CFPB Likely to Take Quicker Route in Revising Open Banking Rule

The Consumer Financial Protection Bureau is rushing to put out a revised open banking rule that would allow lenders to charge fintechs limited fees for customer data access, as it aims to finish the contentious rewrite before the end of the year.

The CFPB is planning to skip some procedural steps and is even weighing whether to release an interim final rule to update the Biden-era regulation without waiting for further comment, according to multiple people familiar with the matter who requested anonymity to discuss the deliberations.

The hurried rewrite—potentially skirting some parts of the Administrative Procedure Act requiring agencies to solicit public input—is the latest twist in the long-running fight involving the CFPB, banks, and fintechs over access to customer data.

It comes after a Justice Department Office of Legal Counsel opinion this month that the CFPB couldn’t get new funding from the Federal Reserve until the central bank is profitable, prompting acting CFPB Director Russell Vought to tell a court that the agency would run out of money in early 2026.

Even if the CFPB releases a full open banking proposal, the comment period will likely be shorter than the 60 days typically allowed for major rules, the people familiar with the situation said. Other CFPB proposals released this month to defang fair lending rules and a small business demographic data collection rule had 30-day comment periods.

The CFPB’s open banking release is expected to come within the next three weeks, the people said.

Process Fouls

Agencies can bypass the official notice-and-comment process for proposed rules under the Administrative Procedure Act if they find the procedures are “impracticable, unnecessary, or contrary to the public interest.”

But alleged APA violations were at the heart of complaints brought by banking and other industry groups challenging a host of CFPB and other regulations during the Biden administration.

All 10 counts in a revised lawsuit filed by the Bank Policy Institute, the Kentucky Bankers Association, and a small Kentucky bank challenging the CFPB’s October 2024 open banking rule alleged violations of the APA.

Judge Danny C. Reeves of the US District Court for the Eastern District of Kentucky said the banking industry was likely to get the open banking rule overturned on the merits in an Oct. 29 ruling delaying the rule’s implementation dates.

The Financial Technology Association, which is defending the rule in court, and BPI declined to comment on the CFPB’s latest rewrite plans. The CFPB didn’t immediately respond to a request for comment.

Fee Limits

The CFPB in August released an advanced notice asking for input on data access fees and other issues, with a comment period that closed last month.

The CFPB plans to allow banks to charge data aggregators and other financial technology companies for accessing customer deposit and credit card account data, the people in the industry familiar with the matter said. However, the CFPB is expected to put in place guardrails that would only allow banks and other data providers to recover costs for maintaining application programming interfaces and other tools for allowing data sharing, they said.

JPMorgan Chase & Co. raised fintechs’ ire earlier this year when it sought to force data aggregators to pay fees that fintechs said were too high and threatened to put some companies out of business. JPMorgan contended that the fees were appropriate given the costs of maintaining data sharing tools and cybersecurity protocols.

JPMorgan has since reached deals with Plaid Inc., the largest data aggregator, and similar companies.

Banks had been pushing the CFPB to only allow fintechs that have a fiduciary relationship with customers to access relevant data, but it appears the CFPB won’t include such a requirement in the latest rule, people in the industry said.

Congress required the CFPB to craft a rule allowing customers to control their financial data in Section 1033 of the 2010 Dodd-Frank Act.

The Biden-era CFPB released its version of the rule in October 2024 following a lengthy rulemaking that included a small business review panel required under the Dodd-Frank Act for significant rules. BPI and its co-plaintiffs sued to block the rule the same day.

The CFPB is weighing whether to skip the small business review entirely or work with the Small Business Administration for a potentially less intensive review of the coming rule’s effect on small banks, credit unions, and fintechs, people familiar with the plans said.

The Trump administration’s CFPB originally asked Reeves to vacate what it called an “unlawful” rule, but it was forced to reverse course after cryptocurrency backers including Donald Trump Jr., the Winklevoss twins, and White House crypto adviser David Sacks raised concerns about JPMorgan’s fees.