The Consumer Financial Protection Bureau is more than a year away from releasing a long-awaited proposal on consumers’ right to control their own financial data, far later than many had expected, according to people familiar with the bureau’s thinking.
The rule has been hotly anticipated because it would address the ability of aggregators and other fintechs to obtain consumers' bank account data through screen scraping and application programming interfaces. These firms seek broad access to help consumers manage their money, but banks and consumer advocates generally want the CFPB to narrow the scope of data collected and provide increased security, privacy and other protections.
The CFPB in the fall had listed April in the government’s
"I think people got excited when they saw the unified agenda published last November with an April 2022 date — that set some expectations for the market," said Dan Quan, co-founder and general partner at Nevcaut Ventures, an Irvine, California, venture capital firm, and a former CFPB senior advisor who headed its innovation office, Project Catalyst.
But the CFPB has continued to list data access as being
In the absence of data-access regulations, consumers using digital apps face many uncertainties, industry experts said. Any delay to the rule would be a substantial setback for consumers and fintechs given the mass adoption of mobile apps — many offered in partnerships with banks — to help consumers manage their finances, some experts said.
A CFPB spokeswoman said Wednesday the agency is still "assessing potential next steps." Its upcoming Spring 2022 agenda will reflect Chopra's priorities, the spokeswoman said.
Many industry experts now think the CFPB will convene a small-business review panel in April, though the move is far from certain. The bureau has not yet announced whether such a panel is required by the Regulatory Flexibility Act or the Small Business Regulatory Enforcement Fairness Act, known as SBREFA. A panel would meet with regulated small businesses including rural and community banks for advice on how to minimize the impact of a rule on small entities.
A small-business panel would be considered by many to be the start of the rulemaking process since the CFPB would be required to provide an outline of its proposal, yet the bureau would still have some leeway in the direction it ultimately takes.
“The SBREFA outline could have a rapid and significant impact on the market as parties start adjusting in anticipation of what rights the final rule will give consumers," said John Pitts, policy lead at Plaid, a San Francisco-based data aggregator. “SBREFA requires an outline of the potential rule, and the number of 'open questions' between banks and aggregators on what regulation should look like is relatively short.”
The timeline for the CFPB’s data-access rule has been fluid partly because of the CFPB’s already packed agenda and the time needed by Rohit Chopra, the CFPB’s new director and a former member of the Federal Trade Commission, to make his own determinations about the rule.
"The CFPB has talked internally about the [small-business review process] for quite a while, it's just that nobody has the marching orders from Chopra," Quan said.
Since taking the reins of the CFPB in October, Chopra has been focused on a slew of other issues including large technology companies' entry into financial services,
A lack of guidance from the CFPB means that consumers may miss out on providing access, depending on their bank, to all their financial data, experts said.
While fintech companies primarily use screen scraping to obtain access to consumer bank records, many aggregators have created partnerships with the top 20 banks using APIs. Some banks do not make data that they consider proprietary — such as the interest rate on a loan or the cost of certain fees — available to third parties. Those limitations make it harder, for example, for challenger banks to offer consumers cheaper rates or help them comparison-shop for financial products.
Last year, the CFPB began reviewing comments in response to
The rule is expected to have a wide-reaching impact by establishing data security and privacy standards to allow consumers to give third-party companies access to their financial data. In addition, the rule will determine the scope of what data a consumer can authorize, set limits on data use and establish a framework of consent to ensure consumers sign off on what information can be accessed or sold. The rule also is expected to bring data aggregators under CFPB supervision.
But some banks and others worry about consumers giving third parties too much control, the potential for security and privacy breaches, and a bank's proprietary information about fees and other pricing getting released in the exchange. The CFPB also is expected to clarify legal liability for issues such as data breaches.
In Congress, lawmakers on both sides of the aisle have taken a keen interest in the rulemaking, finding
"I don't see anything in 2022 other than a SBREFA" panel, Quan said.
The data-access rule is required by Section 1033 of the Dodd Frank Act, which states that consumers have the right to access their own bank account and transaction data in a usable electronic format. The rule may end up taking more than a dozen years to go into effect; it would be the last major rule required by Dodd-Frank to be issued.
