The Consumer Financial Protection Bureau (CFPB) has taken a significant step towards regulating open banking in the United States with its finalization of the Personal Financial Data Rights rule in October 2024. The rule comes into effect on April 1, 2026. This regulation aims to transform how consumers interact with their financial data, fostering competition and innovation in the financial services industry. According to a 2023 survey conducted by Visa, 91% of consumers link their financial accounts to third parties. These may be Personal Finance or budgeting tools, tax automation software, credit score monitoring tools and more. With such a high number of consumers exposing their financial data to “open” services, it is high time this area was regulated. But then again, are consumers really empowered to share and use their financial data the way they want, and with who they want?

Key Aspects of the Rule

Enhanced Consumer Control

The rule requires covered entities, including banks, credit card issuers, and digital wallet providers, to: Provide consumers and authorized third parties with free access to specified consumer financial data upon request Enable seamless transfer of financial data to other providers Make available information needed to initiate payments to or from accounts covered by Regulation E

Privacy and Security Safeguards

To protect consumer interests, the rule: Limits third parties’ use of data to purposes expressly authorized by the consumer Bans “bait-and-switch” data harvesting by third parties Establishes privacy and security standards for data sharing

Empowering Consumers and Fostering Competition

The CFPB’s rule is designed to give consumers unprecedented control over their financial data, enabling them to: Switch providers more easily for better rates and services Compare financial products more effectively Access innovative services, including “pay-by-bank” systems By facilitating data sharing and transfer, the rule aims to boost competition in payments, credit, and banking markets, potentially leading to lower prices and improved customer service.

Implementation Challenges and Industry Opposition

Legal Challenges

The banking industry, led by the Bank Policy Institute, the Kentucky Bankers Association, and Forcht Bank, filed a lawsuit against the CFPB on the same day the rule was released. They argue that the rule exceeds the CFPB’s statutory authority and jeopardizes consumer privacy and security.

Implementation Timeline

The rule’s compliance deadlines are set to begin in April 2026, giving financial institutions time to adapt. However, the industry argues that this timeline is unreasonable given the complexity of the required changes.

Regulatory Uncertainty

With changes in administration and potential shifts in CFPB leadership, the future of the rule remains uncertain. A recent court decision to pause litigation over the rule adds another layer of complexity to its implementation.

Uncertainties Aside, Be Prepared for the Future!

As financial institutions grapple with the implications of the CFPB’s rule, Thales’ OneWelcome Identity Platform offers a robust solution through its Consent and Preference Management capability: User Empowerment: The platform allows users to actively manage their consents and preferences, aligning with the CFPB’s goal of giving consumers control over their data. Compliance Management: Built with data privacy in mind, the platform helps ensure “always-on” compliance with global data privacy regulations, including the new CFPB rule. Secure Access: The platform provides convenient and secure access to financial data, addressing the increasing need for data privacy in regulated markets. Transparency: It integrates the data privacy conversation explicitly into the user journey, fostering trust and transparency. Consent Tracking: The platform maintains and stores a track record of customer consent, crucial for compliance with the new CFPB rule.

The Road Ahead

As the financial services industry awaits the outcome of legal challenges and potential regulatory shifts, institutions must prepare for a future where open banking becomes the norm. While some argue that the private sector has already made significant progress in developing secure data-sharing practices, the CFPB’s rule represents a push towards standardization and consumer empowerment. Financial institutions that embrace this change, leveraging solutions like Thales’ OneWelcome Identity Platform, may find themselves better positioned to thrive in an increasingly open and competitive financial ecosystem. However, the ultimate shape of open banking in the US will likely be determined by the interplay of regulatory action, legal challenges, and market forces in the coming years. Stay tuned!