies. That can leave you without a clear process when a customer says the service was never delivered.

Records are thinner. Card sales through a POS or gateway land in one report and settle to your business bank account. P2P receipts often have to be matched by hand.

Better Options for Accepting Mobile and Online Payments

The practical fix is to take cards through a merchant account. If you keep P2P at all, keep it on a business profile as a backup.

For businesses that move around, mobile card terminals such as the Clover Flex Pocket take cards at a market stall or a client's door. Professional services firms that bill remotely can key card payments through a virtual terminal for phone and invoice payments, and online sellers can connect a payment gateway to their store. Salons can see setups built for appointment businesses on our salon and spa payments page, and trucks can start with food truck payment processing.

If cost is what keeps you on personal P2P, look at programs such as cash discount pricing and dual pricing. They can help eligible merchants offset some or all card-processing costs. But network rules and state laws control how you disclose them and what your signs must say, so set them up with your provider rather than improvising. You will also need a business bank account for your card sales to settle into. Our checklist of business bank account requirements for card processing covers what underwriters ask for.

Start this week by listing every place a personal payment handle appears: the truck window, the salon mirror, invoice footers, your Instagram bio. Replace each one with a business option. For future rule changes, watch Congress, not the CFPB. Because of the CRA, bringing back federal exams of the big payment apps would most likely take new legislation. To see what card acceptance would cost on your volume, you can request a free quote from MannyPay, and a specialist will respond within one business day.

Sources

1. Congress.gov: S.J.Res. 28 (119th Congress), All Actions
2. Congressional Research Service: Congress Repeals Rule That Would Have Subjected Large, Nonbank Digital Wallet and Payment App Providers to CFPB Supervision (IF12935)
3. Federal Register: Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications (Dec. 10, 2024)
4. CFPB: Final rule page, Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications
5. Skadden: CFPB Finalizes Rule To Subject Large Payment Apps to Direct Supervision
6. Greenberg Traurig: CFPB's Final Rule Enhancing Oversight of Large Digital Payment App Providers Goes into Effect Jan. 9
7. Fenwick: CFPB Final Rule Expands Oversight to Larger Digital Payment App Providers
8. McDermott Will & Emery: CFPB Finalizes Rule for Federal Oversight of Popular Digital Payment Apps
9. Holland & Knight: CFPB Overdraft and Digital Payment Rules Repealed by Trump Administration
10. Steptoe: Congress Rolls Back Major CFPB Rules

AR

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.