WASHINGTON—As the CFPB pushes through a new rule on open banking before the year ends, analysts see the regulation as additional compliance burden for FIs, and perhaps a bigger problem for large banks, which also have more accounts to lose with consumers having greater ability to shift from institution to institution.
And one economist is warning about unintended consequences from the rule.
The CFPB, on the other hand, is touting the Personal Financial Data Rights Rule—which will begin to be phased in during 2026—as a boon for consumers. The rule, which applies to FIs greater that $850 million in assets, requires financial institutions, credit card issuers, and other financial providers to make certain personal data regarding financial products and services available to consumers and to authorized third parties for free at the consumer’s request.
“This will be an important step toward a more open and decentralized market for financial services,” stated CFPB Director Rohit Chopra, in prepared remarks delivered Tuesday at the at the Federal Reserve Bank of Philadelphia Fintech Conference. “In today’s economy, the problems in banking are similar to problems that we see in other sectors. Rather than innovate on providing the best products at the best prices, companies have found new ways to boost their profits.”
Chopra said switching a bank account or credit card now involves the risk of “screwing up” an auto-debit for a bill or incurring an unwanted fee.
Rohit Chopra
“People are even warned that canceling an account might hurt their credit score or their ability to get another loan,” he said. “It’s no surprise that for millions of people across the country, they’re still using the same credit card that they first got when they became an adult. I know I’m guilty of this…To make our banking and payments market more competitive, it needs to be open and decentralized using a common set of data standards, free of powerful gatekeepers and middlemen that can impose private regulations and extract fees.”
The rule’s key points:
- Only banks and credit unions with more than $850 million in assets, and non-depository entities of any size, are required to provide data under the rule
- Compliance with the rule will be implemented over a longer period of time. Data providers will be required to comply based on their size at various tiers, with larger providers subject to the rule sooner than smaller ones. “All data providers will have more time to comply. For example, the largest institutions will have to comply by April 2026, while the smallest covered data providers will have until April 2030. The final rule also adds a compliance tier, for a total of five tiers rather than four,” the CFPB said
- The final rule clarifies that it is permissible for authorized third parties to use consumer-authorized data to improve the product or service that the consumer requested without obtaining a separate authorization
- The final rule clarifies that while tokenized account numbers (TANs) are permitted, they cannot be deployed in an anti-competitive manner
- The final rule makes adjustments to the performance requirements that banks and other data providers need to meet with respect to data access
Consumer Data Privacy Protected
The Bureau emphasized consumer data privacy is protected under the new rule, which the agency noted is required under Section 1033 of the Consumer Financial Protection Act.
“The CFPB’s rule conditions data access on strong privacy provisions that prohibit third parties from using the data for any reason other than to provide the product the consumer requested. Banks and other data providers won’t be able to block access to restrict competition, and they will need to provide access that is reliable and in readily useable formats,” the agency stated. “When a person revokes access, the rule requires that data access end immediately, and deletion would be the default practice. Access can be maintained for no more than one year, absent the individual consumer’s reauthorization. When the consumer wants to revoke access, the process must be simple and straightforward.”
The rule also requires that personal financial data can only be used for the purposes requested by the consumer, the CFPB said.
“It ensures that third parties cannot use consumer data for other purposes that benefit the third party, but that consumers do not want. It also helps move the industry away from ‘screen scraping,’ a still common but risky practice that typically involves consumers providing their account passwords to third parties who use them to access data indiscriminately through online banking portals,” the CFPB said.
The Bureau also explained that third parties can only collect, use, or retain data to deliver the product the consumer requested.
“They cannot secretly collect, use, or retain consumers’ data for their own unrelated business reasons—for example, by offering consumers a loan using consumer data that they also use for targeted advertising. The rule does not prohibit any particular uses of data, but it requires that all use be driven by what is necessary to deliver the product sought by the consumer,” the agency said.
When a person revokes access, the rule requires that data access end immediately, and deletion would be the default practice. Access can be maintained for no more than one year, absent express reauthorization.
