Open Banking Update: CFPB Regulation

The U.S. Consumer Financial Protection Bureau (“CFPB”) is in the process of establishing regulations for the Open Banking and financial services data access markets.  As part of the process, regulators, trade groups, and industry participants have been exploring and sharing insights on several Open Banking concepts. Trustly’s Banking and Regulatory Affairs Teams regularly track this topic and wanted to share our notes.

CFPB Positions Itself for a Proposed Open Banking Rule in October

This fall looks to be busy for Open Banking market participants.  That’s because the CFPB has formally scheduled the release of its proposed Open Banking rule for October.  The announcement comes as part of the CFPB’s regulatory agenda process.  All federal agencies, including the CFPB, are required to publish bi-annual rule-making agendas under Section 602 of the Regulatory Flexibility Act.  

The release of a proposed rule will mark the middle of the Open Banking rule-making process. The CFPB kicked off its Open Banking rule-making activities in style, with Director Rohit Chopra making an announcement on the main stage of last year’s Money 20/20 conference in Las Vegas. The Bureau promptly moved into a small business regulatory review panel and released the findings of that process this past March.    

Federal agencies tend to take up to a year to review and address public comments after releasing a proposed rule. Director Chopra has publicly shared he hopes the CFPB will be able to consider the public’s input and release a final Open Banking rule in 2024.

Director Chopra Provides Pre-Rule Guidance

On June 12th, CFPB Director Chopra released a written update on the CFPB’s Open Banking rule-making process as well as provided guidance to the industry.

The Director’s blog post reiterated that Open Banking is a key tool to drive competition in banking and financial services. Director Chopra has long believed that Open Banking can make it easier for consumers to switch banks and that even the threat of consumers being able to change providers more easily should lead to better service, higher interest rates paid on deposits, and better loan offerings.  

Director Chopra’s post highlighted that the CFPB’s upcoming rule is about formalizing a consumer’s right to control his or her own financial data. This is a good reminder to us all that it’s not a bank’s data or a merchant’s data, but instead, it’s the consumer’s data because they are the ones engaging in the underlying financial transactions.  

But consumers and their rights weren’t the core focus of Chopra’s post. Instead, the Director wrote directly of the yin and yang that the Bureau is considering as it writes its first final Open Banking rule — how the industry will need to work collaboratively through industry-setting bodies to fill in the space between the principles in the Bureau’s rule.

Chopra’s comments should not be read as an abdication of decision-making by the CFPB or its director. The blog post directly addresses the fact that banks and third-parties that consumer’s use to access their data are deadlocked on “certain core issues.” The post also notes that the CFPB will not tolerate decisions by industry standards-setting bodies that “do not put consumers fully in the driver’s seat.”  

Director Chopra also takes great care to mention that standards-setting bodies “must not” be dominated by the most prominent market participants. And he warns of powerful firms, who have historically sought to manage emerging technologies through utilities or networks skewed to their interests and even owned by those same large companies.  

Chopra writes, “[c]ontrol of the Open Banking system by such players threatens competition and the consumer’s control of their own financial affairs,” and notes the CFPB “will pay close attention to any attempt to limit consumers’ exercise of their data rights, particularly where such attempts proceed from coordinated efforts by dominant firms.”

Director Chopra does not name any specific firms, but there are a few central parties helping to shape the American Open Banking ecosystem, which the CFPB may be keeping in mind as it issues its proposed rule. The largest U.S. banks own and operate Akoya, which positions itself as a one-stop shop to access consumer Open Banking data from the biggest financial institutions.  Many banks and non-bank industry participants collaborate through the Financial Data Exchange, known as FDX. FDX has helped develop the OAuth standards banks use to offer tokenized account access to companies such as Trustly, and banks and non-banks alike participate in the group’s committees. Bank-owned The Clearing House is also involved in Open Banking, as many large banks are using TCH’s ACH account number tokenization service to provide substitute ACH numbers via Open Banking data. The consumer demand for Real-Time Payments (RTP) have also stirred interest into Open Banking and further driven its adoption in the US.

Insights From Congressional Hearings

Members of Congress recently demonstrated a strong bi-partisan interest in the CFPB’s upcoming rule and had the chance to ask Director Chopra a wide range of questions during his recent testimony and discussion sessions with the Senate Banking Committee and the House Financial Services Committee.

Representative French Hill (R-AR), asked the Director to discuss how the CFPB decided to set the scope of the upcoming rule at accounts covered by Regulation E (debit cards, prepaid cards, stored value wallets, checking and savings accounts) and Regulation Z (credit and charge cards) and hinted at concerns that the rule would not properly cover non-banks that offer financial services.

Director Chopra welcomed the question and explained that the Bureau had asked industry experts what they considered to be the most valuable type of data, and the responses indicated it was transaction and cash flow data. He clarified that the CFPB’s rulemaking activities were intended to include accounts from non-banks, and offered a future-focused example where mortgage and auto lenders could look at cash flow data to underwrite loans that they might have otherwise denied on the basis of credit scores.

Rep. Hill also asked whether the Open Banking rule would address liability for data breach. Director Chopra acknowledged this was an industry concern, specifically from data providers, and noted that the proposed rule should address the issue.

Representative Dr. Bill Foster (D-IL) generally asked for an update on the Open Banking rulemaking. In response, Director Chopra confirmed the CFPB was on track to issue a proposed rule this fall. Director Chopra also used his response to highlight his recent blog post, noting that industry standards will play an important role and the CFPB will want to make sure any such standards give consumers and market participants the ability to switch providers.

Representative Warren Davidson (R-OH) raised questions about competition in Open Banking. He noted how over the last several years, a consortium of the largest financial institutions has positioned itself to “exert governance over data ecosystems” and was “serving as mandated intermediaries between peer-to-peer consumer transactions.”  Through his question, Rep. Davidson drew the conclusion that this type of industry consolidation and control has led to decreased competition and consumer choice, and asked Director Chopra how the CFPB would address competition and privacy concerns in the upcoming Open Banking rule.

Having already addressed competition issues earlier in the hearing, Director Chopra focused on how the proposed Open Banking rule would address what intermediaries can do with Open Banking data, including setting limits for data received.

Representative Dan Meuser (R-PA) raised a question about screen scraping, and asked whether the Open Banking rule could address the practice. Director Chopra agreed that the CFPB’s rule will set the stage for the industry to transition away from screen scraping, highlighting that screen scraping would not be part of American financial infrastructure in the future.

‍

‍