CFPB’s Open Banking Proposal Heads To White House For Review

The CFPB’s long-awaited open banking rewrite has officially landed at the White House, marking the final step before the agency unveils a proposal that could fundamentally reshape how consumer financial data is accessed, priced, and policed.

Headline and lede

CFPB’s Open Banking Proposal Heads to White House for Review, Setting Stage for High-Stakes Data Access Fight

The Consumer Financial Protection Bureau has submitted a revised open banking proposal to the White House’s Office of Information and Regulatory Affairs (OIRA), moving a major overhaul of the agency’s Section 1033 framework into the last phase of interagency review before public release. The rulemaking is expected to redefine the economics and guardrails of consumer-permissioned data sharing, replacing the Biden-era Personal Financial Data Rights rule finalized in 2024 and now under active reconsideration.

From Biden-era PFDR to a Trump-era redo

The proposal now at OIRA represents the culmination of a rapid—and politically charged—revisiting of the CFPB’s original Personal Financial Data Rights (PFDR) rule, which the Bureau finalized in October 2024 to implement Section 1033 of the Dodd-Frank Act.

That 2024 rule:

• Required banks, credit unions, and certain nonbanks above defined asset thresholds to provide consumers, and authorized third parties, with access to defined categories of account data in electronic, machine-readable form.

• Banned “junk fees” for data access, prohibiting covered entities from charging consumers or their agents for transferring personal financial data.

• Imposed use limitations on third parties, restricting data usage to what is “reasonably necessary” to provide the requested product or service and tightening controls on onward sharing and monetization.

Implementation was originally staged, with the largest banks and nonbank data providers facing compliance as early as 2026 and smaller entities phasing in through 2030.

Litigation, political turnover, and industry pushback stalled that timeline. By mid‑2025, the CFPB had effectively put the PFDR rule on ice and reopened the rulemaking record, issuing an advance notice of proposed rulemaking (ANPR) in August 2025 to solicit targeted input on the scope of consumer agents, standards for data access, and privacy and security concerns. The ANPR drew nearly 14,000 comments, underscoring how much was at stake for banks, data aggregators, fintechs, and consumer advocates.

New CFPB leadership, operating under a Trump administration with different priorities on regulation and competition, signaled that the 2024 open banking rule would not survive in its original form. In litigation and public statements, Bureau officials characterized aspects of the prior rule as “unlawful” and indicated that a full-scale rewrite was likely. By early 2026, reports suggested the CFPB was preparing a new proposal to replace, rather than merely tweak, the PFDR framework.

What’s known about the new proposal

While the text of the proposal has not yet been released, industry sources and early reporting point to several likely features and flashpoints once the rule emerges from OIRA review:

• Fee-based access for third parties. Unlike the 2024 PFDR rule, which barred fees for data transfers, the new proposal is expected to allow banks and other data holders to charge fintechs and other third-party data recipients for access to consumer data through standardized interfaces. That shift—described by one banking attorney as a “victory for banks”—would effectively introduce a tolling regime for open banking connections.

• Continuity of consumer data access rights. The core statutory mandate under Section 1033 remains unchanged: consumers must be able to access certain account data and direct that it be shared with third parties of their choosing. The forthcoming rule is still expected to preserve a consumer right to access and port data, albeit under a different economic and supervisory structure.

• Recalibrated privacy and security obligations. The ANPR signaled that the Bureau was reevaluating how third parties can use and store consumer data, with particular emphasis on consent, secondary uses, and data resale. Observers expect the proposal to refine the 2024 rule’s limitations on data use—potentially tightening governance for data aggregators while granting banks more leverage over how data leaves their systems.

• Revised timelines and phased implementation. The CFPB previously acknowledged that timelines in the PFDR rule would need to be revisited, promising a new proposal to extend compliance dates. The new rule is expected to reset phase‑in schedules for large banks, mid-sized providers, and small institutions, with industry groups pressing for significantly longer lead times.

• Scope and standard-setting. The original PFDR rule focused initially on checking and savings, prepaid accounts, credit cards, and digital wallets, with an explicit plan to expand to more products later. Between the 2024 rule and the 2025 ANPR, the Bureau launched a process for recognizing standard-setting bodies for open banking, laying groundwork for technical and security standards. The new proposal will likely clarify how recognized standard setters, data aggregators, and bank consortia fit into the compliance ecosystem.

With the proposal now at OIRA, the timing of public release could be a matter of weeks, if not days, depending on how quickly the White House completes its review. The review process also creates an opportunity for the administration to align the open banking rule with broader financial policy goals, including competition, innovation, and oversight of crypto-linked and embedded finance models.

