CFPB finalises Open Banking rule in ‘pivotal moment’ for US consumers

The Consumer Financial Protection Bureau (CFPB) has finalised the Personal Financial Data Rights rule, which it said “moves” the US closer to “a competitive, safe, secure, and reliable” Open Banking ecosystem.

Under the new rule – which is part of the CFPB’s efforts to finally activate Section 1033 of the Consumer Financial Protection Act – financial institutions, credit card issuers, and other financial providers will be required to “unlock” an individual’s personal financial data and transfer it to another provider at the consumer’s request for free.

Consumers will be able to access, or authorise a third party to access, their data associated with bank accounts, credit cards, mobile wallets, payment apps, and other financial products, such as transaction information, account balance information, information needed to initiate payments, upcoming bill information, and basic account verification information.

“Too many Americans are stuck in financial products with lousy rates and service. Today’s action will give people more power to get better rates and service on bank accounts, credit cards, and more,” said CFPB director Rohit Chopra.

Financial firms will be required to comply based on their size, with the largest institutions given a compliance deadline of April 1, 2026, while the smallest covered institutions will have until April 1, 2030. Certain small banks and credit unions are not subject to this rule.

In addition to spurring greater choice for consumers and increasing competition, the CFPB has said that the Personal Financial Data Rights rule will enable US consumers to securely share payments information, which can enable Pay by Bank.

The CFPB stated that such products enable consumers to pay merchants and peers, as well as move money between their own accounts and will, therefore, help bring greater competition to payments markets, “which have long been an area of anti-competitive practices”.

The Open Banking rule will also clamp down on “bait-and-switch data harvesting”, by ensuring that third parties can only collect, use, or retain data to deliver the product the consumer requested and that they cannot “secretly” collect, use, or retain consumers’ data for their own unrelated business reasons.

Industry hails ‘next era’ of Open Finance

“The CFPB’s final Section 1033 rule marks a pivotal moment for millions of consumers across the country, who, for the first time, have a legally binding right to access and share access to their financial data,” Steve Boms, executive director of FDATA North America, said.

“We applaud the final rule, which puts consumers in control of their financial data, allowing them to select the financial provider that best meets their needs.

“Today’s final rule does more than fulfil a long-standing need—it redefines the future of financial services in the United States, setting the stage for a more competitive, transparent, affordable, and consumer-focused marketplace for generations to come.”

He added: “We look forward to continuing to work with the CFPB and with stakeholders from throughout the financial services ecosystem to expand the framework the Bureau finalized today to include additional accounts over time, facilitating a true Open Finance system in the United States.”

FDATA North America pointed to the exclusion of Electronic Benefit Transfer (EBT) data from the scope of data included under the final rule, and urged the CFPB to include EBT data in future iterative rules “to address this gap and extend the benefits of Open Finance to lower-income individuals”.

John Pitts, Plaid’s head of policy, said: “Today’s announcement from the CFPB reaffirms that Open Banking in the US benefits consumers, promotes a healthy financial services marketplace, and should be protected by law.

“The 1033 rule will usher in a new, more consumer-centric chapter of financial services in the US and accelerate competition in payments, more inclusive access to credit, enable more advanced fraud fighting tools, and other innovations that benefit consumers. We look forward to this next era of Open Finance.”

Misha Esipov, co-founder and chief executive officer of Nova Credit, said that Section 1033 is “only going to accelerate the adoption of Open Banking”, adding that is is imperative for bank leaders to have “a concrete strategy” for how their institutions are going to adapt.

“Further adoption of Open Banking is a huge driver of cash flow underwriting, which we believe is the most transformative aspect of 1033. While the adoption of cash flow underwriting is already well underway, 1033 turns it from an innovation into a necessity for financial institutions,” Esipov said.

However, Alexandre Gonthier, founder and chief executive officer of Trustly, said that while the final rule helps solidify Open Banking by putting consumers in control of their financial data, it “fails to match director Chopra’s lofty rhetoric on encouraging competition in payments and supporting pay-by-bank”.

“We were hopeful the CFPB would reconsider its proposal to allow tokenized account numbers (TANs) to be used in place of the consumer’s ACH account and routing numbers and are concerned by the final rule’s stance,” Gonthier added.

“Our position has been clear from the beginning – we’ve seen TANs serve as a new tool for fraudsters rather than safeguarding consumer information as intended.

“Additionally, we are disappointed by the CFPB’s final rule regarding the reauthorization of data sharing by consumers every 12 months. Consumers want to eliminate the friction in the payment process, and the final rule misses the mark in this area.”

Further reading: CFPB issues rule to recognise Open Banking standard setters