CFPB’s 1033 open banking rule empowers consumers and protects sensitive private consumer data

The Consumer Financial Protection Bureau’s (CFPB) Personal Financial Data Rights Rule (Rule 1033) helps create a more consumer-friendly and competitive financial services marketplace by allowing people to easily and securely move their personal financial data between financial institutions. Prior to this rule, many banks and financial institutions limited how consumers could use their financial data, which made it difficult for people to comparison shop, manage money, use new technology, or switch accounts and service providers. With Rule 1033, people who wish to switch financial service providers can share their banking history and data from previous transactions in a secure manner, helping them more easily move between service providers.

• Rule 1033 supports competition and provides much needed flexibility for customers. Individuals who are not satisfied with their financial institution will no longer have to surrender their banking history or data when they switch providers. “Trapped” financial data in an existing account will not prevent someone from switching to a better product, and an individual’s financial institution will be required to share that person’s current data, empowering customers to use their own transaction histories to comparison shop for alternative financial products and more easily transfer their account data to a new financial institution. The rule will prohibit banks and credit unions from charging customers for sharing that data, allow customers to modify or cancel data access, and require data users (third parties such as fintechs, software companies, budgeting programs, and data aggregators) to obtain consent before accessing that individual’s financial information.
• Rule 1033 makes payments systems safer. Rule 1033 clarifies that individuals own their own financial data (data that is generated by or associated with that individual) and reiterates that this data should only be shared with an individual’s explicit authorization for the narrow purpose for which it has been authorized, drawing clear boundaries for how data might be used and shared. Data access also ends immediately when an account is closed. Additionally, Rule 1033 moves payment systems away from screen scraping, a risky practice that gives nonbanks unrestricted visibility into someone’s payment account.
• Rule 1033 helps push the U.S. banking system in a more inclusive and innovative direction, in line with some of the world’s best payment systems. Reducing friction in data sharing fosters innovation in banking and may lead to greater financial inclusion. By supporting safe data sharing, the rule will advance open banking in the United States, which has already been adopted in places such as the United Kingdom, the European Union, Australia, and Brazil. Polling demonstrates that an overwhelming majority of people agree with and support a rule requiring banks and other providers to make personal financial data available without junk fees.