FINANCIAL 

TECHNOLOGY

Information on 

Subsectors and 

Regulatory Oversight 

Report to Congressional Requesters

April 2017

GAO-17-361

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-361, a report to 

congressional requesters

April 2017

FINANCIAL TECHNOLOGY

Information on Subsectors and Regulatory Oversight 

What GAO Found

The financial technology (fintech) industry is generally described in terms of 

subsectors that have or are likely to have the greatest impact on financial 

services, such as credit and payments. Commonly referenced subsectors 

associated with fintech include marketplace lending, mobile payments, digital 

wealth management, and distributed ledger technology. 

• Marketplace lenders connect consumers and small businesses seeking 

online and timelier access to credit with individuals and institutions seeking 

profitable lending opportunities. Marketplace lenders use traditional and may 

use less traditional data and credit algorithms to underwrite consumer loans, 

small business loans, lines of credit, and other loan products.

• Mobile payments allow consumers to use their smartphones or other mobile 

devices to make purchases and transfer money instead of relying on the 

physical use of cash, checks, or credit and debit cards. There are different 

ways to make mobile payments, including the use of a mobile wallet.

• Digital wealth management platforms use algorithms based on 

consumers’ data and risk preferences to provide digital services, including 

investment and financial advice, directly to consumers. Digital wealth 

management platforms provide services including portfolio selection, asset 

allocation, account aggregation, and online risk assessments.

• Distributed ledger technology was introduced to facilitate the recording 

and transferring of virtual currencies, specifically using a type of distributed 

ledger technology, known as blockchain. Distributed ledger technology has 

the potential to be a secure way of conducting transfers of digital assets in a 

near real-time basis potentially without the need for an intermediary. 

Regulation of these subsectors depends on the extent to which the firms provide 

a regulated service and the format in which the services are provided. For 

example, a marketplace lender may be subject to:

• federal regulation and examination by the Board of Governors of the Federal 

Reserve System, the Federal Deposit Insurance Corporation, and the Office 

of the Comptroller of the Currency in connection with certain services 

provided to depository institutions by the lender;

• state licensing and regulation in the states in which the lender conducts

business;

• securities offering registration requirements administered by the Securities 

and Exchange Commission if the lender publicly offers securities; and/or

• enforcement actions by the Bureau of Consumer Financial Protection and the 

Federal Trade Commission for violations of certain consumer protection 

laws.

To learn about the fintech industry, some agencies hosted forums, formed 

working groups, and published whitepapers and regulatory guidance. View GAO-17-361. For more information, 

contact Lawrance L. Evans at (202) 512-8678 

or Evansl@gao.gov

Why GAO Did This Study

Advances in technology and the 

widespread use of the Internet and 

mobile communication devices have 

helped fuel the growth in fintech

products and services, such as small 

business financing, student loan 

refinancing, mobile wallets, virtual 

currencies, and platforms to connect 

investors and start-ups. Some fintech 

products and services offer the 

potential to expand access to financial 

services to individuals previously 

underserved by traditional financial 

institutions.

GAO was asked to review a number of 

issues related to the fintech industry,

including how fintech products and 

services are regulated. This report, the

first in a series of planned reports on 

fintech, describes four commonly 

referenced subsectors of fintech and 

their regulatory oversight. GAO 

conducted background research and a 

literature search of publications from 

agencies and other knowledgeable 

parties. GAO also reviewed guidance, 

final rulemakings, initiatives, and 

enforcement actions from agencies. 

GAO interviewed representatives of 

federal agencies, including the federal 

prudential regulators, state supervision 

agencies, trade associations, and other 

knowledgeable parties. 

GAO is making no recommendations in 

this report.
Page i GAO-17-361 Financial Technology

Letter 1

Marketplace Lending 3

Mobile Payments 18

Digital Wealth Management 30

Distributed Ledger Technology 39

Agency Comments and Our Evaluation 48

Appendix I Agencies with Oversight Responsibilities Related to 

Financial Technology Firms 50

Appendix II Comments from the National Credit Union Administration 52

Appendix III Comments from the Conference of State Bank Supervisors 53

Appendix IV GAO Contact and Staff Acknowledgments 62

Bibliography 63

Tables

Table 1: Examples of Federal Laws and Regulations Relevant to 

Marketplace Lending 15

Table 2: Examples of Federal Laws and Regulations Relevant to 

Mobile Payment Transactions 28

Table 3: Federal and State Regulators and Agencies with 

Oversight Responsibilities Related to Financial Services 

Offered by Financial Technology Firms 50

Figures

Figure 1: Example of a Direct Lender Model 5

Figure 2: Example of a Platform Lender Model 5

Figure 3: How Mobile Wallets Work in Stores 20

Contents
Page ii GAO-17-361 Financial Technology

Figure 4: Survey Responses to the Use of Mobile Payments by 

Age Group, 2011-2014 and 2015 22

Figure 5: Example of a Digital Wealth Management Platform 32

Figure 6: How Blockchain Works 41

Abbreviations

CFPB Bureau of Consumer Financial Protection known as 

the Consumer Financial Protection Bureau

CFTC Commodity Futures Trading Commission

CSBS Conference of State Bank Supervisors

DLT distributed ledger technology

FDIC Federal Deposit Insurance Corporation

Federal Reserve Board of Governors of the Federal Reserve System

FINRA Financial Industry Regulatory Authority

FTC Federal Trade Commission

NCUA National Credit Union Administration

NMLS Nationwide Multistate Licensing System

OCC Office of the Comptroller of the Currency

SBA Small Business Administration

SEC Securities and Exchange Commission

Treasury Department of the Treasury

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-361 Financial Technology

441 G St. N.W.

Washington, DC 20548

April 19, 2017

The Honorable Sherrod Brown

Ranking Member

Committee on Banking, Housing, and Urban Affairs

United States Senate

The Honorable Jeanne Shaheen

Ranking Member

Committee on Small Business and Entrepreneurship

United States Senate

The Honorable Jeffrey A. Merkley

United States Senate

Advances in technology and the widespread use of the Internet and 

mobile communication devices have helped fuel the growth in financial 

technology (fintech) products and services. Consumer access to these 

new technologies has resulted in changes in their preferences and 

expectations regarding how they conduct financial transactions, such as 

using their smartphones to make payments or purchases. Fintech 

products and services include small business financing, education 

refinancing, mobile wallets, virtual currencies, and platforms to connect 

investors and start-ups.

There is no universal definition of fintech. It is also difficult to quantify the 

size of the industry because data are not separately reported from 

existing financial services or products’ data, and because the industry is 

constantly evolving. Traditional financial service firms also provide fintech 

products or services (e.g., existing financial services firms introducing 

fintech products and services). The fintech industry is generally described 

in terms of subsectors that have or are likely to have the greatest impact 

on traditional financial services, such as credit and payments.

You asked us to provide information on the fintech industry, including the 

marketplace lending subsector, such as its structure and development 

over the last several years, as well as how federal regulators supervise 

fintech firms. This report, the first in a series of planned reports on fintech, 

describes four commonly referenced subsectors of fintech: marketplace 

lending; mobile payments; digital wealth management; and distributed 

ledger technology and their regulatory oversight. For each subsector, this 

Letter
Page 2 GAO-17-361 Financial Technology

report provides information including what it is and how it works; potential 

benefits and risks; industry trends; and regulation and oversight.

To identify and describe fintech industry subsectors, we conducted 

background research and a literature search of publications from 

agencies, including regulators (agencies), industry groups, and other 

knowledgeable parties. We also reviewed prior GAO reports on personto-person lending and virtual currencies.1 Once we identified commonly 

referenced subsectors, we conducted interviews with agencies, industry 

groups, and other knowledgeable parties to identify information for each 

subsector on what it is and how it works, including potential benefits and 

risks and industry trends for each subsector. We also attended and 

summarized fintech-related forums held by federal agencies and others.

To identify the regulation and oversight of the four commonly referenced 

subsectors, we reviewed publications from federal and state agencies 

and other knowledgeable parties. We also reviewed prior GAO work on 

financial regulation.2 We reviewed examples of federal laws and 

regulations related to fintech subsectors. We also reviewed guidance, 

final rulemakings, initiatives, and enforcement actions from agencies. We 

interviewed staff from agencies and other knowledgeable officials to 

obtain information on fintech oversight and regulation at the federal and 

state levels. To obtain a federal regulatory perspective, we interviewed 

staff from the federal prudential regulators: the Board of Governors of the 

Federal Reserve System (Federal Reserve), the Federal Deposit 

Insurance Corporation (FDIC), the National Credit Union Administration 

(NCUA), and the Office of the Comptroller of the Currency (OCC), as well 

as staff from the Commodity Futures Trading Commission (CFTC), 

Bureau of Consumer Financial Protection, known as the Consumer 

Financial Protection Bureau (CFPB), Department of the Treasury 

(Treasury), Federal Trade Commission (FTC), Financial Industry 

Regulatory Authority (FINRA), Securities and Exchange Commission 

(SEC), and Small Business Administration (SBA). To obtain a state-level 

perspective we interviewed representatives of the Conference of State 

Bank Supervisors (CSBS) and the National Association of State Credit 

 1

See GAO, Person-to-Person Lending: New Regulatory Challenges Could Emerge as the 

Industry Grows, GAO-11-613 (Washington, D.C.: July 7, 2011); and Virtual Currencies: 

Emerging Regulatory, Law Enforcement, and Consumer Protection Challenges, 

GAO-14-496 (Washington, D.C.: May 29, 2014).

2

GAO, Financial Regulation: Complex and Fragmented Structure Could be Streamlined to 

Improve Effectiveness, GAO-16-175 (Washington, D.C.: Feb. 25, 2016).
Page 3 GAO-17-361 Financial Technology

Union Supervisors. We also interviewed knowledgeable officials and 

representatives of trade associations including representatives of the 

American Bankers Association, Barefoot Innovation Group, Center for 

Financial Services Innovation, Chamber of Digital Commerce, Electronic 

Funds Transfer Association, Electronic Transactions Association, 

Financial Innovation Now, Innovative Lending Platform Association, 

Marketplace Lending Association, Milken Institute Center for Financial 

Markets, and Money Transmitter Regulators Association.

We conducted this performance audit from July 2016 to April 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Marketplace lending connects consumers and small businesses seeking 

online and timelier access to credit with individuals and institutions 

seeking investment opportunities. Marketplace lenders use traditional and 

may use less traditional types of data and credit algorithms to assess 

creditworthiness and underwrite consumer loans, small business loans,

lines of credit, and other loan products.

The marketplace lending subsector originated as person-to-person 

lending where individual investors financed loans to consumers.3 The 

investor base for online marketplace lenders has expanded to include 

institutional investors such as hedge funds and financial institutions. 

Additionally, there has been the emergence of a market for securitizations 

of marketplace lending loans—both consumer and small business loanbacked offerings.4 Marketplace lending firms have evolved to offer a wide 

variety of loan products and services to consumers and small businesses 

and have recently begun to offer mortgages, life insurance, and auto 

loans. Although a number of marketplace lending models exist, 

 3

See GAO, Person-to-Person Lending: New Regulatory Challenges Could Emerge as the 

Industry Grows, GAO-11-613 (Washington, D.C.: July 7, 2011). 

4

Broadly, securitization is a process whereby lenders and others create pools of loans and 

sell to investors securities that are backed by cash flows from these loan pools—thereby 

replenishing funds available for lending.

Marketplace Lending

What It Is and How It 

Works
Page 4 GAO-17-361 Financial Technology

publications we reviewed highlighted two common models: direct lenders 

and platform lenders.5 Direct lenders, also known as balance sheet 

lenders, use capital obtained from outside sources to fund loans and 

often hold loans on their balance sheet. Examples of direct lenders 

include CAN Capital, Kabbage, and SoFi.6 Platform lenders partner with 

depository institutions to originate loans that are then purchased by the 

lender or by an investor through the platform. Examples of platform 

lenders include LendingClub Corporation, Prosper, and Upstart. However, 

there are various permutations based on these two common models. For 

example, direct lenders like OnDeck have developed hybrid models, 

selling some whole loans to institutional investors while retaining servicing 

responsibilities.

The marketplace lending process for the two models typically begins with 

a prospective borrower filling out an online application on the marketplace 

lending platform’s website. Marketplace lenders use traditional and may 

use less traditional types of data and credit algorithms to assess 

creditworthiness and underwrite loans. Marketplace lenders use 

traditional credit data (e.g., credit scores, income, and debt repayment 

history) but, according to publications we reviewed, may also use less 

traditional data such as monthly cash flow and expenses, educational 

history, payment and sales history, and online customer reviews.

7

After assessing the creditworthiness and needs of the applicant, the 

marketplace lender will approve or deny the borrower’s loan request. 

Generally, the loan will include a principal amount, an interest amount, 

 5

Congressional Research Service, Marketplace Lending: Fintech in Consumer and SmallBusiness Lending, September 6, 2016; Department of the Treasury, Opportunities and 

Challenges in Online Marketplace Lending, May 10, 2016; Alan McQuinn, Weining Guo, 

and Daniel Castro, Policy Principles for Fintech, Information Technology & Innovation 

Foundation, October 2016; S&P Global Market Intelligence, An Introduction to Fintech: 

Key Sectors and Trends, October 2016; and S&P Global Market Intelligence, 2016 U.S. 

Digital Lending Landscape (Charlottesville, Va.: December 2016). 

6

Jackson Mueller, Milken Institute Center for Financial Markets, U.S. Online, Non-Bank 

Finance Landscape, May 2016.

7

Congressional Research Service, Marketplace Lending: Fintech in Consumer and SmallBusiness Lending, September 6, 2016; Department of the Treasury, Opportunities and 

Challenges in Online Marketplace Lending, May 10, 2016; SoFi, “SoFi is now officially a 

“FICO-Free Zone,” January 12, 2016, PRNewswire, accessed March 28, 2017, 

http://www.prnewswire.com/news-releases/sofi-is-now-officially-a-fico-free-zone300202822.html. 
Page 5 GAO-17-361 Financial Technology

and the marketplace lender may charge a servicing fee for collecting and 

transmitting payments and handling collections in case of a default.

Funding a borrower’s request depends on the business model of the 

marketplace lender. Direct lenders typically originate the loan, hold most 

or all of the loans on their own balance sheets, earn interest on the loans, 

and carry credit risk for the entire loan (the risk is that the borrower does 

not repay), see figure 1. These lenders can raise funds to make loans by 

issuing equity to institutional investors (in addition to other means). 

