CFPB and Crypto Payments: Consumer Protection Rules Taking Shape

When a consumer sends a bank transfer to the wrong account, federal law requires the bank to investigate and, in most cases, return the funds. When a consumer sends a stablecoin payment to the wrong address, there is no equivalent legal requirement: no mandated investigation, no provisional credit, no guaranteed resolution. The Consumer Financial Protection Bureau (CFPB) has spent two years trying to close this gap, with mixed results.

The scale of the problem is significant. The FBI's Internet Crime Complaint Center reported $11.4 billion in crypto-related fraud losses in 2025, a 22% increase from 2024. Unlike victims of credit card fraud or unauthorized bank transfers, most crypto fraud victims have no federal statute guaranteeing error resolution or liability limits. Understanding where consumer protection rules stand today is essential for anyone building or using crypto payment infrastructure.

How Consumer Protection Works for Traditional Payments

The U.S. consumer protection framework for payments rests on two pillars: the Electronic Fund Transfer Act (EFTA) of 1978 and chargeback rights under the Truth in Lending Act. The EFTA, implemented through the CFPB's Regulation E, governs debit cards, ACH transfers, and other electronic fund transfers. It provides a specific set of consumer guarantees.

• Liability for unauthorized transfers is capped at $50 if reported within two business days
• Financial institutions must investigate disputed transactions within 10 business days
• Provisional credit must be issued while investigations are pending
• Consumers receive periodic statements and error resolution procedures

Credit card users get even stronger protections under Regulation Z: a $50 liability cap for unauthorized charges, the right to dispute billing errors, and the ability to initiate chargebacks for goods or services not delivered. These protections exist because Congress decided decades ago that consumers using electronic payment systems deserve a safety net.

Crypto payments currently sit outside this framework. The question regulators are grappling with: should they be brought inside, and if so, how?

The CFPB's Two Attempts at Crypto Oversight

The CFPB pursued two parallel strategies to bring crypto payments under federal oversight. Both were rolled back within months.

The Larger Participant Rule

In November 2024, the CFPB finalized a larger participant rule under Dodd-Frank Act authority, targeting nonbank providers of general-use digital payment applications processing 50 million or more consumer payment transactions annually. The rule would have given the CFPB supervisory authority to examine these companies for compliance with consumer financial protection laws.

Notably, the rule was limited to U.S. dollar transactions and explicitly excluded transfers of digital assets, including Bitcoin and stablecoins. Its targets were services like Venmo, Cash App, and Apple Pay, not crypto wallets. Trade groups representing Apple, Google, and Meta sued to block the rule in January 2025.

Congress repealed the rule using the Congressional Review Act. The Senate voted 51-47 on March 5, 2025, the House followed 219-211 on April 9, and President Trump signed the disapproval resolution in May 2025. The repeal prevents the CFPB from issuing a substantially similar rule without new legislation.

The Regulation E Expansion Proposal

On January 15, 2025, the CFPB published a proposed interpretive rule in the Federal Register that would have extended EFTA and Regulation E protections to accounts holding stablecoins and other digital payment mechanisms. The proposal would have treated certain stablecoin accounts as "accounts" under the EFTA, triggering requirements for error resolution, unauthorized transfer protections, and periodic disclosures.

The proposal drew criticism from multiple directions. The American Bankers Association asked the CFPB to withdraw it. America's Credit Unions objected to the shifting of liability for unauthorized transactions. Coin Center raised a different concern: the proposal made no distinction between custodial services and self-custody wallets, potentially extending compliance obligations to software that individuals use to manage their own keys.

The CFPB withdrew the proposal on May 15, 2025, alongside two other rules introduced under the previous administration. Like the larger participant rule, its withdrawal means the door is closed for now but could reopen under a future administration.

The GENIUS Act: Stablecoin Law Without Payment Protections

While the CFPB retreated, Congress moved forward with the GENIUS Act (P.L. 119-27), signed into law on July 18, 2025. It is the first comprehensive federal framework for payment stablecoins in the United States. The law establishes licensing requirements for issuers, reserve composition rules, and a dual federal-state regulatory structure.