“To prevent ‘dark patterns’ from emerging, the process to revoke access must be simple and straightforward,” the Bureau stated.
Pay-By-Bank
The rule is also expected to boost pay-by-bank in the U.S. Pay-by-bank is a payment method that allows consumers to pay for goods and services directly from their bank account, rather than using a debit or credit card.
Dennis Dollar
“The rule ensures consumers are able to securely share payments information, which can help enable what is sometimes referred to as pay-by-bank. Such products enable consumers to pay merchants, peers, and others, as well as move money between their own accounts. The rule will help bring greater competition to payments markets, which have long been an area of anti-competitive practices,” the CFPB said.
Regulatory Burden
Former NCUA Chairman Dennis Dollar believes the rule will create a great deal of work for financial institutions.
“The rule itself, in my view, certainly is going to be a compliance nightmare because of the record keeping of opt-ins and opt-outs—but it won’t necessarily be bad for credit unions,” said the Dollar Associates principal. “History has shown us that more big bank customers move to credit unions for better service, rates and fees than the other way around.”
Dollar said the rule is likely to be challenged in court by the big banks, “who actually have more compliance issues because of the number of account holders and millions more customers potentially to lose than credit unions. With the Supreme Court recently overruling the Chevron Doctrine that gave automatic deference to federal agencies, there is always the possibility that litigation could tie up the rule for a while, just as is happening with the credit card late fee price-fixing rule, and is almost certain with the upcoming overdraft fee price-fixing rule.”
Michael Moebs, economist and chair of Moebs $ervices, sees FI’s regulatory costs rising with the rule.
“This rule has been a long time coming,” said Moebs. “Overall, this rule is positive as it intends to give the consumer more control and access to their digital data dealing with financial institutions and fintechs related to financial services, payment channels/apps/infrastructure. In addition, the reinforced privacy protections and standards for handling sensitive consumer data is also welcomed. Yet, with any new regulation there will be a regulatory cost and burden imposed on banks and credit unions, which ultimately will be passed on to the consumer. In addition, the rules will provide the government access to a lot of personal consumer data.”
Michael Moebs
Dollar noted that the open banking rule will not be the end of the CFPB’s rulemaking in 2024.
“This will not be the last final rule we see pushed through before the election—or at least before the next administration,” said Dollar. “Since the president, whoever it may be, can remove the CFPB director and the election polls are so close, you’ll see CFPB and other agencies whose head serves at the will and pleasure of the president rushing to get every new regulation they have been working on for years finalized and in place. Of course, a new administration and CFPB director can delay or revise the rules—but he or she will have to go back through the comment process again.”
Moebs concurred.
“While the rule is positive overall, there is sure to be unintended consequences yet to be determined,” said Moebs. “More importantly, still looming is the CFPB’s anticipated actions on junk fees—such as, overdrafts, NSF and other financial service fees.”
The CFPB noted that the rule is the Bureau’s first significant rule to “accelerate responsible open banking” in the U.S., and the agency will be developing additional rules to address more products, services and use cases.
ACU Responds
America's Credit Unions is asserting the rule reduces FI data to a "commodity."
“From a few lines of text concerning consumer data portability in Dodd-Frank, the CFPB has spun a weighty rule intended to reengineer financial sector competition. The rule demands that credit unions share, at no cost, information with fintechs and other third parties who receive permission from consumers," said ACU president and CEO Jim Nussle. "In doing so, the CFPB reduces one of the most valuable assets of a financial institution, its data, to a commodity, which will likely put even greater competitive pressure on credit unions to merge. While we appreciate the CFPB’s willingness to exclude the smallest credit unions from the scope of the final rule, consistent with our request for greater relief, our concerns related to risk management, downstream fraud, and the ability to defray the cost of maintaining APIs without charging fees remain present. This rulemaking reinforces the need for CFPB reforms to ensure accountability and oversight – the Bureau stepped far outside the lines made by Congress that will ultimately jeopardize consumers’ access to safe financial institutions like credit unions.”