CFPB Seeking Comments on Open Banking

The Consumer Financial Protection Bureau (CFPB) is issuing an Advanced Notice of Proposed Rulemaking seeking comments on its 2024 open banking rule. The comment period will last for 60 days, offering an opportunity for banks, fintechs, and other institutions to shape the rule. The CFPB obtained a stay in federal court litigation last month over the rule when it said it would revise the rule on an expedited timeline.

Four of the CFPB’s questions align with concerns that banking plaintiffs had when they filed a lawsuit in October 2024. “The statutory text of section 1033 is quite sparse and does not specifically address several important questions that arise from the rights it creates,” reads the advanced notice of proposed rulemaking.

The CFPB wants to address the proper understanding of who can represent the consumer and how to settle the costs of providing financial data to a “covered person” in responding to a request from a consumer. The Bureau is also seeking comment on the threat of data privacy and security with Section 1033 of the Dodd-Frank Act that requires open banking. 

“The statutory text of section 1033 of Dodd-Frank provides that, subject to rules issued by the CFPB, consumers shall have access to requested information in the control or possession of financial entities relating to the products or services obtained from those financial entities,” said the CFPB, according to Consumer Finance Monitor. 

The fate of open banking recently gained new urgency for fintechs when the largest U.S. bank, JPMorgan Chase, informed data aggregators of new fees to access consumers’ financial information, which could add hefty costs to fintechs seeking to lure consumers away from banks.

Many banking trade groups support the CFPB’s decision to reopen the rulemaking process. Lindsey Johnson, President and CEO of the Consumer Bankers Association called it “a welcome step toward restoring accountability, consumer protection, and the rule of law.”

The current open banking rule is set to take effect in mid-2026 for the largest banks, with compliance deadlines for other banks set through 2030. Financial institutions with less than $850 million in assets are exempt from the rule.