The CFPB finalized a rule Wednesday outlining the process by which a standard setting organization (SSO) gains recognition from the bureau. The rule supplements an October 2023 Personal Financial Data Rights proposal by describing in greater detail how an SSO will apply to the CFPB for recognition and issue consensus standards when the full section 1033 rule is finalized.
America’s Credit Unions’ legacy organizations wrote the October proposal “goes far beyond any reasonable interpretation” of section 1033 of the Dodd-Frank Act and recommended multiple changes. The CFPB noted in Wednesday’s release it will finalize the data rights proposal “in the coming months.”
The new rule identifies the attributes that SSOs must demonstrate to be recognized by the CFPB.
To be recognized by the CFPB, the SSOs must apply to the CFPB and display the following attributes:
- Open to all interested parties, including public interest groups, app developers, and a broad range of financial firms with a stake in open banking;
- Procedures must be transparent to participants and publicly available;
- The decision-making power to set standards must be balanced across all interested parties, including consumer and other public interest groups. There must also be meaningful representation for large and small commercial entities;
- Standards development must proceed by consensus, though not necessarily unanimity. Comments and objections must be considered using fair and impartial processes; and
- Use of documented and publicly available policies and procedures, adequate notice of meetings, sufficient time to review drafts and prepare views and objections, access to views and objections of other participants, and a fair and impartial process for resolving conflicting views.
The proposal also includes a mechanism for the CFPB to revoke the recognition of an SSO setters and a maximum recognition duration of five years, after which recognized SSOs will have to apply for re-recognition.
The CFPB is also releasing a guide for how standard setters can apply for CFPB recognition.
The rule will be effective 30 days after publication in the Federal Register.
