The Latest on CFPB's Open Banking Rule

The Consumer Financial Protection Bureau’s (CFPB) open banking rule which implements Section 1033 of the Consumer Financial Protection Act (CFPA) was finalized last October. It requires depository institutions to make available certain consumer data to consumers and their authorized third parties through secure methods for data sharing. The rule also prohibits depository institutions from charging fees back to the consumer for consumer/third party access to the data. It’s important to note that credit unions (and other depository institutions) with $850 million or less in assets are exempt from the final rule.

Under the rule, credit unions must ensure they have the capability to make covered data readily available and cannot discourage or interfere with a consumer’s or authorized third party’s ability to request data. Likewise, the rule also permits credit unions to become third parties that can request a consumer’s covered data.

Credit unions (and other depository institutions) with more than $850 million are subject to the rules requirements but have varying implementation dates depending on asset size, with the largest depository institutions required to comply first. For example, the compliance date for depository institutions with more than $250 billion in assets is currently set for April 1, 2026; and for depository institutions with assets more than $850 million but less than $1.5 billion, their compliance date is not until April 1, 2030.

The rule had an effective date of January 17, 2025, so it was not subject to the hold put in place by the Trump Administration for rules that were not yet in effect. However, the tiered implementation schedule is on hold, pending a review of the 1033 rule by the Trump Administration.

In case it is helpful, below are a few key points regarding the 1033 rule.

• It does not apply to depository institutions with less than $850 million in assets.
• Implementation for larger depository subject to the rule currently have compliance dates that stretch from April 1, 2026, to April 1, 2030.
• Secure data sharing methods (such as standardized application programming interfaces or APIs) must be in place to allow third parties to securely access consumer information (for deposit accounts, payment services, and credit cards) that the consumer wants to share.

As reported in the press, the Trump Administration has the open-banking (1033) rulemaking on its radar and is considering re-working the rule – because depository institutions subject to the rule are concerned that they could be liable in the event of data breaches (under the rule depository institutions cannot deny third party access in the event of security concerns). It is still unknown whether the Administration will decide to rework/rewrite the 1033 rule or vacate it.

Also of interest is the rule is being challenged in court with the claim that the rule is “arbitrary and capricious” and violates the Administrative Procedures Act. The existing lawsuit was filed upon the CFPB finalizing the rule in October 2024 by three parties representing depository institutions. However, a group representing the fintech industry supports CFPB’s rule and filed a motion to intervene. As of last week, a judge granted the fintech group’s request to intervene so there will be more to come in a few weeks.

You may have heard that the Trump Administration nominee to run the CFPB has been withdrawn. It was announced that Jonathon McKernan has been nominated to serve as the Under Secretary of Domestic Finance at the U.S. Department of Treasury. Russell Voight currently remains in the position as acting director of the CFPB. A new nominee for the CFPB has not yet been named.

While the status of the 1033 rule isn’t all that clear, keep in mind depending on how things play out, state attorneys general and regulators have the authority under Section 1042 of Dodd-Frank to enforce CFPB final rules so state attorneys general could take action against depository institutions for failure to comply with the data sharing requirements.

The final rule summary on the October 2024 open banking rule is available here.