A federal judge has issued a preliminary injunction halting enforcement of the Consumer Financial Protection Bureau’s Personal Financial Data Rights Rule — a key component of the agency’s open banking framework — until the CFPB completes its reconsideration and revision of the rule. The ruling delivers a major win to banking trade groups and leaves the future of open banking hanging in the balance.
Why it matters: The CFPB is in the middle of an accelerated rulemaking process to overhaul the original version of the rule, which was adopted under the previous administration. The injunction freezes a regulation that would have required banks and credit unions to build developer interfaces for sharing consumer financial data with third parties upon request and at no cost.
The latest ruling:
- District Court Judge Danny Reeves of the District Court for the Eastern District of Kentucky, granted the injunction after finding plaintiffs are likely to succeed on their claims that the CFPB exceeded its authority under Section 1033 of the Dodd-Frank Act.
- The court criticized the rule’s mandatory data-sharing with third-party fintechs, its prohibition on banks charging access fees, and fixed compliance deadlines tied to standards that don’t yet exist.
- Reeves wrote that requiring compliance with a rule “that the CFPB itself previously argued was unlawful and is now in the process of replacing through new rulemaking” would create irreparable harm to banks forced to invest in infrastructure that may be obsolete.
What’s next: The CFPB’s timeline for completing the new rule remains uncertain. While the agency published an Advance Notice of Proposed Rulemaking in August and received more than 14,000 public comments, no draft rule has yet been released. Until a revised rule is finalized, the original rule is enjoined and cannot be enforced nationwide.
Industry reactions:
- Banking groups welcomed the ruling. “This is a common-sense procedural step that ensures banks won’t be forced to invest time and resources preparing for a rule that is currently being rewritten,” the Bank Policy Institute, Kentucky Bankers Association, and Forcht Bank said in a joint statement.
- Fintechs pushed back. The Financial Technology Association said it was “exploring all options, including an appeal,” calling open banking a “foundational right in today’s digital age.” The American Fintech Council said the ruling “delays the promise” of giving consumers control over their own financial data.
Between the lines: The injunction has no immediate operational impact, since the first compliance deadline was set for June 2026. However, it raises the risk that banks could begin charging fintechs for access to consumer data.
What we’re watching: Whether the CFPB under Acting Director Russ Vought, who has publicly questioned the Bureau’s future will move forward with a new rule at all. If the agency’s reconsideration drags out or is abandoned, the rule could remain in regulatory limbo indefinitely.
Bottom line: The court’s decision doesn’t kill open banking, but it puts it on ice until the CFPB finishes what may become a slow and uncertain rewrite.