Platform lenders match investors (institutional or individual) to loans that a 

depository institution, such as a bank, originates (see fig. 2). If the loan is 

made and transferred to investors, the platform lender services the 

account. Investors have the option of either partially or fully funding a 

loan.

Figure 1: Example of a Direct Lender Model

Figure 2: Example of a Platform Lender Model

Consumers: can use term loans from marketplace lenders to cover 

personal expenses (such as home or medical expenses); consolidate 

debt; or refinance student loans, among other reasons. According to

Treasury, three marketplace lenders offer consumer loans ranging from 

Who Uses It
Page 6 GAO-17-361 Financial Technology

$1,000 to $40,000.8 Treasury also indicated that marketplace lending 

firms generally provide consumer loans to prime and near-prime 

borrowers although some marketplace lending firms target subprime 

borrowers or applicants without credit scores or with a limited credit 

history.9

Small Businesses: can use short and fixed-term loans, lines of credit, and 

merchant cash advances from marketplace lenders, among other 

products and services, to finance business expenses and expansions, 

among other reasons. According to a Federal Reserve Bank of Cleveland 

publication, limited data are available about the types of small businesses 

that use online lenders, why they have chosen to apply, how successful 

they are in obtaining funds, and how satisfied they are with their 

experiences as borrowers.10

Lower costs: Marketplace lenders’ online structure may reduce overhead 

costs because not all firms have brick-and-mortar locations. In addition, 

the algorithms used by marketplace lenders to underwrite credit decisions 

may result in lower underwriting costs when compared to banks’

underwriting costs.

Expanded access to credit: Marketplace lending may expand credit 

access to underserved populations that may not meet traditional lending 

requirements or that seek smaller loans than those that banks traditionally 

offer.11

 8

Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016. 

9

A credit score is a numeric value ranging from 300 to 850 (calculated based on credit 

reports from the national credit bureaus) that indicates a borrower’s ability to repay future 

obligations. Although the categories are not rigidly defined, higher credit scores are 

considered prime, whereas lower credit scores are considered “near prime” or subprime.

10Federal Reserve Bank of Cleveland, Click, Submit: New Insights on Online Lender 

Applicants from the Small Business Credit Survey (Cleveland, Ohio: Oct. 12, 2016). This 

publication serves to address knowledge gaps in small business lending and the analysis 

draws from data in the Federal Reserve’s 2015 Small Business Credit Survey.

11Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016; Department of the Treasury, Opportunities 

and Challenges in Online Marketplace Lending, May 10, 2016.

Potential Benefits
Page 7 GAO-17-361 Financial Technology

Faster service: According to Treasury, marketplace lenders can provide 

funding decisions within 48 to 72 hours from when applications are 

submitted.12 According to an SBA Office of Advocacy publication, 

LendingClub Corporation advertises that potential applicants can receive 

a quote within minutes and that its approval and funding process typically 

takes 7 days, Kabbage Inc. can provide same-day approval for small 

business loans, and OnDeck can provide funding within 24 hours.13

According to representatives from one industry organization we spoke 

with, faster service is beneficial to small businesses that may need quick 

access to credit in an emergency, such as a restaurant that needs its 

oven or refrigerator repaired to continue operations.

 12Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016.

13Miriam Segal, Small Business Administration Office of Advocacy, Peer-to-Peer Lending: 

A Financing Alternative for Small Businesses, Issue Brief Number 10 (Washington, D.C.: 

Sept. 10, 2015). Kabbage, Inc. is an example of a current small business marketplace 

lender.
Page 8 GAO-17-361 Financial Technology

Payment term transparency: Marketplace lending firms offer various loan 

types and terms, particularly for small business loans. It can be difficult for 

small businesses to understand and compare loan terms such as the total 

cost of capital or the annual percentage rate.14 According to a Federal 

Reserve 2015 survey, one reason for small business lenders’

dissatisfaction with online lenders was a lack of transparency.15

Small business borrower protections: Current federal laws and 

regulations applicable to marketplace lending generally apply to 

consumer loans and not small business loans or other commercial 

loans.16 For example, the Truth in Lending Act, which among other things, 

requires the lender to show the cost and terms to the borrower, applies to 

consumer loans but generally not small business loans.17 According to 

Treasury, small business loans under $100,000 share common 

characteristics with consumer loans, yet do not receive the same 

protections. However, the report also notes that small business loans may 

receive protection under the enforcement of fair lending laws under the 

Equal Credit Opportunity Act.18

Use of less traditional data in credit decisions: Unlike traditional lending 

companies that look at a person’s credit reports (which include reported 

installment credit and revolving credit), publications we reviewed indicate 

that some marketplace lenders also take into account or have considered 

using less traditional data (e.g., utilities, rent, telephone bills, educational 

 14The total cost of capital generally includes all interest, loan fees, and any other fees that 

are a condition of receiving capital. The total cost of capital metric states the total dollar 

cost of the finance option. The annual percentage rate (APR) provides the cost of 

capital—including fees that are a condition of receiving capital, when applicable—

expressed as a yearly rate. While APR can be used for comparison purposes, it is not the 

interest rate applied or used to calculate the total dollar cost of a finance option. For more 

information, see http://innovativelending.org/smart-box-model-disclosure-depth/. 

15Federal Reserve Bank of Cleveland, Click, Submit: New Insights on Online Lender 

Applications from the Small Business Credit Survey (Cleveland, Ohio: Oct. 12, 2016). 

Other reasons for dissatisfaction included high interest rates and unfavorable repayment 

terms. 

16Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016; and Karen Gordon Mills and Brayden McCarthy, The State of 

Small Business Lending: Innovation and Technology and the Implications for Regulation, 

working paper 17-042 (Cambridge, Mass.: Harvard Business School, 2016).

1712 C.F.R. § 226.1;12 C.F.R. § 1026.1.

18Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016.

Potential Risks
Page 9 GAO-17-361 Financial Technology

history) during the underwriting process.19 However, according to 

Treasury, data-driven algorithms used by marketplace lenders carry the 

risk for potential fair lending violations.20 According to staff from FTC, 

marketplace lenders must ensure that their practices meet fair lending 

and credit reporting laws.21 The use of less traditional data also 

introduces the risk that the data used are inaccurate and concerns that 

consumers may not have sufficient recourse if the information being used 

is incorrect.

Uncertainty about performance in full credit cycle: According to 

publications we reviewed, the marketplace lending subsector experienced 

considerable growth following the 2007-2009 economic downturn in an 

environment with tightened lending standards and low interest rates.22 In 

addition, little is known about how the industry will perform in other 

economic conditions such as a recession, which could lead to 

delinquency and defaults of marketplace loans.23 According to the 

Congressional Research Service (CRS), it is also possible that loan 

servicing could be disrupted in the event the marketplace lender goes out 

of business.24

Partnerships: According to Treasury, some marketplace lenders have 

sought partnerships with traditional banks and community development 

 19Consumer Financial Protection Bureau, Request for Information Regarding Use of 

Alternative Data and Modeling Techniques in the Credit Process, 

http://files.consumerfinance.gov/f/documents/20170214_cfpb_Alt-Data-RFI.pdf.

20Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016.

21Federal Trade Commission, Fintech Forum: A closer look at marketplace lending, 

https://www.ftc.govnews-events/blogs/business-blog/2016/08/fintech-forum-closer-lookmarketplace-lending.

22Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016; Department of the Treasury, Opportunities 

and Challenges in Online Marketplace Lending, May 10, 2016.

23Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016.

24Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016. 

Industry Trends
Page 10 GAO-17-361 Financial Technology

financial institutions (CDFI) in various models.25 According to a CRS

report, in a white label partnership, a traditional bank sets underwriting 

standards, originates the loan, and holds the loan once issued.

26 The 

bank can integrate a marketplace lending firm’s technology services to 

originate the loan. For example, JPMorgan Chase & Co. partnered with

OnDeck to offer small business loans to JPMorgan Chase & Co. 

customers.

27 In referral partnerships, banks refer customers who do not 

meet a bank’s underwriting standards, or who are seeking products the 

bank does not offer, to a marketplace lender. In turn, the bank may collect

a fee from the marketplace lender. Referrals may also allow CDFIs to 

reach customers that may otherwise not be served. For example, in 2015, 

Regions Bank, Fundation Group LLC (an online small business 

marketplace lender), and TruFund (a CDFI) partnered to provide small 

loans to underserved small businesses.28

Self-regulatory efforts: A number of self-regulatory marketplace lending 

efforts were established with the intent of developing responsible 

innovation and mitigating and reporting risks to potential borrowers 

seeking marketplace lending products. However, limited information is 

available on the impact of these efforts. Four examples are discussed 

below.

• The Marketplace Lending Association (MLA) was established in April 

2016 to represent the marketplace lending industry. MLA states that one 

of its goals is to support responsible growth in the marketplace lending 

sector.29

 25CDFI certifications are issued by Treasury to financial institutions serving economically 

distressed communities and low-income people across the country. CDFI certification 

allows financial institutions to apply for technical assistance and financial assistance 

awards, as well as training provided by the CDFI Fund.

26Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016.

27Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016.

28See http://ir.regions.com/releasedetail.cfm?ReleaseID=989068. 

29See http://www.marketplacelendingassociation.org.
Page 11 GAO-17-361 Financial Technology

• The Online Lenders Alliance represents firms offering loans online. The 

Alliance provides resources including a consumer hotline, a portal to 

report fraud, and consumer tips.30

• In 2016, three small business lending platforms formed the Innovative 

Lending Platform Association. The Association developed the 

Straightforward Metrics Around Rate and Total cost (SMART) Box tool to 

help small businesses understand and assess the cost of their small 

business finance options. For example, some metrics described in the 

SMART Box tool include total cost of capital, annual percentage rate 

calculations, and average monthly payment amounts. Its goal is to 

include clear and consistent pricing metrics, metric calculations, and 

metric explanations to help small businesses understand and assess the 

costs of their small business finance options.31

• In 2015, the Responsible Business Lending Coalition launched the Small 

Business Borrowers Bill of Rights to foster greater transparency and 

accountability across the small business lending sector.

32

The regulation of marketplace lenders is largely determined by the 

lenders’ business model and the borrower or loan type. For example, 

marketplace lenders that provide services through an arrangement with a 

federally regulated depository institution may be subject to examination 

 30See http://onlinelendersalliance.org. 

31See http://innovativelending.org/smart-box/. 

32See http://www.responsiblebusinesslending.org. 

Regulation and Oversight
Page 12 GAO-17-361 Financial Technology

as a third-party service provider by the federal prudential regulator.33 The 

federal prudential regulators have provided third-party guidance or vendor 

risk management guidance to depository institutions that describes the 

risk assessment, due diligence and risk monitoring, and oversight that 

depository institutions should engage in when they deal with third parties, 

including marketplace lenders.34

Depending on the facts and circumstances, including the type of activities 

being performed, marketplace lenders may be subject to federal 

consumer protection laws enforced by CFPB and FTC. Also, CFPB and 

FTC maintain databases of consumer complaints. In March 2016, CFPB 

 33The four federal prudential regulators are the Federal Deposit Insurance Corporation 

(FDIC), the Board of Governors of the Federal Reserve System (Federal Reserve), the 

National Credit Union Administration (NCUA), and the Office of the Comptroller of the 

Currency (OCC). The Bank Service Company Act authorizes FDIC, Federal Reserve, and 

OCC to examine and regulate certain services provided by third parties to insured 

depository institutions to the same extent as if the activities were performed by the 

financial institution itself. That act does not however reach NCUA, nor does the Federal 

Credit Union Act provide comparable authority. Previously, we have asked Congress to 

consider granting NCUA with this authority, but no actions have been taken to date. See 

GAO, Cybersecurity: Bank and Other Depository Regulators Need Better Data Analytics 

and Depository Institutions Want More Usable Threat Information, GAO-15-509 

(Washington, D.C.: July 2, 2015). According to representatives from NCUA, NCUA’s 

ability to influence compliance is limited to working with credit unions engaging with fintech

payment providers to ensure that the institutions monitor the risks of these relationships. 

According to representatives of the National Association of State Credit Union 

Supervisors, state regulators have varying authority over third-party service providers that 

provide services to state-licensed credit unions. In such capacity however, state credit 

union regulators will generally only be reviewing the third party in the context of safety and 

soundness and the compliance of the credit union clients.

34For example, OCC’s Third-Party Relationships Risk Management Guidance says that a 

bank should adopt risk management processes commensurate with the level of risk and 

complexity of its third-party relations and ensure comprehensive risk management and 

oversight of third-party relationships involving critical activities, through the life-cycle of the 

relationship. Office of the Comptroller of the Currency, Third-Party Relationships, OCC

Bulletin 2013-29 (Washington, D.C.: Oct. 30, 2013). FDIC’s Guidance for Managing ThirdParty Risk provides four main elements of an effective third-party risk management 

process: (1) risk assessment, (2) due diligence in selecting a third party, (3) contract 

structuring and review, and (4) oversight. Federal Deposit Insurance Corporation Financial 

Institution Letters 44-2008, Guidance For Managing Third-Party Risk (Washington, D.C.: 

June 6, 2008). In July 2016, FDIC proposed third-party lending guidance that outlines the 

risks that may be associated with third-party lending as well as the expectations for a riskmanagement program, supervisory considerations, and examination procedures related to 

third-party lending. The draft guidance supplements and expands on previously issued 

guidance and would apply to all FDIC-supervised institutions that engage in third-party 

lending programs. NCUA issued guidance to the credit union industry related to indirect 

and third-party partnerships or relationships, for example, see 10-CU-15 Indirect Lending 

and Appropriate Due Diligence. 
Page 13 GAO-17-361 Financial Technology

announced it would begin accepting consumer complaints about 

marketplace lenders.35 However, according to CFPB staff, CFPB’s 

complaint system does not specifically categorize complaints for 

marketplace lending because consumers may not know whether to 

categorize those services as such. FTC encourages consumers to file a 

complaint if they believe they have been the victim of fraud, identity theft, 

or other unfair or deceptive business practices. According to FTC staff, 

fintech is not a category within FTC’s consumer complaint database and 

marketplace lending complaints are generally categorized as consumer 

loan complaints.

As previously discussed, certain regulations generally apply to consumer 

loans but may not apply to small business loans or other commercial 

loans. However, FTC has authority under Section 5 of the Federal Trade 

Commission Act to protect, among others, small businesses that are 

consumers of marketplace lending products or services from unfair or 

deceptive business acts or practices.36

At the federal level, we previously noted that SEC regulates the offer and 

sale of securities to investors through disclosure requirements and 

antifraud provisions that can be used to hold companies liable for 

providing false or misleading information to investors.

