The CFPB's Open Banking Rule Is On Hold — What Section 1033 Would Require If It Takes Effect

If you use an app that connects to your checking account — a budgeting tool, a bill-pay service, a lending app that pulls your transaction history to underwrite a loan — the legal right that makes that connection possible is Section 1033 of the Dodd-Frank Act. The CFPB spent years writing a rule to make that right concrete. Right now, that rule is finalized on paper and enjoined in practice, and the Bureau is rewriting it. Here's what's actually in force, what isn't, and what the rule would require if and when a version of it takes effect.

The short version

The CFPB finalized the Personal Financial Data Rights Rule on October 22, 2024, implementing Section 1033. A bank and two banking-industry trade groups sued the same day. A federal court has since blocked the CFPB from enforcing it, and the Bureau is now rewriting the rule from an advance-notice stage. As of this writing, no compliance deadline under the original rule is enforceable, and the rewritten version hasn't been published for public comment yet.

What the 2024 rule actually says

The rule as finalized applies to banks, credit unions, credit card issuers, and other providers holding data tied to bank accounts, credit cards, mobile wallets, and payment apps. Per the CFPB's own summary, covered institutions must make the following available to a consumer or their authorized third party, free of charge: transaction information, account balance information, information needed to initiate payments, upcoming bill information, and basic account-verification information.

Three restrictions go with that access:

• Purpose limitation. A third party "can only collect, use, or retain data to deliver the product the consumer requested" — not to sell it or repurpose it for something the consumer didn't authorize.
• Immediate revocation. When a consumer revokes access, the rule requires it to end right away, not on some delayed schedule.
• A one-year ceiling. Access can be maintained for no more than one year without the consumer renewing it.

The rule was also meant to phase out "screen scraping" — third parties logging into a bank's consumer-facing site with your credentials to pull data — in favor of standardized, secure data-sharing connections. As finalized, compliance was phased by institution size, starting with the largest providers on April 1, 2026 and extending to the smallest covered institutions by April 1, 2030; certain small banks and credit unions are exempt from the rule entirely.

Why none of that is currently enforceable

Forcht Bank, the Bank Policy Institute, and the Kentucky Bankers Association filed suit the day the rule was finalized, arguing the CFPB had exceeded what Section 1033 actually authorizes. On October 29, 2025, Judge Danny Reeves of the U.S. District Court for the Eastern District of Kentucky granted a preliminary injunction, finding the plaintiffs were likely to succeed on their claims — including that the rule "likely exceeds CFPB's statutory authority because Section 1033 permits data sharing only with consumers or fiduciary-like agents, not commercial third parties." That's a live legal question, not a settled one — the injunction blocks enforcement while the case and the rulemaking continue, it doesn't resolve the underlying dispute.

The CFPB, for its part, had already signaled it wanted to revisit the rule before the injunction: it opened an Advance Notice of Proposed Rulemaking on August 22, 2025, asking for public input on four specific pieces — who counts as an authorized "representative" for data-sharing purposes, how (or whether) providers can charge fees for responding to data requests, data-security cost-benefit tradeoffs, and data-privacy risks.

Where the rewrite stands now

On August 6, 2026, the CFPB submitted a new proposed rule — "Personal Financial Data Rights Reconsideration" — to the Office of Information and Regulatory Affairs (OIRA) for review under Executive Order 12866. OIRA review is generally one of the last steps before a proposed rule is published in the Federal Register for public comment — so a rewritten version of the rule, open for comment, is a plausible next step, though the CFPB hasn't published one yet as of this writing. Nothing here is a prediction about what that rewrite will say — the ANPR confirms the fee question and the definition of who qualifies as an authorized representative are both under active reconsideration, but not what the Bureau will ultimately decide on either one.

What this means if you use a bank-linked app today

Nothing about the underlying legal right in Section 1033 changed — it's still Dodd-Frank law. What's on hold is the CFPB's specific rulebook for how banks have to implement it: the free-access requirement, the screen-scraping phase-out, the one-year access cap. Until a version of the rule is actually in force, the specifics of what a bank must share, how it must share it, and what it can charge for the privilege are governed by each institution's own agreements and practices — not a uniform federal standard. That's the same instinct behind what your bank is legally required to tell you in its GLBA privacy notice: the specifics of what's disclosed and what you can opt out of are worth reading directly rather than assuming, the same way it's worth knowing exactly what changed the last time the CFPB rewrote how it handles complaints. The mechanism is the same across all of it: read the primary source for what's actually in force today, not what a headline from 2024 implied would be permanent.