Personal Financial Data Rights Rule Delayed

Toward the end of the Biden administration, the Consumer Financial Protection Bureau (CFPB) issued a final rule to implement the open-banking requirements of Section 1033 of the Dodd-Frank Act. Under it, financial institutions with $850 million or more in assets are required to make covered data regarding consumer financial products and services available to both consumers and authorized third parties in electronic form. The largest financial institutions must begin complying with the rule in 2026.

The CFPB was immediately sued in federal district court in the Eastern District of Kentucky. The plaintiffs in the lawsuit allege that the agency exceeded its statutory authority in promulgating the rule.

On July 29, under Acting Director Russell Vought, the CFPB indicated in a court filing that it planned to engage in an accelerated rulemaking process to rewrite the rule. On August 22, it published an advance notice of proposed rulemaking in the Federal Register seeking industry comments on four specific issues related to its rewrite of the rule.

However, it appears unlikely that the CFPB will complete its rewrite of the rule prior to the first mandatory compliance date of June 30, 2026, and it has done nothing to delay the current effective dates. In light of this, Judge Danny C. Reeves of the Eastern District of Kentucky issued an injunction on October 29. The court’s order, available here, prohibits the CFPB from enforcing the personal financial data rights rule against any covered financial institution until it has completed its rewrite of the rule.