In late 2024, the Consumer Financial Protection Bureau finalized a rule that would have let it examine the largest nonbank payment apps — think Venmo, Cash App, PayPal, and similar wallet services — the same way it examines banks: proactively, through on-site reviews and compliance audits, not just after a complaint comes in. Five months later, Congress erased it. Not “paused for review” or “sent back for revision” — erased, using a fast-track legislative tool that leaves virtually no room for the agency to bring it back on its own.

If you use one of these apps, that whiplash raises a fair question: who is actually watching them now? The honest answer is that no single regulator picked up everything the voided rule would have covered. Instead, oversight fell back to a patchwork of authorities that were already there before the rule existed — some quite strong, some considerably thinner than what the CFPB rule proposed. This piece walks through exactly how the repeal happened and which regulators and mechanisms fill the resulting gap, so you can tell the difference between “no oversight at all” (not true) and “oversight as strong as what was proposed” (also not true).

What the Voided Rule Would Have Actually Done

The rule, formally titled “Defining Larger Participants of a Market for General-Use Digital Consumer Payment Applications,” did one specific thing: it classified nonbank companies processing at least 50 million consumer payment transactions a year as “larger participants” subject to the CFPB’s direct supervisory authority — the same category of oversight the agency already applies to large banks, credit reporting agencies, and student loan servicers. The CFPB estimated this threshold captured a small number of companies that together move well over 10 billion transactions annually.

Supervision in this sense means something specific: examiners can request records, review compliance programs, and identify problems before a pattern of consumer harm shows up in complaints. That’s different from enforcement, which requires the agency to already have evidence a law was broken before it can act. The rule didn’t create new consumer rights — it added a proactive examination layer on top of protections that already existed under other laws.

How the Repeal Actually Happened

The rule was rescinded through the Congressional Review Act (CRA), a 1996 law that lets Congress overturn a recently finalized federal regulation with a simple majority vote in each chamber and the president’s signature — bypassing the Senate’s normal 60-vote threshold for most legislation. It’s a narrow, time-limited tool: it only works within a set window after a rule is finalized, and once used, it comes with an unusually strong side effect described below.

Here, the joint resolution disapproving the rule (S.J.Res. 28) passed the Senate 51–47 in early March 2025, then the House 219–211 about a month later, largely along party lines. The president signed it in May 2025. Two industry trade groups had also separately sued to block the rule in federal court; once Congress acted, they dropped that lawsuit as moot.

The practical effect of a CRA repeal is blunter than an ordinary regulatory rollback: the rule “shall have no force or effect,” and — this is the part that matters for predicting the future — the CFPB is barred from reissuing any rule in “substantially the same form” unless a subsequent act of Congress specifically authorizes it. That’s a materially higher bar than a typical agency reversing its own policy, which it could otherwise do again in a future rulemaking. This doesn’t mean payment-app supervision can never return — Congress could pass new authorizing legislation, or a future rule could be structured differently enough to not count as substantially the same — but it does mean the CFPB itself can’t simply reissue a close variant next year if a new administration wants to.

Who Actually Fills the Gap Today

With the proactive-supervision layer gone, several other authorities continue to apply — none of them new, and none of them, individually, equivalent to what the voided rule proposed.

Bank-Partner Oversight (OCC, FDIC, and the Federal Reserve)

Many payment apps don’t hold your money themselves — they route stored balances through a partner bank behind the scenes. Where that’s the structure, the partner bank’s deposit-taking activity remains subject to routine examination by its primary federal regulator: the Office of the Comptroller of the Currency for nationally chartered banks, the FDIC for state-chartered banks it insures, or the Federal Reserve for state member banks (credit-union-affiliated apps fall under the National Credit Union Administration instead). This oversight was never part of the voided CFPB rule and wasn’t affected by its repeal — but it covers the bank’s own conduct, not necessarily every consumer-facing decision the app layer makes on top of it, and the split between “app” and “bank” varies by product and isn’t always visible to a user.

State Money-Transmitter Regulators

Nonbank companies that move consumer money between parties are generally required to hold a money-transmitter license in every state where they operate, and state financial regulators retain independent examination authority over licensees within their jurisdiction. Many states coordinate these exams through a shared multistate framework rather than each acting alone, which has closed some of the consistency gap, but the depth and frequency of examination still varies by state, and coverage assumes the company is properly licensed everywhere it should be.

The FTC’s Section 5 Authority

The Federal Trade Commission’s power to pursue unfair or deceptive acts and practices under the FTC Act was untouched by the CRA repeal — it’s a separate statute entirely. This authority is enforcement-based: the FTC generally acts after a pattern of consumer harm is identified, not through routine proactive exams, but it applies broadly across the payment-app market regardless of company size or transaction volume.

