December 2016
Prepaid Accounts Rule:
Preparing for the
Coming Changes
An article by John A. Epperson, CAMS, Clayton J. Mitchell, CAMS, and Robert B. Kirsh, J.D.
Audit / Tax / Advisory / Risk / Performance
Smart decisions. Lasting value.™
Prepaid Accounts Rule:
Preparing for the Coming Changes
Changes are imminent under the final prepaid
accounts rule, which begins to go into effect in
less than a year.
The Consumer Financial Protection Bureau
(CFPB) issued its final prepaid accounts
rule. The rule becomes effective Oct.
1, 2017, except for the requirement to
submit prepaid account agreements to the
CFPB, which is delayed until Oct. 1, 2018,
and certain exceptions with respect to
electronic and written account transaction
histories and disclosures produced in the
normal course of business prior to Oct.
1, 2017. The rule changes the operating
environment for prepaid account issuers
and creates and clarifies comprehensive
consumer protections for prepaid accounts
under Regulation E of the Electronic
Fund Transfer Act, Regulation Z of the
Truth in Lending Act, and the official
interpretations of those regulations.
At a high level, the prepaid accounts
rule modifies general Regulation E
requirements to create tailored provisions
governing disclosures, limited liability and
error resolution, and periodic statements.
The rule also adds new requirements to
submit account agreements to the CFPB,
to post agreements online, and to make
agreements available to consumers upon
request. Additionally, the rule regulates
2
December 2016
overdraft credit features that may be
offered in conjunction with prepaid
accounts. Subject to certain exceptions,
credit features will be covered under
Regulation Z, including when credit can
be accessed in the course of a transaction
conducted with a prepaid card.
While issuers of prepaid accounts
have a year to comply with the prepaid
accounts rule, the strategic decisions,
change management, disclosure updates,
new controls implementation, and
tactical execution of the plans should be
completed well in advance of the deadline
to ensure that proper processes, which
have been tested prior to implementation,
are in place prior to the deadline. In
addition, if issuers determine that card
packaging materials need to be pulled and
replaced, that process must start several
months in advance of the Oct. 1, 2017,
implementation date.
Crowe Horwath LLP
Highlights of the Rule
Understanding the regulatory requirements
and the changes to be implemented by the
prepaid accounts rule will help financial
services companies assess the overall effect
of the rule. The most substantive changes
were found in the following six areas:
1.Definition
2.Pre-acquisition disclosures
3.Access to account information
4.Error resolution
5.Submission and posting of account
agreements
6.Credit features
1. Definition
The prepaid accounts rule specifically
includes certain accounts, namely:
• Payroll card accounts and government
benefit accounts that currently are
subject to Regulation E
• Accounts that are marketed or labeled as
“prepaid,” redeemable upon presentation
at multiple, unaffiliated merchants
for goods or services, or usable at
ATMs (for example, nonpayroll prepaid
accounts such as general purpose
reloadable accounts)
• Accounts that are issued on a prepaid
basis or capable of being loaded with
funds; whose primary function is to
conduct transactions with multiple,
unaffiliated merchants for goods or
services, or at ATMs, or to conduct
person-to-person (P2P) transfers (for
example, PayPal accounts); and that
are not checking accounts, share
draft accounts, or negotiable order of
withdrawal (NOW) accounts
crowehorwath.com
Likewise, the rule specifically excludes
certain accounts, namely:
• Store gift cards and gift certificates
• General-use prepaid cards that are
marketed and labeled as a gift card or
gift certificate (for example, open-loop
gift cards)
• Loyalty, award, or promotional cards
• Accounts used for savings or
reimbursements related to certain
health, dependent care, and transit or
parking expenses
• Accounts used to distribute qualified
disaster relief payments
• Accounts with P2P functionality that
are established by or through the U.S.
government, and whose primary function
is to conduct closed-loop transactions
on U.S. military installations or vessels,
or similar government facilities such
as those currently marketed under the
brand names EagleCash, Navy Cash®,
and Marine CashSM, as outlined in the
commentary to the rule
• Accounts established for needs-tested
benefits disbursements by state or
local agencies
Commentary to the rule also exempts
brokerage and savings accounts as well as
reload packs.
2. Pre-acquisition Disclosures
The prepaid accounts rule creates
requirements for new prepaid-specific,
pre-acquisition disclosures. Generally,
both a short-form and long-form disclosure
must be provided before a consumer
acquires (by purchasing, opening, or
choosing to be paid by) a prepaid account.
The short form sets forth the prepaid
account’s most important fees and certain
3
Prepaid Accounts Rule:
Preparing for the Coming Changes
other information to help the consumer
understand the account’s important terms
and to allow the consumer to comparison
shop among prepaid account programs.
