Two months after vowing to kill the previous administration's rule on the sharing of customer data between banks and fintechs, the Consumer Financial Protection Bureau is revisiting the issue.
The agency says it plans to write a new advanced notice of proposed rulemaking, a starting point for a new rule, in three weeks.
The agency filed a motion to stay proceedings to the federal district court of Eastern Kentucky on Tuesday, to halt a case in which Forcht Bank, the Kentucky Bankers Association and the Bank Policy Institute sued the CFPB over its Personal Financial Data Rights rule, which would require banks to share customer data with fintechs. On Tuesday night, the judge granted the stay.
Today, banks share data with fintechs through data aggregators, but they are not required to; the rule would force them to. The banking groups requested that the rule be vacated, saying it violates the Administrative Procedure Act. In May, the Financial Technology Association was allowed to intervene and oppose the lawsuit, but around the same time, the CFPB's new leadership under the Trump administration said it intended to vacate the rule.
But in the CFPB's new motion on Tuesday, it said it has decided to "initiate a new rulemaking to reconsider the Rule with a view to substantially revising it and providing a robust justification," the motion stated. "The Bureau seeks to comprehensively reexamine this matter alongside stakeholders and the broader public to come up with a well-reasoned approach to these complex issues that aligns with the policy preferences of new leadership and addresses the defects in the initial Rule."
The agency’s new stance elicited a range of reactions.
The Consumer Bankers Association welcomed the move. “CBA is grateful to the CFPB for committing to substantially revise this rule,” the group’s President and CEO Lindsey Johnson said in a statement. “As we have long conveyed, including in testimony before Congress earlier this month, America's leading retail banks support consumer access to their financial data and increased innovation in the marketplace. The Biden-Chopra final rule, however, would pose significant risks to consumers' privacy and data security while also creating new avenues for fraud and exploitation.”
Consumer advocates objected to the change. “The original Section 1033 rule was the product of a years-long, bipartisan effort that struck a careful balance between fintechs, data providers, and consumers,” said Adam Rust, director of financial services at the Consumer Federation of America. “It earned praise from congressional leaders on both sides of the aisle because no single industry got everything it wanted — a sign of a fair and impartial process. By moving to vacate that rule, the new CFPB has created uncertainty that recent events show is harmful to the market. The simplest solution is to restore the original rule."
Fintech leaders welcomed the CFPB’s move. "Consumers deserve a right to their own financial data, full stop,” said Phil Golfeder, CEO of the American Fintech Council. “We are encouraged by the CFPB's motion to stay the litigation pending the Bureau's reengagement on the open banking rule, and the court's decision to grant the request. As we have in the past, we look forward to representing responsible innovators and elevating consumers and their needs through the proposed expedited rulemaking process. “ He added, “Unfortunately, we have seen the nation's largest banks make moves to disrupt a thriving financial ecosystem, eliminate competition, and tear down open banking, hurting consumers in the process.”
Penny Lee, president and CEO of the Financial Technology Association, similarly said her group does not oppose the CFPB writing a new rule.
"Given recent anti-competitive developments in the marketplace, we do not oppose the CFPB's motion to stay this litigation," she said. "We intend to participate in the rulemaking process in good faith in the hopes of achieving a solution that upholds consumers' fundamental right to their financial information."
Earlier in the day, the Bank Policy Institute, Forcht Bank and the Kentucky Bankers Association filed a brief saying the FTA's and the fintech industry's support for the CFPB's Section 1033 rule distorts the law and ignores the threat that the rule poses to consumers' sensitive data.
"This Biden-era rule gives big technology companies the green light to exploit the privacy and security of consumer financial data, while concurrently forcing banks to shoulder the financial burden and fallout when a fintech company does wrong. Instead of trying to fix prices to enrich their investors, fintechs should work with banks to protect consumers," said Paige Pidano Paridon, BPI executive vice president and co-head of regulatory affairs.
BPI and the other groups said they object to the CFPB's refusal to ban screen scraping (letting data aggregators log in and copy and paste data from customers' accounts using their credentials).
The bank advocates also say the Dodd-Frank Act requires banks to provide account data to the consumer "or a special, fiduciary-like representative of the consumer – not to any third-party middleman who wants it. This rule has nothing to do with a customer accessing an account, or giving an accountant, lawyer or financial adviser access to the account; it is about technology companies whose business model is to obtain customer credentials and then constantly mine that data — hundreds of millions of times — in ways the customer could only imagine." This is a reference to data aggregators who scrape or pull data from banks and sometimes fintechs and feed it to their customers in exchange for fees.
The bank groups further said Congress did not authorize the CFPB to prohibit banks from charging fees to third parties for access to customer data. "The fintech industry is clearly seeking to free-ride off banks' investments in secure data sharing platforms while simultaneously mining and selling customer data for its own profits," the brief stated. "Nothing in the statute entitles the fintech industry to securely access consumer bank data for free."
Last week, the FTA and several other fintech groups sent an open letter to President Trump that appeared to be a response to JPMorganChase's recent attempt to start
The letter said progress in financial innovation is under threat from the biggest U.S. banks.
"These large, incumbent banks are taking aggressive action to unwind the recent progress achieved under your Administration by moving to charge exorbitant fees for access to fintech and crypto apps," it stated. Crypto firms donated an estimated $18 million to Trump's inauguration fund.
The CFPB's data-sharing rule, the fintech groups said, "safeguards Americans' right to securely connect their bank accounts to the apps and services of their choice – whether it's a digital asset wallet, a payment app, or an investing tool." The FTA urged Trump to ask the Kentucky court to affirm the CFPB's data sharing rule.
