What's next in the fight over the CFPB's open banking rule?

The Consumer Financial Protection Bureau is embarking on a new open banking proposal that pits banks against fintechs and underscores the difficulty of crafting a rule that gives consumers access to their own financial data.

Tuesday is the deadline for submitting public comments on the Trump administration's version of open banking — whatever that turns out to be. The Trump administration is gearing up to make changes but no one knows if the CFPB will scrap and rewrite the rule finalized under the Biden administration, or keep some pieces of it in place.

The Biden administration's rule explicitly prohibited banks from charging fees and forbade the use of data for targeted advertising. In addition, third party fintechs could not sell or share the data for their own purposes.

Banks, fintechs, crypto firms and the public are weighing in on four key issues including whether banks can charge fees to cover the cost of providing data to third-party apps and fintech firms.

Open banking is the idea that customers have a right to know what is being done with their data and to decide who to share it with, for how long and for what purpose, with the opportunity to turn off the "sharing" if they choose.

Data has become an even more valuable currency in the AI-driven economy, and open banking has complexities and nuances beyond just the fight for control of data between banks and fintechs. Payments and digital identity are a huge part of open banking going forward. Banks hold troves of customer financial data and are both competitors of, and partners with, nonbank financial firms that want to sell products and profit off the data.

Penny Lee, president and CEO at the Financial Technology Association, spoke about what she described as the "twists and turns" of the open banking rule, which was authorized 15 years ago by the Dodd-Frank Act. The trade group has been defending the Biden administration's open banking rule in court, having intervened in a lawsuit to preserve the rule when the Trump administration said it would not defend it.

"When the Trump administration came in, we expected that they were going to have some concerns about the rule and potentially reopen it," said Lee. "Where we are right now is just part of the rulemaking process that we all have to go through."

Initially, the Trump-era CFPB, led by acting Director Russell Vought, intended to vacate the open banking rule that was finalized in October under former CFPB Director Rohit Chopra. That rule, though finalized, has not yet gone into effect because the Biden-era CFPB was sued within just hours of issuing the rule by the Bank Policy Institute, a big bank trade group.

Then in July, JPMorganChase made a bold move by telling data aggregators that it planned to charge fees to access customers' data. The CFPB responded by requesting a stay in the Bank Policy Institute's litigation, citing "recent events in the marketplace." It said it would reopen and revise the rule, and in August it issued an advance notice of proposed rulemaking, kickstarting the rulemaking process all over again.

The rule promulgated under Chopra had prohibited banks from charging fees.

In a bizarre twist, the Financial Technology Association, or FTA, petitioned the court to defend defend the final open banking rule before the Trump filed a motion to vacate the rule in May. FTA was granted the right to intervene. In September, the FTA filed a legal brief opposing a motion by the Bank Policy Institute to lift the federal court stay and indefinitely delay the rule's implementation. The FTA has alleged that big-bank plaintiffs want the court to narrowly define the scope of the CFPB's authority in hopes of constraining the forthcoming rulemaking.

For now, the litigation is stayed as the CFPB rewrites the rules. Fintechs and banks are still waiting for a judge to rule on the Bank Policy Institute's motion to lift the stay and delay the compliance dates. Though the FTA is still an intervenor-defendant, the case is currently on hold due to the government shutdown.

The stakes are high and the players are moving quickly.

JPMorganChase and Plaid signed an agreement in September under which the New York bank will charge Plaid a fee for data access, with both companies making technology investments. Moreover, banks' data-sharing agreements have enabled a competitive ecosystem of fintech apps to thrive while eliminating unsafe data-collection practices like screen scraping. Currently, consumers are able to access apps and services offered by more than 4,000 banks and credit unions, and 10,000 fintechs.

Still, it is unclear whether any other large banks will charge fees to data aggregators under similar deals, or whether some aggregators could lose access. While large banks may charge fees, small- and medium-sized banks may not have much leverage to do so, experts said.

Consumer advocates also are entering the fray, urging lawmakers to hold hearings on why the CFPB is rewriting the Biden-era rule that had garnered bipartisan support including in Congress.

