The Consumer Financial Protection Bureau (CFPB) has announced a full reversal on its October 2024 open banking rule under Section 1033 of the Dodd-Frank Act. Instead of defending the rule, the agency filed a recent motion asserting the regulation is unlawful and must be vacated. The CFPB now intends to launch a wholly revised rulemaking process with an advanced notice of proposed rulemaking issued within weeks.
Stakeholders across the banking and fintech spectrum now await a substantial rewrite that addresses past legal objections while potentially reshaping access rights, fee prohibitions, and data-sharing protocols.
Why the CFPB Reversal Matters
Financial institutions and trade groupsincluding the Bank Policy Institute, Kentucky Bankers Association, and Forcht Bankpromptly sued to block the 1033 rule, accusing the agency of overstepping its statutory authority and undermining data security. The original regulation had banned banks from charging for third-party data access and mandated API-based consumer data sharing.
Under new CFPB leadership, the Bureau now agrees the rule lacked legal justification. The court granted a stay on litigation and required status reports every 90 days. Many expect the revised version to be narrower, addressing banks’ concerns while preserving consumer data rights.
Global Open Banking Regulation: Broader Context
While the US rule awaits revision, more than 60 jurisdictions worldwide have implemented open banking or open finance frameworks. In the UK and EU, Payment Services Directive 2 (PSD2) and proposed Financial Data Access (FiDA) regulation continue evolving. Australia’s Consumer Data Right expands open banking securely across sectors.
Even in markets like India, a hybrid model of central APIs via account aggregators supports trusted data flow. These global frameworks emphasize structured consent, API standardization, and fee models that balance data provider costs with consumer rights.
Recent Related Developments
- JPMorgan recently announced charges for data aggregators such as Plaid and Finicity, highlighting friction around access fees.
- Fintech associations warn rollback of open banking could stifle innovation and entrench bank control over consumer financial data.
- In the UK, regulators face tensions with government over fintech policy, exemplified by Revolut’s delayed license and political pressure.
These global dynamics underscore the larger debate: protecting consumer data access versus preserving institutions’ operational and security prerogatives.
Section 1033 Original Rule: What It Required
The October 2024 rule mandated:
- Consumer and authorized third-party access to account data via secure APIs
- Phase-in deadlines between April 2026 and 2030
- Fee prohibition to access data
- Data limited to necessary services
- API-based access forbidding screen-scraping
Nearly immediately, legal challenges were filed citing overreach and data liability concerns. The CFPB now advocates revising or replacing these mandates entirely.
Key Implications by Stakeholder
Banks and credit unions
They may avoid costly system build-outs if rule is narrowed. However, statutory obligations still require some form of standardized access.
Fintech companies and data aggregators
They risk losing access to consumer-permissioned data. They actively seek to influence upcoming rulemaking to preserve at least limited API-based data flows.
Consumers
They face uncertainty: original promises of free data portability may be delayed or altered. Final policy may offer protections but with narrower scopes or conditional access structures.
Regulatory Compliance Challenges
Financial institutions must prepare for multiple scenarios:
- Systems built to meet API deadlines may require reconfiguration or delay.
- Compliance teams must monitor ANPR publication and submission timelines.
- Institutions may still need to implement consent protocols, privacy safeguards, and secure third-party integrations.
Fintech firms should model how future rules could affect data access thresholds, accreditation processes, and revenue models if fee limits are reinstated.
Global organizations also should align US developments with parallel efforts in EU FiDA regulation, UK smart-data frameworks, and Australia’s CDR, ensuring consistent cross-border compliance strategies.
Sector Examples: A Global Comparison
| Region | Approach to Open Banking/Open Finance |
|---|---|
| UK / EU | Hybrid regulatory architecture; PSD2 now sets standards, FiDA could expand access and identity frameworks. |
| Australia | CDR mandates broad data-sharing rights across finance, energy, and telecom sectors. |
| India | Centralized API architecture with regulated “account aggregators” mediating data access. |
| US (CFPB) | Original rule required free API access; now paused and under rewrite following legal challenges. |
Globally, regulators grapple with balancing consumer control, innovation, and operational complexity. The US pivot underscores the importance of legal authority and policy clarity.
Proposed New Rule: What Might Change
Signs point to possible adjustment in key areas:
- Fee structures: rule may allow reasonable cost recovery rather than strict fee prohibition
- Access limits: institutions below certain asset thresholds may face exemptions or modified deadlines
- Liability framework: stronger privacy and security provisions required for data-sharing agreements
- Scope of data: definition of permissible data transfer may narrow to core transactional and payment information
Expect the CFPB to solicit comments on these areas when ANPR appears imminently.
Preparing for the Revised Rulemaking Process
Organizations can take several proactive steps:
- Map current APIs, data flows, and vendor partnerships to assess readiness.
- Monitor ANPR release and submit thoughtful public comments on scope, consumer consent, and cost models.
- Engage legal counsel to evaluate Section 1033 interpretations and risk exposure.
- Benchmark global open finance frameworks to anticipate alignment opportunities.
- Design modular systems that adjust quickly to policy shifts in access protocols or security standards.
Why This Matters Beyond the US
Even absent final US policy, open banking standards globally influence cross-border fintech interoperability. Harmonizing with international API and consent protocols positions companies to serve global markets and avoid costly reworking.
For multinational banks, aligning US, EU, UK and Australia requirements creates efficiency and investor confidence. For fintech innovators, enforcing compatible consent, security, and data portability measures supports consumer trust and expansion.
What Key Parties Should Watch Next
- Publication of the ANPR in coming weeks
- The public comment period, likely prompting responses from banks, credit unions, fintech firms, consumer advocates
- Revised proposed rule draft reflecting balanced approach to access, fees, liability, and timelines
- Subsequent litigation challenging new rule if deemed unlawful or overreaching
Conclusion
The CFPB’s reversal signals a major policy and legal realignment in open banking regulation. While the original 1033 rule offered wide consumer access, legal vulnerabilities and industry resistance forced a recalibration. As the agency embarks on an accelerated rulemaking process, firms must engage proactively in shaping the future regulatory environment.
By closely monitoring regulatory developments, aligning global compliance strategies, and preparing for multiple outcome scenarios, banks and fintech firms can strengthen CFPB compliance and remain ready for change.
Meanwhile, consumers continue to await a future rule that balances data portability rights with meaningful protections against misuse.
