This blog article was originally published on July 31, 2024. It was last updated on January 16, 2025.
The Small Dollar Lending Rule (Rule), established by the Consumer Financial Protection Bureau (CFPB), aims to protect consumers from the potentially harmful practices associated with payday loans, vehicle title loans, deposit advance products, and certain high-cost installment loans.
Originally issued in 2017 to address unfair and abusive collection practices, the regulation aimed to put mandatory underwriting requirements, including requiring lenders to conduct robust “ability to repay” analysis, and multiple payment provisions in place. The payment provisions essentially adopted a “two-strikes-and-you’re-out” rule. Under the rule, after two consecutive attempts to withdraw money from an account have failed, covered lenders would not be able to attempt another payment unless the borrower specifically authorized the third attempt. The regulation was originally set to go into effect in 2019, but litigation delayed it for years. In July 2020, the mandatory underwriting component was rescinded, and all related underwriting provisions were eliminated.
The payment provisions were not rescinded, however, but would go on to be challenged for the next few years. Fast forward to 2024, the Supreme Court issued a decision in CFPB v. CFSA and overruled the 5th Circuit Opinion on the impermissible funding structure of the CFPB, essentially putting an end to the previous rule challenges. The CFBP states the Rule will now be effective on March 30, 2025, for all covered loans, but there is ongoing litigation that may result in delays.
Which Loans are Covered Under the Rule?
It’s important not to focus on the amount of the loan or type of loan (payday, title, etc.), as those definitions and guidelines can quickly blur. Instead, one should pay attention to the term and APR of the loan, along with the payment structure. There are currently three main categories of covered loans under the Rule (see §1041.3 for full scope):
- Short-term consumer loans with a term of 45 days or less
- Longer-term balloon-payment loans with a term of greater than 45 days and where one or more payments is twice as large as another payment
- Longer-term loans with an APR of greater than 36% and where the lender can initiate transfers from the consumer’s account without further action by the consumer
What are the Payment Provisions of the Rule?
The payment provisions aim to protect consumers from repeated, unsuccessful payment attempts and prevent excessive fees and bank account closures. To summarize, the rule restricts lenders from attempting to withdraw payment from a borrower’s account after two consecutive failed payment transfers unless the borrower provides new authorization for the third attempt.
This means any two consecutive declines on a borrower’s bank account regardless of the payment method used (i.e., ACH and corresponding debit card on the same bank account) should result in discontinuing any future attempts to debit that borrower’s account. This includes a one-time payment attempt or a recurring schedule attempt on any of the borrower’s loans with the lender.
In order to begin re-attempting payments on any one of the borrower’s loans, the lender must follow the guidelines laid out in the notifications portion of this provision (see Consumer Rights Notice below) and obtain brand new authorizations where applicable.
Notifications Portion of the Payment Provisions:
As part of this rule, lenders are required to notify consumers in the following ways:
- First Payment Withdrawal Notice: Inform consumers at least three business days before the first attempt to withdraw funds from their account.
- Unusual Withdrawal Notice: Inform consumers of unusual payment withdrawals such that the amount, date or channel is different than what is expected or regularly scheduled.
- Consumer Rights Notice: Inform consumers after two consecutive failed payment transfers from a consumer’s account and explain that further attempts require new authorization. This notification must be delivered no later than three business days after the lender is notified of the second consecutive failed payment transfer. This notice is required even if the lender does not intend to attempt a third withdrawal.
All communications must be retainable and outline date, amount, and payment channel for a given payment method. Long form notifications must be provided in-person or sent via mail or email for all notification types. Notifications via SMS or push notifications may be used in conjunction with long form but cannot replace long form.
REPAY Product Offerings
Our priority is to support our clients with solutions that can help you maintain compliance while successfully collecting on your loans. In addition to numerous capabilities already in place within REPAY’s payment technology solutions, we are introducing a number of enhancements in four key areas to help clients comply with the Rule. These enhancements will be made to REPAY’s Channels and Payrazr product suites and will also work for clients who process payments directly through REPAY’s payment gateway:
1. Identify Eligible Loans in REPAY's Systems
REPAY will support a label that can be used to flag loans that are subject to the Rule. For example, clients who upload loan data to REPAY in a daily file will see a new field. When REPAY processes a payment that has been labeled, our systems will apply Rule logic to enforce payment limits, track failed payment transfers, and trigger notifications back to the client as appropriate.
