What the Future May Hold for the Consumer Financial Protection Bureau's Open Banking Rule

Will the Consumer Financial Protection Bureau’s (CFPB) recently promulgated open banking rule survive under the new Congress and incoming presidential administration? Two upcoming proceedings may hold the answer.

On 22 October 2024, the CFPB finalized a rule to govern personal financial data rights, known colloquially as the open banking rule.¹ In promulgating the open banking rule, the CFPB relied on Section 1033 of the Dodd-Frank Act for authority. In general, the open banking rule requires banks to establish electronic facilities for the reliable and accurate transmission of consumer data to authorized third parties at the consumer’s request and for a specified purpose and time period. Under the new Congress and incoming presidential administration, the rule may face two significant challenges to its existence in the coming months. 

The first challenge may occur rapidly now that the 119th Congress is in session. Under the Congressional Review Act (CRA), Congress may disapprove of any rule finalized by the CFPB within the last six months of the outgoing presidential administration. To do so, both the Senate and the House must pass an identical joint resolution of disapproval. All votes under the CRA are simple majority votes, and under most circumstances, the resolution is not subject to filibuster in the Senate. Whether Congress will reject the open banking rule remains to be seen. To disapprove of a rule under the CRA, Congress must act within a 60-day period that commences in mid-January. This review period overlaps with the first weeks of the new administration when the Senate is typically focused on confirming the president’s cabinet nominees. The CFPB also issued a flurry of rules in the final months of the outgoing administration, so the new Congress may need to pick and choose which ones to consider jettisoning during the short CRA review window.

The second challenge to the open banking rule is playing out in a lawsuit filed by a Kentucky-based national bank and the Bank Policy Institute in federal court in Lexington, Kentucky. In their amended complaint, the plaintiffs allege that the open banking rule exceeds the congressional grant of rulemaking authority in at least six ways, which include the following:

1. The rule purports to regulate the provision of data to third parties, but the statute only permits rulemaking with respect to banks’ obligations to “make available to a consumer, upon request, information in the control or possession of the [bank] concerning the consumer financial product or service that the consumer obtained” from the bank.²  
2. The rule increases risk to consumers by forcing banks to make available information enabling third parties to initiate payment from a consumer’s account and tasks banks with ensuring that unsupervised third parties can be trusted with the data they receive.
3. The rule seeks to outsource the task of establishing standards for compliance to private entities.
4. The rule imposes vague and confusing performance standards for the developer interfaces that data providers are required to establish.
5. The rule would require compliance before any of the standard-setting bodies are convened, much less able to promulgate standards for compliance.
6. The rule prevents data providers from recouping any of the substantial costs that compliance with the rule will impose.³

The CFPB filed an answer to the amended complaint on 27 December 2024, and the court directed the parties to confer regarding a case schedule. The incoming CFPB director will have wide latitude to use the lawsuit to determine the fate of the rule. The new director could, for example, consent to an injunction that would prevent the rule from taking effect. Whether the open banking rule will meet this fate remains to be seen. The proposed rule drew bipartisan support, including from former US Representative Patrick McHenry, the then-chair of the House Financial Services Committee. And the final rule, though controversial in many respects, appears to have avoided the ire of at least some members of the incoming administration.

Regardless of what happens to the rule, open banking is likely here to stay. Data providers have already established private, though largely unregulated, facilities for the electronic sharing of consumer data. Consumers and market participants who take issue with the manner in which data is shared, or allegedly misused, have several legal remedies available to them, regardless of whether open banking is regulated by the CFPB.

While it is impossible to predict the ultimate fate of the open banking rule, this much is likely certain: it will meet its destiny sooner rather than later. the firm will continue to provide updates on the fate of the rule.