CFPB revamps 1033 open banking rule with new focus on fees

The Consumer Financial Protection Bureau has done an about-face on its open banking rule, issuing a new proposal seeking comment on whether banks can charge fees for data access and if third parties can represent consumers in tapping financial data.

On Thursday, the CFPB issued a 13-page advance notice of proposed rulemaking that is expected to be published Friday in the Federal Register. 

In amending last year’s final open banking rule, the CFPB said it will focus on four specific issues: who can serve as a representative for the consumer; whether banks can charge fees to defray their costs; data security; and liability. A critical change is that the CFPB is now asking for comment on the statutory definition of a “consumer,” which the Dodd-Frank Act of 2010 defines to include an “agent, trustee or representative” acting on a consumer’s behalf. 

The CFPB took action to revamp, rather than rescind, the 1033 open banking rule after JPMorgan Chase began last month discussing charging fees to data aggregators. JPMorgan Chase has said the fees are intended to offset the costs of maintaining a secure system for protecting customer data. Banks now allege that the law only requires that they share data with a consumer, and not with third-party middlemen.  

The open banking rule finalized last year under the Biden administration does not allow banks to charge fees for data access. That rule, finalized by former CFPB Director Rohit Chopra, remains in effect but is tied up in litigation, which could complicate its implementation. The CFPB plans to issue a notice of proposed rulemaking to extend the compliance dates for the existing rule. The CFPB was granted a stay in the litigation after stating that it intended to initiate a new rulemaking in May. Because the rule was finalized, it remains current law with a compliance date of mid-2026, and that deadline has not been amended. 

The advance notice of proposed rulemaking seeks comments within 60 days on a variety of topics including fees, data security, liability for data breaches, the cost of data access and the definitions of a “consumer,” and “representative.” The CFPB aims to finalize a new rule by year-end. 

Dodd-Frank instructed the CFPB to write a rule on personal financial data rights and section 1033 of that law gives consumers control over their financial data. Yet the bureau acknowledged in its proposal that section 1033, which contains roughly 335 words, provides few details on how to implement a rule requiring that banks provide consumers with access to their credit card or bank account transaction data upon request. 

“The statutory text of section 1033 is quite sparse and does not specifically address several important questions that arise from the rights it creates,” the CFPB said in the proposal.

The bureau said it is seeking comments on “precisely who may act on behalf of the consumer,” and how costs to banks may be defrayed.

Some experts have said that the current approach differs dramatically from the final 2024 rule, when the bureau was looking at on liability, risk management and fees. There was little discussion in comment letters that a data aggregator or fintech couldn’t represent a consumer.

In addition the CFPB said it is looking at “the potential negative consequences to the consumer” of exercising their financial data rights “in an environment where there are tens of thousands of malign actors regularly seeking to compromise data sources and transmissions.”

The proposal’s language acknowledges that consumers don’t always know what they are signing up for when agreeing to allow third-party access.

The bureau said it is looking for more information on the “potential negative consequences to the consumer in exercising this right where the data contains information that the consumer may not want disclosed, but does not fully understand or realize may be disclosed by the third party through which it has made a request.”

In addition, the bureau is seeking comments on “the potential benefits to consumers or competition of facilitating the consumer-authorized transfer of data to financial technology companies, application developers, and other third parties.” 

Banks sued the CFPB last year on the same day that it issued the final open banking rule, claiming it exceeded the bureau’s statutory authority. The plaintiffs in the case, the Bank Policy Institute, Kentucky Bankers Association and Forcht Bank, a $1.5 billion-asset community bank in Lexington, Kentucky, have asked a federal court to change the compliance dates of the final rule. 

Banks’ reaction to the new rule has been largely positive. BPI, the KBA and Forcht Bank said in a statement that the new rule goes a long way toward resolving their issues with the 2024 rule.

“This rulemaking presents an opportunity for the CFPB to right the problems of the Biden-era rule by sticking to its statutory authority and putting consumers’ security first,” the statement reads. “Banks are advocating for a solution that both protects consumers and preserves marketplace innovation already underway.”

Rob Nichols, president and CEO of the American Bankers Association, said stakeholders “from every part of the data sharing chain have significant concerns with the current rule.”