"We knew it wasn't a perfect rule," said Lee. "It wasn't going to be a perfect rule for fintech. It wasn't going to be a perfect rule for the banks or for anybody. And that's kind of what rulemaking is about; it's listening to all of the different diverse opinions about how to craft this, and then come together for something."

What is a consumer or a 'representative?'

The Biden-era CFPB's open banking rule would have required banks to safely share financial data on checking accounts, prepaid cards, credit cards, mobile wallets, payment apps and other financial products at the request of a customer.

Fintech groups want the Trump administration to make changes that would allow for the secondary use of data. They fault the final rule for being too restrictive by not allowing for secondary uses for product updates, fraud control and research. There also are concerns about the reauthorization requirements for consumers.

The open banking rule finalized under Biden defines a "consumer" as "an individual or an agent, trustee, or representative acting on behalf of an individual." Fintech groups want the CFPB to maintain this established definition of a representative, which allows consumers to share their financial data with third-party services of their choosing.

However, the banks are trying to narrow the definition of representative to only fiduciaries, which the fintechs argue would limit open banking. A narrow definition could result in consumers having to manually download and upload their financial data to access apps and services, which fintechs argue would be a clunky and insecure process that defeats the purpose of open banking.

Some open banking experts say they are concerned that changes may not provide enough consumer protections.

"People expect certain protections to be in place when they do things online without being responsible for reading every word of the fine print," said Eyal Sivan, general manager for North America at Ozone API, a platform that facilitates the sharing of financial data with authorized third parties.

Sivan, who hosts the "Mr. Open Banking" podcast and is a board member of the Open Finance Network Canada, said there is concern that some fundamental rights and protections will be ignored or put on the shoulders of consumers. To that end, many fintechs suggest that digital disclosures made in fine print that no one reads will provide consumer protection.

"The idea that it's ultimately the user, or the consumer's responsibility, is a little silly," Sivan said. "The responsibility is something that is shared by the market, the regulator and by the individual as well."

A novel argument supported by banks and their trade groups is that Congress never intended for the CFPB to create a massive apparatus around third-party data access through application programming interfaces, or APIs. Banks claim that the statutory text of section 1033 of Dodd-Frank says only that a bank shall provide information to the consumer, upon request, pertaining to their financial data. Fintechs reject the banks' argument.

"If they wrote a rule saying it didn't apply to third parties, it would set the industry back a decade," said Moira Vahey, a spokesperson for Plaid. "Everyone has built APIs with the understanding that open banking is extended to third parties. If the CFPB determines that banks do not have to give data to third-parties, then there is no point in doing a rule."

Banks have argued in the litigation that they are only required to provide data to the consumer, and are not obligated to give any data to a third-party. unless that third-party is agent-trustee representative of the consumer with requires a fiduciary responsibility and they are only required to provide the data to the consumer – and they are not obligated to give it to third-pary.

definitely has taken some twisted turns. You know, unforeseen.

Another recent development involves the Trump administration's engagement with the cryptocurrency industry. Like fintechs, crypto firms do not want to pay banks fees for access to data. They also are expected to object to the Dodd-Frank Act's definition of "consumer" that includes a fiduciary responsibility of third parties,connoting some form of legal liability for breaches or other data losses.

The political chaos that triggered the government shutdown could also impact the CFPB's rulemaking, particularly with the Trump administration seeking to complete a final rule on a rushed timeline.

In February, acting CFPB Director Vought was sued by the National Treasury Employees Union over his plan to fire up to 90% of the bureau's employees. Vought said on a radio program last week that he expected the CFPB to be shut down in two to three months, which would throw off the timeline for an open banking proposal.

Vought said on "The Charlie Kirk Show" that the CFPB wants to "weaponize the tools of financial laws against basically small mom-and-pop lenders and other small financial institutions."

It is unclear if his comments will have any impact on the current litigation and the open banking rulemaking if the CFPB has to complete a small business review.

For reprint and licensing requests for this article, click here.
Regulation and compliance Fintech Consumer banking Customer data Trump administration CFPB News & Analysis JPMorgan Chase
MORE FROM AMERICAN BANKER