Stakeholder stakes: banks, fintechs, and consumers

For banks and credit unions, the prospect of fee-based access marks a significant pivot from the 2024 rule, which they argued would have required substantial API investments without allowing recovery of costs. A tolling structure could:

• Support new revenue streams tied to data access and premium connectivity tiers.

• Encourage some institutions, particularly larger banks, to build more robust, standardized interfaces if they can charge for throughput and service levels.

• Prompt renewed tension with fintechs and consumer advocates who see paywalled data access as undermining competition and consumer choice.americanbanker+2

Fintechs and data aggregators—many of which have built business models on free or low‑cost access to bank data—are bracing for potentially higher operating costs and renewed fragmentation in technical standards. Industry groups have already urged the White House to block “anti‑consumer data access fees,” arguing that new tolls could entrench incumbents and chill innovation in personal finance apps, credit-building tools, and alternative underwriting models.news.bloomberglaw+1

For consumers, the tradeoffs are more complex. The original PFDR rule promised no-fee access, portability of data across providers, and clear limits on data misuse. A new regime that allows data access fees may indirectly influence:consumerfinance+2

• The cost and availability of free fintech products that rely on bank data.

• How aggressively banks and third parties invest in security, uptime, and error-resolution mechanisms for data interfaces.

• The extent to which open banking expands competition on pricing, rewards, and credit access versus solidifying a more closed, bank-centric ecosystem.americanbanker+2

Consumer advocates are likely to scrutinize whether the new proposal preserves the core pro‑competition and pro‑consumer protections embedded in the 2024 rule, including limits on data resale and tightened oversight of third-party access.consumerfinance+3

Implications for credit, collections, and reporting

For the credit and collections sector, the shape of the open banking rule has downstream implications that extend beyond the relationship between banks and fintech apps.

• Alternative data and credit decisioning. The 2024 PFDR framework, and the broader open banking conversation, have fueled expectations that transactional bank data could increasingly support cash‑flow underwriting, income verification, and alternative credit scoring models. A more restrictive or costlier data environment for third parties could slow adoption of these tools or tilt the market toward bank-affiliated providers.congress+2

• Consumer permissioning in collections and repayment. Fintech payment platforms and repayment tools that rely on consumer‑permissioned access to bank accounts could face new cost structures or technical changes. That could affect how collection agencies leverage third‑party tools for payment plans, recurring authorizations, and real‑time balance verification within existing regulatory constraints.

• Data flows into credit reporting. To the extent open banking data is used to supplement traditional credit bureau files—either directly or via specialty reporting—changes in access rules and pricing could affect which entities can practically participate. Smaller fintechs and niche data providers may find it harder to scale participation if they face bank-imposed tolls for every data pull.

• Compliance and dispute management. Any new rule is likely to reaffirm or expand requirements around data accuracy, clear disclosures of data use, and consumer dispute and revocation rights. Collection agencies, lenders, and servicers that rely on fintech intermediaries will need to understand not only their own obligations, but also how their vendors’ data practices intersect with Section 1033 and other consumer protection frameworks.consumerfinance+3

For compliance teams across credit, collections, and reporting, the next iteration of the open banking rule will be another layer in an already dense regulatory stack that includes the FCRA, FDCPA, UDAAP standards, and a shifting set of state privacy and data security requirements.

What’s next: timeline and action items

With the proposal now under OIRA review, industry observers expect the following sequence:

1. OIRA review and White House coordination. The review process typically includes consultations with other financial regulators and key domestic policy staff, especially given the rule’s implications for banking competition and fintech innovation.whitehouse+3

2. Public release of the proposed rule. Once cleared, the CFPB will publish the proposal in the Federal Register, triggering a new notice-and-comment window. Given the volume of prior interest, stakeholder engagement is expected to be intense.

3. Comment period and stakeholder advocacy. Banks, credit unions, data aggregators, fintechs, consumer groups, and trade associations will likely focus on fee structures, scope of covered data, security and privacy requirements, and implementation timelines. Expect competing narratives around whether data access fees promote sustainable infrastructure or suppress competition.

4. Final rule and implementation planning. The Bureau will need to balance legal risk, political pressure, and operational feasibility. Compliance professionals should anticipate phased deadlines and potential interplay with existing PFDR timelines that were previously stayed or extended.congress+2

For credit and collection market participants, key action items include:

• Inventorying current reliance on consumer‑permissioned bank data, directly or through vendors.

• Monitoring how vendors and counterparties—particularly data aggregators and payment platforms—position themselves on potential fee and access changes.

• Preparing to update disclosures, consent flows, and vendor management programs to align with any new Section 1033 requirements.

The open banking rule has already taken one lap through the regulatory process. With the CFPB’s new proposal now at the White House, a second—and potentially more consequential—round is about to begin.