The rapidly evolving payments ecosystem that aims to streamline commerce and payments for consumers also poses risks to them, the Consumer Financial Protection Bureau warned in a report published this month.

Although financial services phone apps, also known as “super apps,” buy now-pay later options and embedded commerce in social media apps offer convenience for consumers, the federal agency flagged the emerging risks they present. Those may include the collection and monetization of consumers’ financial data and the potential for large companies to dominate the market, the CFPB report said.

The CFPB’s report, “The Convergence of Payments and Commerce: Implications for Consumers,” was published Aug. 4; it noted the CFPB is “carefully monitoring the payments ecosystem.” 

Since CFPB Director Rohit Chopra took the helm last year, the agency has intensified its watchdog role, launching a BNPL inquiry and demanding information on payment practices from big tech companies including Apple, Google, Facebook and Amazon. A former CFPB enforcement director pointed out earlier this year the bureau is pursuing an antitrust agenda in a way it hasn’t before.

Michael Guerrero, a partner at law firm Ballard Spahr who focuses on consumer protection issues, said the latest report is consistent with a skepticism toward innovation the agency has demonstrated in recent months. 

“This bureau is very aggressive and active,” Guerrero said. “They’ve been issuing guidance at an incredible pace.”

From his perspective, it’s discouraging to see the CFPB take “such an adversarial approach to companies trying to be more innovative,” he said. Guerrero works predominantly with fintechs as well as financial firms, including large banks and card issuers.

“It’s one thing to enforce the laws and protect consumers,” Guerrero said. “It’s another to almost have an agenda that targets innovative companies.”

“There seems to be a theme that the bureau’s much more comfortable with what it knows,” he also noted.

Protecting consumer data

In an effort to give consumers enhanced control of their payments and transaction data, the CFPB plans to propose rules on personal financial data rights, in accordance with the Consumer Financial Protection Act, the report said. The agency expects to release an outline related to that in November, a CFPB spokesperson said.

Just before the report was released, eight trade groups, including the American Bankers Association, petitioned the CFPB to engage in rulemaking that would provide clarity around who the “larger participants” in data aggregation are that would have to comply with the CFPB’s rule. Those groups argue such a move would “strengthen the privacy and security of consumer financial data held by fintechs, Big Tech and data aggregators,” per an Aug. 2 news release.

The CFPB also plans to issue a report on its BNPL findings and a decision on “whether regulatory interventions are appropriate” in that market, the report noted. The spokesperson declined to say when that report would be released.

Also noteworthy: The agency is “carefully focused” on the rise of real-time payments in the U.S. and seeks “to mitigate the potential consequences of large technology firms moving into this space,” the report said. The CFPB is studying the use of real-time payments in other markets as it considers how to protect consumers and lower fraud risk.

Detailing the risks the agency sees in the payments landscape, the CFPB report pointed to actors in the payments ecosystem profiting from consumer transaction data when used for marketing purposes.

When consumers transact online, social media sites, for example, may use this information to generate revenue through targeted advertising or by selling information to other companies without consumers’ approval, the CFPB said. As financial service providers and social media and e-commerce companies become more intertwined, the “emerging risk in payments is the potential that consumer financial data and behavioral data are used together in increasingly novel ways,” the report warned.

Capabilities like machine-learning have allowed companies to use financial data in ways that may take advantage of consumers, the report said. “The Bureau intends to carefully monitor and scrutinize these practices for potential fair lending risks, as well as risks of unfair, deceptive, and abusive practices,” the report noted.

Targeting market domination

The report also flagged market domination concerns in payments, noting the current ecosystem involves “four large card networks for payment processing and two major facilities for processing bank-to-bank transactions.” The CFPB spokesperson identified those companies as Visa, Mastercard, American Express and Discover, and Nacha and The Clearing House.

Addressing similar market domination in a recent blog post, Chopra called out the concentration of power among big processors Fidelity National Information Services (FIS), Fiserv, Jack Henry and Finastra.

While payments innovations have resulted in new fintech players and products, the CFPB noted the potential for emerging business models like BNPL to use scale effects such as a two-sided marketplace and data aggregation “to create a new generation of dominant incumbents.” 

The report singled out the Chinese market as one that’s given rise to two dominant players, WeChat Pay and Alipay. It also noted the quick scale of tech giant's Apple credit card franchise, branded the Apple Card, which includes virtual cards tucked inside smartphones as well as physical versions. The CFPB noted “many of the concerns of the market power of these companies would then be extended into the payments space.” Apple has also quickly grown the customer base for its Apple Pay application in its trademark iPhones.

The agency is paying attention to such developments. “The concept of a financial services super app is becoming more prevalent (both Apple Pay and Google Pay offer components of a super app), and it’s possible that they will continue to expand their offerings to stay competitive,” the report said. “In fact, Apple recently announced plans to expand their financial services offerings."

Similarly, embedded payments in a social media channel could needle merchants into paying more fees if they see an advantage due to data and scale capabilities, the report said. It called out such dynamics “with existing payment networks, which recently announced intent to further increase swipe fees on merchants.”

Congress members are also scrutinizing the power of the card networks that impose those fees. Senators Dick Durbin (D-IL) and Roger Marshall (R-KS) introduced legislation last month that would impose new requirements on routing credit card transactions to spur more competition for the two biggest U.S. credit card network companies, Visa and Mastercard.