Administration (NCUA) share insurance
eligibility, and whether an overdraft credit
feature may be offered in conjunction
with the account
The long form provides a comprehensive
list of all of the fees associated with the
prepaid account, detailed information on
how those fees are assessed, and certain
other information about the prepaid
account program. Alternative timing is
permitted for the delivery of the long-form
disclosure for prepaid accounts acquired at
retail locations and by telephone, provided
certain conditions are met.
Safe harbor is provided for accurate and
appropriately used model short-form
disclosures. An example of this form can be
found on the CFPB’s website.
The rule also establishes requirements
about the content, form, and formatting
of the forms. For the short form,
certain sections or parts must be
included, such as:
The rule establishes additional requirements
with respect to the following:
• A statement regarding alternative wage or
benefit payment options for payroll card
and government benefit accounts
• “Static” fees, which disclose
standardized fees that must be provided
for all prepaid account programs, even if
the fees are $0 or if they relate to features
not offered by a particular program
• Information about certain additional
types of fees that may be charged for the
prepaid account program, including the
two fee types that generate the highest
revenue from consumers (certain fees
are excluded)
• Other important information, including
statements regarding registration
and Federal Deposit Insurance Corp.
(FDIC) deposit or National Credit Union
4
December 2016
Likewise, the prepaid accounts rule
provides certain requirements for the long
form beyond the information required in the
short form, including a table of all account
fees and their qualifying conditions.
• Any purchase price or activation fee must
be disclosed outside of, but in close
proximity to, the short-form disclosure
• Disclosures required to be printed on the
prepaid card itself
• Short-form and long-form disclosure
requirements for prepaid accounts with
multiple service plans (such as pay-asyou-go, monthly, and annual plans)
In certain circumstances, pre-acquisition
disclosures must be provided in a foreign
language if that foreign language is used
in connection with the acquisition of the
prepaid account (for instance, in marketing
materials or if consumer information
was obtained in a foreign language).
Furthermore, an issuer always must provide
the long-form disclosure in English on its
website and upon a consumer’s request.
Crowe Horwath LLP
3. Access to Account
Information
In lieu of mailing written monthly
statements, financial services companies
are permitted to give consumers access
information about their prepaid accounts
using certain other methods. The prepaid
accounts rule states that financial services
companies are not required to mail
printed periodic statements if they make
balance information, at least 12 months
of electronic account transaction history,
and, upon a consumer’s oral or written
request, at least 24 months of written
account transaction history available
to consumers by telephone. Periodic
statements and account transaction
histories must disclose the amount of
any fees assessed against the account
and must display a summary total of the
amount of all fees assessed by the financial
services company against the consumer’s
prepaid account for the prior calendar
month and for the calendar year to date.
4. Error Resolution
The prepaid accounts rule extends
Regulation E’s limited liability and error
resolution requirements to all prepaid
accounts, regardless of whether a financial
services company has completed its
consumer identification and verification
process with respect to the account. Once
the account has been verified, the company
must comply with the provisional credit
requirements for errors that occur both
prior to and after account verification within
the provisional credit timeframe. However,
the rule does not require provisional credit
for accounts that have not completed the
consumer identification and verification
crowehorwath.com
process, but the rule does not extend the
same exception with respect to liability
limitations. Complying with regulation E
error resolution requirements continues
to be challenging for financial services
companies throughout the country as it
requires the right people, processes, and
technology to enable ongoing compliance.
5. Submission and Posting of
Account Agreements
Under the rule, issuers must submit their
prepaid account agreements to the CFPB
and publicly post on their own websites
prepaid account agreements offered to the
general public. Any agreements not posted
on their websites, must be made available
to consumers who have prepaid accounts
under those agreements, upon request. If
there are changes to terms and disclosures
over time, the issuer also must maintain
record-retention controls and ensure that
proper disclosures are being made to the
appropriate consumers. The rule requires
issuers and program managers to submit
and post within 30 days of the effective
date of any change, which likely will require
significant effort.
6. Credit Features
Perhaps the prepaid accounts rule’s most
significant mandate is to bring prepaid
accounts under the scope of Regulation Z,
as prepaid access traditionally has been
viewed as the antonym of “credit.” Given the
wholesale changes that this portion of the
regulation will require, especially for issuers
who also do not deal in credit products,
significant resources will be needed to
determine applicability of the regulation,
5
Prepaid Accounts Rule:
Preparing for the Coming Changes
develop and implement plans to comply,
and for ongoing monitoring and testing. The
rule makes Regulation Z’s credit card rules
applicable to what the CFPB has termed
a “hybrid prepaid-credit card,” which is
a prepaid card that can access both an
overdraft credit feature (that is subject to
the Regulation Z credit card rules) and the
asset portion of a prepaid account. More
specifically, Regulation Z’s credit card
rules apply to any credit feature offered in
conjunction with a prepaid account when the
credit feature does both of the following:
• Is offered by the prepaid account issuer,
its affiliate, or its business partner
• Can be accessed in the course of a
transaction conducted with the prepaid
card to obtain goods or services, obtain
cash, or conduct P2P transfers
Generally, such credit features must
be distinct from the asset portion of
the prepaid account – structured as
a separate credit account or a credit
subaccount to the asset account – to
facilitate transparency and compliance
with various Regulation Z requirements.
