A motion filed in Kentucky Wednesday (Aug. 13) by Forcht Bank, the Kentucky Bankers Association and the Bank Policy Institute alleges the CFPB’s new open banking rule is fundamentally unlawful. The plaintiffs argue that the rule exceeds the bureau’s statutory authority by forcing banks to share sensitive customer data with commercial third parties, rather than just the individual consumers themselves.
The suit contends that the rule’s overall framework is arbitrary and capricious, particularly in how it manages the inherent risks to consumer data. As has been the case with the legal back and forth with the CFPB, a key point of contention also involves the CFPB’s prohibition on banks charging fees to the commercial third parties that benefit from accessing these newly mandated data interfaces.
Financial Impact
As the motion seeks clarification from the court regarding compliance, the banks’ immediate concern centers on the practical and financial consequences of preparing for the rule that is on track to take effect next year.
- Unrecoverable Compliance Costs Amidst Uncertainty: Banks argue they face imminent and irreparable financial harm due to the “unrecoverable costs” of preparing for a rule that is likely to be vacated or substantially revised. Because the federal government is protected by sovereign immunity, any funds expended by banks to comply cannot be recouped later, even if the rule is ultimately overturned. Personnel, technological development and ongoing infrastructure maintenance for a “rule-compliant developer interface” would be required to satisfy a mandate that the CFPB itself has acknowledged is legally deficient and is actively working to replace. The complexity of the rule’s requirements already made timely compliance by the initial April 2026 deadline (since adjusted to June 2026 for the largest banks) “unrealistic,” and now these expenditures are likely to be entirely wasted, the banks allege.
- The Paradox of Binding Deadlines Without Regulatory Clarity: Despite the CFPB’s own concession that the rule is unlawful, as well as the bureau’s stated intent to initiate a new rulemaking process, the current compliance deadlines remain in effect. This puts banks in a position where they cannot simply ignore the existing rule and its approaching deadlines without incurring regulatory risk, according to the motion.
- A Protracted Regulatory Re-evaluation Process: The bureau’s proposed path to addressing the rule’s legal deficiencies involves a new rulemaking, beginning with an “advance notice of proposed rulemaking” (ANPRM). Plaintiffs emphasize that an ANPRM is merely a “preparatory step” and not the formal notice of proposed rulemaking that begins the public comment period. Such a “complex” and “comprehensive” re-examination of the rule is expected to take years, especially given that the initial promulgation of this rule took eight years from the CFPB’s first information request to its current form. This extended timeline means banks will likely be forced to continue substantial, unrecoverable compliance efforts past the initial June 2026 deadline, according to the plaintiffs.
“Plaintiffs respectfully request an order staying the rule’s compliance deadlines and enjoining the rule’s enforcement until one year following the conclusion of this litigation,” the motion states. “Only at that point will all parties have certainty about all relevant regulatory obligations.”
Beyond the immediate compliance cost dilemma, the lawsuit delves into several other legal disputes. The plaintiffs argue that the CFPB’s interpretation of “consumer” in Section 1033 is overly broad, extending data access beyond individual account holders to commercial third parties that typically lack a special, fiduciary-like relationship.
Advertisement: Scroll to Continue
The Battle Over Data and Fees
The battle over the fees and access is being fiercely waged. In a separate matter, and in an e-mail to PYMNTS Thursday (Aug. 14), the Bank Policy Institute, along with the American Bankers Association and the Consumer Bankers Association, responded to a letter from the Financial Technology Association and a variety of FinTechs that had been sent to President Donald Trump. The letter contends that data access, or “account access” fees, would limit information flows that underpin FinTech, cryptocurrency and digital innovation.
In the response, the banking trade groups counter that “the double standard these companies want to perpetuate, where they may charge fees for service while banks are expected to provide the same service to these private companies for free, is absurd.”
