On August 21, the Consumer Financial Protection Bureau published an advance notice of proposed rulemaking (ANPR) in the Federal Register to reconsider its Personal Financial Data Rights Rule under Section 1033 of the Dodd-Frank Act. The Bureau stated that it is reopening the rule in light of policy changes under new leadership and a court-ordered stay in ongoing litigation challenging the 2024 final rule.
The rule (previously discussed here and here), which is currently being challenged by banking trade associations, requires financial institutions and other covered persons to make transaction and account data available to consumers and their authorized third-party representatives. The Bureau is now seeking comment on four central issues:
- Scope of representatives. Whether the term “representative” under Section 1033 should be limited to fiduciaries or extend to third-party fintechs.
- Defrayment of costs. Whether data providers should be permitted to charge fees to offset compliance and operational expenses.
- Data security. Whether the rule’s existing Gramm-Leach-Bliley Act–based standards and screen scraping restrictions are adequate.
- Privacy concerns. The risks associated with licensing, sale, and third-party use of sensitive consumer financial data.
Comments on the ANPR are due October 21, 2025.
Putting It Into Practice: The ANPR formalizes the Bureau’s decision to revisit its open banking framework. The Bureau also confirmed that it intends to extend compliance dates, which were originally set to begin in mid-2026. Market participants should anticipate further revisions and prepare for potentially significant changes to data access and privacy obligations. We will continue to monitor for future developments.
