What Comes Next for Open Banking?

The Consumer Financial Protection Bureau is moving closer to changing the rules governing how consumers access and share their financial information.

Section 1033 of the Dodd-Frank Act gives consumers a right to access certain financial information. In 2024, the CFPB issued a rule implementing that provision and extending requirements to consumer-authorized third-party access. The rule quickly became the subject of legal challenges, and the CFPB is now reconsidering key questions around third-party access, fees, data security, and privacy.

Now, that reconsideration appears to be moving forward. The CFPB's proposed rewrite has been sent to the White House for review, bringing a new proposal closer to public release.

Consumers benefit from open banking

In the decade since Dodd-Frank's passage, a diverse ecosystem of financial technologies has developed around consumers' ability to securely connect their financial information to tools they choose.

Today, consumers use these tools to transfer funds, organize budgets, and much more. That ability has expanded convenience, consumer choice, and innovation across the marketplace. But those benefits depend on strong protections.

As consumers share sensitive financial information across a growing number of platforms, strong protections need to follow that data wherever it goes. Without consistent standards, gaps in privacy, fraud prevention, security, and accountability can leave consumers exposed.

At the same time, rules that unnecessarily restrict consumers’ ability to share bank information with, say, Venmo or Rocket Money could harm consumers' ability to transfer money and invest. That's why getting the balance right is so important.

Stability requires shared responsibility

This marketplace of financial tools depends on trust across consumers, banks, and financial technology platforms. Consumers need confidence that their data will be handled safely, banks need clear rules for managing and responding to data-access requests, and fintech platforms need a predictable framework for accessing information responsibly.

Clear rules should give every participant clear responsibilities. That means establishing who can access financial information, under what conditions, how that information can be used, what standards apply once the data leaves a financial institution, and who is accountable when something goes wrong.

Financial institutions invest in the technology, cybersecurity, and fraud controls needed to make consumer data available securely. Third parties that access and use that information should likewise bear appropriate responsibility for protecting it.

A durable open-banking framework should preserve consumers’ ability to use the financial tools they want while establishing consistent standards across every participant in the ecosystem.

The details will matter

Reporting currently suggests that the new rule will differ meaningfully from the 2024 proposal, but until the text is public, important questions remain.

The proposal will show how the CFPB intends to address those questions for consumers, financial institutions, and fintech companies alike. The goal should be a system people can understand and trust—one that supports innovation while protecting the sensitive financial information that makes it possible.

The Ledger Project recently published a more extensive explanation of section 1033, and we will continue tracking the proposal as more details become available.

For more updates like this, sign up for The Ledger Project’s emails here.