37 The Securities Act 

of 1933 generally requires issuers that make a public offering of securities 

to register the offer and sale of their securities with SEC and provide 

investors with disclosures that include information about the company

issuing securities such as risk factors and financial

information.38According to staff from SEC, certain transactions by 

marketplace lenders may be exempt from the registration requirements of 

the Securities Act of 1933 depending on the particular facts of their 

securities offerings.39 At the state level, state securities regulators are 

generally responsible for registering certain securities products and, along 

 35Consumer Financial Protection Bureau, Press Release, “CFPB Now Accepting 

Complaints on Consumer Loans from Online Marketplace Lender,”

https://www.consumerfinance.gov/about-us/newsroom/cfpb-now-accepting-complaints-onconsumer-loans-from-online-marketplace-lender/.

3615 U.S.C. § 45.

37GAO-11-613.

3815 U.S.C. §§ 77e, 77f, 77g.

3915 U.S.C. § 77d.
Page 14 GAO-17-361 Financial Technology

with SEC, investigating securities fraud.40 Table 1 provides examples of 

federal laws and regulations relevant to marketplace lending.

 40GAO-11-613. 
Page 15 GAO-17-361 Financial Technology

Table 1: Examples of Federal Laws and Regulations Relevant to Marketplace Lending

Law or regulation Example of relevant requirements or provisions

Federal agencies with regulatory or 

enforcement authority

Bank Service 

Company Act

Provides the federal banking agencies with the authority to 

regulate and examine the performance of certain services by a 

third-party service provider for a depository institution (or for any 

subsidiary or affiliate of a depository institution that is subject to 

examination by that agency) “to the same extent as if such 

services were being performed by the depository institution itself 

on its own premises.”

FRS, OCC, FDIC

Electronic Fund 

Transfer Act 

(Regulation E)

Provides certain consumer rights regarding the electronic transfer 

of funds to and from consumers’ bank accounts. Requires 

disclosure of terms and conditions of electronic transfers, limits 

consumer liability for unauthorized transfers, and establishes 

procedures for preauthorizing transfers and error resolution 

procedures.a

OCC, FRS, FDIC, NCUA, FTC, CFPB

Equal Credit 

Opportunity Act 

(Regulation B)

Prohibits creditors from discriminating against credit applicants

with respect to any aspect of a credit transaction on the basis of 

race, color, religion, national origin, sex or marital status, or age, 

or the fact that all or part of the applicant’s income derives from 

any public assistance program or the fact that the applicant has in 

good faith exercised any right under the federal Consumer Credit 

Protection Act or any applicable state law. Authorizes disparate 

treatment and disparate impact claims. Requires creditors to 

provide borrowers with notice of any action taken on their 

application for credit. 

OCC, FRS, FDIC, NCUA, FTC, CFPB, 

SEC

Fair Credit 

Reporting Act 

(Regulation V)

Requires a permissible purpose to obtain a consumer credit 

report, and requires persons to report information to credit bureaus 

accurately; imposes disclosure requirements on creditors who take 

adverse action on credit applications based on information 

contained in a credit report; requires creditors to develop and 

implement an identity theft prevention program.

OCC, FRS, FDIC, NCUA, SEC, FTC, 

CFPB

Truth in Lending Act 

(Regulation Z)

Requires creditors to provide meaningful disclosures concerning 

certain terms and conditions of certain loan and credit transactions 

with consumers; intended to help consumers understand the cost 

of credit and compare credit options.a

CFPB, FRS, OCC, NCUA, FDIC, FTC

Investment Advisers 

Act of 1940

Persons that engage, for compensation, in the business of 

advising others as to matters involving securities meet the 

definition of investment adviser under the Investment Advisers Act. 

The Investment Advisers Act of 1940 and rules thereunder require 

investment advisers to meet recordkeeping, custodial, reporting 

and other regulatory responsibilities. 

SEC 

Securities Act of 

1933 (Public 

Offerings and 

Private Offerings)

Public Offerings: Online marketplace lenders engaged in the 

public offering of securities are required to register the securities 

offerings with SEC, unless the securities or offerings are exempt 

from the registration requirements of the Securities Act of 1933.

Private Offerings: Online marketplace lenders may engage in 

private offerings of their securities, including offerings made in 

reliance on the safe harbors in Regulation D. 

SEC
Page 16 GAO-17-361 Financial Technology

Law or regulation Example of relevant requirements or provisions

Federal agencies with regulatory or 

enforcement authority

UDAAP Prohibits unfair, deceptive, or abusive acts or practices (UDAAP). CFPB, FRS, FDIC, OCC, NCUA

Section 5 of the 

Federal Trade 

Commission Act 

Prohibits unfair or deceptive acts or practices (UDAP). FTC, FRS, FDIC, OCC, NCUA

Title V of the 

Gramm- LeachBliley Financial 

Modernization Act 

(Regulation P) 

Limits when a financial institution may disclose a consumer’s 

“nonpublic personal information” to nonaffiliated third parties; 

requires financial institutions to notify their customers about their 

information-sharing practices and to tell consumers of their right to 

“opt out” if they do not want their information shared with certain 

nonaffiliated third parties. 

FTC, CFPB, FRS, FDIC, OCC, NCUA

Legend

CFPB – Bureau of Consumer Financial Protection, known as the Consumer Financial Protection Bureau

FDIC – Federal Deposit Insurance Corporation

FRS – Board of Governors of the Federal Reserve System

FTC – Federal Trade Commission

NCUA – National Credit Union Administration

OCC – Office of the Comptroller of the Currency

Source: GAO and Department of the Treasury information. | GAO-17-361

Note: This table is not exhaustive, and other federal laws and regulations may apply.

a

Additional requirements will become effective at a later date, including comprehensive consumer 

protection for prepaid accounts under Regulation E, implementing the Electronic Fund Transfer Act,

and Regulation Z, implementing the Truth in Lending Act. Prepaid Accounts Under the Electronic 

Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z), 81 Fed. Reg. 83934 

(Nov. 22, 2016). CFPB issued a proposed rule in March 2017 to delay the effective date of these 

provisions an additional six months until April 2018. 82 Fed. Reg. 13782 (March 15, 2017).

Marketplace lenders are subject to state-level laws in each state in which 

they are licensed to conduct business.41 Specifically, some marketplace 

lenders that originate loans directly to consumers or businesses (e.g., a 

direct marketplace lender) are generally required to obtain licenses and 

register in each state in which they provide lending services.42 According 

to officials from CSBS, state regulators then have the ability to 

supervise these lenders, ensuring that the lender is complying with 

state and federal lending laws. CSBS officials noted that the states

leverage the Nationwide Multistate Licensing System (NMLS) to facilitate 

compliance with state-by-state licensing mechanisms.43 NMLS is intended 

 41Congressional Research Service, Marketplace Lending: Fintech in Consumer and 

Small-Business Lending, September 6, 2016.

42Department of the Treasury, Opportunities and Challenges in Online Marketplace 

Lending, May 10, 2016.

43NMLS was originally developed as a voluntary system for state licensing and then 

became mandatory for mortgage licensing in the Secure and Fair Enforcement for 

Mortgage Licensing Act of 2008, which was part of the Housing and Economic Recovery 

Act of 2008. Pub. L. No. 110-289, Title V, 122 Stat. 2654, 2810 (2008).
Page 17 GAO-17-361 Financial Technology

to enable firms to complete one record to apply for state licensing that 

fulfills the requirements of each state, for states that participate in the 

system.

Some agencies have taken a number of steps to understand and monitor 

the fintech industry, including the marketplace lending subsector. For 

example, in May 2016, Treasury issued a whitepaper on marketplace 

lending.

44 In November 2016, SEC hosted a fintech forum where industry 

representatives and regulators discussed capital formation (including 

marketplace lending and crowdfunding) and related investor protections.45

On December 2, 2016, the Comptroller of the Currency announced intent 

to make special-purpose national bank charters available to fintech 

companies, such as marketplace lenders. OCC published a paper 

discussing issues related to chartering special-purpose national banks 

and solicited public comment to help inform its path moving forward.46

OCC plans to evaluate prospective applicants’ reasonable chance of 

success, appropriate risk management, effective consumer protection, 

fair treatment and access, and capital and liquidity position.

 44Department of the Treasury, Opportunities and Challenges in Online Marketplace

Lending, May 10, 2016.

45Crowdfunding generally refers to a financing method in which money is raised through 

soliciting relatively small contributions from a large number of individuals. According to 

SEC staff, SEC has promulgated Regulation Crowdfunding, which provides an exemption 

from registration for certain crowdfunding transactions involving securities.

46Office of the Comptroller of the Currency, Exploring Special Purpose National Bank 

Charters for Fintech Companies (Washington, D.C.: December 2016). In March 2017, 

OCC published a draft supplement to its existing licensing manual which outlines the way 

it will apply existing licensing standards and requirements in its policies to fintech 

companies that apply for charters. OCC said it will accept comments on the draft through 

April 14, 2017. For more information, see Office of the Comptroller of the Currency, OCC 

Summary of Comments and Explanatory Statement: Special Purpose National Bank 

Charters for Financial Technology Companies (Washington, D.C.: March 2017); and 

Office of the Comptroller of the Currency, Comptroller’s Licensing Manual Draft 

Supplement, Evaluating Charter Applications from Financial Technology Companies

(Washington, D.C.: March 2017). 
Page 18 GAO-17-361 Financial Technology

Mobile payments allow consumers to use their smartphones or other 

mobile devices to make purchases and transfer money.47 Consumers and 

businesses use these devices to make and receive payments instead of 

relying on the physical use of cash, checks, or credit and debit cards.

According to publications we reviewed, there are different ways to make 

mobile payments, including the use of a mobile wallet. Mobile wallets are 

electronic versions of consumers’ wallets that offer consumers the 

convenience of faster transactions without having to enter credit or debit 

card information for each transaction.48 Using a mobile wallet, consumers 

can store payment card information and other information on their mobile 

devices that is often needed to complete a payment for later use.49

Generally, mobile wallets replace sensitive information with randomlygenerated numbers—a process called tokenization—that provides greater 

security when making a payment, and then transmit this information using 

existing credit and debit card networks.50 A variety of companies provide 

mobile wallets, including Apple, Google, and Samsung; merchants such 

as Starbucks, Walmart, and CVS; and financial institutions such as 

JPMorgan Chase & Co. and Citibank. Consumers may use mobile wallets 

to make payments to other consumers, referred to as person-to-person

(P2P) payments, or to businesses, referred to as person-to-business

(P2B) payments, either in mobile applications, through mobile browsers, 

or in person at a store’s point-of-sale terminal. In addition, other 

 47This report focuses on macro trends in the mobile payments industry and does not 

describe all areas of activity in the payments subsector. For example, it does not include 

mobile payments such as electronic invoicing, remittances, and cross-border payments. 

This report describes some retail payment methods that involve transactions between two 

consumers and consumers and businesses. Other retail payment methods include those 

between businesses but are not discussed in this report. These retail methods are 

common areas of payment innovations. We have forthcoming work on the payments 

industry.

48Federal Deposit Insurance Corporation Supervisory Insights, Mobile Payments, Winter 

2012; Federal Trade Commission Staff Report, Paper, Plastic...or Mobile? An FTC 

Workshop on Mobile Payments, March 2013; and Alan McQuinn, Weining Guo, and 

Daniel Castro, Policy Principles for Fintech, Information Technology & Innovation 

Foundation, October 2016.

49In a mobile wallet, consumers can enter payment information from debit and credit 

cards, gift cards, and prepaid cards. Consumers can also store other information often 

needed to complete a payment, such as shipping address, e-mail, and phone number.

50Marianne Crowe, Susan Pandy, David Lott, and Steve Mott, Is Payment Tokenization

Ready for Primetime? Perspectives from Industry Stakeholders on the Tokenization 

Landscape, Federal Reserve Bank of Atlanta and Federal Reserve Bank of Boston, June 

11, 2015. 

Mobile Payments

What It Is and How It 

Works
Page 19 GAO-17-361 Financial Technology

providers, such as Paypal or Venmo, allow individuals to create accounts 

to receive and make payments.

P2P payments: Consumers can transfer value from a bank account 

(checking or savings), stored funds in a mobile wallet, credit/debit card, or 

prepaid card to another consumer’s account. P2P methods use the 

Internet, mobile applications, or text messages and generally move funds 

through the automated clearing house (ACH) network or debit and credit 

card networks.51 A variety of fintech firms provide P2P services. For 

example, current P2P providers include PayPal, Venmo, and Google; 

social networks such as Facebook and Snapchat; and financial 

institutions such as Bank of America Corporation and JPMorgan Chase &

Co.52

P2B payments: Consumers can also use their mobile devices to make 

payments to businesses in stores or on their mobile device. In stores, 

consumers can use mobile wallets to pay a business for goods or 

services at compatible point-of-sale terminals. These transactions rely on 

various technologies to transfer payment data between the consumer’s 

mobile device and the business, including quick response (QR) codes 

and wireless communication technologies that enable the payment 

information to be transferred by allowing compatible devices to exchange 

data when placed in very close proximity to each other (see fig. 3).53

 51The ACH network is a system that processes payments on a batched basis, governed 

by a specific set of rules that provide for the interbank clearing of electronic debit and 

credit entries for participating institutions. Both the Federal Reserve System and the 

private sector provide ACH services. See GAO, Payment Services: Federal Reserve’s 

Competition with Other Providers Benefits Customers, but Additional Reviews Could 

Increase Assurance of Cost Accuracy, GAO-16-614 (Washington, D.C.: Aug. 30, 2016).

52These financial institutions, among others, are part of a network for customers to send 

and receive payments.

53QR codes are a two-dimensional form of barcode whose contents can be decoded 

electronically at high speed. Wireless communication technologies include Near Field 

Communications (NFC) technology, a standards-based wireless communication 

technology that allows data to be exchanged between devices that are a few centimeters 

apart, among others.
Page 20 GAO-17-361 Financial Technology

Figure 3: How Mobile Wallets Work in Stores

The Federal Reserve’s 2016 report on Consumers and Mobile Financial 

Services found that of those with a mobile phone in 2015, 30 percent of 

individuals ages 18 to 29 and 32 percent of individuals ages 30 to 44 

made mobile payments.54 By comparison, 13 percent of those ages 60 or 

 54Board of Governors of the Federal Reserve System, Consumers and Mobile Financial 

Services 2016, March 2016, accessed January 11, 2017, 

https://www.federalreserve.gov/econresdata/consumers-and-mobile-financial-servicesreport-201603.pdf. The survey defines mobile payments as “purchases, bill payments, 

charitable donations, payments to another person, or any other payments made using a 

mobile phone.” The 2016 report presents findings from the survey conducted in November 

2015, which focused on consumers’ use of mobile technology to access financial services 

and make financial decisions.

