){kind=logo}
The Consumer Financial Protection Bureau (CFPB) in October issued a final rule for personal financial data rights, referred to as the “open banking” rule because it requires banks, credit unions and other financial service providers to make consumer data available upon request to consumers and authorized third parties in a secure and reliable manner. This rule also establishes obligations for third parties accessing this data and promotes an open and inclusive industry standard for the consumer-directed exchange of personal financial data
Following the issuance of the final rule, the Washington, D.C.-based Bank Policy Institute, along with its Kentucky-based counterparts, filed a lawsuit in Kentucky federal court challenging the new rule as overreaching and “fundamentally irrational.” The lawsuit complaint alleges that the CFPB lacks statutory authority for its open banking mandate and that imposing it risks undermining emerging private sector efforts to facilitate safer financial data-sharing for consumers.
Who (and what) is covered by the final rule?
The rule requires data providers—the covered banks, credit unions and other financial service providers—to electronically share covered data (e.g., transaction details, account balances, basic account verification and other consumer financial data) related to covered financial products and services, including bank debit accounts, credit card accounts and the facilitation of payments from those accounts, with consumers and authorized third parties. Depository institutions with total assets at or below the U.S. Small Business Administration (SBA) size standard for their North American Industry Classification System (NAICS) code are exempt from this requirement.
What is the CFPB’s intended purpose of the final rule?
The rule aims to 1) empower consumers by allowing them to access their account data from data providers and authorize third parties to access their data; 2) promote competition through standardization; 3) prevent the dominance of existing data providers and intermediaries; and 4) protect consumers against unfair, deceptive and abusive practices.
What are the key provisions of the final rule?
Access Requirements: The final rule mandates that data providers must provide access to the covered data in compliance with the following access requirements:
- Reliability and Security: Data providers must provide covered data reliably and securely to promote competition.
- Standardization: Data providers must provide covered data in a standardized, machine-readable format and a commercially reasonable manner.
- Frequency of Access: Data providers cannot unreasonably limit the frequency of data requests.
- Prohibition of Screen Scraping: Data providers cannot use screen scraping (using consumer credentials to log in and retrieve data) to comply with data access requirements.
- No Fees: Data providers may not impose fees or charges for data access.
- Public Disclosure: Data providers must publicly disclose certain information to facilitate data access and promote accountability.
Authorized Third Parties: The final rule mandates that to become an authorized third party, a third party must:
- Provide Authorization Disclosure: Give the consumer a disclosure with key terms of data access.
- Certify Obligations: Include a statement certifying the third party’s compliance with specific obligations.
- Obtain Consent: Secure the consumer’s express informed consent, either electronically or in writing.
- Limit Collection: Limit data collection, use and retention to what is necessary for the consumer’s requested service. Activities like targeted advertising and data selling are excluded.
- Annually Renew the Authorization: The authorization is valid for up to one year, after which a new authorization is needed. If the consumer revokes consent, the third party must stop collecting and using the data unless it’s still necessary for the service.
- Establish Policies: Have policies ensuring accurate data handling.
- Implement an Information Security Program: Implement an information security program compliant with the Gramm-Leach-Bliley Act (GLBA) Safeguards Framework.
- Allow Revocation: Allow consumers to revoke authorization and notify relevant parties upon revocation.
- Ensure Compliance: Confirm other third parties comply with these obligations through contractual agreements.
Data Aggregators: The final rule mandates that data aggregators are allowed to handle authorization procedures on behalf of authorized third parties seeking consumer authorization. However, the authorized third party remains responsible for compliance. If a data aggregator is used, it must certify to the consumer that it will meet the authorized third party obligations, except for informing consumers and providing the authorization disclosure, contact information and a revocation mechanism. This certification can be included in the authorization disclosure or provided separately. The authorized third party’s authorization disclosure must also include the data aggregator’s name and a description of its services related to accessing the consumer’s data.
Policies, Procedures and Recordkeeping
- Data Providers: Must have written policies and procedures to ensure the availability of covered data, proper response to developer interface access requests, accuracy of data transmitted and record retention.
- Third Parties: Defined as covered persons or service providers under the Consumer Financial Protection Act; must maintain records proving compliance for at least three years after obtaining the consumer’s most recent authorization.
- Data Aggregators: Must maintain records proving compliance for at least three years after obtaining the consumer’s most recent authorization.
What are the key takeaways from the final rule?
If the final rule withstands the legal challenge, then data providers, authorized third parties and data aggregators should take several steps to prepare for compliance. including, but not limited to:
|
Business Type |
Key Takeaways |
| Data Providers |
1. Develop and Implement Policies and Procedures
2. Standardize Data Formats
3. Review and Update Systems
4. Train Staff
5. Prepare for Public Disclosure
6. Conduct Legal and Compliance Reviews
7. Develop Consumer Communication Strategies
8. Establish Record Retention
|
| Authorized Third Parties |
1. Understand Authorization Requirements
2. Certify Compliance
3. Implement Security Measures
4. Develop Consumer Communication Strategies
5. Establish Recordkeeping Practices
6. Prepare for Data Aggregator Collaboration
7. Review and Update Contracts
8. Train Staff
|
| Data Aggregators |
1. Understand Authorization Requirements
2. Implement Security Measures
3. Develop Consumer Communication Strategies
4. Establish Recordkeeping Practices
5. Review and Update Contracts
6. Train Staff
7. Collaborate With Third Parties
|
When does the final rule become effective?
The effective date of the final rule is 60 days after the rule is published in the Federal Register. The CFPB proposed this effective date and did not receive any comments. As set forth in 12 CFR 1033.121, data providers must comply with the requirements of this rule beginning on April 1, 2026. Compliance with the rule will be phased in between April 1, 2026, and April 1, 2030, based on the size of the financial institution. Larger providers must comply by April 1, 2026, while smaller institutions have until April 1, 2030.
-
Of Counsel