President Joe Biden gave a boost to Consumer Financial Protection Bureau’s decade-long effort to kickstart open banking in the U.S. when he signed an executive order last week aimed at boosting competition in the economy.
The president’s July 9 order includes a provision that strongly encourages the CFPB to issue Dodd-Frank Act regulations that would make it easier for consumers to access their bank data and transfer it to other banks and outside apps, such as
Allowing consumers to easily transfer bank account information and other data is the heart of open banking, a system where tech firms and other third parties create applications that can be added to a user’s existing banking infrastructure.
After years of studying the issue, the CFPB began crafting rules in late 2020 that would cover consumer privacy, data breach liability, and how much information can be shared in open banking.
But the agency must balance competing demands from banks, fintechs, and a growing number data firms like Plaid or Yodlee that collect and share data among institutions and apps. The CFPB also faces challenges in applying a maze of dated consumer finance laws to open banking technologies.
Don’t hold your breath waiting for final rules. It’s going to take some time.
What is Open Banking?
Banking in the U.S. is a relatively closed ecosystem where banks for the most part are the gatekeepers for account information and other customer data. The need for open banking regulations has only increased with the proliferation of new fintech apps and products that rely on consumers’ permission to access their bank accounts or other sensitive financial information.
The industry has established some technical standards for sharing customer account data with fintech apps and others. But there have been frequent skirmishes over practices such as screen scraping, which involves a bot using a consumer’s financial account login credentials to collect information from a bank’s files directly.
Some data sharing has moved to agreed-upon data portals, which allow consumers and banks to have more control over how much data is shared. Plaid Inc. reached an agreement with Capital One June 9 in which Plaid agreed to halt screen scraping and use Capital One’s application programming interface to gather data.
The European banking system is far more open than the U.S. Customers there can transfer their account data to third-party apps for payments, budgeting and other apps with ease and without the fear that banks could block access to the data. Advocates for open banking want to bring that system to the U.S.
What is the CFPB’s Role?
Section 1033 of the 2010 Dodd-Frank Act directed the CFPB to create a formalized framework for consumer data sharing.
The CFPB was given the role because it oversees a host of consumer protection laws important to open banking, including the Fair Credit Reporting Act, the Equal Credit Opportunity Act, the Electronic Funds Transfer Act, and privacy and data security provisions of the Gramm-Leach-Bliley Act.
The CFPB will also have to determine whether it should monitor and examine the largest data companies. Dodd-Frank gave the CFPB authority to directly supervise the “largest participants” in emerging financial markets.
What Has the CFPB Done?
So far, not much. Open banking regulations took a back seat to other priorities, including mortgage lending and servicing rules and payday lending regulations.
The agency issued nonbinding guidance in 2017. The CFPB’s “consumer protection principles” for financial data sharing and aggregation called for banks to provide data at a consumer’s request. The guidance focused on consumer consent for any data transfer to outside apps and others.
The CFPB’s 2017 principles were neutral on the types of technology that data aggregators and other app developers use, something industry and consumer advocates applauded.
After years of study, the bureau kicked off the regulatory process last October with an advance notice of proposed rulemaking. The notice requested public input on a broad array of concerns, including consumer privacy, security, and control over how their data is used.
The comment period quietly closed in February as the bureau awaits new leadership. Rohit Chopra, Biden’s choice to lead the CFPB, is still awaiting Senate confirmation but could see a vote before the August recess.
Will Biden’s Order Speed Things Up?
Yes, but that doesn’t mean it’ll be fast. The rulemaking process takes time and Chopra’s confirmation delay has already thrown some wrenches into the works.
Having the president single out open banking rules means that the topic will likely get a more prominent billing on the agency’s crowded regulatory agenda, according to former CFPB officials.
Once a draft proposal is out, industry participants and consumer advocates will have as much as three months to respond before the CFPB even begins reviewing comments.
From there, the rulemaking process could take years. But with Biden pushing for rules, look for the CFPB to come in at the shorter end of that range.