Who Uses It
Page 21 GAO-17-361 Financial Technology

over made a mobile payment (see fig. 4).55 From 2011 to 2014, the same 

general trend was true: younger adults were more likely to make a mobile 

payment than older age groups. However, the survey results are not 

comparable because the definition of mobile payments was revised for 

the 2015 survey.56

 55Board of Governors of the Federal Reserve System, Consumers and Mobile Financial 

Services 2016, March 2016.

56For the 2011 through 2014 surveys, the following definition of mobile payments was 

provided to respondents: “Mobile payments are purchases, bill payments, charitable 

donations, payments to another person, or any other payments made using a mobile 

phone. You can do this either by accessing a web page through the web browser on your 

mobile device, by sending a text message (SMS), or by using a downloadable application 

on your mobile device. The amount of the payment may be applied to your phone bill (for 

example, Red Cross text message donation), charged to your credit card, or withdrawn 

directly from your bank account.” For the 2015 survey, the following definition of mobile 

payments was provided to respondents: “Mobile payments are purchases, bill payments, 

charitable donations, payments to another person, or any other payments made using a 

mobile phone. This includes using your phone to pay for something in a store as well as 

payments made through an app, a mobile web browser or a text message.”
Page 22 GAO-17-361 Financial Technology

Figure 4: Survey Responses to the Use of Mobile Payments by Age Group, 2011-

2014 and 2015

Note: According to the survey, responses are among respondents who own or use a mobile phone.

a

2015 survey results are not directly comparable to prior years because the definition of mobile 

payments was revised for the 2015 survey.

According to a survey by the Pew Charitable Trusts of over 2,000 

consumers, 46 percent of the U.S. population reported having made a 

mobile payment.57 Specifically, 39 percent of mobile payments users 

 57Mobile payment users were defined as consumers who made an online or point-of-sale 

purchase, paid a bill, or sent or received money using the Internet, text message, or app 

on a smartphone. Pew Charitable Trusts, Who Uses Mobile Payments? Survey findings 

on consumer opinions, experiences, May 2016.
Page 23 GAO-17-361 Financial Technology

were millennials and 33 percent were between the ages of 35 and 50 

compared to 29 percent of users over the age of 50.

Underbanked: FDIC and the Federal Reserve have found that 

underbanked consumers use mobile financial services. According to a 

2015 survey by FDIC, 20 percent of households in the United States were 

underbanked, meaning that the household had an account at an insured 

institution but also obtained financial services and products outside of the 

banking system.58 According to qualitative research conducted by FDIC in 

2016, underbanked consumers stated that they used P2P payments and 

a variety of financial products to manage their day-to-day finances.59 The 

Federal Reserve’s 2015 survey indicated that a higher percentage of 

underbanked consumers used mobile payments than fully banked 

respondents (34 percent versus 20 percent).60

Convenience and efficiency: According to publications we reviewed, 

mobile wallets offer consumers the convenience of instant transactions 

without having to enter credit card information, PIN numbers, and 

shipping addresses each time they make a purchase.61 Mobile wallets 

 58Federal Deposit Insurance Corporation, 2015 FDIC National Survey of Unbanked and 

Underbanked Households, October 20, 2016, accessed December 29, 2016, 

https://www.fdic.gov/householdsurvey/. The survey found that between 2013 and 2015, 

smartphone access increased by 30 percent for unbanked households and by 17 percent 

for underbanked households.

59FDIC defines underbanked as those who have an account but also obtain financial 

services from nonbank alternative financial services providers such as check cashers or 

payday lenders. Federal Deposit Insurance Corporation, Opportunities for Mobile 

Financial Services to Engage Underserved Consumers Qualitative Research Findings, 

May 25, 2016, accessed January 5, 2017, 

https://www.fdic.gov/consumers/community/mobile/MFS_Qualitative_Research_Report.pdf.

60According to the Federal Reserve’s 2015 survey, underbanked is defined as having a 

bank account but also using an alternative financial service (typically from a nonbank 

provider), including a money order, check-cashing service, tax refund anticipation loan, 

pawn shop loan, payday loan, auto title loan, or a paycheck advance/deposit advance. In 

addition, according to the Federal Reserve survey, the list of alternative financial services 

included in the Federal Reserve’s survey differs from those included in FDIC’s work on

unbanked and underbanked groups, and thus comparability of underbanked figures 

across the two surveys must be approached with these differences in mind.

61Board of Governors of the Federal Reserve System, Consumers and Mobile Financial 

Services 2014, March 2014; Alan McQuinn, Weining Guo, and Daniel Castro, Policy 

Principles for Fintech, Information Technology & Innovation Foundation, October 2016;

and Krista Becker, Mobile Phone: The New Way to Pay? Federal Reserve Bank of Boston 

Emerging Payments Industry Briefing, February 2007. 

Potential Benefits
Page 24 GAO-17-361 Financial Technology

can also streamline the checkout time. For example, consumers can 

wave their smartphone in front of an in-store terminal to make a 

purchase, which can be faster than swiping a credit or debit card.

Data security: Mobile payments can be protected by various security 

mechanisms, such as codes that must be entered to access a mobile 

device.62 According to publications we reviewed, mobile wallets may also 

improve data security by replacing a consumer’s payment card 

information with a randomly generated number, or token.

63 Mobile 

payments can use this token to transact with a merchant, which better 

protects consumer account credentials.

Many of the potential risks associated with mobile payments are the same 

as those that exist with traditional payment products. Some examples of 

those risks are discussed below.

Data security: Data security risks include the possibility of payment and 

personal data being lost or vulnerable to theft because of consumers’

reliance on the use of smartphones or other mobile communication 

devices. According to the Federal Reserve’s 2015 survey, respondents 

identified concerns about the security of the technology as one of the 

main reasons they do not use mobile payments.64 Security concerns 

include the event of a smartphone being hacked, the loss or theft of a 

smartphone, or if a company does not sufficiently protect mobile 

transactions, among other concerns.

 62Consumer Financial Protection Bureau, The Consumer Credit Card Market, December 

2015. 

63This process is referred to as tokenization. Marianne Crowe, David Lott, Steve Mott, and 

Susan Pandy, Is Payment Tokenization Ready for Primetime? Federal Reserve Bank of 

Atlanta and Federal Reserve Bank of Boston, June 11, 2015; The Clearing House, 

Ensuring the Safety & Security of Payments, Faster Payments Symposium, August 4, 

2015. 

64Board of Governors of the Federal Reserve System, Consumers and Mobile Financial 

Services 2016, March 2016. Responses from the question, “Which one of the following 

security aspects are you most concerned with?”

Potential Risks
Page 25 GAO-17-361 Financial Technology

Human error and confusion: According to publications we reviewed, 

mobile payment methods can create operational risk for human error.65

For example, consumers can deposit or send money to the wrong person 

when using P2P payments (e.g., if they type in the wrong phone number). 

Mobile payment methods can also increase consumer confusion 

regarding protections based on the underlying funding source. According 

to FDIC, consumers may not understand which regulators supervise the 

parties providing mobile payments and may be unsure which consumer 

protections apply.66

Mobile Payment Activities: According to the Federal Reserve’s 2015 

survey, the three most common mobile payment activities among mobile 

payments users with smartphones were paying bills through a mobile 

phone web browser or app (65 percent), purchasing a physical item or 

digital content remotely using a mobile phone (42 percent), and paying for 

something in-store using a mobile phone (33 percent).67

Partnerships: Some industry stakeholders we spoke with said that the 

relationship between banks and mobile payment firms has changed to 

more partnerships because banks and mobile payment firms recognize 

mutual benefits. For example, mobile payment firms can benefit from 

banks’ experience with regulatory compliance and banks can remain 

competitive by meeting the needs of their customers.

The regulatory and oversight framework for mobile payments consists of 

a variety of federal and state regulation and oversight. Determining which 

laws apply to mobile payments depends on several factors, including 

agency jurisdiction, mobile payment providers’ relationship to depository 

institutions, and the type of account used by a consumer to make a 

mobile payment.

 65Federal Deposit Insurance Corporation, Supervisory Insights, Mobile Payments: An 

Evolving Landscape, Winter 2012; Professor Mark E. Budnitz, Pew Charitable Trusts, The 

Legal Framework Of Mobile Payments: Gaps, Ambiguities, and Overlap, February 10, 

2016.

66Federal Deposit Insurance Corporation, Supervisory Insights, Mobile Payments: An 

Evolving Landscape, Winter 2012. 

67Board of Governors of the Federal Reserve System, Consumers and Mobile Financial 

Services 2016, March 2016.

Industry Trends

Regulation and Oversight
Page 26 GAO-17-361 Financial Technology

Three of the federal prudential regulators—Federal Reserve, FDIC, and 

OCC—are authorized to examine and regulate the provision of certain 

services provided by mobile payment providers for federally insured 

banks and thrifts.68 For example, these regulators can examine mobile 

payment providers that are considered third-party service providers of a 

regulated depository institution if the payment provider offers services to 

customers on behalf of a depository institution. The federal prudential 

regulators can also take enforcement actions against mobile payment 

providers if the provider is an institution-affiliated party of the bank.69

CFPB has consumer protection authority over certain nonbank institutions 

and enforcement jurisdiction over entities that offer or provide consumer 

financial products or services.70 In October 2016, CFPB issued a final rule

to add prepaid cards and some of the payment services that fintech 

providers are offering, such as PayPal, to the definition of accounts 

covered under regulations applicable to electronic fund transfer systems 

such as automated teller machine transfers, telephone bill-payment 

services, point-of-sale terminal transfers in stores, and preauthorized 

transfers from or to a consumer’s account (such as direct deposit and 

Social Security payments).71 According to CFPB staff, the rule is aimed at 

 68As previously discussed in the regulation and oversight of marketplace lending, the 

fourth federal prudential regulator, NCUA, does not have formal authority over fintech 

firms that partner with federally insured credit unions. 

69The Bank Service Company Act gives FDIC, OCC, and the Federal Reserve authority to 

examine a federally insured bank’s third-party service providers to see what risks they 

impose on the bank. The Federal Financial Institutions Examination Council Examination 

Handbook encourages financial institutions to effectively assess, manage, and monitor

risk with respect to third-party mobile financial service providers. The Federal Deposit 

Insurance Act authorizes the federal banking agencies to take enforcement actions 

against “institution affiliated parties” which are defined to include independent contractors, 

which may include third-party service providers. The banking agency must establish that 

the independent contractor engaged in knowing or reckless misconduct that “caused or is 

likely to cause more than a minimal financial loss to, or a significant adverse effect on, the 

insured depository institution.” 12 U.S.C. § 1813(u)(4).

70CFPB has consumer protection oversight for certain nonbank entities that offer 

consumer financial products and services and for depository institutions with more than 

$10 billion in total assets and their affiliates. CFPB also has rulemaking and interpretive 

authority for certain federal consumer financial laws relevant to mobile financial services 

(see table 2).

71Prepaid Accounts Under the Electronic Fund Transfer Act (Regulation E) and the Truth 

in Lending Act (Regulation Z), 81 Fed. Reg. 83934 (Nov. 22, 2016). The CFPB director 

signed the final rule on October 3, 2016. In March 2017, CFPB issued a proposed rule 

that would delay the effective date of the Prepaid Account rule for six months, until April 1, 

2018. 82 Fed. Reg. 13782 (March 15, 2017). 
Page 27 GAO-17-361 Financial Technology

providing wide-ranging protections to consumers holding prepaid 

accounts. Although this rule largely focuses on prepaid cards, the 

protections also extend to P2P payments and certain mobile wallets that 

can store funds.

72

Nonbank providers of financial products and services, including mobile 

payment providers and prepaid card providers, may be subject to FTC 

consumer protection enforcement actions.73 According to FTC staff, FTC 

has brought and settled enforcement actions alleging unfair or deceptive 

conduct by wireless providers providing mobile payment services.

Finally, at the federal level, the Federal Communications Commission 

(FCC) has jurisdiction over wireless providers, which provide the devices 

used for mobile payments or sometimes collect such payments through 

their customers’ billing statements.74

According to FDIC, to date, no federal laws and regulations specifically 

govern mobile payments. However, to the extent a mobile payment uses 

an existing payment method, the laws and regulations that apply to that 

method also apply to the mobile payment.75 Table 2 provides examples of 

federal laws and regulations relevant to mobile payment transactions.

 72The rule also recognizes that some covered products are offered on mobile devices so 

the agency provides clarity on how to comply with the rule, including the font size for 

disclosures, on a mobile device.

73CFPB and FTC share joint enforcement jurisdiction over certain nonbank providers of 

financial products and services, as governed by the Dodd-Frank Act and a memorandum 

of understanding. “Memorandum of Understanding between the Consumer Financial 

Protection Bureau and the Federal Trade Commission” (Mar. 6, 2015), 

https://www.ftc.gov/policy/cooperation-agreements/ftc-cfpb-interagency-cooperationagreement.

74FCC is responsible for the Truth-in-Billing rule. Mobile payment products that include 

wireless bill charges as a payment method may be subject to FCC’s authority. 

75Federal Deposit Insurance Corporation, Supervisory Insights, Mobile Payments: An 

Evolving Landscape, Winter 2012.
Page 28 GAO-17-361 Financial Technology

Table 2: Examples of Federal Laws and Regulations Relevant to Mobile Payment Transactions

Law or regulation

Example of relevant requirements or 

provisions

Applicability to mobile 

payment transactions

Federal agencies with 

regulatory or 

enforcement authority

Bank Service 

Company Act

Provides the federal banking agencies with the 

authority to regulate and examine the 

performance of certain services by a third-party 

service provider for a depository institution (or for 

any subsidiary or affiliate of a depository 

institution that is subject to examination by that 

agency) “to the same extent as if such services 

were being performed by the depository 

institution itself on its own premises.”

Applies when a mobile 

payment provider is a thirdparty service provider to a 

depository institution. 

