The Consumer Financial Protection Bureau (CFPB) has presented details of a proposed new rule to ‘accelerate a shift’ towards open banking across the US.
Governments worldwide are encouraging open banking, which aims to encourage innovation and boost competition in financial services, at different paces and in different ways. ‘Open’ refers to the use of open application programming interfaces (APIs).
In the US president Joe Biden signed an executive order in July 2021 directing the CFPB to facilitate the portability of consumer financial transaction data so people can more easily switch financial institutions and use new fintech products.
The newly proposed Personal Financial Data Rights rule (set out in a 299-page document) activates a dormant provision (section 1033) of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which was brought in more than a decade ago. The CFPB says that it should ‘jumpstart competition’ by forbidding financial institutions from ‘hoarding’ a person’s data and by requiring companies to share data at the person’s direction with other companies.
‘The proposed rule would allow people to break up with banks that provide bad service and would forbid companies that receive data from misusing or wrongfully monetising the sensitive personal financial data,’ the CFPB states in its Personal Financial Data Rights rule announcement.
RELATED ARTICLE US consumer agency aims to finalise open banking rules in 2024 – a news story (31 October 2022) on CFPB director Rohit Chopra presenting an update on planned open banking rules at an event in Las Vegas
Empowering consumers
“With the right consumer protections in place, a shift toward open and decentralised banking can supercharge competition, improve financial products and services and discourage junk fees [unexpected and/or hidden charges],” said the watchdog’s director Rohit Chopra, adding that the proposal would “give consumers the power to walk away from bad service and choose the financial institutions that offer the best products and prices.”
The CFPB explains that, at present, people’s access to their financial data is inconsistent between financial institutions.
‘Even among companies that do share data at a customer’s request, the terms of the sharing vary greatly. This lack of norms in the market allows incumbents to play games to their own customers’ detriment – including hiding or obscuring important data points like prices. This undercuts the ability of small or upstart institutions to compete with incumbents, even when people want their data shared,’ the CFPB states.
Under the proposed new rule, people would have the power to share data about their use of checking and prepaid accounts (a checking account is a form of deposit account), credit cards and digital wallets. This would allow them to access competing products and services ‘without worrying that their data might be collected, used or retained to serve commercial interests over their own,’ according to the CFPB, adding that ‘importantly, people could be certain that their data would be used only for their own preferred purpose – and not for financial institutions or tech companies to surveil and manipulate.’
The CFPB is subject to a rulemaking obligation that means that before issuing any proposed rule, it is obliged to convene a panel of small businesses to provide input on proposals. It kicked off that process last October and, in March 2023, released a 301-page ‘Final Report of the Small Business Review Panel on the CFPB’s Proposals and Alternatives Under Consideration for the Required Rulemaking on Personal Financial Data Rights’.
RELATED ARTICLE ‘Open to possibilities: governments bank on opening up financial services data’ – our report on a Global Government Fintech ‘Open Banking and Open Finance: What Role – And Benefits – For Governments?’ webinar, which was held on 15 March 2022
Guarding against data exploitation
Under the newly released proposal, requirements would be implemented in phases, with larger providers being subject to them ‘much sooner’ than smaller ones. In addition, the ‘many’ community banks and credit unions that have no digital interface at all with their customers would be exempt.
The CFPB has invited comments on its proposal, ‘including on other consumer financial products and services that could be covered via subsequent rulemaking’, by 29 December 2023. It will then aim to finalise the rule by autumn 2024.
In ‘prepared remarks’ released alongside the CFPB’s announcement, Chopra expanded on how the proposed rule seeks to guard against exploitation of personal data.
“Exploitation of personal data by bad actors is a real concern, and financial data is a particularly valuable commodity,” he said. “We have seen first-hand how some financial firms, including major players in China, are ingesting data in ways that raise risks of invasive financial surveillance and censorship.”
“That is why our proposal sets out a clear prohibition,” he continued. “Companies receiving data can only use it to provide the product people asked for, and for nothing else. When a consumer permits their private data to be used by a company for a specific purpose, it is not a free pass for that company to exploit the data for other uses. Importantly, the rule says that firms that receive financial data to provide a specific service cannot feed the data into algorithms for unrelated activities, such as targeted advertising and marketing.”
RELATED ARTICLE Swiss government sets mid-2024 deadline for open finance progress – a news story (6 January 2023) on developments in Switzerland
Fintech and banking groups react
Penny Lee, president and chief executive officer of the Washington DC-headquartered Financial Technology Association (FTA), described the proposed new rule as a “win for consumers”, who she described as being “one step closer to having a strong right to control their financial data”.
“We look forward to the CFPB creating strong rules of the road that guarantee people’s right to use the digital financial tools they want, regardless of where they bank,” Lee said. “The proposal builds on our industry’s progress and can provide assurances for continued consumer-friendly innovation. Looking ahead, we urge the CFPB to implement open banking in a way that prevents anti-competitive behaviour from incumbent financial institutions, safeguards consumer data privacy and fosters innovation in the marketplace.”
In January the FTA urged the CFPB to expand the scope of the ‘1033 rule’ to include consumer data from accounts such as retirement funds, utility payments, payroll and social security: to, in effect, accelerate the introduction of ‘open finance’ – open banking’s more expansive sibling movement.
American Bankers Association (ABA) president and chief executive Rob Nichols, meanwhile, described the proposed rule as “bring[ing] us one step closer to achieving our common goal of enhancing consumers’ access to their financial data and allowing them to share it safely with companies of their own choosing, whether that sharing is from bank to bank, bank to fintech or fintech to bank.”
But he said it was “critical that the CFPB ‘right-size’ the scope of the rule pertaining to the types of accounts involved and the information data providers are required to share, as well as address the question of liability if something goes wrong.”
“In addition, we remain concerned with the significant implementation costs our members will face,” Nichols continued, adding that entities granted access to consumers’ data “must be held not only to the same high standards but also to the same level of supervision related to data security, privacy and consumer protection that banks must meet every day”.
Global Government Fintech’s open banking / open finance topic section
US (and Canada) playing catch-up
The US is playing catch-up with some other parts of the world when it comes to bringing in open banking rules, although its northern neighbour Canada has also been slow out of the blocks.
Fintechs Canada (an industry association that operated as Paytechs of Canada until last year) earlier this month launched a campaign called ‘Choose More’, urging government action on open banking (as well as payments modernisation). Its campaign website contains a ‘myth vs fact’ section stating that ‘open banking is not yet available in Canada despite it being available in other countries like Australia and the UK’.
Australia already has its Consumer Data Right (CDR) – a relatively high-profile data-sharing and portability initiative that has expanded from banking into the energy sector. The UK is widely seen as a leading nation when it comes to developing an open banking ecosystem, spurred by the creation of its Open Banking Implementation Entity (OBIE) in 2016, while its public sector has also blazed a trail in public procurement of open banking technology.
The current chair and trustee of OBIE (which is now being referred to as Open Banking Limited), Marion King, warned at a conference in London earlier this month that the UK would be wise not to “underestimate the pace of change in the rest of the world” when it comes to rolling out rules to support open banking. “It’s [open banking] in dozens of jurisdictions now across the globe, moving quickly in different ways,” King said at the ‘Fintech as a force for good’ event.
In his prepared remarks, Chopra said that the proposed US rule “also aligns with many of the guidelines in place or under consideration in other major jurisdictions around the world.”
 has presented details of a proposed new rule to ‘accelerate a shift’ towards open banking across the US.){kind=link}