Consumers need “a robust liability regime for resolving unauthorized activity or data breaches, [while] preserving data providers’ ability to safeguard data,” Nichols said, adding that the new rule would end the “dangerous practice of screen scraping that puts consumer personal information at greater risk.”

On the issue of banks charging fees, Nichols claimed that the final open banking rule amounted to “government-mandated subsidization of other companies’ business models.”

“One thing everyone can agree on is the need for a rule that follows the law; any provisions in the amended regulation must be supported by statutory language,” Nichols said in a press release. 

Rebeca Romero Rainey, president and CEO of the Independent Community Bankers of America, agreed that banks should be able to charge “reasonable fees.” Nonbank fintech firms may not take the same care in protecting consumer privacy and data that community banks do, she said. 

But ICBA also wants the CFPB to preserve a provision from the final rule that exempted small community banks from having to create and maintain a third-party developer interface.

“The nation’s community banks should not be required to bear the costs of establishing and maintaining developer portals to allow third-party companies to access consumer data,” Rainey said in a press release. 

Nichols said that banks want to “retain the positive aspects of the existing regulation, such as the role of industry standard setting for data formats and strong privacy protections to prevent the unwitting sale of consumers’ sensitive personal financial information by data aggregators.” 

It is unclear if the CFPB’s revamp would have any impact on the Financial Data Exchange, which has been officially recognized as the standard-setting body for open banking. FDX provides a framework for compliance, supports secure authentication and consumer consent management across the financial ecosystem.

Lindsey Johnson, president and CEO of the Consumer Bankers Association, said the proposal was ” a welcome step toward restoring accountability, consumer protection, and the rule of law,” claiming that the Biden Administration’s rule “stretched far beyond what Congress intended in Section 1033, mandating broad data sharing that created real risks of fraud, breaches, and consumer harm.”

In the litigation, the Financial Technology Association was granted the right to defend the final rule in lieu of the CFPB, which had refused to uphold it.

Penny Lee, FTA’s president and CEO, said the Trump administration “is calling needed attention to barriers to innovation being erected by the largest banks, especially recent threats to impose more fees on Americans who simply want open access to their own bank accounts.”

“A rule affirming consumers’ right to access and permission their data is essential as we move forward,” Lee said. “This rulemaking gives consumers, innovative banks, fintechs, and Main Street businesses an opportunity to stand up for Americans’ rights to access innovation and control their own financial data without unfair roadblocks.”

The CFPB may run into legal issues with a completely new rulemaking while the final rule still stands. Due to time constraints, the CFPB appears to be disavowing the need for a small business review, which is required under the Small Business Regulatory Enforcement Fairness Act, known as the SBREFA process. 

Because a revamped open banking rule would likely have a significant impact on small businesses, it is likely to prompt further litigation on procedural grounds under the Administrative Procedure Act. Banks have in the past stressed the importance of the SBREFA process as a way to hold the CFPB accountable. Republican lawmakers also have repeatedly emphasized the need to conduct a cost-benefit analysis of the impact on small entities, which includes fintech start-ups and crypto companies. 

Failure to follow any of the process-related statutes would be challenged as “arbitrary and capricious,” under the APA.

“Are Republicans really going to skip the small business impact evaluation portion of a major rule?” said Dan Murphy, founder of Sunset Park Advisors and former CFPB open banking program manager, who co-led the rule-writing of the final rule. 

The Trump administration’s embrace of the cryptocurrency industry also complicates matters. In order for consumers to use a crypto service more widely, they will need to onboard and offboard funds from a bank — a project that would be made far simpler with a fee-free open banking rule. When JPMorgan Chasse began charging for data access, crypto firms alerted the White House’s Crypto Czar David Sacks, which led to the CFPB’s lightning-quick response with the new open banking proposal.  

More than 100 million consumers have used consumer-authorized data access via third parties, the bureau said. 

Open banking also may complicate the Trump administration’s efforts to dismantle the CFPB. Acting CFPB Director Russ Vought, who is also the director of the Office of Management and Budget, has sought to fire 90% of the CFPB’s employees. Vought is tapping OMB staff detailed to the bureau to conduct and oversee the rule-writing process. Last week, a federal court gave the Trump administration the go-ahead to conduct reductions in force, or RIFs, though the mass firings likely are on hold while the CFPB’s union appeals.