Trump’s CFPB reverses course on 1033 open bank regulation

The Consumer Financial Protection Bureau signaled that its embattled consumer financial data rights rule may soon be nullified, according to a legal filing submitted just before Memorial Day weekend. 

In a filing Friday in the Eastern District of Kentucky, CFPB Chief Legal Officer Mark Paoletta said the bureau leadership aims to table the rule after deeming it lacking legal basis. The CFPB plans to seek a summary judgment this week asking the court to formally void the rule — a move that would kill the regulation.

“After reviewing the Rule and considering the issues that this case presents, Bureau

leadership has determined that the Rule is unlawful and should be set aside,” Paoletta noted in the filing. “To that end, Defendants intend to file a motion for summary judgment by May 30, 2025, the date that this Court had set for plaintiffs in its March 27 Order.”

Since the reelection of President Donald Trump, banking experts have expected the open banking rule — dubbed the “1033” rule after the section in the Dodd-Frank Act it was intended to fulfill — to be either amended, rescinded or reissued, though until Friday’s filing, the process the bureau would take was unclear. 

It has taken the bureau nearly a decade to craft the rule, which stems from a section of the 2010 Dodd-Frank law requiring financial services companies to make consumer data available to individuals in an accessible electronic format.

The 1033 rule stood to give consumers unprecedented control over their financial data by requiring banks, credit unions and certain fintechs to share account information — like transaction history, and account balances — with authorized third parties as long as consumers gave consent. The rule explicitly exempted institutions with less than $850 million in assets. 

Proponents of 1033 said it democratizes data and opens the door for firms to evaluate consumers using alternative credit assessments such as tracking their cash flow, because traditional credit scores can be less accessible to underserved groups. Bank trade groups — some of the loudest critics of the rule — worried the rule shifted liability risks to banks while not overseeing nonbanks as heavily. 

A cohort of bank trade groups — including the Bank Policy Institute and the Kentucky Bankers Association — sued the CFPB the same day it finalized the rule in October last year. In the 56-page lawsuit, the groups argued that the bureau overstepped its statutory authority. 

The industry groups said they worried that the rule compelled banks to turn over customer data to third-parties that are not regulated like banks. The rule limited banks’ ability to refuse to provide customers with their personal data to only instances the agency deemed reasonable. 

Following the signal by the CFPB, BPI and the Kentucky Bankers Association issued a statement celebrating the all-but-imminent demise of 1033, framing it as a win for consumer data privacy. 

“The CFPB has taken the appropriate step of acknowledging Section 1033’s clear legal deficiencies, and we urge the big tech companies to do the same, rather than protracting a legal dispute that endangers consumer financial data,” the groups said in a release.  “Banks have already made it possible for hundreds of millions of Americans to safely access and share their data — the current rule undermines and disrupts that ecosystem to the benefit of tech companies looking to profit even further from consumers’ data.”