If you asked the average person on the street if they would like their bank account data to be treated in the same way as data on Instagram or Facebook — that is, shared with advertisers, vendors and service providers — the response would be a resounding: "No! Absolutely not!"
Yet every day, millions of consumers give permission to a wide range of companies and digital apps that gather, analyze, store — and sell — the transaction data from their bank accounts.
Last year, the Consumer Financial Protection Bureau under the Biden administration
The CFPB's 1033 rule would have mandated that consumers have personal financial data rights, which experts say starts with bank account data and could spread to other areas, giving consumers control over all their data even outside of the financial realm, including on social media.
After the agency issued the final rule in October, the
The impact of 1033 is so important that Jamie Dimon, the CEO of JPMorganChase, commented on the issue in his
In late May, the Trump administration's CFPB and its acting Director Russell Vought filed a status report to the Eastern Kentucky court handling the BPI case that said, "Bureau leadership has determined that the rule is unlawful and should be set aside." The CFPB and Vought intend to file a motion for summary judgment by May 30. President Donald J. Trump, his advisor and donor Elon Musk and Vought each have
"The default position under the Trump administration is that regulation is bad and 1033 falls into that bucket by default. That's the starting point," said Eyal Sivan, general manager for North America at Ozone API, a platform that facilitates the sharing of financial data with authorized third parties.
Sivan, a board member of the Open Finance Network Canada and a host of the Mr. Open Banking podcast, thinks the rule would have led to huge innovations in consumer finance.
"If what you're trying to do is create another fintech renaissance in the U.S., and you want the banks to play nice and open up their kimono and integrate with all these new tools, 1033 [would have helped] you do that," Sivan said.
BPI's lawsuit claims that the rule went far beyond what was required in the statute, and many experts agree.
"The law says that if a consumer wants their information, then their provider has to give it to them," said Scott Pearson, a partner and practice leader at the law firm Manatt, Phelps & Phillips. "That's different from saying that third parties should get access to all of that data."
The 1033 rule would have applied to checking accounts, prepaid cards, credit cards and digital wallets.
Vought, who is also the director of the Office of Management and Budget, and an architect of Project 2025, the Republican blueprint for reshaping the federal government, is involved in all aspects of the Trump administration's effort to cut the federal government.
As a result, any new open banking rules will likely fall to the next permanent director of the CFPB, a position that is in flux. Jonathan McKernan, a former Republican board member of the Federal Deposit Insurance Corp., was nominated to replace Vought to lead the CFPB permanently, but Trump subsequently nominated him to be undersecretary of domestic finance at Treasury, an important regulatory role.
'A battle is brewing,' says JPMorganChase's Dimon
Dimon made his own pitch to policymakers about how open banking could upend traditional banks, and lead to increased competition with major fintech companies and other nonbank financial institutions.
In the letter, he staked a clear position between banks and Big Tech firms.
"Now a new battle is brewing: Third parties want full access to banks' customer data so they can exploit it for their own purposes and profits," Dimon wrote in his shareholder letter. "Contrary to what you may read, we have no problem with data sharing but only if it is done properly: It must be authorized by the customer — the customer should know exactly what data is shared and when and how it is used; third parties should pay for accessing the banking system and payment rails; third parties should be restricted from using the customers' data for purposes beyond what the customer authorized, and they should be liable for the risks they create when accessing and using that data. When banks utilize third party data, they will be, and in most cases already are, subject to these same obligations."
In other countries, consumers are given free access to their financial data, and having companies pay for access is not generally accepted, experts said.
Dimon is the chairman of BPI, which sued the CFPB over the rule, but JPMorganChase is also a member of the Financial Data Exchange, which received approval from the CFPB in January to be the standard-setting body for open banking.
More than 144 million customers are supported on APIs that are aligned with FDX's standards.
Kevin Feltes, the CEO of FDX, said the company is watching what's happening in Washington.
