Court halts compliance with CFPB's final open banking rule

CFPB
The Consumer Financial Protection Bureau (CFPB) headquarters in Washington, D.C., U.S., on Saturday, April 16, 2022. The Credit-reporting company TransUnion is an "out-of-control" repeat offender engaging in “deceptive” marketing practices the CFPB alleged this week after filing a lawsuit. Photographer: Samuel Corum/Bloomberg
Samuel Corum/Bloomberg

  • Key Insight: A district court sided with banks in halting the Consumer Financial Protection Bureau enforcement of a final rule on personal financial data rights. 
  • Forward Look: The Trump administration is reconsidering the open banking rule.
  • What's at Stake: Banks have already started charging fees for data aggregators and fintechs to access consumers' financial data. 

A federal court has agreed to halt the compliance and enforcement of the Consumer Financial Proteçtion Bureau's Biden-era open banking rule while the Trump administration completes its own rule on personal financial data rights. 

On Wednesday, U.S. District Court Judge Danny C. Reeves of the Eastern District of Kentucky lifted a stay in the litigation of the CFPB's open banking rule and issued a preliminary injunction to halt the CFPB from enforcing compliance with the rule finalized last year under the Biden administration.

The ruling is a major win for banks, which had asked the court to halt the first compliance deadline of June 30, 2026. 

"It is unlikely that the CFPB will issue a new rule before that date," the judge stated in the 18-page court order. "And it remains unclear whether or when the CFPB will extend the compliance deadlines. The CFPB has stated that it intends to 'comprehensively reexamine' the rule and 'envisions' adopting a 'new final rule that substantially revises the rule under review.' Accordingly, the CFPB will suffer no harm if the Court prohibits the CFPB from enforcing a rule it is currently reconsidering."

The judge acknowledged that the public "could arguably lose some benefit from the rule not being enforced at the set compliance deadlines because it could 'delay consumer control over their information.'" 

However, Reeves also stated that the banks have a strong likelihood of success on the merits of the case. The Bank Policy Institute and other plaintiffs said they were grateful that the court stayed the compliance deadline.

"This is a common-sense procedural step that doesn't interfere with the rulemaking process but ensures banks won't be forced to invest time and resources preparing for a rule that is currently being rewritten," the plaintiffs said in a statement.

Penny Lee, president and CEO of the Financial Technology Association, a trade group of fintechs, said in a statement that they "respectfully disagree" with the judge's preliminary injunction order and are exploring all options, including an appeal.

"Section 1033 gives consumers the right to securely control and share their personal financial data with the authorized representatives they choose and without having to pay a fee," she said in a statement. "Most Americans today rely on open banking connectivity to access apps and services and manage their financial lives, a foundational right in today's digital age."

The litigation in the case began last year immediately after the CFPB, under former Director Rohit Chopra, finalized the rule. The Bank Policy Institute, Kentucky Bankers Association and Forcht Bank, a $1.5 billion-asset community bank in Lexington, Kentucky, sued, alleging that the CFPB exceeded its statutory authority and the rule was 'arbitrary and capricious,' in violation of the Administrative Procedure Act. 

The final open banking rule has not been vacated, but the fight over how to give consumers access to their personal financial data has started up again. 

The Biden-era rule prohibited banks from charging fees to data aggregators, fintechs and third parties to cover the cost of building and maintaining secure systems for data access. The CFPB acknowledged that banks will incur up to $47 million annually to comply with the rule's requirements. 

The CFPB has restarted the rulemaking process by publishing an advance notice of proposed rulemaking in August seeking public comment on several issues to address banks' concerns in the litigation. The bureau has received 13,979 comment letters, though thousands of the comments are form letters. 

The 1033 rule, known for its section of the Dodd-Frank Act, was first initiated in 2016. Though the rule finalized in October had bipartisan support from lawmakers, acting CFPB Director Russ Vought began working on a new open banking rule — the second major effort to craft a rule around personal financial data rights — after JPMorganChase and other banks started charging fees for data access.

The CFPB under Vought refused to defend the Biden rule in court. Instead, the Financial Technology Association took up that cause, supporting the final rule largely because it did not allow banks to charge fees. The FTA led a coalition of fintechs and crypto companies urging the Trump administration to protect the previous rule. 

Penny Lee, president and CEO of the FTA, said in a comment letter to the CFPB that the nation's largest banks shouldn't be able to "stifle competition, and keep America stuck in an analog age."  

Under the new rulemaking process, the CFPB is asking about the definition of a consumer's "representative," whether there should be a prohibition on fees, as well as liability issues and a prohibition on secondary uses of data.  

For reprint and licensing requests for this article, click here.
Regulation and compliance Politics and policy CFPB News & Analysis
MORE FROM AMERICAN BANKER