COMMENT CALL: The Consumer Financial Protection Bureau (CFPB) has released an advanced notice of proposed rulemaking (ANPR), asking for public input on a rewrite it is considering for its so-called “open banking” rule.
Background
The rule – formally known as the Personal Financial Data Rights Rule – implements section 1033 of the Dodd-Frank Act. It is designed to give consumers control over their financial data by requiring banks, credit unions, and certain fintechs to share account information (like transaction history and account balances) with authorized third parties if consumers consent. The rule’s goal is to let consumers add or switch financial services providers to access better rates, receive better terms, and find services that best suit their needs.
The CFPB finalized its rule last fall, and we published a Compliance Courier about it at the end of October. The current rule provides for compliance dates to be phased in over time, with larger providers required to comply in spring 2026 and smaller providers in spring 2030. But compliance has been stayed as the rule is being litigated in a federal court in Kentucky.
Why the rule is important for CUs
According to America’s Credit Unions, the current rule “will have a major impact on credit union operations by requiring the creation of ‘developer interfaces’ and ‘consumer interfaces’ (i.e., APIs) to facilitate the exchange of certain covered data elements between consumers and authorized third parties. Today, the PFDR provides exemptive relief to depository institutions under $850 million in total assets; however, the PFDR is poised to have a major impact on the competitive dynamics of the financial sector by making it easier for consumers to switch accounts and move deposits between institutions. Reconsideration of the final rule could result in significant changes to the PFDR, including the allowance of fees for API access, reconsideration of the types of third parties allowed to request data on behalf of a consumer, and changes to risk management approaches to address data security and data privacy concerns.”
CFPB wants feedback on certain issues
The CFPB wants those who comment on its ANPR to address four issues that it plans to address in rewriting the open banking rule.
- The Dodd-Frank Act permits a consumer and/or representative acting on behalf of the consumer to request covered data from a financial institution. The CFPB seeks comment on who should be allowed to serve as a representative acting on behalf of the consumer.
- Under the final rule in its current form, a financial institution is prohibited from imposing any fee and/or charge on a consumer when fulfilling an information request. The ANPR asks whether the Dodd-Frank Act specifically requires this, and if so, what steps a financial institution should be allowed to take to defray some of its costs associated with fulfilling the information request.
- The final rule requires financial institutions to have appropriate safeguards in place to protect against malicious actors in the use, retention, and transmission of consumer financial data. The CFPB seeks comment as to whether the final rule’s information security standards go far enough.
- The final rule requires a financial institution to obtain express informed consent from the consumer before making their consumer financial data available to a third party. The ANPR seeks comment as to whether the rule, in its current form, provides adequate consumer privacy protection.
Make your voice heard
The League plans to comment on this ANPR, but we need your input. (After the open banking rule was proposed, The League submitted a comment letter on behalf of Wisconsin’s credit unions, voicing concerns about the privacy of members’ information and the impact the rule would have on credit unions’ operations.)
Please share your views on the current ANPR and the issues listed above to Paul Guttormsson by Oct. 14, so that our letter (which the CFPB must receive by Oct. 21) reflects your concerns.