.svg)
The Consumer Financial Protection Bureau (CFPB) has determined that its own open banking rule, finalised in October 2024, is unlawful and should be set aside, according to a court filing submitted last week.
In a status report filed with the U.S. District Court for the Eastern District of Kentucky, the CFPB and defendant Russell Vought informed the court that the agency’s leadership is on the side of abandoning the incoming compliance requirements.
“After reviewing the Rule and considering the issues that this case presents, Bureau leadership has determined that the Rule is unlawful and should be set aside,” the document reads.
The report was filed in response to a case brought by Forcht Bank, the Kentucky Bankers Association and the Bank Policy Institute challenging the CFPB’s rule under Section 1033 of the Dodd-Frank Act.
The court had previously granted a 60-day stay to allow time for the bureau’s new leadership to review the rule.
As covered by Vixio, on May 14, the court also granted a motion by fintech industry body the Financial Technology Association (FTA) to intervene in the case and stated that the parties should adhere to the existing briefing schedule set in March.
The CFPB filing, which was signed by agency counsel, including chief legal officer Mark Paoletta and assistant general counsel for litigation Christopher Deal, said the bureau intends to file a motion for summary judgment by May 30, the deadline previously set for plaintiffs, “to adhere to the existing briefing schedule.”
A blow to open banking
Unsurprisingly, the FTA is less than pleased with the CFPB’s decision.
The association, whose membership includes Plaid, PayPal and Amazon Pay, as well as European fintechs such as Klarna, Revolut and Wise, pointed out that the rule was first introduced under the first Trump administration and had broad, bipartisan support.
“Vacating the 1033 rule is a handout to Wall Street banks, who are trying to limit competition and debank Americans from digital financial services,” said Penny Lee, the FTA’s president and CEO.
Lee added that consumers “must have the right to control their financial lives, not the nation’s biggest banks. As an intervening party in the ongoing litigation, FTA will continue to defend open banking and Americans’ freedom to access the financial services they want to use.”
“We remain committed to building a financial system that is inclusive, innovative, and centered on the needs of everyday Americans.”
What is the 1033 rule?
The CFPB’s Section 1033 rule, finalised in October 2024, requires covered financial institutions to provide standardised access to data such as transaction history and balances, either directly to consumers or to authorised third parties with consumer consent.
The rule also includes strict limits on data use and retention, capping retention at one year unless reauthorised, and permits the creation of recognised standard-setting bodies to guide data access and security practices.
The provisions of the rule echo elements of European frameworks on open banking, although they are rather more light touch.
Compliance deadlines are phased by institution size:
- April 1, 2026 for institutions with assets of $250bn or more, such as JPMorgan Chase, Bank of America and Wells Fargo.
- April 1, 2027 for institutions with assets of between $10bn and $250bn, including PNC Financial Services, U.S. Bancorp and Capital One.
- April 1, 2028 for banks with assets of between $3bn and $10bn, such as American Business Bank and First United Bank.
- April 1, 2029 for institutions with assets of between $1.5bn and $3bn, including Community National Bank.
- April 1, 2030 for banks with assets of between $850m and $1.5bn.
Smaller institutions are exempt entirely.
What could happen next?
Stakeholders should be under no illusion that this move by the CFPB could delay the creation of a unified open banking ecosystem in the world’s largest economy, meaning the continuation of the current fragmented, market-driven model.
Although larger players may have the resources to adapt, smaller fintechs and consumers could face reduced transparency, limited data mobility and slower access to innovation.
Fintechs from Europe that had moved into the US market in anticipation of increased openness will no doubt be disappointed, especially as this shuts off what had seemed like a highly viable market with certainty guaranteed through a framework.
The new CFPB leadership may choose to revise and reissue the rule after further review and consultation, but this would require a fresh rulemaking process that could take months or even years, depending on the agency’s evolving priorities.
Congress may also intervene, particularly if pressure mounts from fintech or banking lobby groups seeking legislative clarity around consumer data access rights. However, with a Republican majority in both houses, and priorities elsewhere, that could be less likely.
Meanwhile, intervening parties such as the FTA could still challenge the withdrawal in court, potentially aiming to preserve aspects of the original rule.
In this vacuum of federal rules, industry-led initiatives such as the Financial Data Exchange (FDX) and direct bank-fintech partnerships may continue to dominate, potentially giving larger players an advantage.
In addition, states such as California or New York may step in with their own consumer data access laws.
Although this would give fintechs access to considerable populations state by state, it would also create a patchwork of standards that could further complicate compliance for firms that operate nationally.