FRS, OCC, FDIC

Electronic Fund 

Transfer Act 

(Regulation E)

Provides certain consumer rights regarding the 

electronic transfer of funds to and from 

consumers’ bank accounts. Requires disclosure 

of terms and conditions of electronic transfers, 

limits consumer liability for unauthorized 

transfers, and establishes procedures for 

preauthorizing transfers and error resolution 

procedures.a

Applies when the

underlying payment is 

made to or from a

consumer’s account

via an electronic fund 

transfer.

OCC, FRS, FDIC, 

NCUA, FTC, CFPB

Truth in Lending Act 

(Regulation Z)

Requires creditors to provide meaningful 

disclosures concerning certain terms and 

conditions of certain loan and credit transactions 

with consumers; intended to help consumers 

understand the cost of credit and compare credit 

options.a

Applies when the

underlying source of

payment is a credit

card (or other credit

account covered by

the Truth in Lending Act 

and Regulation Z).

CFPB, FRS, OCC, 

NCUA, FDIC, FTC

UDAAP Prohibits unfair, deceptive, or abusive acts or 

practices (UDAAP). 

Applies to all mobile

payments regardless

of underlying

payment source.

CFPB, FRS, FDIC, OCC, 

NCUA

Section 5 of the 

Federal Trade 

Commission Act 

Prohibits unfair or deceptive acts or practices 

(UDAP).

Applies to all mobile

payments regardless

of underlying

payment source.

FTC, FRS, FDIC, OCC, 

NCUA
Page 29 GAO-17-361 Financial Technology

Law or regulation

Example of relevant requirements or 

provisions

Applicability to mobile 

payment transactions

Federal agencies with 

regulatory or 

enforcement authority

Title V of the 

Gramm- Leach-Bliley 

Financial 

Modernization Act 

(Regulation P) 

Limits when a financial institution may disclose a 

consumer’s “nonpublic personal information” to 

nonaffiliated third parties; requires financial 

institutions to notify their customers about their 

information-sharing practices and to tell 

consumers of their right to “opt out” if they do not 

want their information shared with certain 

nonaffiliated third parties. 

Applies when a

financial institution

handles information

of a “consumer” or

“customer.”

FTC, CFPB, FRS, OCC, 

NCUA, FDIC

Truth in Billing Requires wireless carriers to provide certain 

billing information to customers.

Applies when mobile

payment results in

charges to mobile

phone bill.

FCC

Legend

CFPB – Bureau of Consumer Financial Protection, known as the Consumer Financial Protection Bureau

FCC – Federal Communications Commission

FDIC – Federal Deposit Insurance Corporation

FRS – Board of Governors of the Federal Reserve System

FTC – Federal Trade Commission

NCUA – National Credit Union Administration

OCC – Office of the Comptroller of the Currency

Source: GAO and FDIC information. | GAO-17-361

Note: This table is not exhaustive, and other federal laws and regulations may apply. a

Additional requirements will become effective at a later date, including comprehensive consumer 

protections for prepaid accounts under Regulation E, implementing the Electronic Fund Transfer Act,

and Regulation Z, implementing the Truth in Lending Act. Prepaid Accounts Under the Electronic 

Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z), 81 Fed. Reg. 83934 

(Nov. 22, 2016). CFPB issued a proposed rule in March 2017 to extend the effective date of these 

provisions an additional six months to April 2018. 82 Fed. Reg. 13782 (March 15, 2017).

State regulators also have authority to regulate mobile payment 

providers. For example, most states have licensing and regulatory 

authority over money service businesses that provide money transfer 

services or payment instruments, which can include mobile payment 

providers. For example, fintech firms such as PayPal and Google Wallet 

are subject to state money transmitter laws. State regulators have made 

efforts to make the state licensing process less burdensome by 

conducting multistate exams and using NMLS to facilitate these 

processes.76

According to interviews with some agencies, they formed working groups 

to monitor and understand mobile payments. These examples are listed 

below.

 76For more information on the multistate exam process, see 

https://www.csbs.org/news/presentations/annualreports/Documents/2015%20MMET%20A

nnual%20Report.pdf. 
Page 30 GAO-17-361 Financial Technology

• In January 2010, the Federal Reserve started the Mobile Payments 

Industry Working Group to facilitate discussions as to how a successful 

mobile payments (as opposed to mobile banking) system could evolve in 

the United States.77 The working group meets several times annually to 

share information and ideas. In addition, the Federal Reserve established 

a multidisciplinary working group focused on analyzing potential 

innovation in fintech including payments.

• FDIC established a formal FinTech Steering Committee and two working 

groups, one focus of one of the working groups includes mobile 

payments.

• CFPB met with payment innovators through its Project Catalyst.78

• CSBS formed an Emerging Payments and Innovation Task Force in 2013 

to study changes in payment systems to determine the potential impact 

on consumer protection, state law, and banks and nonbank entities 

chartered or licensed by the states.79

Digital wealth management platforms, including robo-advisors, use 

algorithms based on consumers’ data and risk preferences to provide 

digital services, including investment and financial advice, directly to 

consumers.80 Digital wealth management platforms provide services 

including portfolio selection, asset allocation, banking and account 

aggregation, and online risk assessments.81

 77The group is run by the Federal Reserve Banks of Atlanta and Boston and includes a 

variety of industry stakeholders. See https://www.bostonfed.org/publications/mobilepayments-industry-workgroup/mobile-payments-industry-workgroup.aspx for more 

information. 

78In October 2016, CFPB released its first report on Project Catalyst, the project to 

encourage consumer-friendly innovation in markets for consumer financial products and 

services, see Consumer Financial Protection Bureau, Project Catalyst report: Promoting 

consumer-friendly innovation, October 2016. 

79For more information see https://www.csbs.org/REGULATORY/EP/Pages/default.aspx.

80For purposes of this report, we refer to firms that provide digital wealth management 

platforms as digital wealth management firms. 

81BlackRock, Digital Investment Advice: Robo Advisors Come of Age, September 2016, 

https://www.blackrock.com/corporate/en-at/literature/whitepaper/viewpoint-digitalinvestment-advice-september-2016.pdf; Financial Industry Regulatory Authority, Report 

on Digital Investment Advice, March 2016, http://www.finra.org/sites/default/files/digitalinvestment-advice-report.pdf; Gauthier Vincent, Rohit Gera, Deloitte, Digital Disruption in 

Wealth Management Why Established Firms Should Pay Attention To Emerging Digital 

Business Models For Retail Investors, 2014.

Digital Wealth 

Management
Page 31 GAO-17-361 Financial Technology

According to data from SEC, there were over 12,000 SEC-registered 

investment advisers in 2016.82 However, according to staff from SEC, 

because digital wealth management firms register as investment advisers 

and are not all separately counted or categorized, the total number of 

these entities is not known. Digital wealth management firms incorporate 

technologies into their portfolio management platforms primarily through 

the use of algorithms designed to optimize wealth management services. 

Fully automated platforms have features that let investors manage their 

portfolios without direct human interaction. Examples of current digital 

wealth management firms include Betterment, Wealthfront, Personal 

Capital, BlackRock’s Future Advisor, and Acorns.

Publications we reviewed indicate that digital wealth management 

platforms typically collect information on customers and their financial 

history using online questionnaires.83 These questionnaires may cover 

topics such as the customer’s age, income, investment horizon, risk 

tolerance, and expected returns, among other information.84 Digital wealth 

management platforms allow customers with a need to connect multiple 

accounts—often across multiple providers—to create a holistic picture of 

their wealth and more easily manage their finances across multiple asset 

classes and firms.85 Digital wealth management platforms use the 

information inputted by the customer to help the customer select a risk 

profile. The firms then use algorithms to generate a suggested investment 

strategy to the customer based on that risk profile. Platforms can 

automatically rebalance customers’ portfolios in response to the 

performance of the underlying investments, and the customers’ goals 

(see fig. 5).

 82According to SEC staff, digital wealth management firms typically register with SEC as 

investment advisers. Advisers qualifying under the SEC rule for Internet investment 

advisers (Rule 203A-2(e)) report that status on their SEC registration filing. However, the 

number of Internet investment advisers that file under Rule 201A-2(e) is likely underinclusive for purposes of identifying digital wealth management firms because some firms 

may register with SEC on another basis (e.g., because they have over $100 million in 

regulatory assets under management), and so may not identify themselves as Internet 

advisers on their SEC registration filings. 

83BlackRock, Digital Investment Advice: Robo Advisors Come of Age, September 2016;

Financial Regulatory Authority, Report on Digital Investment Advice, March 2016.

84BlackRock, Digital Investment Advice: Robo Advisors Come of Age, September 2016; 

Financial Regulatory Authority, Report on Digital Investment Advice, March 2016.

85Gauthier Vincent and Rohit Gera, Deloitte, Digital Disruption in Wealth Management -

Why Established Firms Should Pay Attention to Emerging Digital Business Models for 

Retail Investors, 2014. 

What It Is and How It 

Works
Page 32 GAO-17-361 Financial Technology

Figure 5: Example of a Digital Wealth Management Platform

Adviser-assisted digital wealth management platforms combine a digital 

client portal and investment automation with a virtual financial adviser 

typically conducting simple financial planning and periodic reviews over 

the phone. Examples of current platforms in this category include

Personal Capital, Future Advisor, and LearnVest. To further differentiate 

themselves, they may offer value-added services like asset aggregation 

capabilities that enable the provision of more holistic advice than fully

automated digital wealth managers, based on a comprehensive view of 
Page 33 GAO-17-361 Financial Technology

client assets and liabilities, as well as expense-tracking and advice on 

budgeting and financial-goal planning.86

Increased access to wealth management services: Publications we 

reviewed indicated that digital wealth management platforms may expand 

access to underserved segments such as customers with smaller asset 

amounts than those of traditional consumers of wealth management 

services.87 For example, some platforms may not require customers to 

maintain minimum balance amounts. Traditional firms may require 

minimum investment amounts of $250,000, whereas some digital 

platforms require a minimum of approximately $500 or no minimum at 

all.88

Convenience: Regardless of location or the time of day, investors with a 

smart phone, tablet, or computer can make changes to their data and 

preference inputs, send instructions, access their portfolios, and receive 

updated digital advice.89

Lower fees: According to publications we reviewed, digital wealth 

management platforms may charge lower fees for services such as 

investment trade fees than traditional wealth management firms.

90

 86EY, Advice Goes Virtual: How new Digital Investment Services Are Changing The 

Wealth Management Landscape, 2015.

87Deloitte, Robo Advisors: Capitalizing on a growing opportunity, 2015; EY, Advice Goes 

Virtual: How new Digital Investment Services Are Changing The Wealth Management 

Landscape, 2015; Accenture, The Rise of Robo-Advice: Changing the Concept of Wealth 

Management, 2015; BlackRock, Digital Investment Advice: Robo Advisors Come of Age, 

September 2016.

88Bloomberg QuickTake, Robo-advisors: They Invest by Algorithm But Don’t Return Calls, 

June 7, 2016, accessed December 14, 2016, https://www.bloomberg.com/quicktake/roboadvisers. 

89According to SEC staff, the instructions inputted into the platform may not be carried out 

until the relevant markets open. BlackRock, Digital Investment Advice: Robo Advisors 

Come of Age, September 2016. 

90Securities and Exchange Commission Office of Investor Education and Advocacy, 

Investor Bulletin: Robo-Advisers, February 23, 2017, https://www.sec.gov/oiea/investoralerts-bulletins/ib_robo-advisers.html; Qplum, What is Robo-Advising (Jersey City, NJ:

May 5, 2016).

Potential Benefits
Page 34 GAO-17-361 Financial Technology

Some of the potential risks associated with digital wealth management 

platforms may be similar to those that exist with traditional wealth 

management services. Examples of those risks are discussed below.

Insufficient or incomplete information from customers: According to 

publications we reviewed, some digital wealth management platforms 

generate investment outputs based on information provided by the client 

from questionnaire responses.91 A traditional wealth manager is able to 

ask and clarify questions and request follow-up information to capture a 

customer’s full finances and goals. However, automated responses may 

not allow the platform to capture a full picture of the customer’s 

circumstances or short-term goals, for example, whether the customer 

may need investment money to buy a new home. If the customer does 

not understand a question, or does not answer it completely, the platform 

may not assess customers’ full financial circumstances; for example, if a 

customer provides conflicting information on his or her finances, the 

digital wealth management platform may not have a full picture of the 

client’s financial condition or a customer may end up with an undesired 

portfolio.

92

Inaccurate or inappropriate assumptions: Staff of SEC’s Office of Investor 

Education and Advocacy (OIEA) and FINRA issued an investor alert on 

May 8, 2015, which cautioned that assumptions that underlie the 

algorithms used by digital wealth management firms could be incorrect.93

For example, the alert states that the platform may be programmed to use 

economic assumptions that will not react to shifts in the market. 

Specifically, if the platform assumes that interest rates will remain low but 

 91Financial Regulatory Authority, Report on Digital Investment Advice, March 2016; 

BlackRock, Digital Investment Advice: Robo Advisors Come of Age, September 2016.

92Securities and Exchange Commission Office of Investor Education and Advocacy and 

Financial Industry Regulatory Authority, Investor Alert: Automated Investment Tools, May 

8, 2015, accessed January 3, 2017, https://www.sec.gov/oiea/investor-alertsbulletins/autolistingtoolshtm.html; Financial Regulatory Authority, Report on Digital 

Investment Advice, March 2016.

93Securities and Exchange Commission Office of Investor Education and Advocacy and 

Financial Industry Regulatory Authority, Investor Alert: Automated Investment Tools, May 

8, 2015.

Potential Risks
Page 35 GAO-17-361 Financial Technology

interest rates rise instead, the platform’s output will be flawed, which 

could adversely affect investors.94

Consumer Data Protection: To use digital wealth management platforms 

customers must enter personal information. According to an investor alert 

issued by SEC and FINRA staff, digital wealth management platforms

may be collecting and sharing personal information for purposes 

unrelated to the platform. The alert cautions customers to safeguard 

personal information.95

According to publications we reviewed, fintech firms, including at least 

one digital wealth management platform, are using or have considered 

using innovative technologies such as machine learning and artificial 

intelligence.96 For example, one platform is intended to track consumers’

financial account activity and apply user behavior to the advice it delivers.

Hybrid services have evolved that combine traditional wealth 

management and digital wealth management. For example, in 2015 

Vanguard implemented a service that offers investors an option of 

consulting with a human advisory representative in addition to its 

automated investment platform.97 Traditional wealth management firms 

also offer digital wealth management services. For example, in 2015, 

Charles Schwab developed Intelligent Portfolios, available to customers 

 94Securities and Exchange Commission Office of Investor Education and Advocacy and 

Financial Industry Regulatory Authority, Investor Alert: Automated Investment Tools, May 

8, 2015.

