The CFPB's Section 1033 Rule: A Guide to Open Banking, Data Rights, and the Compliance Overhaul

The United States is undergoing a fundamental shift in how personal financial data is controlled, moving away from closed banking silos toward a consumer-centric system known as open banking. At the center of this transformation is the Consumer Financial Protection Bureau's implementation of Section 1033 of the Dodd-Frank Act.

Finalized in late 2024, the Personal Financial Data Rights rule was designed to give consumers the legal right to access their financial data and share it with third-party applications securely and free of charge. It activated a dormant legal authority that had been on the books since the aftermath of the 2008 financial crisis.

For years, consumers wanting to use budgeting apps, loan comparison tools, or alternative payment services had to rely on "screen scraping"—a process where they handed over their bank usernames and passwords to third parties. Section 1033 replaces this risky practice with secure, standardized developer interfaces, commonly known as APIs.

Under the framework, data providers—which include traditional banks, credit card issuers, and digital wallet providers—must build and maintain these interfaces. When a consumer authorizes a third party, the bank must provide the requested data in an electronic, usable format without imposing access fees.

The core objective is to foster competition. By making it easier to transfer transaction history and account verification data, the CFPB aims to lower the barrier to switching financial institutions and break up market concentration.

As CFPB Director Rohit Chopra noted when the rule was initially finalized, too many Americans remain stuck in financial products with poor rates because the friction of moving their data is too high. Open banking theoretically allows consumers to "fire" underperforming banks and seamlessly migrate to better services while keeping their financial history intact.

Beyond competition, the rule introduces some of the strictest data privacy protections in federal financial law. It mandates strict data minimization, meaning authorized third parties can only collect, use, and retain data that is reasonably necessary to provide the specific product the consumer requested.[4]

This provision explicitly bans "bait-and-switch data harvesting." Fintech companies and data aggregators are prohibited from using consumer financial data for secondary purposes, such as targeted advertising or selling the data to data brokers, closing a major loophole in the modern digital economy.[4]

Despite these consumer benefits, the path to implementation has been highly contested. Immediately after the rule was finalized, major banking trade groups, including the Bank Policy Institute and the Kentucky Bankers Association, filed a lawsuit challenging the CFPB's statutory authority and raising concerns about data security and compliance burdens.[1]

Traditional financial institutions argued that forcing them to build free APIs for third parties unfairly shifted the costs of data security onto banks while allowing fintechs to profit. Community banks, represented by organizations like the Independent Community Bankers of America, also pushed for broader exemptions, arguing that the technological overhaul would disproportionately strain smaller institutions.[5]

This legal pressure led to a dramatic regulatory pivot. In July 2025, the CFPB requested a stay in the litigation, announcing its intention to initiate a new rulemaking process to "substantially revise" the 1033 framework and address the defects in the initial rule.[1]

A federal judge in the Eastern District of Kentucky granted the stay, effectively placing the federal regulation of open banking in an extraordinary state of limbo while the agency reworks the text.[2]

Because of this pause, the original compliance timeline has been suspended. The rule initially established a phased rollout, with the largest depository institutions—those holding at least $250 billion in assets—slated to comply by April 1, 2026.[3]

That April 2026 deadline arrived and passed without becoming a binding enforcement trigger. Instead of a live regulatory mandate, the industry is currently operating in a holding pattern, waiting for the CFPB to release its revised rules.[2][3]

However, the delay does not mean open banking is dead in the United States. The CFPB's decision to revise rather than abandon the rule indicates that the direction of travel remains clear, even if the exact technical requirements and fee structures are being renegotiated.[3]

In the absence of an enforceable federal mandate, some states are reportedly considering stepping in to fill the regulatory void, which could create a patchwork of open banking laws if the CFPB does not act swiftly to finalize its revisions.[2]

Furthermore, the industry itself has continued to prepare. The CFPB has already recognized standard-setting bodies, such as the Financial Data Exchange (FDX), to help define the technical specifications for the APIs that will eventually power the ecosystem.[3]

For consumers, the promise of Section 1033 remains a watershed moment for financial autonomy. Once the legal hurdles are cleared and the revised rule takes effect, Americans will finally own their financial data, unlocking a more competitive, transparent, and secure financial marketplace.