Open banking heads back to the drawing board

In the first week of August, the CFPB sent a revised Personal Financial Data Rights proposal to OIRA. That is one of the final steps before a proposed rule publishes for comment, and it confirms that the Bureau intends to substantially rework the October 2024 §1033 rule rather than defend it.

The operative status of the 2024 rule deserves precision, because it is genuinely tangled. A federal court in Kentucky enjoined the Bureau from enforcing it. The appeal of that ruling is stayed in the Sixth Circuit at the CFPB’s request while the Bureau rewrites the rule. The looming compliance deadlines are paused along with it. The rule exists on paper. Its obligations, for now, do not bind.

What we said in May, and what changed

Our May edition described §1033 entering its first compliance tier, with a build clock running for smaller institutions. That was the frame the 2024 rule prescribed, and the injunction and the OIRA submission have formally suspended it. The correction matters. If your 2027–2028 roadmap still cites the old tier dates, it is planning against a schedule that no longer exists.

The deadline is gone, but the direction remains. Open banking keeps arriving. The rewrite is about who pays for the rails and who holds the liability.

Build for the strategy instead of a dead deadline

Reporting on the revised proposal suggests the contested ground is cost recovery for data-access infrastructure and liability allocation. Whether consumers get API access to their data is not in dispute. Credential-based screen scraping is still the practice every party wants retired. The 2024 rule demanded authenticated APIs, consent and authorization logging, and revocation. The market and the eventual rule are still converging on those capabilities. What changed is the clock and possibly the cost model.