Open Banking Will Soon Have a New Overseer As the CFPB Looks to Regulate Data Sharing

With data sharing via open-banking arrangements becoming increasingly vital in the payments business, the Consumer Financial Protection Bureau on Thursday released an outline of a “data-rights rule” it is preparing that would govern how consumers’ financial information is shared among players such as banks and payments companies.

The proposed rule aims at preventing financial institutions and other keepers of consumer data from monopolizing that control to prevent competition from other firms and to keep customers from moving to other providers, according to the CFPB’s release. “Dominant firms shouldn’t be able to hoard our personal data and appropriate the value to themselves,” the bureau’s director, Rohit Chopra, said in a statement. “The CFPB’s personal financial data rights rulemaking has the potential to jumpstart competition, giving Americans new options for financial products.”

The release is the latest step toward what the bureau is expected to introduce next year as a regulation that could take effect as early as January of 2024, estimates Scott Talbott, senior vice president of government affairs for the Electronic Transactions Association, a Washington, D.C.-based trade group.

The CFPB has been studying the issue of consumer data in financial markets, including payments, since at least 2016. At the same time, new open-banking technologies, including data sharing via application programming interfaces between banks and payments providers, have developed to replace the direct use of consumers’ credentials to access their accounts. Typically, open banking is used in payments applications to verify account ownership and balances.

If the CFPB’s latest provisions are adopted by the bureau, financial companies and institutions would be required to turn over consumer information at the consumer’s request, either to the consumer directly or to a firm designated by the consumer. Other restrictions are also under consideration, including preventing “third parties” from reselling data for “other uses,” according to the bureau. The CFPB, which is soliciting feedback on the proposal, said it will also convene panels to gather industry reaction.

The CFPB’s latest action stems from authority granted to the agency by Section 1033 of the Dodd-Frank Act, which addresses the grounds for the agency to write rules for data sharing. It follows an advance notice of public rulemaking on the subject that the agency released in 2020. “They’ve been at this for awhile,” says Talbott. Now, he says, “This is moving toward finalization.”

Open banking has emerged as a major industry in payments in recent years as fintechs seek to facilitate transactions for users through access to their accounts held at financial institutions. Originally, third parties sought to verify accounts by means of copying data displayed on a screen after gaining account access—a procedure known derisively as “screen scraping.” Smoother techniques employing APIs have since emerged to simplify the process. Lately, the emergence of newer payment applications, including buy now, pay later installment plans, has added to the effort to gain access to user accounts. That has led to the development of more secure access standards, including an API developed by the Financial Data Exchange, an industry trade group.