The Consumer Financial Protection Bureau’s (CFPB) open banking rules, issued under Section 1033 of the Dodd-Frank Act, have been the subject of ongoing litigation since their finalization late last year. The litigation is notable for several reasons, one of which is the procedural posture. Initially, several banking trade associations sued the CFPB, claiming that the rule was arbitrary and capricious, and exceeded the CFPB’s statutory authority. Subsequently, the new CFPB leadership indicated that they would not support the rule in court. In response, a FinTech trade association sought and was granted intervenor status in the litigation, stepping into the CFPB’s shoes to defend the rule. The CFPB then reversed its position entirely, aligning with the banks in filing a motion to dismiss and vacate the rules.
In the latest development, on July 29, 2025, the CFPB filed a motion to stay the proceedings, stating that the CFPB would initiate a new rulemaking to substantially revise the existing rules on an “accelerated” timeline, committing to file an advance notice of proposed rulemaking (ANPR) in the next three weeks. The stay was granted, and the CFPB will be required to file status reports with the court every 90 days. This litigation will continue to cast a shadow over both the CFPB and the market as revised rules are debated.
This marks yet another reversal by the CFPB on the appropriate path to address the policy issues presented by open banking. What the agency intends to keep, revise, or remove from the existing rules is unclear. While the administration has focused on deregulatory efforts to eliminate rules, often as quickly as possible, promulgating rules under the Administrative Procedures Act (APA) requires diligent work that ordinarily takes years to complete. Every policy choice in a revised 1033 rule will be subject to scrutiny by market participants who are seemingly willing to litigate if they are not satisfied. It is critical that the CFPB clearly documents its process and rationale in the regulatory record; however, it is unclear whether the CFPB will be able to do so in a manner that can withstand scrutiny under the APA, given its limited staff.
In any case, the CFPB’s tacit acknowledgement that some regulatory framework around open banking is necessary – and that some rules would be better than no rules – is a notable development.
In the meantime, the compliance dates in the existing rule remain effective and are rapidly approaching, with the first compliance dates for large data providers scheduled for June 2026. The FinTech trade association consented to the case being stayed on the condition that the court not further stay the compliance deadlines. While the CFPB could issue interim final rules to extend the existing 1033 compliance dates, as they have done for other rules (see 90 FR 25874), such an extension could have implications in the pending litigation.
Stay tuned for more developments, and read these tips on what companies can do while the CFPB’s 1033 rules hang in legal limbo.
