The CFPB has submitted a proposed rule titled “Personal Financial Data Rights Reconsideration” for White House review, confirming that the agency intends to revisit the Section 1033 regulations it finalized in October 2024. The proposal itself has not yet been released, leaving its precise provisions unknown.
But an earlier analysis by Ballard Spahr provides clues about where the CFPB may be headed. The firm reported in June that the Bureau was considering eliminating the 2024 rule’s blanket prohibition on data-access fees and instead allowing data providers to charge after fulfilling a certain number of requests without charge.
That would represent a potentially important change in the economics of U.S. open banking.
Section 1033 of the Dodd-Frank Act gives consumers a right to obtain electronic information about their financial products. The CFPB’s 2024 implementing rule turned that statutory right into a broader data-sharing framework requiring covered financial institutions to make certain data available electronically to consumers and authorized third parties.
The rule focused initially on credit cards and accounts covered by Regulation E. It also required data providers to make available information sufficient for authorized third parties to initiate payments, although payment initiation and processing remain governed by other rules.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
The regulations quickly ran into legal trouble. A federal court in Kentucky enjoined the CFPB from enforcing them after finding that challengers were likely to establish that the rules exceeded the Bureau’s statutory authority and were arbitrary and capricious. An appeal is stayed while the CFPB works on revisions.
The Bureau signaled the breadth of that reconsideration in an August 2025 advance notice of proposed rulemaking. Among other things, it sought input on who can qualify as a consumer’s authorized representative, privacy and cybersecurity protections, compliance burdens and whether data providers should be permitted to charge for access.
The fee issue could prove particularly contentious.
Under the 2024 framework, covered data providers generally cannot charge for required data access. Banks and other industry participants have argued that Section 1033 itself does not prohibit reasonable cost recovery and that building and maintaining secure application programming interfaces and related infrastructure imposes substantial continuing expenses. The CFPB subsequently requested comment on permitting financial institutions to impose reasonable fees on authorized third parties.
According to Bloomberg, allowing fees after some threshold of free requests could provide a compromise between consumer access rights and banks’ demands for compensation for maintaining the infrastructure supporting FinTechs and data aggregators.
It could also alter commercial relationships throughout the open banking ecosystem. Even amid regulatory uncertainty, banks, lenders, payments providers, payroll companies, FinTechs and data aggregators continue negotiating bilateral data-access agreements covering liability, security, service levels, audit rights and fees.
Fees, however, are only part of the reconsideration. Ballard Spahr noted that the fundamental architecture of the 2024 framework could survive, including requirements for data providers to develop technical capabilities to share specified information and obligations on authorized third parties regarding disclosures and data management.
That makes the forthcoming proposal potentially more of a recalibration than a retreat from federal open banking. The central issue may be not whether consumers retain the ability to move their financial data, but who pays for the infrastructure that makes that portability possible, and under what conditions.
Add as Preferred Source
