The Consumer Financial Protection Bureau today issued an Advance Notice of Proposed Rulemaking, to revisit its open banking rule, known as the Section 1033 rule, under the Dodd-Frank Act. The move follows a Kentucky district court’s stay of a lawsuit challenging the 2024 rule, which was criticized for exceeding statutory authority and risking consumer data security.
Why it matters: The ANPR signals a shift in the CFPB’s approach, aiming to address industry concerns while enhancing consumer control over financial data. It seeks stakeholder input on key issues like data security, privacy, representative roles, and fees, impacting banks, credit unions, fintechs, and collection agencies.
What’s next: Comments are due by October 21, 2025, with the CFPB planning an accelerated rulemaking process to propose a revised rule. Compliance dates, currently set for June 30, 2026, may be extended.
By the numbers:
- 60 days: Comment period after the ANPR’s Federal Register publication on August 22, 2025.
- 100 million+: Consumers estimated to have used authorized data access via third parties in 2024.
- $55 billion: Losses from Business Email Compromise scams (2013–2023), highlighting data security risks.
The details:The CFPB’s ANPR focuses on four areas:
- Representative Roles: Clarifying who can act on behalf of consumers, questioning whether fiduciaries are required.
- Fees: Evaluating whether data providers can charge for data access to offset costs.
- Data Security: Addressing risks of breaches and compliance with Gramm-Leach-Bliley Act standards.
- Data Privacy: Tackling concerns over unintended disclosure of sensitive financial information.
The 2024 rule, finalized under former CFPB Director Rohit Chopra, required financial institutions to share transaction data with consumers and authorized third parties. Legal challenges from the Bank Policy Institute, Kentucky Bankers Association, and Forcht Bank led to a stay, citing violations of the Administrative Procedure Act. Industry groups like the American Bankers Association welcome the rewrite, emphasizing consumer protection and innovation.
Go deeper:
- The CFPB seeks input on 36 specific questions, covering fiduciary duties, cost estimates, and privacy safeguards.
- Fintechs, including crypto firms, oppose bank fees for data access, arguing they stifle competition. A July 2025 letter from 80+ fintech leaders urged President Trump to block such fees.
- JPMorgan’s plan to charge for data access sparked debate, with banks arguing it promotes responsible data handling.
What they’re saying:
- Lindsey Johnson, Consumer Bankers Association: “The Bureau’s decision to reopen this rulemaking is a welcome step toward restoring accountability, consumer protection, and the rule of law.”
- Rob Nichols, American Bankers Association: Urges retaining strong privacy protections and ending risky practices like screen scraping.
The big picture: The CFPB’s rethink aims to balance consumer empowerment with robust security and privacy measures, addressing tensions between traditional finance and fintech sectors. Stakeholders must weigh in to shape a rule that fosters innovation without compromising data integrity.