An issuer may not extend credit via a
negative balance on the asset portion of the
prepaid account, except in several limited
circumstances including when the credit is
incidental and the issuer generally does not
charge credit-related fees for that credit.
For example, when an issuer has a general
established policy and practice of declining
to authorize transactions when a consumer
has insufficient or unavailable funds in
the asset portion of the account to cover
the transaction, but credit nonetheless is
extended as a result of so-called “force
6
December 2016
pay” transactions or other transactions
that will not take the account negative by
more than $10 (the de minimis “purchase
cushion”), or when certain transactions are
conducted while incoming deposits to the
prepaid account are pending, the incidental
credit is not subject to Regulation Z.
The prepaid accounts rule also restricts
charging certain fees in the first year after
account opening, limits penalty fees, and
requires an assessment of the consumer’s
ability to pay. One significant difference
for credit cards under Regulation Z is that
issuers must wait at least 30 days after
a prepaid account is registered before
soliciting a consumer to link a covered
credit feature to the prepaid account
and must obtain consumer consent
before linking such a credit feature to a
prepaid account. Furthermore, issuers
are permitted to deduct credit card debt
automatically from the prepaid account or
another deposit account held by the card
issuer no more frequently than once per
month. However, issuers may make such
deductions only if they have a signed,
written authorization by the cardholder
to do so. Consumers must have at least
21 days to repay the debt incurred in
connection with using such features, and
issuers are prohibited from compulsory use
of pre-authorized electronic fund transfers
(EFTs) to repay credit extended through
an overdraft credit feature accessible by a
hybrid prepaid-credit card.
Crowe Horwath LLP
What’s Your Plan?
The 1,700-page document on the prepaid
accounts rule released by the CFPB goes
further than simply updating account
disclosures. It requires a cross-functional,
enterprisewide analysis and execution of
change management procedures involving
compliance, legal, finance, operations,
marketing, production, distribution, sales,
IT, product, and other teams.
Significantly, disclosures must reflect reality.
Financial services companies need to
determine which policies and procedures
must change, who must buy in and make the
changes happen, whether IT development is
necessary, and if so, what the planning cycle
is and how long the “go-live” queue will be.
Financial services companies should
consider the following steps when
implementing the new prepaid accounts rule:
1.Review the rule and its impact on the
business, taking a strategic view toward
the requirements and the business.
2.Determine which products and specific
features within those products remain
feasible to provide under the rule.
3.Conduct a current-state assessment
that identifies gaps and the change
management activities necessary to
comply with the rule.
Beyond the immediate work, the rule also
will change the examination procedures and
the supervisory methods of the CFPB and
other regulators with consumer oversight.
An overarching focus will be on issuers’
compliance management system (CMS),
which, in part, should do the following:
• Establish compliance responsibilities.
• Communicate those responsibilities
to employees.
• Make sure that responsibilities for meeting
legal requirements and internal policies are
incorporated into business processes.
• Review operations, including testing
and monitoring, to make certain that
responsibilities are carried out and legal
requirements are met.
• Take corrective action.
• Update tools, systems, and materials,
as necessary.
Issuing banks, program managers,
and other prepaid-related entities have
significant work ahead of them to comply
with the prepaid accounts rule. Given that
mass-scale projects often take longer than
expected, it certainly is better to get started
sooner rather than later.
4.Build a risk-based and priority-driven
project plan (road map), which includes
testing the implemented systems and
controls to comply with the Oct. 1, 2017,
effective date.
5.Execute on the road map.
crowehorwath.com
7
Connect With Us
John Epperson
Principal
Crowe Horwath LLP
+1 630 575 4220
[email protected]
Clayton Mitchell
Crowe Horwath LLP
+1 317 208 2438
[email protected]
Rob Kirsh
Crowe Horwath LLP
+1 317 269 6683
[email protected]
crowehorwath.com
In accordance with applicable professional standards, some firm services may not be available to attest clients.
This material is for informational purposes only and should not be construed as financial or legal advice. Please seek guidance specific to your organization from qualified advisers in your jurisdiction.
© 2016 Crowe Horwath LLP, an independent member of Crowe Horwath International crowehorwath.com/disclosure
FS-17008-006