The Consumer Financial Protection Bureau estimates that 100 million consumers have authorized third parties to access their data.¹ That data drives endless business decisions and capabilities. But financial institutions and technology developers must also be aware of regulations regarding consumers and their rights over their data.

One such proposed regulation, Rule 1033, would require financial institutions and other data providers to help consumers access and share their data securely using application programming interfaces.

What is CFPB’s Rule 1033?

Section 1033 of the Consumer Financial Protection Act of 2010 was sent for comment in October 2023² and is expected to be finalized in the fall of 2024. This proposed rule would require depository and non-depository entities to:

• make available to consumers and authorized third parties certain data relating to consumers’ transactions and accounts;
• establish obligations for third parties accessing a consumer’s data, including important privacy protections for that data;
• provide basic standards for data access; and
• promote fair, open and inclusive industry standards.

Compliance dates for this rule will be staggered based on institutional asset size, ranging from six months to four years from the date of the final rule publication.

Rule 1033’s Potential Impact on Financial Data Rights

The proposed rule is designed to address challenges with open banking by defining the:

• scope of data that third parties can access on a consumer’s behalf;
• terms on which data is made available; and
• mechanics of accessing the data, proposed to be consumer permission based.

It seeks to impose a framework in which data transfers occur via APIs instead of existing methods, such as screen scraping or credential sharing. Data providers would be required to maintain a digital interface for consumers and developers, both of which must meet certain performance specifications to receive and respond to data access requests.

This approach aims to ensure third parties are acting on behalf of consumers when accessing their data and respect their privacy interests. Rule 1033 also promotes security and reliability, as it would apply a set of consistent standards across the market for sharing data.

Third party access proposals would require these companies to provide an authorization disclosure to inform the consumer of key terms of access and obtain the consumers’ informed consent. According to the CFPB, the proposed rule would “forbid companies that receive data from misusing or wrongfully monetizing the sensitive personal financial data.”³

What Data Does Rule 1033 Cover?

The rule includes a definition of the types of data that providers, such as card issuers and financial institutions, would need to make available upon request. According to the proposed rule, covered data includes:

• transaction information, including historical data (at least 24 months);
• account balances;
• terms and conditions;
• upcoming bill information; and
• basic account verification information, such as name, address, email, etc.

It excludes confidential commercial information, algorithms, information used to prevent fraud or money laundering or other crimes, and information that is required confidential under other laws, as well as other information that the provider cannot retrieve in the ordinary course of business.

At the request of a consumer or authorized third party, providers must make covered data available in a machine-readable format that can be retained by the consumer or authorized by a third party and transferred for processing into separate information systems – all without imposing fees or charges.

How Rule 1033 is Accelerating Open Banking

Open banking uses APIs to enable developers to access an institution’s data, which includes customer data.⁴ The technological approach enables banks to offer new products or services without building them internally or relying on a single provider. Rule 1033 aims to place data rights in the hands of consumers, expanding the definition of open banking and giving them more control.

While that control could make customers less “sticky,” it could be welcome news for institutions that prioritize a relationship-based approach to customer service, like community banks. As consumers exercise more control over their data, they’re more able to switch to banks that provide personalized service and their desired products, instead of remaining with those that hoard all their financial data but provide poor service and lacking products.

Data Rights Considerations in Open Banking

As with any technology partnership, concerns may arise regarding data sharing and third-party data breaches. However, there are ways to mitigate risk for your institution. And the opportunities that open banking provides, from improving customer experience to expanding revenue lines, can better position your institution against the competition.

As a data steward, your bank should consider several factors to protect your customers and remain compliant. Safeguard your digital services, core platform and any other sectors placed into your open banking ecosystem. Your bank should also ensure you have secure processes in place, including handling file transfers without opening yourself up to any vulnerabilities.

To maximize your security and incident preparedness, develop and maintain policies and procedures for preventing and managing a security breach. Additionally, make sure you understand data retention and data deletion obligations.

Sharing Data in the Digital Era

When it comes to Rule 1033, your bank has a choice to make. Will you simply implement measures to ensure compliance once required and deliver data upon request? Or will you embrace open banking to better serve current and prospective customers? Developing the right open banking strategy for your institution can provide long-term benefits for your bank.