Summary:

Situation Overview: On 21 August, the Consumer Financial Protection Bureau (“CFPB”) issued an Advanced Notice of Proposed Rulemaking (“ANPR”) regarding Section 1033 of the Consumer Financial Protection Act.

What: Many fintech companies, data aggregators, and other non-banks have expressed support for the Section 1033 final rule issued in October 2024, which requires covered financial institutions to provide data to authorized third parties without imposing fees. On the other hand, a number of banks and other depository institutions have continued to express concerns with data security and to assert the appropriateness of charging data access fees to third parties.

Who: The CFPB’s final rule for Section 1033 will significantly impact “open banking,” meaning authorized third-party access to a customer’s financial information.

In Depth

The Trump administration’s CFPB leadership has rolled back a series of Biden-era initiatives. As part of this deregulatory push, on 30 May, CFPB leadership signaled its intent to change course on the rulemaking mandated by Section 1033, notwithstanding prior issuance of a final regulation. Following an 11 July report by Bloomberg that JPMorgan Chase & Co. would begin charging third parties fees for access to customer data, some industry participants – including fintechs and data aggregators – sent an open letter to the President requesting that he “protect open banking.” On 29 July, the CFPB stated its intent “to initiate a new rulemaking,” with the 21 August ANPR constituting the first step in this process.

Section 1033

Section 1033 of the Consumer Financial Protection Act is titled “Consumer Rights to Access Information.” It states, “a covered person shall make available to a consumer, upon request…information relating to any transaction, series of transactions, or to the account including costs, charges and usage data.” Exceptions are made for some information, including data that is confidential or difficult to retrieve “in the ordinary course of business.”

The Final Rule

The CFPB issued a final rule for Section 1033 on 22 October 2024. Notably, it required that covered persons provide requested customer data to not only a customer but also to “an authorized third party.” Such third parties could include data aggregators, thus enabling them to move beyond rudimentary “screen scraping.” Importantly, the final rule also prohibited “any fees or charges on a consumer or an authorized third party” for making available requested data.

Reaction to the final rule

Many fintech companies and data aggregators praised the final rule. For example, Betterment issued a statement describing the final rule as “an important step in expanding access to innovative and affordable financial services.” Conversely, the day the rule was announced, Forcht Bank, N.A.; the Kentucky Bankers Association; and the Bank Policy Institute jointly filed a lawsuit against it. They argued that the CFPB was “overstepping its statutory mandate” and that the regulatory framework was “fundamentally unsafe” in its treatment of third-party risk. The plaintiffs noted the “substantial progress” market participants had already made toward open banking through “secure data-sharing practices.” They argued that the rule unfairly banned banks from charging fees to “recoup…costs to the third-party fintechs and aggregators who will profit from the new framework.”

Trump administration’s treatment of 1033 final rule

After successfully submitting a motion to stay the litigation brought by the banking organizations on 25 February, the CFPB filed a motion for summary judgement on 30 May requesting that the rule “be set aside” as it “exceeds the Bureau’s statutory authority.”

On 11 July, Bloomberg reported that JPMorgan Chase & Co. (“JPMC”) “has told financial-technology companies that it will start charging fees amounting to hundreds of millions of dollars for access to their customers’ bank account information.” While the rationale behind JPMC’s reported fee structure is not clear, it is possible that it was related to the CFPB’s departure from the Section 1033 final rule. On 23 July, a group of trade associations – including fintech companies, digital asset companies, and community bankers – sent a joint letter to President Trump requesting he uphold the rule.

On 29 July, the CFPB requested a stay of proceedings “[in] light of recent events in the marketplace.” It promised “to initiate new rulemaking…with a view to substantially revising [the final rule] and providing a robust justification.” The CFPB issued an ANPR on 21 August, requesting public comment on who qualifies as a “representative” for customers, how to properly defray costs related to the provision of customer data, and what concerns persisted over data privacy and security.

Debates surrounding Section 1033

The crux of the debate surrounding Section 1033 is whether it requires covered persons to provide data access to customer-authorized third parties as well as customers. If Section 1033 does extend to those third parties, the CFPB will have to decide which ones actually qualify, to what extent they are exempt from fees, and their data security responsibilities.

Ultimately, CFPB leadership will have to balance the Trump administration’s deregulatory agenda and its desire for innovation within the financial services industry (as evidenced by its actions regarding digital assets). In addition, any final rule may face continued legal challenges from those dissatisfied with how this balance is struck in the context of Section 1033.

Put Patomak’s Expertise to Work

Regardless of the requirements of a new final rule, market participants should be prepared to implement significant changes to their third-party and data risk management frameworks. Furthermore, market participants should expect possible action from state regulators, which have become increasingly proactive in matters dealing with data privacy and security. If you would like to learn more about how Patomak can partner with you to not only follow but stay ahead of these changes, please reach out to Jim Carley at jcarley@patomak.com, Mona Elliot at melliot@patomak.com, or Andrew Bonney at abonney@patomak.com.