- within Insolvency/Bankruptcy/Re-Structuring, Government and Public Sector topic(s)
The Consumer Financial Protection Bureau (CFPB) has taken the next significant step toward revising its Section 1033 “open banking” regulation.
According to the Office of Information and Regulatory Affairs (OIRA), the CFPB has submitted a Notice of Proposed Rulemaking (NPRM) entitled Personal Financial Data Rights Reconsideration (Section 1033 of the Dodd-Frank Act) for review under Executive Order 12866. Submission of a proposed rule to OIRA is generally one of the final steps before the proposal is published in the Federal Register for public comment.
Although the substance of the proposal has not yet been made public, the OIRA submission confirms that the CFPB is moving forward with its previously announced effort to substantially reconsider the October 2024 final rule issued during the Biden Administration. We recently blogged about the state of open banking regulations in 2026, including potential revisions to the CFPB’s rules and state legislative efforts to regulate open banking.
What Happens During OIRA Review?
OIRA, a component of the Office of Management and Budget, reviews significant federal regulations before they are published to ensure, among other things, that they are consistent with the President’s policy priorities and that the agency has adequately considered the rule’s costs, benefits, and alternatives.
Under Executive Order 12866, OIRA review ordinarily is expected to be completed within 90 days, although that period may be extended in limited circumstances. In practice, however, reviews frequently conclude much sooner, particularly when an agency intends to move expeditiously. Given the CFPB’s repeated statements that revising the Section 1033 rule is a priority, it would not be surprising if OIRA completed its review within a matter of weeks.
Once OIRA completes its review, the CFPB may publish the proposed rule in the Federal Register, beginning the public comment process.
A Fundamental Reconsideration of the 2024 Rule
The Bureau’s forthcoming proposal follows its August 2025 Advance Notice of Proposed Rulemaking (ANPR), in which it announced that it intended to comprehensively reconsider the 2024 Section 1033 rule.
The ANPR identified numerous issues for reconsideration, including:
- whether banks and other data providers should be permitted to charge fees to third parties for access to consumer-authorized financial data;
- who may qualify as a consumer’s authorized representative;
- the appropriate balance among competition, innovation, consumer choice, privacy, and cybersecurity; and
- the operational and compliance burdens imposed by the existing rule.
Data-Access Fees Overshadow a Consequential Rulemaking
Among the issues raised in the ANPR, perhaps none has attracted more attention than whether financial institutions should be allowed to recover the costs of making consumer-authorized data available.
The 2024 rule generally prohibited covered data providers from charging fees for providing required data access. Banks and many industry participants argued that Section 1033 does not prohibit reasonable cost recovery and that maintaining secure application programming interfaces and related infrastructure entails significant ongoing expense.
The ANPR specifically requested comment on whether financial institutions should be permitted to charge reasonable fees to authorized third parties, signaling that the CFPB may be considering a significant departure from the prior rule.
Whether the forthcoming proposal adopts such an approach will likely become one of the most closely watched aspects of the rulemaking.
Zooming out, however, fees are a small component of the overarching open banking data sharing regulatory structure contemplated in the existing 1033 rules. The bulk of the regulatory obligations established in the CFPB’s current rules – for “data providers” to develop technical capabilities to share specific data with “authorized third parties,” and for “authorized third parties” to provide disclosures and commit to significant data management obligations – create consequential compliance demands that seem likely to remain in some form.
Looking Ahead
The submission of the NPRM to OIRA represents an important milestone in the CFPB’s effort to reshape the federal open banking framework. While the contents of the proposal remain unknown, the rule is expected to address several foundational issues that have divided banks, fintech companies, data aggregators, consumer advocates, and other stakeholders since the 2024 rule was adopted.
We will closely monitor the OIRA review process and will publish a detailed analysis as soon as the CFPB releases the proposed rule.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
