What we know about the CFPB's forthcoming open-banking rule

• Key insight: Under a revised open-banking proposal, banks are expected to be allowed to charge fees to fintechs and other third parties that want to access customer financial data.
  
• What's at stake: The proposal has not been publicly released but could be issued any day now that it has been submitted to the White House's Office of Information and Regulatory Affairs.
  
• Forward look: If fintechs have to pay for data access, banks may face prolonged legal battles, experts say.
  

The Consumer Financial Protection Bureau has submitted a new proposal on open-banking regulations to the White House's Office of Information and Regulatory Affairs, signaling that a major overhaul of consumer financial data rights is imminent.

The submission to OIRA late Tuesday night marks a critical step toward replacing the Biden-era open-banking rule that was finalized in late 2024.

Joe Lynyak, a banking expert at the law firm Dorsey & Whitney, said he thinks the Trump administration may allow banks to charge fees to offset their costs, overturning a framework that the Biden administration had sought to install.

"The proposal sent to the White House is a victory for banks by providing for a fee structure when third-party representatives seek customer data," said Lynyak, who said he has not yet seen the proposal.

The rulemaking was mandated by the Dodd-Frank Act of 2010, and technology has changed dramatically in the past 16 years.  

The rule will require banks, credit unions and credit-card issuers to make certain data available in an electronic, usable form to consumers and authorized third parties. The mandatory sharing covers bank-transaction histories for up to 24 months, account balances, and account and routing numbers, plus upcoming bill information.

A central pillar of the previous Biden-era rule was a prohibition on charging consumers or third parties, such as fintechs or data aggregators, any fees for processing data requests or maintaining the necessary developer interfaces. 

But banks balked at the previous open-banking rule, and bank trade groups immediately sued the agency, alleging the CFPB overstepped its legal authority by forcing financial institutions to share proprietary systems and data without compensation. Last year, a federal judge paused the Biden-era rule to give the Trump administration time to decide if it would issue its own rulemaking.

Now the proposed rule is coming, with a public release expected within weeks, if not days.

Read more:

• Should a bank ever be liable when a customer gets scammed?
• OpenAI models' Hugging Face breach is a red flag for bankers
• The top-performing banks with $2B to $10B of assets in 2025
• Inside Upstart's journey to get a bank charter approval

"The CFPB's decision to advance a revised Section 1033 proposal marks an important step in the ongoing effort to establish a lasting open banking framework in the United States," said Steve Boms, executive director of the Financial Data and Technology Association, which largely represents fintechs. "As the rulemaking process moves forward, FDATA believes the final framework must preserve consumers' right to fee-free, secure access to and sharing of their financial data with the providers of their choosing." 

Open banking is expected to have a major impact on consumers, as well as on banks and financial technology firms, and how they compete going forward. The Trump White House, which has close ties to the cryptocurrency industry, is expected to weigh in on the proposal. Crypto firms are among the fintechs that would have to pay banks to access consumer financial data.

Requirements of the previous rule had been set to roll out over several years. A major goal was the elimination of "screen scaping," whereby consumers share their login credentials with a third party, which requires banks to establish secure application programming interfaces, or APIs, and allow private standard-setting bodies to define the technical specifications. 

Though the new rule is expected to be more favorable to banks than the earlier version, banks are still concerned the revised rule will expose them to greater liability and also require costly oversight of third-party fintech companies, a tall task in an ecosystem awash with data and a surfeit of fintech upstarts. 

As the main data providers, banks expect to be given some ability to deny third parties access to consumer data if a company presents risks to the financial system. Lynyak said banks will likely develop contractual provisions to indemnify themselves from liability if data is mishandled, or if there is a breach.  

Despite the regulatory push, banking leaders warn that significant hurdles remain, including technical overhauls to eliminate screen scraping, liability risks surrounding data breaches and inevitable long-term legal battles.

In the absence of a rule, banks have moved forward on their own. Last year, JPMorganChase roiled the industry by cutting deals on fees with data aggregators. Banks want regulators to strictly limit data access to protect against misuse, and to protect consumers. 

The CFPB faces strict administrative constraints because Russell Vought, the former acting CFPB director who is also the director of the Office of Management and Budget, has prioritized aligning the bureau's regulatory actions with executive priorities through the OIRA-led review process. 

Before his term as the CFPB's acting director expired last week, Vought bypassed the standard notice-and-comment period typical of an "interim" final rule, which could be grounds for challenging the new CFPB rule in court.