United StatesCFPB Personal Financial Data Rights rule (open banking), data provider access duties and third party obligations
Also known as Personal Financial Data Rights rule, Section 1033 rule, open banking rule.
A data subject rights rule binding private bodies.
As of .
What it requires
- If you are a data provider (a financial institution, a card issuer, or any other person that controls or possesses information about a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either), make covered data available on request to the consumer and to an authorized third party in an electronic form they can use, including the most recently updated data you hold and information about authorized transactions not yet settled (12 CFR 1033.111, 1033.201(a), (b)).
- Maintain a consumer interface and a developer interface, make covered data available in a machine-readable file on request, and impose no fee or charge on a consumer or an authorized third party for the interfaces or for requests (12 CFR 1033.301(a) to (c)).
- Take no action with the intent of evading the rule, and no action you know or should know is likely to render covered data unusable or to prevent, interfere with, or materially discourage a consumer or authorized third party from accessing it (12 CFR 1033.201(a)(2)).
- If you are a third party seeking access to covered data on a consumer's behalf, give the consumer an authorization disclosure that is clear, conspicuous and segregated from other material, certify in it that you agree to the third party obligations, and obtain the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401, 1033.411).
- Limit your collection, use and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service; targeted advertising, cross-selling of other products or services, and the sale of covered data are not reasonably necessary (12 CFR 1033.421(a)).
- Stop collecting covered data one year after the consumer's most recent authorization unless the consumer gives a new authorization no later than the anniversary of the most recent one (12 CFR 1033.421(b)).
- Apply to your systems for the collection, use and retention of covered data an information security program that satisfies the Gramm-Leach-Bliley Act safeguards rules or, if you are not subject to them, the Federal Trade Commission's Standards for Safeguarding Customer Information, 16 CFR part 314 (12 CFR 1033.421(e)).
- Give the consumer a method to revoke your authorization that is as easy to access and operate as the initial authorization, and notify the data provider, any data aggregator and other third parties holding the consumer's covered data when you receive a revocation request (12 CFR 1033.421(h)).
These lines are LexLint's reading of the law's text, as of . Also read by: Consumer Financial Protection Bureau (guidance, recorded ); Forcht Bank, N.A. v. Consumer Financial Protection Bureau, No. 5:24-cv-304-DCR (E.D. Ky. ) (recorded ).
Who enforces it
Enforcement body
Consumer Financial Protection Bureau, which a federal court enjoined on from enforcing the rule until the Bureau has completed its reconsideration of it.
Settledness
The order enjoins the Bureau from enforcing the rule until it has completed its reconsideration; the order recites that the Bureau is engaged in rulemaking to reconsider the rule.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-kyed-5_24-cv-00304/pdf/USCOURTS-kyed-5_24-cv-00304-1.pdf
- Guidance link
- https://www.govinfo.gov/content/pkg/FR-2025-08-22/pdf/2025-16139.pdf
- Case citation
- Forcht Bank, N.A. v. Consumer Financial Protection Bureau, No. 5:24-cv-304-DCR (E.D. Ky. )
- Guidance body
- Consumer Financial Protection Bureau
- Under challenge
- Yes
- Open questions
- Who can serve as a "representative" making a request on behalf of the consumer under section 1033 of the Dodd-Frank Act, a question on which the Bureau's August 2025 notice seeks comment?
What this law does
The Consumer Financial Protection Bureau's Personal Financial Data Rights rule requires a data provider to make available to a consumer and an authorized third party, upon request, covered data in the data provider's control or possession concerning a covered consumer financial product or service that the consumer obtained from the data provider, in an electronic form usable by consumers and authorized third parties (12 CFR 1033.201(a)).
A covered consumer financial product or service is a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either, excluding products or services that merely facilitate first party payments (12 CFR 1033.111(b)). A data provider must maintain a consumer interface and a developer interface (12 CFR 1033.301(a)). It must not impose any fees or charges on a consumer or an authorized third party in connection with the interfaces or with requests (12 CFR 1033.301(c)).
A third party becomes an authorized third party by giving the consumer an authorization disclosure, certifying that it agrees to the third party obligations, and obtaining the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401).
An authorized third party must limit its collection, use, and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service, and targeted advertising, cross-selling of other products or services, and the sale of covered data are not part of what is reasonably necessary (12 CFR 1033.421(a)). It must limit the duration of collection to a maximum period of one year after the consumer's most recent authorization (12 CFR 1033.421(b)(2)).
It must give the consumer a method to revoke its authorization that is as easy to access and operate as the initial authorization (12 CFR 1033.421(h)(1)). The final rule is effective , and its compliance dates for data providers begin on for the largest depository institution data providers and the largest nondepository institution data providers.
On , the United States District Court for the Eastern District of Kentucky enjoined the Bureau from enforcing the rule until the Bureau has completed its reconsideration of it. The Bureau's advance notice of proposed rulemaking of seeks comments and data on four issues related to implementation of section 1033 of the Dodd-Frank Act.
When LexLint raises it
When your app profile says your app is a bank, is a lender, is a payment provider or processes personal data.