The CFPB's Personal Financial Data Rights Rule: A Guide to US Open Banking and API Mandates

For years, the United States financial system has operated on a fragmented and often insecure approach to consumer data sharing. When individuals want to connect their bank accounts to budgeting applications, payment services, or investment platforms, they frequently have to hand over their actual banking usernames and passwords to third-party aggregators. This risky practice, known across the industry as "screen scraping," allows automated bots to log into banking portals and extract data indiscriminately. It exposes consumers to significant privacy and security risks, while leaving financial institutions blind to exactly who is accessing their systems and for what specific purpose.[1][2]

To modernize this ecosystem and align the U.S. with global financial standards, the Consumer Financial Protection Bureau (CFPB) finalized the Personal Financial Data Rights Rule in October 2024. Commonly referred to as the Section 1033 rule—named after the dormant provision of the 2010 Dodd-Frank Act it activated—the regulation was designed to formally usher in "open banking" in the United States. The core premise of the rule is simple: consumers own their financial data, and they have the legal right to access it and share it securely with authorized third parties without facing artificial barriers or fees.[1][3]

The mechanism for this transformation relies on mandating secure technology. The 2024 rule required banks, credit card issuers, and other financial providers to build dedicated, secure Application Programming Interfaces (APIs). These developer interfaces allow authorized third-party applications to access specific consumer data—such as account balances and transaction history—without ever seeing the user's login credentials. By forcing the industry to transition from screen scraping to standardized APIs, the CFPB aimed to boost competition, making it easier for consumers to switch banks or shop around for better financial products.[1]

However, as of mid-2026, the regulatory landscape for U.S. open banking is in a state of extraordinary flux. The first major compliance deadline for the largest banks and data providers arrived on April 1, 2026, but it passed without becoming a binding enforcement trigger. Instead of a synchronized rollout of consumer data rights, the industry is navigating a complex legal and political limbo where the federal rule exists on paper but cannot currently be enforced by the agency that wrote it.[2]

The delay stems from a protracted legal battle that began almost immediately after the rule's publication. Banking industry groups, including the Bank Policy Institute and the Kentucky Bankers Association, sued the CFPB in a Kentucky federal court. They argued that the agency had exceeded its statutory authority under the Dodd-Frank Act and imposed arbitrary, overly burdensome requirements on financial institutions. In late 2025, the federal court sided with the banks, issuing an injunction that halted the CFPB from enforcing the compliance deadlines while the litigation proceeded.[2]

Concurrently, under new leadership, the CFPB itself initiated a formal reconsideration process, effectively pausing its own mandate while it rewrites key provisions of the regulation. In a rare legal maneuver in May 2025, the agency even asked the court to vacate its own rule so it could start fresh. The CFPB's August 2025 Advance Notice of Proposed Rulemaking signaled that the agency intends to substantially revise the framework, leaving banks and fintechs to guess what the final compliance architecture will look like when the dust settles.

The most contentious issue in the ongoing rewrite is the question of "data tolls." The original 2024 rule strictly prohibited banks from charging fees to third-party apps and data aggregators for accessing consumer data, arguing that such fees would stifle innovation and limit consumer choice. Banks fiercely opposed this ban, arguing that building and maintaining secure, high-volume APIs requires massive ongoing investment. They contend that they should be permitted to recoup those costs from the commercial entities that are profiting off the data access, rather than subsidizing the fintech industry.[1]

The revised rulemaking process has explicitly reopened this fee debate. Recent indications suggest the CFPB may eliminate the total ban on data provider fees, potentially allowing banks to charge aggregators after a certain number of requests have been fulfilled for free. This shift has fiercely divided the industry. Fintech trade associations warn that allowing banks to charge for access will ultimately pass operating costs down to consumers and crush smaller startups, while banks view it as a necessary mechanism to ensure the safety and soundness of the data-sharing ecosystem.[2]

Despite the regulatory freeze at the federal level, the transition to open banking is happening anyway, driven by intense consumer demand and market realities. Millions of Americans already rely on interconnected financial apps, and financial institutions recognize that they can no longer support the security liabilities of screen scraping. Consequently, many large banks have moved forward with API integrations of their own accord, striking bilateral, fee-bearing agreements with major data aggregators to ensure secure data transfer outside the purview of the frozen CFPB rule.[2]

These early design decisions and private contracts are effectively setting the de facto standard for the U.S. open banking market. Legal experts note that the architecture being built today will heavily influence future compliance requirements. Even without active federal enforcement, institutions that treat the current pause as a permanent reprieve risk falling severely behind. Furthermore, the federal vacuum has prompted states like New York to consider stepping in with their own open banking legislation, raising the specter of a fragmented, state-by-state compliance patchwork.

For consumers, the underlying promise of open banking remains a powerful force for financial empowerment. The shift toward secure, consumer-permissioned data sharing represents a permanent evolution in how financial services operate. While the exact regulatory parameters—and the ultimate allocation of infrastructure costs—are still being negotiated in Washington and the courts, the era of siloed financial data and risky password sharing is coming to an end, paving the way for a more competitive and secure digital economy.[1][4]

Beyond just access and fees, the open banking transition also introduces critical new privacy safeguards. Under the envisioned framework, third parties can only collect, use, or retain data to deliver the specific product the consumer requested. This bans "bait-and-switch" data harvesting, where an app might offer a budgeting tool but secretly use the harvested transaction data for targeted advertising or sell it to data brokers. Regardless of how the final rule is rewritten, these baseline privacy expectations are becoming the new industry standard, ensuring that consumers finally have transparency and control over their digital financial footprints.[1][4]