2. Associate Payment Methods and Track Declines
REPAY’s new Declined Payment Tracker is built specifically to address the needs of the Rule. ACH and debit payments which decline for insufficient funds will be tracked in this central cache. All payments subject to the Rule will be checked against this cache. The Declined Payment Tracker is also available as an API to clients who process payments outside of REPAY, allowing businesses to centrally manage customers who may be impacted by the Rule.
3. Notify Clients of Events Related to the Rule
The Declined Payment Tracker uses webhooks to notify subscribers (clients, other REPAY products) when a payment method subject to the Rule has a change in the number of failed payment transfers for insufficient funds. For clients who cannot consume webhooks directly, REPAY can configure an email to be triggered automatically and sent to clients for handling. However, REPAY will not share information from the Declined Payment Tracker directly with customers. It is each client's responsibility to send required notices (e.g., Consumer Rights Notice) to customers as may be appropriate for their business.
In addition to notifications for failed payment transfers, REPAY’s products will provide email notifications to clients for payment plans and future-dated payments on loans subject to the Rule. Clients can then send the required notices (e.g., First Payment Withdrawal) as appropriate. Future enhancements may include reports which summarize this activity for clients with higher volume.
4. Support Resetting the Failed Payment Transfer Count
When a payment method subject to the Rule reaches a count of 2 failed payment transfers for insufficient funds, REPAY will not allow further payments to be processed. However, the Rule provides for a client to request a new authorization from a customer to resume payment attempts. When that happens, the client can “reset the count” in the Declined Payment Tracker. This can be accomplished through the Channels and Payrazr user interfaces as well as directly via API. It’s important to note that REPAY will never reset a payment method count independently – the client must initiate the change.
Strategies to Consider
As a lender, it's crucial to understand and adhere to this new Rule to safeguard both your business and your borrowers. Here are a few things to consider to help you maintain compliance and strengthen borrower relationships:
- Monitor Payment Attempts Across All Payment Modalities: Implement robust systems to track payment transfers, ensuring no more than two consecutive failed payment transfers are made to a borrower's bank account without obtaining new authorization from the borrower.
- Provide Advance Notices: Develop clear procedures to provide the required advance notice before attempting a withdrawal, detailing the payment amount, date, and other relevant information.
- Execute Clear Communication: Transparency is key to building trust and ensuring compliance. Clearly disclose all loan terms, costs, and fees to borrowers in a way that is easily understandable and use prescribed formats for disclosures and notices to ensure clarity and completeness.
- Perform Rigorous Reporting and Recordkeeping: Keep detailed records of all loan transactions, borrower communications, and compliance efforts.
- Conduct Comprehensive Training: Regularly train your staff on the Rule’s requirements, emphasizing the importance of compliance in all aspects of loan origination and servicing. Provide ongoing education and updates about any changes to the Rule or its interpretation.
- Establish Strong Compliance Programs: Conduct regular internal audits and reviews to identify and address any compliance gaps. Consider engaging external auditors to provide an unbiased evaluation of your compliance efforts.
- Handle Consumer Complaints and Feedback: Establish a system for tracking and responding to consumer complaints and feedback and promptly address any issues raised by borrowers to mitigate potential compliance risks.
- Leverage Technology and Systems: Implement automated systems to manage loan underwriting, payment tracking, and reporting, reducing the risk of human error.
- Stay Updated on Legal and Regulatory Changes: Keep abreast of any changes to the Rule and other relevant regulations. Consult with your legal counsel to evaluate your loan portfolio and interpret regulatory changes and their impact on your business practices.
By implementing these strategies, you can navigate the complexities of the Rule and build a sustainable, compliant lending practice. REPAY is here to serve as your partner and provide you with the tools and information to help you stay compliant with these new regulations.
Legal Disclaimer: Information provided in this blog post is not intended to be used by REPAY’s clients as legal advice, and it may not be used as legal advice. It is the responsibility of REPAY’s clients to comply with all applicable laws, regulations and payment brand rules when accepting a payment for goods or services. As such, each REPAY client shall seek independent legal counsel to verify the accuracy and completeness of information in this blog post and to ensure compliance with all applicable laws, regulations and payment brand rules.