This blog article was originally published on July 31, 2024. It was last updated on January 16, 2025.
The Small Dollar Lending Rule (the Rule), established by the Consumer Financial Protection Bureau (CFPB), aims to protect consumers from the potentially harmful practices associated with payday loans, vehicle title loans, deposit advance products, and certain high-cost installment loans.
Originally issued in 2017 to address unfair and abusive collection practices, the regulation aimed to put mandatory underwriting requirements, including requiring lenders to conduct robust “ability to repay” analysis, and multiple payment provisions in place. The payment provisions essentially adopted a “two-strikes-and-you’re-out” rule. Under the rule, after two consecutive attempts to withdraw money from an account have failed, covered lenders would not be able to attempt another payment unless the borrower specifically authorized the third attempt. The regulation was originally set to go into effect in 2019, but litigation delayed it for years. In July 2020, the mandatory underwriting component was rescinded, and all related underwriting provisions were eliminated.
The payment provisions were not rescinded, however, but would go on to be challenged for the next few years. Fast forward to 2024, the Supreme Court issued a decision in CFPB v. CFSA and overruled the 5th Circuit Opinion on the impermissible funding structure of the CFPB, essentially putting an end to the previous rule challenges. The CFBP states the Rule will now be effective on March 30, 2025, for all covered loans, but there is ongoing litigation that may result in delays.
It’s important not to focus on the amount of the loan or type of loan (payday, title, etc.), as those definitions and guidelines can quickly blur. Instead, one should pay attention to the term and APR of the loan, along with the payment structure. There are currently three main categories of covered loans under the Rule (see §1041.3 for full scope):
The payment provisions aim to protect consumers from repeated, unsuccessful payment attempts and prevent excessive fees and bank account closures. To summarize, the rule restricts lenders from attempting to withdraw payment from a borrower’s account after two consecutive failed payment transfers unless the borrower provides new authorization for the third attempt.
This means any two consecutive declines on a borrower’s bank account regardless of the payment method used (i.e., ACH and corresponding debit card on the same bank account) should result in discontinuing any future attempts to debit that borrower’s account. This includes a one-time future-dated payment attempt or a recurring schedule attempt on any of the borrower’s loans with the lender.
In order to begin re-attempting payments on any one of the borrower’s loans, the lender must follow the guidelines laid out in the notifications portion of this provision (see Consumer Rights Notice below) and obtain brand new authorizations where applicable.
As part of this rule, lenders are required to notify consumers in the following ways:
All communications must be retainable and outline date, amount, and payment channel for a given payment method. Long form notifications must be provided in-person or sent via mail or email for all notification types. Notifications via SMS or push notifications may be used in conjunction with long form but cannot replace long form.
Our priority is to support our clients with solutions that can help you maintain compliance while successfully collecting on your loans. In addition to numerous capabilities already in place within REPAY’s payment technology solutions, we are introducing a number of enhancements in four key areas to help clients comply with the Rule. These enhancements will be made to REPAY’s Channels and Payrazr product suites and will also work for clients who process payments directly through REPAY’s payment gateway:
REPAY will support a label that can be used to flag loans that are subject to the Rule. For example, clients who upload loan data to REPAY in a daily file will see a new field. When REPAY processes a payment that has been labeled, our systems will apply Rule logic to enforce payment limits, track failed payment transfers, and trigger notifications back to the client as appropriate.
REPAY’s new Declined Payment Tracker is built specifically to address the needs of the Rule. ACH and debit payments which decline for insufficient funds will be tracked in this central cache. All payments subject to the Rule will be checked against this cache. The Declined Payment Tracker is also available as an API to clients who process payments outside of REPAY, allowing businesses to centrally manage customers who may be impacted by the Rule.
The Declined Payment Tracker uses webhooks to notify subscribers (clients, other REPAY products) when a payment method subject to the Rule has a change in the number of failed payment transfers for insufficient funds. For clients who cannot consume webhooks directly, REPAY can configure an email to be triggered automatically and sent to clients for handling. However, REPAY will not share information from the Declined Payment Tracker directly with customers. It is each client's responsibility to send required notices (e.g., Consumer Rights Notice) to customers as may be appropriate for their business.
In addition to notifications for failed payment transfers, REPAY’s products will provide email notifications to clients for payment plans and future-dated payments on loans subject to the Rule. Clients can then send the required notices (e.g., First Payment Withdrawal) as appropriate. Future enhancements may include reports which summarize this activity for clients with higher volume.
When a payment method subject to the Rule reaches a count of 2 failed payment transfers for insufficient funds, REPAY will not allow further payments to be processed. However, the Rule provides for a client to request a new authorization from a customer to resume payment attempts. When that happens, the client can “reset the count” in the Declined Payment Tracker. This can be accomplished through the Channels and Payrazr user interfaces as well as directly via API. It’s important to note that REPAY will never reset a payment method count independently – the client must initiate the change.
As a lender, it's crucial to understand and adhere to this new Rule to safeguard both your business and your borrowers. Here are a few things to consider to help you maintain compliance and strengthen borrower relationships:
By implementing these strategies, you can navigate the complexities of the Rule and build a sustainable, compliant lending practice. REPAY is here to serve as your partner and provide you with the tools and information to help you stay compliant with these new regulations.
Legal Disclaimer: Information provided in this blog post is not intended to be used by REPAY’s clients as legal advice, and it may not be used as legal advice. It is the responsibility of REPAY’s clients to comply with all applicable laws, regulations and payment brand rules when accepting a payment for goods or services. As such, each REPAY client shall seek independent legal counsel to verify the accuracy and completeness of information in this blog post and to ensure compliance with all applicable laws, regulations and payment brand rules.