95Securities and Exchange Commission Office of Investor Education and Advocacy and 

Financial Industry Regulatory Authority, Investor Alert: Automated Investment Tools, May 

8, 2015.

96Advanced machine learning is an artificial intelligence (AI) discipline that allows 

computers to handle new situations via analysis, self-training, observation, and experience 

– with minimal “supervision” by humans. See GAO, Data and Analytics Innovation: 

Emerging Opportunities and Challenges, Highlights of a Forum, GAO-16-659SP 

(Washington, D.C.: September 2016); Qplum, What is Robo-Advising (Jersey City, NJ:

May 5, 2016).

97Vanguard Press Room, Vanguard Introduces Personal Advisor Services, Lowers 

Minimum to Investors With $50,000, 

https://pressroom.vanguard.com/news/Vanguard_Introduces_Personal_Advisor_Services

_Lowers_Minimum.html.

Industry Trends
Page 36 GAO-17-361 Financial Technology

with $5,000 in savings, and Deutsche Bank launched a robo-advisor 

within its online investment platform.98

SEC regulates investment advisers, which generally includes firms that 

provide digital wealth management platforms. Other federal and state 

agencies have a role with respect to oversight of digital wealth 

management firms, depending upon the services a digital wealth 

management platform provides.

SEC and state securities regulators share responsibility for the oversight 

of investment advisers in accordance with the Investment Advisers Act of 

1940 (Advisers Act).99 SEC subjects digital wealth management firms to 

the same regulations as traditional investment advisers and requires 

digital wealth management firms that manage over $110 million in assets 

to register as investment advisers.100 The Advisers Act generally requires 

anyone in the business of receiving compensation for providing 

investment advice to others regarding securities to register with SEC or 

one or more states. SEC’s supervision of investment advisers includes 

evaluating their compliance with federal securities laws by conducting 

examinations, including reviewing disclosures made to customers. It also 

investigates and imposes sanctions for violations of securities laws. SEC 

held a forum in November 2016 that discussed fintech innovation in the 

financial services industry, including the impact of recent innovation in 

investment advisory services, which includes digital wealth management.

In January 2017, SEC’s Office of Compliance Inspections and 

Examinations announced that electronic investment advice is a 2017 

examination priority.101 In February 2017, SEC’s Division of Investment 

 98Charles Schwab press release, Charles Schwab Launches Schwab Intelligent Portfolios, 

https://pressroom.aboutschwab.com/press-release/corporate-and-financial-news/charlesschwab-launches-schwab-intelligent-portfolios; Deutsche Bank press release, 

https://www.db.com/newsroom_news/2015/medien/deutsche-bank-launches-maxbluerobo-advisor-en-11366.htm. 

99The Advisers Act defines an investment adviser as any person (i.e., individual or firm) 

who is in the business of providing advice, or issuing reports or analyses, regarding 

securities, for compensation. 15 U.S.C. § 80b-2(a)(11); IA Rel. No. 1092.

100As noted, SEC Rule 203A-2(e) permits internet investment advisers to register with 

SEC if the adviser provides investment advice to all of its clients exclusively through the 

adviser’s interactive website, except that the investment adviser may provide investment 

advice to fewer than 15 clients through other means during the preceding 12 months.

101Securities and Exchange Commission Office of Compliance Inspections and 

Examinations, Examination Priorities for 2017.

Regulation and Oversight
Page 37 GAO-17-361 Financial Technology

Management issued guidance for robo-advisers that provide services 

directly to clients over the Internet. SEC’s Office of Investor Education 

and Advocacy issued an Investor Bulletin that provided information to 

help investors using robo-advisers to make informed decisions in meeting 

their investment goals.

102

State securities regulators generally have registration and oversight 

responsibilities for investment adviser firms that manage less than $100 

million in client assets, if they are not registered with SEC. According to 

staff from SEC, state securities regulators can bring enforcement actions

against firms with assets of any amount for violations of state fraud laws. 

For example, the state of Massachusetts’ Securities Division issued a 

policy in April 2016 stating that fully automated robo-advisers may be 

inherently unable to carry out the fiduciary obligations of a Massachusetts 

state-registered investment adviser.103 The policy states that until 

regulators have determined the proper regulatory framework for 

automated investment advice, robo-advisers seeking state registration will 

be evaluated on a case-by-case basis.104

FINRA, a self-regulatory organization, is also responsible for regulating 

broker-dealers doing business with the public in the United States.105

 102Securities and Exchange Commission Division of Investment Management, “Guidance 

Update, Robo-Advisers,” No. 2017-02 (Washington, D.C.: February 2017), 

https://www.sec.gov/investment/im-guidance-2017-02.pdf; Securities and Exchange 

Commission Office of Investor Education and Advocacy, Investor Bulletin: Robo-Advisers, 

February 23, 2017, https://www.sec.gov/oiea/investor-alerts-bulletins/ib_roboadvisers.html. 

103Massachusetts Securities Division Policy Statement – Robo-Advisers and State 

Investment Adviser Registration, April 1, 2016.

104Massachusetts Securities Division Policy Statement – Robo-Advisers and State 

Investment Adviser Registration, April 1, 2016.

105Most broker-dealers must register with SEC and join a self-regulatory organization, 

such as FINRA. By statute, a broker, in general, is any person engaged in the business of 

effecting transactions in securities for the accounts of others. 15 U.S.C. § 78c(a)(4). 

Additionally, by statute, a dealer is, in general, any person engaged in the business of 

buying or selling securities for that person’s own account through a broker or otherwise.

15 U.S.C. § 78c(a)(5). A broker-dealer is a person or company that is in the business of 

buying and selling securities—stocks, bonds, mutual funds, and certain other investment 

products—on behalf of its customers (as broker), for its own account (as dealer), or both. 

Individuals who work for broker-dealers—the sales personnel whom most people call 

brokers—are technically known as registered representatives. For additional information 

on FINRA and its oversight, see GAO, Securities Regulation: SEC Can Enhance Its 

Oversight of FINRA, GAO-15-376 (Washington, D.C.: Apr. 30, 2015).
Page 38 GAO-17-361 Financial Technology

Broker-dealers can use digital investment advice tools to provide 

investment services to clients.106 According to FINRA staff, FINRA may 

test the use of digital wealth management technologies by broker-dealers 

as part of its examinations. According to FINRA staff, FINRA has taken 

one enforcement action against a broker-dealer offering clients roboadviser-like functionality.107 In March 2016, FINRA issued a report to 

share effective practices related to digital investment advice tools and 

remind FINRA-registered broker-dealers of their obligations under FINRA 

rules, including that broker-dealers are required to supervise the types of 

businesses in which they engage.108

CFTC has oversight authority with respect to commodity trading advisers 

under the Commodity Exchange Act.109 According to CFTC officials, 

digital wealth management firms that meet the statutory definition of a 

commodity trading adviser would be subject to the same oversight and 

compliance obligations as other traditional commodity trading advisers.110

The act generally requires that commodity trading advisers register with 

CFTC.111

Digital wealth management firms are subject to consumer protection laws 

that are enforced by FTC. FTC is charged with protecting consumers 

against unfair or deceptive acts or practices in commerce. According to

 106The Financial Industry Regulatory Authority generally categorizes digital investment 

tools into two groups: (1) those that are available to clients, referred to as “client facing”

tools, and (2) those that are used by broker-dealers’ registered representatives, referred to 

as “inward-facing” or “advisor-facing” tools. For more information, see: Financial Industry 

Regulatory Authority, Report on Digital Investment Advice, March 2016.

107Financial Industry Regulatory Authority Letter of Acceptance, Waiver, and Consent No. 

2013039465901 regarding Capital One Investing, LLC. 

108Financial Industry Regulatory Authority, Report on Digital Investment Advice, March 

2016.

1097 U.S.C. § 1 et seq.

110The Commodity Exchange Act defines a commodity trading advisor as “any person 

who for compensation or profit, engages in the business of advising others, either directly 

or through publications, writings, or electronic media, as to the value of or the advisability 

of trading in” swaps, commodity futures, commodity options, or FOREX. 7 U.S.C. §1a(12).

1117 U.S.C. § 6m(1). Pursuant to CFTC regulations, registered commodity trading 

advisors are required to provide certain disclosures to participants, and maintain specified 

books and records relating to the clients and subscribers of the commodity trading advisor 

as well as the advisor itself. CFTC also investigates and disciplines firms for violations of 

CEA and its regulations.
Page 39 GAO-17-361 Financial Technology

FTC staff, FTC enforces applicable consumer protection laws in regard to 

fintech services, such as digital wealth management, just as it applies 

those laws to other products and services. According to staff from CFPB, 

certain aspects of digital wealth management such as data aggregation, 

credit, or linked deposit accounts may also be subject to consumer 

oversight authority by CFPB.112

In April 2016, the Department of Labor (DOL) adopted a regulation that 

would expand the circumstances in which those who provide retirement 

investment advice, including digital wealth management firms, would 

have to abide by a “fiduciary” standard, acting prudently and in the best 

interest of their clients.

113 The rule was scheduled to be applicable in April 

2017.114 However, the President issued a memorandum on February 3, 

2017, that directed the Secretary of DOL to examine the fiduciary duty 

rule to determine whether it may adversely affect the ability of Americans 

to gain access to retirement information and financial advice.115 In April 

2017, DOL extended the applicability date for an extra 60 days.116

Distributed ledger technology (DLT) was introduced in 2009 as a 

technology intended to facilitate the recording and transferring of bitcoin, 

a virtual currency, specifically using blockchain.117 DLT has the potential 

 112Under the Dodd-Frank Wall Street Reform and Consumer Protection Act, CFPB was

granted rulemaking authority to require certain entities to make available to consumers 

certain types of their digital financial account information. Pub. L. No. 111-203, § 1033, 

124 Stat. 1376, 2008 (2010) (codified at 12 U.S.C. § 5533).

113See https://www.dol.gov/ProtectYourSavings/FactSheet.htm, accessed January 13, 

2017. 

114Definition of the Term “Fiduciary;” Conflict of Interest Rule – Retirement Investment 

Advice, 81 Fed. Reg. 20946 (Apr. 8, 2016).

11582 Fed. Reg. 9675 (Feb. 7, 2017).

116Definition of the Term “Fiduciary;” Conflict of Interest Rule. 82 Fed. Reg. 16902 (April 7, 

2017).

117See GAO, Virtual Currencies: Emerging Regulatory, Law Enforcement, and Consumer 

Protection Challenges, GAO-14-496 (Washington, D.C.: May 29, 2014).

Distributed Ledger 

Technology
Page 40 GAO-17-361 Financial Technology

to be a secured way of conducting transfers of digital assets in a near 

real-time basis potentially without the need for an intermediary.118

DLT is a generic technology for a distributed database, while blockchain 

is one type of DLT.119 According to one study we reviewed, DLT involves 

a distributed database maintained over a network of computers 

connected on a peer-to-peer basis, such that network participants can 

share and retain identical, cryptographically secured records in a 

decentralized manner.120 A network can consist of individuals, 

businesses, or financial entities. 

One type of DLT is blockchain, which is a shared ledger that records 

transactions in a peer-to-peer network. Blockchain is a series of digital 

blocks of information (transactions) that are chained together. The party 

initiating a transaction sends a message represented as a block to a 

network of participants that can include financial institutions, financial 

market participants, and regulators. For a transaction to be included, 

network participants must validate the transaction. Once a transaction 

has been confirmed, details of the transaction are recorded on the 

blockchain that can be visible to network participants (see fig. 6).

 118An intermediary can include financial institutions (such as banks, broker/dealers, and 

other institutions that interact with the end-users of a financial transaction) and 

infrastructures (such as payment, clearing, and settlement systems for funds, securities, 

and derivatives). See David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff 

Marquardt, Clinton Chen, Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, 

Vanessa Kargenian, Max Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed 

ledger technology in payments, clearing, and settlement,” Finance and Economics 

Discussion Series 2016-095, Washington: Board of Governors of the Federal Reserve 

System, https://doi.org/10.17016/FEDS.2016.095; Board of Governors of the Federal 

Reserve System, Consumer Compliance Outlook, Fintech Special Edition, 3rd ed.

(Philadelphia, Pa.: 2016). 

119For purposes of this report, we refer to blockchain as a type of distributed ledger 

technology. 

120Financial Industry Regulatory Authority, Distributed Ledger Technology: Implications of 

Blockchain for the Securities Industry, January 2017.

What It Is and How It 

Works
Page 41 GAO-17-361 Financial Technology

Figure 6: How Blockchain Works

DLT solutions can have different types of access control. For example, 

there may be “permissionless” (public) ledgers that are open to everyone 

to contribute data to the ledger and cannot be owned; or “permissioned”

(private) ledgers that may have one or many owners and only they can 

add records and verify the contents of the ledger. According to one study, 

permissioned DLT is not fully decentralized.121

 121International Organization of Securities Commissions, IOSCO Research Report on 

Financial Technologies (Fintech), February 2017. 
Page 42 GAO-17-361 Financial Technology

According to publications we reviewed, an important feature of blockchain 

is that transactions added to a ledger are validated by network 

participants.122 This validation process is referred to as a consensus

mechanism.123 Consensus mechanisms can help prevent the problem of 

double spending.124 Publications we reviewed indicate there are different 

kinds of consensus mechanisms that include proof-of-work and proof-ofstake.125 Proof-of-work may be used in permissionless DLT and proof-ofstake may be used in permissioned DLT. Consensus mechanisms also 

incorporate security aspects such as cryptography and digital signatures

that are listed below:

• Cryptography is used to encrypt data to ensure transactions are valid and 

provide identity verification. For example, during asset transfers, a form 

of cryptography known as public key cryptography usually forms the 

foundation of the transaction validation process.126

 122United States Postal Service, Office of Inspector General, Blockchain Technology: 

Possibilities for the U.S. Postal Service, Report No. RARC-WP-16-011, May 23, 2016, 

accessed January 11, 2017, https://www.uspsoig.gov/sites/default/files/document-libraryfiles/2016/RARC-WP-16-001.pdf; United Kingdom Government Office for Science, 

Distributed Ledger Technology: beyond block chain, December 2015, accessed January 

11, 2017, 

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/492972/gs16-1-distributed-ledger-technology.pdf.

