CFPB to propose open banking regulation in coming months, finalize in 2024

Bloomberg News

Consumer Financial Protection Bureau Director Rohit Chopra said Monday that the agency will propose a much-anticipated open banking rule in the coming months and will aim to finalize the rule in 2024.

Chopra outlined the time frame in a blog post Monday, which comes as the bureau attempts to pivot the financial industry toward open banking, meaning consumers have control over their personal financial information and can share that data as they choose.

The rule, which the CFPB is required to issue as part of Section 1033 of the Dodd-Frank Act, will open up competition in the financial services industry by mandating that large institutions allow consumers to request the share of their personal financial data with fintechs and other banks and online lenders, Chopra said.

"Control of the open banking system by [dominant firms] threatens competition and the consumer's control of their own financial affairs," the agency said, adding that "it will pay close attention to any attempts to limit consumers' exercise of their data rights, particularly where such attempts proceed from coordinated efforts by dominant firms."

While they have not been named, some of the firms that the regulation is targeting are likely to include megabanks like JPMorgan Chase and Bank of America, as well as established third-party firms like Plaid and Strike, which share personal consumer data with banks and other third parties.

CFPB News & Analysis

CFPB chief previews next steps in open-banking rulemaking

October 26, 2022 9:00 PM

The open banking rule will also apply to "covered data providers," which includes banks, credit unions and other entities that hold consumer accounts, issue access to devices or provide electronic transfer services. But it excludes mandates over data sharing to mortgage, student, auto loan and other credit accounts — an exclusion that has earned the agency criticism.

Data sharing will likely be made possible through the use of application program interfaces, or APIs, which serve as a conduit for financial data between depository institutions and third-party providers and set standards on how they interact, according to Stephen J. Newman, a partner at Stroock & Lavan LLP. Other technological solutions, he said, have also been argued for as equally secure but less expensive alternatives.

"I think ultimately, the impact will be to increase competitiveness throughout the industry," said Newman. "The goal is to balance consumer and financial interests and ultimately reduce friction overall in the system."

The CFPB was required to issue a rule allowing consumers some measure of control over their financial data by Section 1033 of the Dodd-Frank Act, but it was only kickstarted after the agency began a proposed rulemaking process in 2020 and CFPB Director Rohit Chopra announced a time line for its rollout in October.

The regulatory plans emerge as data sharing becomes a more significant part of consumers' lives and regulators take note of how that information is shared and stored, often without consumer consent, Newman said. 

"The financial world is the first place we're seeing it because there's a lot of data in that space, but I expect other industries will see that as well," Newman said.