The GENIUS Act includes several consumer-facing provisions:

• Stablecoin holders receive first priority on reserve assets in the event of issuer insolvency
• Issuers are prohibited from marketing stablecoins as government-backed or FDIC-insured
• Fee disclosures must be public and written in plain English
• A clear redemption process must be maintained
• Issuers cannot pay interest or yield to holders simply for holding the stablecoin

The protection gap: The GENIUS Act does not include error resolution procedures, unauthorized transfer protections, liability caps, or a private right of action for consumers. As Consumer Reports noted, the law does not clearly apply the EFTA, UDAAP provisions, or other core financial safeguards that protect consumers from fraud, error, or unauthorized transactions.

The FDIC reinforced this gap in March 2026, when Chairman Travis Hill stated that payment stablecoin holders will not be eligible for federal deposit insurance, even when reserves are held at insured banks. The FDIC was drafting a proposal to explicitly bar pass-through insurance for stablecoins and to prohibit issuers from advertising such coverage.

Consumer Rights: Traditional Payments vs Crypto Payments

The following table illustrates the gap between the consumer protections available for traditional electronic payments under existing law and the protections available for crypto and stablecoin payments today.

This gap is not hypothetical. When a consumer's custodial wallet is compromised through a SIM swap attack or phishing scheme, there is no federal statute requiring the wallet provider to investigate, credit the account, or limit the consumer's losses. The absence of dispute resolution mechanisms in crypto is one of the most significant barriers to mainstream payment adoption.

The Self-Custody Question

The tension between consumer protection and self-custody is the hardest regulatory design problem in crypto payments. Traditional consumer protection laws assume an intermediary: a bank, a card network, or a payment processor that can be compelled to investigate errors, reverse transactions, and absorb fraud losses. Self-custodial wallets eliminate that intermediary by design.

The CFPB's withdrawn Regulation E proposal highlighted this problem. As Coin Center pointed out, the proposal failed to differentiate between custodial services provided by trusted intermediaries (which may rightly be subject to consumer protection requirements) and software tools used to secure one's own crypto. Extending Regulation E to self-custodial wallet software raises fundamental questions:

• Who is the "financial institution" responsible for error resolution when the user holds their own keys?
• How would provisional credit work when no intermediary controls the funds?
• Would open-source wallet developers face compliance obligations for software they distribute but do not operate?

The regulatory dilemma: Treating self-custodial wallets like banks protects consumers from their own mistakes but undermines the core value proposition of self-custody. Exempting them entirely leaves users without recourse when things go wrong. No jurisdiction has found a satisfying middle ground.

One approach that has gained traction is regulating the on-ramps and off-ramps rather than the wallets themselves. Under this model, exchanges and fiat on-ramps would bear Regulation E obligations for the custodial phase of a transaction (when the exchange holds funds), while the self-custodial phase (after withdrawal to a personal wallet) would fall outside the regulatory perimeter. The GENIUS Act partially follows this logic by regulating stablecoin issuers rather than wallet providers.

How the EU Compares: MiCA's Consumer Framework

The European Union's Markets in Crypto-Assets regulation, which has applied since December 2024, takes a more prescriptive approach to consumer protection than U.S. law currently does. MiCA establishes a unified supervisory regime for crypto asset service providers (CASPs) across all 27 member states.

MiCA's consumer protection provisions are broader than U.S. law, but they come with caveats. In October 2025, the EU's three supervisory authorities (EBA, EIOPA, ESMA) jointly warned consumers that legal protection for crypto users may still be limited depending on the specific asset and service. Neither MiCA nor any other EU regulation provides deposit insurance for crypto holdings, and the 14-day withdrawal right applies to initial token offerings, not to payment transactions.

What Remains: The Regulatory Tools Still in Play

The withdrawal of the CFPB's Regulation E proposal and the repeal of the larger participant rule do not mean crypto payments operate in a regulatory vacuum. Several federal authorities retain jurisdiction over aspects of crypto consumer protection.