Card Network Operating Rules

Where a payment app rides existing card-network rails — a debit card linked to a wallet, or a transaction routed through Visa or Mastercard’s network — that network’s own operating rules add a private, contractual layer of consumer protection on top of federal law, including dispute-resolution timelines and liability limits for certain unauthorized-use claims. This layer is enforced through the network’s merchant and issuer agreements, not by a government regulator, and it doesn’t apply uniformly to every transaction type a payment app processes — P2P transfers between individuals, for instance, typically don’t route over card-network rails at all and don’t get this protection.

State Attorneys General

State AGs can bring their own consumer-protection actions under state unfair-and-deceptive-practices statutes, independent of anything happening at the federal level, and several have coordinated multistate investigations into payment-app practices in the past. This authority doesn’t depend on federal rulemaking status at all.

What Stayed Exactly the Same: EFTA and Regulation E

The Electronic Fund Transfer Act, implemented through Regulation E, is the one piece of this picture that the CRA repeal didn’t touch even indirectly — it’s a separate statute the CFPB administers, not a rule the agency wrote and could un-write. It requires financial institutions, including many payment app providers, to investigate and generally restore funds for genuinely unauthorized electronic transfers, subject to reporting-time rules. Its protections are considerably narrower for transfers you were personally tricked into authorizing, which is a distinct and more contested problem — our companion piece on the durable protections that apply to payment apps covers that distinction in more depth, and our look at the authorized-transfer reimbursement gap walks through why banks so often decline to refund those cases specifically.

What Actually Changed for an Everyday User

For a consumer with a specific, individual problem — a wrongly denied dispute, an unauthorized transfer, a frozen account — the practical path forward barely changed. You can still file a complaint with the CFPB, still invoke Regulation E for an unauthorized transfer, still contact your state’s money-transmitter regulator, and still report fraud to the FTC. None of those channels required the voided rule to function.

What changed is upstream of any individual complaint: the CFPB lost the ability to look inside a large payment app’s compliance program before a documented pattern of harm exists. Proactive examination is a preventive tool — it can catch a systemic problem (a broken dispute process, a discriminatory account-closure pattern) before thousands of individual complaints pile up. Enforcement-only oversight, by contrast, generally needs the harm to already be visible somewhere first. That’s the real, structural difference between “before” and “after” — not whether any protection exists, but whether a regulator can act before or only after the damage is already done.

How to Protect Yourself in the Current Landscape

Given that the strongest layer of proactive oversight is currently off the table, a few habits matter more than they otherwise would:

  • Treat P2P transfers like handing someone cash. Once you authorize a transfer, EFTA’s strongest protections generally don’t apply, and no regulator can undo an authorized transfer after the fact.
  • Use a credit card, not a linked bank transfer, for purchases where you want dispute leverage. Credit card chargeback rights are a separate, well-established protection that doesn’t depend on any of the regulators discussed above.
  • Know which entity actually holds your balance. If you’re unsure whether your app’s stored balance sits at a partner bank, check the app’s own terms of service or deposit agreement — it usually names the bank.
  • Report fraud immediately and to more than one place — the app itself, your bank if one is involved, the CFPB, and the FTC. Multiple channels create a paper trail even when no single one can guarantee recovery.
  • Check primary sources before trusting a secondhand summary of “the current rule.” This exact topic has moved twice in under two years; the CFPB’s own site and Congress.gov reflect the current state more reliably than a news article from even a few months ago.

Frequently Asked Questions

Did Congress repeal all federal oversight of payment apps? No. Congress repealed one specific rule — proactive CFPB examination authority over the largest nonbank apps. The FTC’s enforcement authority, Regulation E’s unauthorized-transfer protections, state money-transmitter licensing, and bank-partner oversight through the OCC or FDIC all continued operating exactly as before.

Can the CFPB just write a similar rule again? Not easily. Under the Congressional Review Act, a rule that Congress disapproves cannot be reissued “in substantially the same form” unless a later law specifically authorizes it. A meaningfully different rule, or new legislation from Congress, could still create similar oversight in the future.

Does this affect my ability to dispute an unauthorized transaction? No. Your Regulation E rights for genuinely unauthorized transfers come from a separate statute the CFPB administers, not from the repealed larger-participants rule, and were not affected by the Congressional Review Act resolution.

Is Venmo, Cash App, or PayPal now completely unregulated? No. These companies remain subject to state money-transmitter licensing, FTC enforcement, and — where they route balances through a partner bank — that bank’s federal prudential regulator. What they lost is proactive CFPB examination specifically, not all oversight.

Where should I file a complaint about a payment app right now? Start with the CFPB at consumerfinance.gov/complaint and the FTC at ReportFraud.ftc.gov. If your issue involves licensing or a specific state’s rules, your state’s financial regulator is also a relevant contact — these channels were unaffected by the 2025 repeal.

Sources

This is an editorial explainer, not legal or financial advice. Regulatory status can change quickly — this exact topic has shifted twice in under two years. For a specific account problem, contact your payment app provider directly, and check the CFPB’s current guidance at consumerfinance.gov or Congress.gov for the latest legislative status.