Washington, D.C. - The Bank Policy Institute responded today to a CFPB advance notice of proposed rulemaking revisiting the Biden Administration's Personal Financial Data Rights Rule under Section 1033 of the Dodd-Frank Act. The effort aims to address serious legal deficiencies in the current rule that would endanger consumers' sensitive financial data. The rule would also disrupt the existing robust data-sharing arrangements between banks and fintechs that allow consumers to access the apps and services of their choice.

BPI's submission reiterates fundamental problems with the rule and areas where the Biden CFPB exceeded its legal authority, a fact the current CFPB leadership has acknowledged.

"Individual consumers should have secure and easy access to their financial data, and decades of investments from banks and fintechs have delivered exactly that. The evidence is on every phone and personal device across America. The Biden Administration didn't deliver open banking; it disrupted it by introducing regulatory uncertainty and security risks to a system that already works. The CFPB should right this wrong and deliver a free-market solution that follows the law and places consumers' financial data security first." - Paige Pidano Paridon, Executive Vice President & Co-Head of Regulatory Affairs

Congress passed Section 1033 of the Dodd-Frank Act so that consumers could easily obtain access to their financial data. In the 14 years between the law's passage and the CFPB's issuance of the rule, technology changed, but the law's intent did not. BPI supports the CFPB's decision to revisit the rule and narrow it to reflect Congress's intent. The letter calls on the CFPB to preserve individual consumers' ability to access and share their data securely and stay within the limits of the authority granted under Section 1033.

Background:

The Bank Policy Institute, the Kentucky Bankers Association and Forcht Bank challenged the Biden Administration's Section 1033 rule in October 2024. The lawsuit asserted that the Bureau overstepped its statutory authority and adopted a rule jeopardizing consumers' privacy, financial data and account security. Specifically:

• It unlawfully mandated banks to share sensitive consumer data with third-party fintechs and aggregators;
• It required no oversight of third parties using bank customer data;
• It increased the likelihood of fraud and scams by mandating mass data sharing and failing to address weak safeguarding practices;
• It allowed screen scraping and other unsafe practices to persist;
• It failed to hold third parties accountable for data breaches of their systems; and
• It allowed third parties to profit, at no cost, from systems built and maintained by banks.

On May 23, 2025, the CFPB stated in a status report with the court that the Section 1033 rule is unlawful. On May 30, the CFPB filed a motion for summary judgment asking the court to vacate the rule. The court did not rule on that motion, but granted a stay of the litigation while the CFPB conducts a new rulemaking process. The CFPB issued its latest ANPR on August 21, 2025. A full timeline can be accessed here.

To access a copy of BPI's submission, please click here.

Additional Resources

• Fintechs' Mixed Messages on the Biden Administration's 'Open Banking' Rule
• A Fair Exchange: Why Data Aggregators Should Pay to Access Bank APIs
• Screen Scraping: What Is It and How Does It Work?
• Correcting the Record on Safe Data Sharing
• Fintechs Want to Protect Data-Sharing Privileges, Just Not for Consumers
• A Fair Exchange: Why Data Aggregators Should Pay to Access Bank APIs
• Banks Challenge CFPB Rule Jeopardizing Security and Privacy of Consumer Financial Data
• A Short Prescription for Ensuring Responsible Open Banking in the United States
• Data Aggregators Issue Summary

###

About Bank Policy Institute.

The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks and the major foreign banks doing business in the United States. The Institute produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.

Media Contacts

• Austin Anton, Bank Policy Institute, [email protected]