123A consensus mechanism is the way in which a majority or all network members agree 

on the value of a proposed transaction, which is then updated to the ledger. There are 

different mechanisms that can build consensus using algorithms. 

124For example, bitcoins are created and entered into circulation through a process called 

mining. Bitcoin miners download free software that they use to solve complex math 

problems. Solving these problems verifies the validity of bitcoin transactions by grouping 

several transactions into a block and mathematically proving that the transactions 

occurred and did not involve double spending of a bitcoin.

125Byzantine Fault Tolerance is another example of a consensus mechanism. For more 

information on consensus mechanisms, see International Organization of Securities 

Commissions, IOSCO Research Report on Financial Technologies (Fintech), February 

2017; United Kingdom Government Office for Science, Distributed Ledger Technology: 

beyond block chain, December 2015.

126David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, Clinton Chen, 

Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, Vanessa Kargenian, Max 

Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed ledger technology in payments, 

clearing, and settlement,” Finance and Economics Discussion Series 2016-095, 

Washington: Board of Governors of the Federal Reserve System, 

https://doi.org/10.17016/FEDS.2016.095.
Page 43 GAO-17-361 Financial Technology

• Digital signatures are based on cryptography and are used in DLT to 

certify the authenticity of transactions (i.e., to show that a person is the 

true owner of an indicated digital identity). When a person creates and 

sends a DLT transaction, the transaction must also bear that person’s 

digital signature.127

According to publications we reviewed, agencies, financial institutions, 

and industry stakeholders have identified potential uses for DLT in the 

financial service industry through the clearing and settlement of financial 

transactions.128 Examples of these transactions include:

• international money transfers;129

• private trades in the equity market; and

• insurance claims processing and management.

DLT can also incorporate smart contracts. Smart contracts can automate 

different kinds of processes and operations. For example, smart contracts 

can facilitate the automation of complex, multiparty transactions, such as 

the payment of bonds and insurance coupons.130 According to one study, 

 127United Kingdom Government Office for Science, Distributed Ledger Technology: 

beyond block chain, December 2015.

128David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, Clinton Chen, 

Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, Vanessa Kargenian, Max 

Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed ledger technology in payments, 

clearing, and settlement,” Finance and Economics Discussion Series 2016-095, 

Washington: Board of Governors of the Federal Reserve System, 

https://doi.org/10.17016/FEDS.2016.095; Financial Industry Regulatory Authority, 

Distributed Ledger Technology: Implications of Blockchain for the Securities Industry, 

January 2017; Financial Stability Oversight Council 2016 Annual Report (Washington, 

D.C.: June 21, 2016); Alan McQuinn, Weining Guo, and Daniel Castro, Policy Principles 

for Fintech, Information Technology & Innovation Foundation, October 2016; United 

Kingdom Government Office for Science, Distributed Ledger Technology: beyond block

chain, December 2015; United States Postal Service, Office of Inspector General, 

Blockchain Technology: Possibilities for the U.S. Postal Service, Report No. RARC-WP16-011, May 23, 2016; World Economic Forum, The Future of Financial Infrastructure: An 

ambitious look at how blockchain can reshape financial services, August 2016, accessed 

January 11, 2017, https://www.weforum.org/reports/the-future-of-financial-infrastructurean-ambitious-look-at-how-blockchain-can-reshape-financial-services. 

129See GAO-14-496. As we previously reported, virtual currencies can be used to make 

payments and transfer funds.

130Financial Stability Oversight Council, 2016 Annual Report (Washington, D.C.: June 21, 

2016).

Who Uses It
Page 44 GAO-17-361 Financial Technology

there are several versions of smart contracts composed using computer 

code.131

Transparency: According to publications we reviewed, DLT has the 

potential to facilitate transparency between financial institutions, 

regulators, and other financial market participants.132 DLT can increase 

transparency between participants by creating a shared record of activity 

where participants have access in real time. Changes by any participant 

with the necessary permission to modify the ledger are immediately 

reflected in all copies of the ledger. Because distributed ledgers can be 

designed to be broadly accessible and verifiable, the technology could 

enhance financial market transparency.

Efficiencies: According to publications we reviewed, DLT can enhance 

efficiencies in securities and payment clearing and settlement times.133

Specifically, DLT has the potential to reduce settlement times for 

securities transactions by facilitating the exchange of digital assets during 

the same period of time as the execution of a trade. According to staff 

from SEC, while the financial services industry is moving toward 

shortening settlement cycles, DLT may offer efficiencies should it be 

deployed in securities clearance and settlement functions. In 2015, SEC 

requested comments on how blockchain technology could facilitate the 

role of a transfer agent and separately, in 2016, requested comments on 

the utility of DLT in shortening the settlement cycle for most broker-dealer 

 131Chamber of Digital Commerce, Smart Contracts Alliance, Smart Contracts: 12 Use 

Cases for Business & Beyond (Washington, D.C.: December 2016). 

132David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, Clinton Chen, 

Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, Vanessa Kargenian, Max 

Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed ledger technology in payments, 

clearing, and settlement,” Finance and Economics Discussion Series 2016-095, 

Washington: Board of Governors of the Federal Reserve System, 

https://doi.org/10.17016/FEDS.2016.095; Financial Industry Regulatory Authority, 

Distributed Ledger Technology: Implications of Blockchain for the Securities Industry, 

January 2017; United Kingdom Government Office for Science, Distributed Ledger 

Technology: beyond block chain, December 2015; World Economic Forum, The Future of 

Financial Infrastructure: An ambitious look at how blockchain can reshape financial 

services, August 2016. 

133Financial Industry Regulatory Authority, Distributed Ledger Technology: Implications of 

Blockchain for the Securities Industry, January 2017; S&P Global Market Intelligence, An 

introduction to fintech: Key Sectors and trends, October 2016. 

Potential Benefits
Page 45 GAO-17-361 Financial Technology

securities transactions.134 In addition, conducting international money 

transfers through DLT can provide real-time settlement.

Like most new technologies, DLT can pose certain risks and 

uncertainties, which market participants and financial regulators and 

agencies will need to monitor.

Operational risk including security risk: According to a publication by the 

Board of Governors of the Federal Reserve System, operational failures 

include errors or delays in processing, system outages, insufficient 

capacity, fraud, and data loss and leakage.135 According to a FINRA

report, given that DLT involves sharing of information over a network it 

poses security-related risks.136 The Financial Stability Oversight Council

noted that market participants have limited experience working with 

distributed ledger systems, and it is possible that operational 

vulnerabilities associated with such systems may not become apparent 

until they are deployed at scale.137 According to officials from CSBS, 

permissionless DLT presents security risks (e.g., anti-money-laundering 

and Bank Secrecy Act) that can be mitigated. 

Publications we reviewed suggest some financial institutions have taken 

several approaches to adopt DLT. For example, some financial 

institutions have initiated blockchain projects, joined a multiparty 

consortium, or announced partnerships to examine DLT’s potential. In 

 134Transfer agents record changes of ownership, maintain an issuer’s security holder 

records, cancel and issue certificates, and distribute dividends. See Transfer Agent 

Regulations, 80 Fed. Reg. 81948 (December 31, 2015) and Amendment to Securities 

Transaction Settlement Cycle, 81 Fed. Reg. 69240 (October 5, 2016). 

135David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, Clinton Chen, 

Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, Vanessa Kargenian, Max 

Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed ledger technology in payments, 

clearing, and settlement,” Finance and Economics Discussion Series 2016-095, 

Washington: Board of Governors of the Federal Reserve System, 

https://doi.org/10.17016/FEDS.2016.095.

136Financial Industry Regulatory Authority, Distributed Ledger Technology: Implications of 

Blockchain for the Securities Industry, January 2017. 

137Financial Stability Oversight Council, 2016 Annual Report (Washington, D.C.: June 21, 

2016).

Potential Risks

Industry Trends
Page 46 GAO-17-361 Financial Technology

addition, the largest securities depository and a large stock exchange 

have used DLT.

• According to the World Economic Forum, 80 percent of banks are 

expected to initiate blockchain projects by 2017.138

• The R3 industry consortium made up of over 50 financial institutions 

designed a DLT platform for recording and managing financial 

agreements named Corda.139

• The Depository Trust and Clearing Corporation proposed to build a 

derivatives distributed ledger solution for post-trade processing.140

Through this initiative, the Depository Trust and Clearing Corporation 

seeks to reduce costs and increase efficiencies in the post-trade process.

• In December 2015, the stock exchange Nasdaq enabled its first trade on 

a blockchain using its Linq ledger through a private blockchain 

developer.

141 Nasdaq Linq is a digital ledger technology that leverages a 

blockchain to issue and record transfers of shares of privately-held 

companies.

Continued development of DLT is needed to understand how DLT and its 

components will be regulated by the existing legal and regulatory 

system.142 Additionally, it is unclear whether new regulation will need to 

be created because DLT can present new and unique challenges. 

According to the Financial Stability Oversight Council, financial regulators 

should monitor how a DLT network can affect regulated entities and their 

 138World Economic Forum, The Future of Financial Infrastructure: An ambitious look at 

how blockchain can reshape financial services, August 2016.

139R3, “Introducing R3 Corda: A Distributed Ledger Designed for Financial Services,” April 

5, 2016, accessed March 6, 2017, http://www.r3cev.com/blog/2016/4/4/introducing-r3-

corda-a-distributed-ledger-designed-for-financial-services. 

140See http://www.dtcc.com/news/2017/january/09/dtcc-selects-ibm-axoni-and-r3-todevelop-dtccs-distributed-ledger-solution, for more information. 

141Accessed March 7, 2017, http://ir.nasdaq.com/releasedetail.cfm?releaseid=948326.

142David Mills, Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, Clinton Chen, 

Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley Liao, Vanessa Kargenian, Max 

Ellithorpe, Wendy Ng, and Maria Baird (2016), “Distributed ledger technology in payments, 

clearing, and settlement,” Finance and Economics Discussion Series 2016-095, 

Washington: Board of Governors of the Federal Reserve System, 

https://doi.org/10.17016/FEDS.2016.095; Financial Stability Oversight Council, 2016 

Annual Report (Washington, D.C.: June 21, 2016).

Regulation and Oversight
Page 47 GAO-17-361 Financial Technology

operations.143 Representatives of financial regulators have noted the 

importance of implementing DLT in a manner that is transparent and 

satisfies regulatory requirements.144

With respect to virtual currencies, federal and state regulators have taken 

varied approaches to regulation and oversight.145 For example, in 2015,

CFTC stated it considers bitcoin and other virtual currencies to be 

included in the definition of “commodity” under the Commodity Exchange 

Act.146 SEC’s Office of Investor Education and Advocacy has stated that 

the rise of bitcoin and other virtual and digital currencies creates new 

concerns for investors.147 Two bureaus within the Department of the 

Treasury treat bitcoin in different ways, including the Department of the 

Treasury Financial Crimes and Enforcement Network (FinCEN), which 

determined that certain virtual currency businesses would be money 

transmitters under the Bank Secrecy Act, subject to regulation as money 

services businesses, and the Internal Revenue Service, which treats 

bitcoin as property for U.S. federal tax purposes.148 FTC can apply the 

Federal Trade Commission Act to combat unfair or deceptive acts or 

practices in or affecting commerce, which includes virtual currencies. In 

addition, approximately 44 states have issued licenses to companies that 

use virtual currency in their business model.149 The existing regulatory 

 143The Financial Stability Oversight Council was created by the Dodd-Frank Wall Street 

Reform and Consumer Protection Act in 2010 as a body designed to identify risks and 

respond to emerging threats to the United States’ financial stability. Pub. L. No. 111-203, 

§ 112, 124 Stat. 1376, 1394-1398 (2010).

144Governor Lael Brainard, Distributed Ledger Technology: Implications for Payments, 

Clearing, and Settlement, Speech at the Institute of International Finance Annual Meeting 

Panel on Blockchain, Washington, D.C., October 7, 2016; Securities and Exchange 

Commission, Fintech Forum: The Evolving Financial Marketplace, November 14, 2016, 

accessed February 21, 2017,https://www.sec.gov/spotlight/fintech/transcript-111416.pdf. 

145This report does not cover all applicable regulatory requirements and oversight 

activities related to virtual currencies. For more information see GAO-14-496.

146CFTC’s jurisdiction is generally limited to the Commodity Exchange Act and entities 

registered with CFTC, such as intermediaries or derivatives clearing organizations. 

147See https://www.sec.gov/oiea/investor-alerts-bulletins/investoralertsia_bitcoin.html. 

148FinCEN coordinates with its state counterparts to encourage application of FinCEN’s 

guidance on virtual currencies as part of this process. FinCEN is the administrator of the 

Bank Secrecy Act.

149The Conference of State Bank Supervisors and Money Transmitter Regulators

Association, The State of State Money Services Businesses and Regulation and 

Supervision, May 2016. 
Page 48 GAO-17-361 Financial Technology

complexity for virtual currencies indicates that regulatory approaches for 

future applications for DLT will also be complex.

According to interviews we conducted, some agencies and one industry 

association formed working groups to monitor and understand DLT and 

virtual currencies. These examples are listed below.

• In 2015, CFTC formed a working group on blockchain, distributed ledger 

technology, and virtual currencies to study their application to the 

derivatives market and promote understanding and communication 

across the agency. In 2017, the group broadened its focus to cover other 

aspects of fintech and changed its name to the FinTech Working Group.

• In 2016, the Federal Reserve established a working group that is looking 

at financial innovation across a broad range of responsibilities, including 

in payments and market infrastructures, supervision, and financial 

stability.

• In November 2013, SEC formed an internal Digital Currency Working 

Group to build expertise; identify emerging risk areas for potential 

regulatory, examination, and enforcement action; and coordinate efforts 

within SEC in the digital and virtual currency space. In November 2016, 

the group changed its name to reflect that its efforts had expanded 

beyond digital and virtual currencies into related distributed ledger 

technologies and their applications. According to SEC staff, the 

Distributed Ledger Technology Working Group plans to evaluate when 

and how distributed ledger technology will be used within the securities 

market.

• In 2016, FDIC established the FinTech wholesale working group of intraagency experts to monitor work in the areas of DLT, blockchain, and 

smart contracts.

• In 2015, the Chamber of Digital Commerce formed an alliance to provide 

technical assistance and periodic informational sessions on Bitcoin, other 

digital currencies, and broader uses of blockchain.150

We provided a draft of this report for review and comment to CFPB, 

CFTC, CSBS, FDIC, the Federal Reserve, FINRA, FTC, NCUA, OCC, 

SBA, SEC, and Treasury. We incorporated technical comments we 

received from these agencies, as appropriate. In addition, we received 

 150http://www.digitalchamber.org/blockchain-alliance.html. 

