On August 21, the Consumer Financial Protection Bureau (CFPB or Bureau) took a significant step forward in its reconsideration of the Section 1033 open banking final rule, originally issued in November 2024, by issuing an Advance Notice of Proposed Rulemaking (ANPR). This move follows the Bureau’s announcement that it would be reopening the rulemaking process when it requested a stay to the original rule amidst legal challenges.
As discussed here, the CFPB recently decided to stay the Section 1033 rule, which mandated certain financial institutions to provide consumers and authorized third parties with access to their financial data.
The ANPR attempts to gather public input on the following four pivotal issues:
Scope of Representation:
- As the term is used in Section 1033, a “consumer” is defined as an individual or an agent, trustee, or representative acting on behalf of an individual. The CFPB is exploring the definition of “representative” in the context of who can request data on behalf of consumers. Key questions include:
- What is the plain meaning of the term “representative,” and does the current rule’s interpretation align with this meaning?
- Should the term “representative” be restricted to those with fiduciary duties, or should it encompass a broader range of third parties?
- How might different interpretations of “representative” impact consumers’ ability to transfer data and the competitive landscape for financial technology companies?
Cost Defrayment:
- Under the current Section 1033 rule, a data provider must not impose any fees or charges on a consumer or an authorized third party in connection with establishing or maintaining the required consumer and developer interfaces or receiving requests or making available covered data in response to requests. The Bureau is reconsidering its stance on prohibiting fees for data access and seeks input on cost-sharing mechanisms. Questions include:
- Does the prohibition on fees accurately reflect the legislative intent of Section 1033?
- What are the estimated fixed and marginal costs for financial institutions to comply with data access requests, and how do these costs vary by institution size?
- Should covered persons be allowed to recover costs, and if so, should there be a cap on the rates they can charge?
Data Security:
- Under the Section 1033 rule, several types of covered persons are engaged in the use, retention, and transmittal of consumer financial data. Thus, adequate information security standards and controls must be in place to guard against malicious actors. Key questions the Bureau is asking include:
- Are the current protections under the Section 1033 rule sufficient to safeguard consumer data?
- What are the costs associated with establishing a secure information architecture, and how do these costs scale with the size of the institution?
- How do fiduciary relationships influence the cost-benefit analysis of information security measures?
Data Privacy:
- Subpart D of the Section 1033 rule required third parties to obtain a consumer’s express informed consent to access covered data on behalf of the consumer, prescribed what a third party must disclose to a consumer, and limited a third party’s collection, use, and disclosure of covered data. The Bureau is now seeking comments on:
- Are the current privacy protections adequate, and what improvements could be made?
- How prevalent is the practice of licensing or selling consumer data, and what are the typical consent mechanisms?
- What percentage of users actually read and understand privacy notices, and how does this impact consumer awareness and consent?
In the ANPR, the CFPB also announced plans to issue another Notice of Proposed Rulemaking to extend the compliance dates under the Section 1033 rule.
The CFPB is inviting stakeholders to submit their comments within 60 days of the ANPR’s publication in the Federal Register. Comments can be submitted electronically via the Federal eRulemaking Portal or by email.
