On October 19, 2023, the Consumer Financial Protection Bureau released a proposed rule that marks the CFPB’s first rulemaking under section 1033 of the Consumer Financial Protection Act of 2010 (the “CFPA”). Section 1033 generally empowers the CFPB to prescribe rules under which providers of consumer financial products or services must make data available to their consumers regarding the products or services consumers obtain.
Although section 1033 may be applied to a wide range of consumer financial products and services, the proposed rule focuses on data related to payments and payment accounts. Banks, credit unions, and other providers of checking, savings, and credit card accounts and various other payments accounts and products, including digital wallets, would have to make a broad range of information available to consumers through “consumer interfaces” and to consumer-authorized third parties through “developer interfaces.” These third parties, which would include financial technology companies (fintechs), data aggregators collecting data for fintechs, banks, and others, would access the information in connection with providing the consumer with other financial products or services. The proposed rule would impose a number of obligations with respect to both the provision of data through consumer and developer interfaces and third party access to that data. The proposed rule would be implemented in phases, with the largest providers being subject to its requirements within approximately six months after a final rule is published and smaller banks and credit unions having several years before compliance becomes required.
According to the CFPB, the proposed rule would “accelerate a shift toward open banking, where consumers would have control over data about their financial lives and would gain new protections against companies misusing their data.” It would also “jumpstart competition” by permitting consumers to direct existing providers to “share data . . . with other companies offering better products” and enabling consumers “to walk away from bad service.” The proposed rule would prohibit third parties that receive covered data from collecting, using, or retaining the data “to advance their own commercial interests,” including through targeted advertisements, and would “seek[] to move the market away” from “screen scraping.”
Comments on the proposed rule are due by December 29, 2023. CFPB Director Rohit Chopra said in a statement that the CFPB will seek to finalize a rule by fall of 2024.