Agency Comments 

and Our Evaluation
Page 49 GAO-17-361 Financial Technology

written comments from NCUA and CSBS, which are summarized below 

and reprinted in appendixes II and III. 

In its written comments, NCUA acknowledged that regulators face 

challenges understanding the risk of the rapidly evolving financial 

technology industry and the challenge of balancing regulations and 

guidance to address those risks against stifling innovation. NCUA noted 

that it continues to evaluate risks and monitor the evolving market impact 

driven by fintech companies and to indirectly supervise activities through 

credit unions to the extent possible.

In its written comments, CSBS noted that it had formed a task force to 

study fintech developments and determine the potential impact on 

consumer protection, state law, and banks and nonbank entities 

chartered or licensed by the states. CSBS also provided additional 

information about the state regulatory system for marketplace lending, 

mobile payments, and distributed ledger consumer products while noting 

that the states actively license and supervise companies engaged in 

these services. CSBS also noted that the states have work under way to 

improve the Nationwide Multistate Licensing System with a technological 

overhaul to improve compliance with state licensing requirements. 

We are sending copies of this report to the congressional requesters, 

agencies, and other interested parties. In addition, this report will be 

available at no charge on our website at http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-8678 or evansl@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. GAO staff who made key contributions to this 

report are listed in appendix IV.

Lawrance L. Evans, Jr.

Director, Financial Markets and Community Investment
Appendix I: Agencies with Oversight 

Responsibilities Related to Financial 

Technology Firms

Page 50 GAO-17-361 Financial Technology

Regulation of financial technology (fintech) firms depends on the extent to 

which the firms provide a regulated service and the format in which the 

services are provided. Table 3 explains the basic functions of federal and 

state regulators and agencies with oversight responsibilities related to the 

following subsectors: marketplace lending, mobile payments, digital 

wealth management, and distributed ledger technology. 

Table 3: Federal and State Regulators and Agencies with Oversight Responsibilities Related to Financial Services Offered by 

Financial Technology Firms 

Regulator or agency Basic function

Board of Governors of the Federal

Reserve System

Supervises state-chartered banks that opt to be members of the Federal Reserve 

System, bank and thrift holding companies, and the nondepository institution subsidiaries 

of those institutions, and nonbank financial companies designated by the Financial 

Stability Oversight Council (FSOC) for consolidated supervision and enhanced prudential 

standards and certain financial market utilities designated as systemically important by 

FSOC. Supervises state-licensed branches and agencies of foreign banks and regulates 

the U.S. nonbanking activities of foreign banking organizations.

Federal Deposit Insurance

Corporation

Supervises insured state-chartered banks that are not members of the Federal Reserve 

System, as well as state savings associations and any insured state chartered branches 

of foreign banks; insures the deposits of all banks and thrifts that are approved for 

federal deposit insurance; resolves all failed insured banks and thrifts; and may be 

appointed to resolve large bank holding companies and nonbank financial companies 

that are supervised by the Board of Governors of the Federal Reserve System. Also has 

backup supervisory responsibility for all federally insured depository institutions

National Credit Union Administration Charters and supervises federally chartered credit unions and insures savings in federal 

and most state-chartered credit unions.

Office of the Comptroller of the Currency Charters and supervises national banks, federal savings associations, and federally 

chartered branches and agencies of foreign banks.

Bureau of Consumer Financial Protection Regulates the offering and provision of consumer financial products or services under 

the federal consumer financial laws. For depository institutions with over $10 billion in 

assets and their affiliates, the Bureau of Consumer Financial Protection (CFPB) has 

exclusive examination authority as well as primary enforcement authority for the federal 

consumer financial laws. CFPB also supervises certain nondepository financial entities, 

including certain kinds of mortgage market participants, private student lenders, and 

payday loan lenders, and enforces the federal consumer financial laws. The Dodd-Frank 

Act prohibits unfair, deceptive, or abusive acts or practices and CFPB enforces this

prohibition and the other federal consumer financial laws for persons under its 

jurisdiction.

Department of the Treasury Financial 

Crimes Enforcement Network 

The Treasury Financial Crimes Enforcement Network (FinCEN) implements and enforces 

the Bank Secrecy Act (BSA). FinCEN has the authority under 31 U.S.C. §5318(a)(3) to 

examine financial institutions for compliance with BSA and regulations promulgated 

under BSA at 31 C.F.R. Chapter X, as well as to take enforcement actions for violations 

of BSA and the implementing regulations under 31 U.S.C. §§ 5320-23.

Federal Communications Commission Primary regulator of interstate and international communications by radio, wire, satellite, 

and cable.

Appendix I: Agencies with Oversight 

Responsibilities Related to Financial 

Technology Firms 
Appendix I: Agencies with Oversight 

Responsibilities Related to Financial 

Technology Firms

Page 51 GAO-17-361 Financial Technology

Regulator or agency Basic function

Federal Trade Commission Maintains competition and has consumer protection enforcement authority over certain 

nonbank financial entities, including certain kinds of mortgage market participants, 

payment processors, private student lenders, and payday loan lenders, for the purposes 

of enforcing the consumer financial protection laws. The Federal Trade Commission has 

investigative and law enforcement authorities to protect consumers from unfair or

deceptive acts or practices in most sectors of the economy.

Securities and Exchange Commission Primary regulator of the securities markets, including offers and sales of securities and 

regulation of securities activities of certain participants such as securities exchanges, 

broker-dealers, investment companies, clearing agencies, transfer agents, and certain 

investment advisers and municipal advisors. The Securities and Exchange Commission’s 

(SEC) mission is to protect investors; maintain fair, orderly, and efficient markets; and 

facilitate capital formation. SEC also oversees self-regulatory organizations, such as the 

Financial Industry Regulatory Authority (FINRA). FINRA regulates the broker-dealer 

industry with the mission to pursue investor protection and market integrity. 

Commodity Futures Trading Commission Primary regulator of the derivatives markets whose mission is to protect market users 

and the public from fraud, manipulation, abusive practices, and systemic risk related to 

derivatives subject to the Commodity Exchange Act and to foster open, competitive, and 

financially sound futures markets.

State banking regulators Oversee depository and nondepository institutions for safety and soundness, consumer 

protection, and Bank Secrecy Act requirements. 

State securities regulators Oversee the securities market and have responsibility for licensing securities firms and 

investment professionals, such as broker-dealers and investment advisers, registering 

certain securities offerings, and investigating securities fraud.

Source: GAO. | GAO-17-361.
Appendix II: Comments from the National Credit Union 

Administration

Page 52 GAO-17-361 Financial Technology

Appendix II: Comments from the National 

Credit Union Administration
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 53 GAO-17-361 Financial Technology

Appendix III: Comments from the 

Conference of State Bank Supervisors
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 54 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 55 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 56 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 57 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 58 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 59 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 60 GAO-17-361 Financial Technology
Appendix III: Comments from the Conference 

of State Bank Supervisors

Page 61 GAO-17-361 Financial Technology
Appendix IV: GAO Contact and Staff 

Acknowledgments

Page 62 GAO-17-361 Financial Technology

Lawrance L. Evans, Jr. (202) 512-8678, evansl@gao.gov

GAO staff who made major contributions to this report include Harry 

Medina (Assistant Director), Lauren Comeau (Analyst in Charge), Namita 

Bhatia-Sabharwal, Chloe Brown, Pamela Davidson, Janet Eackloff, Cody 

Goebel, Davis Judson, Silvia Porres, Tovah Rom, Jessica Sandler, and 

Jena Sinkfield. 

Appendix IV: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments
Bibliography

Page 63 GAO-17-361 Financial Technology

Accenture. The Rise of Robo-Advice: Changing the Concept of Wealth 

Management, 2015.

Becker, Krista. Mobile Payments: The New Way to Pay? Federal Reserve 

Bank of Boston Emerging Payments Industry Briefing, February 2007.

BlackRock. Digital Investment Advice: Robo Advisors Come of Age,

September 2016.

Board of Governors of the Federal Reserve System. Consumers and 

Mobile Financial Services 2016. March 2016.

Board of Governors of the Federal Reserve System. Consumer 

Compliance Outlook, Fintech Special Edition, 3rd ed. Philadelphia, Pa.: 

2016.

Chamber of Digital Commerce, Smart Contracts Alliance. Smart 

Contracts: 12 Use Cases for Business & Beyond. Washington, D.C.:

December 2016.

Congressional Research Service. Marketplace Lending: Fintech in 

Consumer and Small-Business Lending. September 6, 2016. 

Consumer Financial Protection Bureau. Project Catalyst report: 

Promoting consumer-friendly innovation. Washington D.C.: October 2016. 

Crowe, Marianne; Susan Pandy, David Lott, and Steve Mott, Is Payment 

Tokenization Ready for Primetime? Perspectives from Industry 

Stakeholders on the Tokenization Landscape, Federal Reserve Bank of 

Atlanta and Federal Reserve Bank of Boston, June 11, 2015.

Department of the Treasury. Opportunities and Challenges in Online 

Marketplace Lending. May 10, 2016.

Deloitte. Digital Disruption in Wealth Management - Why Established 

Firms Should Pay Attention to Emerging Digital Business Models for 

Retail Investors, 2014.

EY, Advice Goes Viral: How New Digital Investment Services Are 

Changing the Wealth Management Landscape, 2015.

Federal Deposit Insurance Corporation. Supervisory Insights, 

Marketplace Lending. Winter 2015. 

Bibliography 
Bibliography

Page 64 GAO-17-361 Financial Technology

Federal Deposit Insurance Corporation. Supervisory Insights, Mobile 

Payments: An Evolving Landscape. Winter 2012.

Federal Deposit Insurance Corporation. 2015 FDIC National Survey of 

Unbanked and Underbanked Households. October 20, 2016.

Federal Deposit Insurance Corporation. Opportunities for Mobile Financial 

Services to Engage Underserved Consumers Qualitative Research 

Findings. May 25, 2016.

Federal Reserve Bank of Cleveland. Click, Submit: New Insights on 

Online Lender Applications from the Small Business Credit Survey. 

Cleveland, Ohio: October 12, 2016.

Federal Trade Commission Staff Report. Paper, Plastic...or Mobile? An 

FTC Workshop on Mobile Payments. March 2013. 

Financial Industry Regulatory Authority. Report on Digital Investment 

Advice. March 2016.

Financial Industry Regulatory Authority. Distributed Ledger Technology: 

Implications of Blockchain for the Securities Industry. January 2017.

Financial Stability Oversight Council. 2016 Annual Report. Washington, 

D.C.: June 21, 2016.

GAO. Person-to-Person Lending: New Regulatory Challenges Could

Emerge as the Industry Grows, GAO-11-613. Washington, D.C.: July 7, 

2011. 

GAO. Virtual Currencies: Emerging Regulatory, Law Enforcement, and 

Consumer Protection Challenges. GAO-14-496. Washington, D.C.: May 

29, 2014.

GAO. Financial Regulation: Complex and Fragmented Structure Could be 

Streamlined to Improve Effectiveness, GAO-16-175. Washington, D.C.: 

February 25, 2016.

GAO. Data and Analytics Innovation: Emerging Opportunities and 

Challenges, Highlights of a Forum, GAO-16-659SP. Washington D.C.: 

September 2016.

International Organization of Securities Commissions. IOSCO Research 

Report on Financial Technologies (Fintech). February 2017.
Bibliography

Page 65 GAO-17-361 Financial Technology

McQuinn, Alan, Weining Guo, and Daniel Castro. Policy Principles for 

Fintech, Information Technology & Innovation Foundation, October 2016.

Mills, David; Kathy Wang, Brendan Malone, Anjana Ravi, Jeff Marquardt, 

Clinton Chen, Anton Badev, Timothy Brezinski, Linda Fahy, Kimberley 

Liao, Vanessa Kargenian, Max Ellithorpe, Wendy Ng, and Maria Baird

(2016). “Distributed ledger technology in payments, clearing, and 

settlement,” Finance and Economics Discussion Series 2016-095. 

Washington: Board of Governors of the Federal Reserve System.

Mills, Karen Gordon, and Brayden McCarthy. “The State of Small 

Business Lending: Innovation and Technology and the Implications for 

Regulation.” Harvard Business School working paper 17-042 (2016).

Office of the Comptroller of the Currency. Exploring Special Purpose 

National Bank Charters for Fintech Companies. Washington, D.C.: 

December 2016.

Office of the Comptroller of the Currency. Comptroller’s Licensing manual 

Draft Supplement, Evaluating Charter Applications from Financial 

Technology Companies. Washington, D.C.: March 2017.

Office of the Comptroller of the Currency. OCC Summary of Comments 

and Explanatory Statement: Special Purpose National Bank Charters for 

Financial Technology Companies. Washington, D.C.: March 2017.

Pew Charitable Trusts. Who Uses Mobile Payments? Survey findings on 

consumer opinions, experiences. May 2016.

Professor Mark E. Budnitz. Pew Charitable Trusts, The Legal Framework 

Of Mobile Payments: Gaps, Ambiguities, and Overlap. February 10, 2016. 

Qplum. What is Robo-Advising. Jersey City, NJ: May 5, 2016.

Segal, Miriam. Small Business Administration Office of Advocacy. Peerto-Peer Lending: A Financing Alternative for Small Businesses, Issue 

Brief Number 10. Washington, D.C.: September 9, 2015.

S&P Global Market Intelligence. An Introduction to Fintech: Key Sectors 

and Trends. October 2016.

S&P Global Market Intelligence. 2016 U.S. Digital Lending Landscape. 

Charlottesville, Virginia: December 2016.
Bibliography

Page 66 GAO-17-361 Financial Technology

The Clearing House. Ensuring the Safety & Security of Payments, Faster 

Payments Symposium. August 4, 2015.

The Conference of State Bank Supervisors and Money Transmitter 

Regulators Association. The State of State Money Services Businesses 

and Regulation and Supervision. May 2016.

United Kingdom Government Office for Science. Distributed Ledger 

Technology: beyond block chain. December 2015.

United States Postal Service, Office of the Inspector General, Blockchain 

Technology: Possibilities for the U.S. Postal Service, Report No. RARCWP-16-011. May 23, 2016.

World Economic Forum. The Future of Financial Infrastructure: An 

ambitious look at how blockchain can reshape financial services. August 

2016.

(101024)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.