By Mauro M. Wolfe and Carolina Goncalves
Like banks, cryptocurrency firms are not immune from attacks designed to steal consumer assets, which attacks reportedly caused billions in crypto losses for consumers in 2024 alone. As a result, the US Consumer Financial Protection Bureau (CFPB) proposed a rule intended to protect crypto users from illicit activities by requiring cryptocurrency firms to reimburse consumers for stolen funds. The Electronic Funds Transfer Act (EFTA) and Regulation E currently limit consumer liability for unauthorized electronic fund transfers (EFTs) and impose investigation and error resolution obligations (e.g., funds in reserve) on financial institutions when notified that a consumer’s funds have been compromised. The proposed rule would provide similar consumer protections in the event of an unauthorized cryptocurrency transfer from an account established primarily for personal, family, or household purposes.
The EFTA and Regulation E apply to an EFT authorizing a financial institution to debit or credit a consumer’s account. The CFPB’s definition of “financial institution” includes nonbank entities that (a) hold a consumer account or (b) issue an access device and agree with a consumer to provide EFT services. The CFPB has also determined that “funds” include digital assets, like stablecoins, that operate as either a medium of exchange or as a means of paying for goods and services. The CFPB’s definition of “account” is also broad enough to include nonbank asset accounts (e.g., accounts on gaming platforms, virtual currency wallets) with features similar to those of more traditional deposit or savings accounts, such as paying for goods or services from multiple merchants, having the ability to withdraw funds or obtain cash, or conducting person-to-person transfers.
The proposed rule intends to establish a more consistent application of the EFTA and Regulation E to a range of “emergent payment mechanisms” by requiring “market participants offering new types of payment mechanisms to facilitate electronic fund transfers [to] understand whether their account meets the definition of ‘other consumer asset account,’ including whether it is established for ‘personal, family, or household purposes.’” The proposed rule is open to public comments until March 31.
We anticipate material changes to digital asset and blockchain policy when the next chapter begins under the Trump administration. The broader question for consideration is where consumer protection will fit within crypto regulations. We hope for the benefit of retail investors that it is of paramount importance.