Two trade groups that represent large tech companies, TechNet and NetChoice, have sued the Consumer Financial Protection Bureau in the District of Columbia District Court, saying it doesn't have the right to oversee nonbank tech companies that offer financial services. The complaint accuses the agency of overstepping its authority and of failing to properly assess the impact of its rule.
TechNet members include Apple, Block, Box, Cisco, Dell, Google, HireVue, Intuit, Meta, OpenAI, PayPal, Salesforce, Samsung, Uber, Verizon and Visa. Members of NetChoice include Amazon, Google, Meta, PayPal, X and Yahoo.
"Instead of fostering a regulatory environment that supports responsible innovation, the CFPB is undermining the very principles that make the U.S. a global leader in financial technology," said Carl Holshouser, executive vice president of TechNet, in a statement. "By granting itself broad authority over a company's operations, even those entirely unrelated to digital payments, the CFPB goes far beyond its mandate. … This isn't regulation; it's overreach and risks creating a chilling effect on innovation that drives economic growth and benefits millions of consumers."
The groups are reacting to a final rule the CFPB published in December that grants it authority to supervise large companies that facilitate at least 50 million consumer payment transactions a year.
The Consumer Financial Protection Act of 2010 (a section of the Dodd-Frank Act) gave the CFPB supervisory authority over "larger participant[s] of a market for other consumer financial products or services, as defined by rule[s]" the CFPB issues. The bureau did not write this rule until recently, however.
In their complaint, the groups said Congress did not give the CFPB free rein in choosing which nonbank entities to supervise under this "larger participant" authority. Rather, the statute says the CFPB's supervision must be "risk-based" and that the bureau "shall exercise its [supervision] authority" by assessing "the risks posed to consumers in the relevant product markets and geographic markets."
Logically, it would seem that companies that manage millions of consumer payments do represent risk. Consumers that use person-to-person payment systems like Venmo or digital wallets like Google Pay can be subject to fraud, security incidents, outages, errors and even customer service lapses that deprive them of much-needed access to money and the ability to pay important bills. TechNet did not respond to a request for an interview.
The tech companies seem to be leaning on legal technicalities of the laws that govern the CFPB.
"The TechNet lawsuit is typical of aggressive industry reactions to federal rulemaking since the Supreme Court eliminated deference to agency interpretations of law in the Loper Bright case," said Todd Baker, a senior fellow at the Richman Center for Business, Law & Public Policy at Columbia University and the managing principal of Broadmoor Consulting, referring to Loper Bright Enterprises v. Raimondo, a 2024 Supreme Court case that overturned the Chevron doctrine, which required federal courts to defer to agency interpretations of ambiguous statutes.
"While it seems obvious that hundreds of millions of consumer payments transactions present material risks to consumers, post Loper Bright, the courts get the final say over what 'risk' is and how to interpret Congress' broad but bounded delegation of authority to the CFPB under the 'larger participant' provisions of Dodd-Frank," Baker said.
Michele Alt, co-founder of Klaros Group, pointed out that the Dodd-Frank Act requires the CFPB to assess risks posed to consumers in its rulemaking.
"The [TechNet lawsuit's] argument is that the CFPB has exceeded its statutory authority by not really defining or articulating those risks," Alt said.
The tech companies cited the CFPB's preamble to its final rule, in which the agency said it disagreed with commenters on the proposed rule who suggested that the agency must make findings regarding risk to issue this larger participant role.
That issue of "statutory construction" is a critical question, Alt said. The court in this case "will need to decide whether the CFPB acted arbitrarily or capriciously here in its interpretation of its statutory authority," Alt said.
The other major argument the tech companies made in their lawsuit is that under the Administrative Procedure Act, agencies are required to conduct a cost-benefit analysis of any new rule before issuing it.
"The regulatory analysis in the proposed rule is laughable, because it so underestimated the burden," Alt said. "The CFPB originally said that 17 larger companies would be covered by this rule. There's a lot of speculation that that is an underestimate. Their estimates of the cost of compliance were also, in my opinion, wildly understated."
For instance, the CFPB estimated that participating in an exam would cost nonbank entities $25,000. "That barely covers the cost of a meeting with regulators, let alone an exam," Alt wrote in a LinkedIn post a year ago.
These are more than technicalities, in Alt's view.
"Ever since the CFPB was created, it's basically had a target on its back," she said. "There have been all sorts of challenges to legitimacy, jurisdiction, etc., so it is absolutely incumbent upon that agency to get rulemaking right. And on this one, they made a lot of mistakes and I think that rule will be very vulnerable."
The future of the CFPB's rule for supervising larger participants such as tech companies is in question under the incoming Trump administration, even without this lawsuit challenging it.
"We can assume, I think safely, that the new administration would not have adopted the larger participant rule in the way that the CFPB has in the final days of the Biden administration," Alt said.
The new government could simply not enforce it, or issue a rule to modify it or rescind it, she said.
"In the meantime, this lawsuit will proceed," Alt said. "In the post Loper Bright environment, I think they probably have a good shot of success."
Baker expects this lawsuit will tie up the regulation for years, "which is the point even if Congress does not override it under the Congressional Review Act," he said.