CFPB UDAAP Authority

The CFPB retains authority to bring enforcement actions against unfair, deceptive, or abusive acts and practices (UDAAP) in consumer financial services, including crypto. This is an enforcement tool, not a prophylactic rule: it operates after harm occurs rather than preventing it.

FTC Section 5

The Federal Trade Commission can pursue deceptive practices in crypto marketing and sales under Section 5 of the FTC Act. The FTC has brought cases against crypto promoters for misleading claims, though it does not regulate payment mechanics.

State Money Transmitter Laws

Most states require crypto exchanges and custodial wallet providers to obtain money transmitter licenses, which include consumer protection components like bonding requirements, permissible investment restrictions for customer funds, and examination authority. New York's BitLicense imposes additional requirements including cybersecurity standards and consumer disclosure obligations.

The GENIUS Act's Issuer Framework

While the GENIUS Act lacks Regulation E-style payment protections, its issuer licensing and reserve requirements create a baseline for stablecoin safety. The OCC published implementing rules in the Federal Register in March 2026 for national bank stablecoin issuers. State-chartered issuers follow their respective state frameworks, with the GENIUS Act setting minimum federal standards.

What This Means for Crypto Payment Users

For consumers using crypto payment services today, the practical implications are straightforward:

• Custodial wallet users rely on the provider's voluntary policies for dispute resolution, not federal mandates
• Stablecoin holders have insolvency protection under the GENIUS Act but no error resolution or unauthorized transfer protections
• Self-custodial wallet users bear full responsibility for transaction accuracy and key security
• Credit card and debit card users retain their existing Regulation E and Regulation Z protections, even when purchasing crypto

The consumer protection gap creates a meaningful difference in risk profiles between payment methods. A $500 unauthorized charge on a debit card triggers a federally mandated investigation with a 10-day resolution window. A $500 unauthorized stablecoin transfer from a custodial wallet depends entirely on the wallet provider's internal policies.

Self-Custody and Responsibility

For self-custodial protocols like Spark, the consumer protection question takes a different shape. When users hold their own keys, the traditional regulatory model of compelling an intermediary to resolve disputes does not apply. The tradeoff is explicit: users gain direct control over their assets and eliminate custodial risk (the risk that a third party loses or mismanages their funds), but they also accept responsibility for transaction accuracy and key security.

This tradeoff is precisely why the regulatory design question matters. As the GENIUS Act and the CFPB's withdrawn proposals both illustrate, regulators have not yet decided where the line falls between protecting consumers and preserving the right to self-custody. For users who prefer sovereignty over their financial assets, understanding these custody tradeoffs is critical to making informed choices.

Wallets built on Spark, such as General Bread, demonstrate one approach: combining self-custodial architecture with user-friendly design, so that users benefit from direct asset control without needing to navigate the complexity of on-chain transaction management. As consumer protection frameworks evolve, self-custodial infrastructure will need to complement regulatory requirements with strong UX, clear disclosures, and recovery mechanisms that operate at the protocol level rather than through legal mandates. Developers building on Spark can explore the Spark SDK documentation to understand how self-custodial payments work at the protocol level.

What Comes Next

The current U.S. approach to crypto consumer protection is a patchwork: the GENIUS Act covers stablecoin issuers, state money transmitter laws cover custodial services, and UDAAP enforcement covers the worst abuses. But nobody covers the gap where consumers need protection most: error resolution, unauthorized transfer liability, and dispute resolution for everyday payment transactions.

The Congressional Review Act repeal of the larger participant rule and the withdrawal of the Regulation E proposal mean that filling this gap requires new legislation or new rulemaking under a future administration. The GENIUS Act's implementing regulations, still being developed by the OCC and state regulators, offer one opportunity to address some of these gaps through rulemaking. Whether regulators will seize that opportunity remains an open question.

For the crypto payment industry, the challenge is clear: mainstream adoption requires consumers to trust that they have recourse when something goes wrong. Building that trust through voluntary standards, protocol-level safeguards, and transparent practices may prove as important as any regulation.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.