"If the regulatory environment changes, FDX is still very committed to supporting the industry," said Feltes, who previously worked for nearly 10 years at JPMorganChase. "Many, many companies are continuing to march forward to support safe consumer data sharing under any scenario, and we're here to support them."
Because 1033 created an infrastructure and protocols that would have given consumers control over their own data, including who it would be shared with and for how long, many experts think the ability to initiate payments should be included in a future version of the regulation.
Payment initiation, however, is a problem for banks, notably JPMorganChase, which is a major credit card issuer.
"This is a very sensitive spot for the U.S.," said Sivan, noting that the two largest credit card issuers in the world, Visa and Mastercard, are American. "I can understand why they were hesitant to add payment initiation to the scope of the rule because it will create a race to the bottom on payment services that exist, and a significant regulatory burden on those existing players that adhere to the regulation. But when you add payments, the benefits of open banking really kick into gear."
The final 1033 rule swept in payment apps and other financial products such as Apple Pay, Google Pay, PayPal, Zelle and Venmo,
Fintechs asked for changes to the rule's ban on secondary data use. The final rule excluded secondary uses for research but drew a line in the sand by defining a primary use of data to include third parties improving an existing product but not developing new ones.
Fintechs and third parties have claimed that they should be able to use consumer data beyond the purposes authorized by consumers. They point to the example of a customer using a personal financial management tool on an app that gives recommendations on how to improve their finances, which might be considered a secondary use that would have been prohibited under the final rule.
John Pitts, head of industry relations and digital trust at data aggregator Plaid, said the Trump administration thinks Chopra overreached in prohibiting secondary data use and in creating a privacy regime.
"I think there's a general interest in revisiting those data use restrictions," Pitts said.
He cited
Companies like Venmo and Robinhood need a customer's bank account and routing number to move money out of a bank and into a new account, which Pitts argues is the core of what open banking is about.
The other problem: Liability
Liability is a problem that no jurisdiction has definitively solved. A common principle in data privacy and security is that the "liability follows the data." Under 1033, the responsibility and consequences of data breaches or misuse typically fell on the entity that possesses and controls the data, and banks object to having to shoulder all of the liability risk.
BPI's complaint states that the CFPB refused to create any rules "for fairly apportioning liability among data providers, authorized third parties, and data aggregators in the event a customer's data is breached or misused," and called the CFPB's liability framework "unsafe."
Hypothetically, there are several different paths and legal strategies that the CFPB could take if it were to reopen 1033.
Steve Boms, executive director of the Financial Data and Technology Association, said returning to the starting point of issuing another advance notice of proposed rulemaking would be a major setback.
"If the CFPB rescinds the rule and goes back to an ANPR, they're basically resetting the clock four or five years," Boms said. "It risks the progress that the industry has made collaboratively to get to this point and 95% of the rule that everybody agrees is generally pretty good."
Moreover, the 1033 rule was started in the first Trump administration, under former CFPB Director Kathy Kraninger, spurred in part by a
Boms thinks one of the easiest ways for the CFPB to make changes would be to publish guidance on what the primary use of consumers' data is and what it isn't, to address secondary data issues.
But such guidance is unlikely. In April, Vought accused former CFPB Director Rohit Chopra of using guidance to create rights and obligations that were unlawful, and
However the Trump administration decides to change the rule, the larger trend of open banking, as Sivan envisions it, is that ultimately, a consumer's right to their own financial data will translate into standards that give consumers access to all their data, everywhere.
"The 1033 rule is technically called 'Personal Financial Data Rights,' which means consumers not only have a right to their financial data, it also opens the door to the question of data rights generally, which means, what other data does the consumer have a right to?" Sivan said. "Banking isn't special, it's just first. We're going to start with banking but quickly move to telecom and health care and energy and e-commerce, where we have a push toward privacy and a generalized data right. And why is banking first? Because banking is probably the single domain of data where people have the biggest assumption of privacy and control."
