Required Rulemaking on Personal Financial Data Rights
CFPB is in the process of writing regulations to implement section 1033 of the Consumer Financial Protection Act of 2010 (CFPA).
CFPA section 1033 provides that, subject to rules prescribed by the CFPB, a covered entity (for example, a bank) must make available to consumers, upon request, transaction data and other information concerning a consumer financial product or service that the consumer obtained from the covered entity. Section 1033 also directs the CFPB to prescribe by rule standards to promote the development and use of standardized formats for information made available to consumers.
October 2024 Personal Financial Data Rights Final Rule
On October 22, 2024, the CFPB released a Final Rule for the Required Rulemaking on Personal Financial Data Rights. The final rule requires data providers to make covered data regarding covered financial products and services available to consumers and authorized third parties in an electronic form, subject to a number of requirements. The final rule also sets forth criteria a third party must satisfy in order to be an authorized third party, including certifying it will satisfy certain obligations regarding the collection, use, and retention of covered data.
Industry Standard-Setting Final Rule
On June 5, 2024, the CFPB issued a final rule regarding the attributes a standard-setting body must demonstrate in order to be recognized by the CFPB for purposes of the personal financial data rights rule. The CFPB also published a step-by-step guide for how to apply to be a recognized standard-setting body. On September 24, 2024, the CFPB published the first standard setter recognition application seeking public comment.
Notice of Proposed Rulemaking
On October 19, 2023, the CFPB released the Notice of Proposed Rulemaking for the Required Rulemaking on Personal Financial Data Rights.
SBREFA Outline of Proposals Under Consideration and Panel Report
Under the process established by Congress in the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), the CFPB is required to convene a Small Business Review Panel to consult with representatives of small entities likely to be affected directly by the regulations the CFPB is considering proposing and to obtain feedback on the likely impacts the rules the CFPB is considering would have on small entities.
On October 27, 2022, the CFPB released an Outline of Proposals and Alternatives Under Consideration for the Personal Financial Data Rights Rulemaking , which describes proposals that the CFPB considered to implement section 1033 along with the relevant law, the regulatory process, and an economic analysis of the potential impacts of the proposals on directly affected small entities. The CFPB also released a High-Level Summary and Discussion Guide of Outline of Proposals and Alternatives Under Consideration for SBREFA: Required Rulemaking on Personal Financial Data Rights .
On February 1, 2023, the CFPB convened a Small Business Review Panel for its Personal Financial Data Rights rulemaking. The Panel met with small entity representatives (SERs) in a series of Webex meetings on February 1 and 2, 2023. The Panel consisted of a representative from the CFPB, the Chief Counsel for Advocacy of the Small Business Administration, and a representative from the Office of Information and Regulatory Affairs in the Office of Management and Budget. The Panel collected advice and recommendations from representatives of small entities that are likely to be subject to the regulation that the CFPB is proposing.
On March 30, 2023, the CFPB completed the Final Report of the Small Business Review Panel on the CFPB’s Proposals and Alternatives Under Consideration for the Required Rulemaking on Personal Financial Data Rights . It was released on April 3, 2023. The Report includes a summary of the feedback from small entity representatives during the Panel process, and findings and recommendations made by the Panel.