Section 1033 of the Dodd-Frank Act gives the Consumer Financial Protection Bureau authority to write rules requiring financial firms to make a consumer's own account data available, on the consumer's request, to a third party the consumer chooses. The bureau used that authority to adopt its personal financial data rights rule — the open banking rule — and the obligations it creates fall mainly on the firms that hold the data, not on the fintech apps that receive it. The specific covered entities, obligations, and compliance dates are fixed by the final rule text, and teams should read that text rather than summaries of it.
This matters because account data is the raw material of most consumer fintech. Budgeting apps, payment services, and lending platforms all depend on a customer's ability to point at a bank or card account and say: share this. Before a rule like this, that sharing ran on bilateral agreements and screen-scraping, with no federal floor of rights. The rule replaces that patchwork with a statutory basis — Section 1033, part of the Dodd-Frank Wall Street Reform and Consumer Protection Act passed in 2010, the same statute that created the bureau itself.
The Consumer Financial Protection Bureau is an independent federal agency charged with consumer protection across banks, credit unions, debt collectors, credit reporting, and other financial companies operating in the United States. Its rulemakings carry the force of federal regulation, and its regulations sit in Chapter X of Title XII of the Code of Federal Regulations — the same shelf as Regulation E and Regulation Z. The data rights rule joins that family, and its enforcement posture comes from the same supervisory and enforcement machinery the bureau applies elsewhere.
What does the rule actually require?
At its core, the rule establishes a right of data access. A consumer can direct a covered firm to make that consumer's transaction, account, and identity data available to an authorized third party, in a usable form. The rule also addresses revocation: the consumer's authorization is not permanent, and the framework contemplates the consumer withdrawing it. Data providers and data recipients each carry duties — the provider to make the data available as the rule specifies, the recipient to use it within the scope the consumer authorized.
Two features distinguish this from ordinary privacy law. First, the right belongs to the consumer, not to the firm holding the data; the firm is not free to refuse because sharing is commercially inconvenient. Second, the rule is about portability, not just protection. Existing privacy regimes generally limit what a company may do with data. Section 1033 rulemaking is affirmative: it compels disclosure to a party of the consumer's choosing. That inversion is what makes it an open banking rule rather than a privacy rule.
The precise data categories, the form of authorized requests, and the exceptions — for instance, what a provider may refuse to share — are set out in the final rule as published. Compliance teams should treat the rule text and the bureau's accompanying releases as the operative instruments, and summaries, including this one, as orientation only.
Which firms does it cover?
The rule's coverage turns on the definitions in the final rule: which entities count as data providers, which third parties count as authorized recipients, and where thresholds fall. Coverage questions of this kind are where implementation risk concentrates, because the definitions determine whether a given product — a card program, a prepaid account, a wallet — sits inside the rule or outside it.
Context helps here. The bureau's jurisdiction reaches banks and large non-bank entities, including credit reporting agencies and debt collectors, per USAGov's agency profile. The bureau also examines institutions above asset thresholds for compliance with the consumer financial laws it administers. A rule built on that supervisory base will reach well beyond depository banks, but the exact perimeter is a text question, not an analogy question. Firms close to a boundary should map their products against the definitions directly.
When do the obligations attach?
The final rule phases in compliance by dates set in the rule itself, generally scaled so that larger institutions come into scope before smaller ones. Those dates are the operative deadlines, and they control project sequencing: data access requires interface work, credentialing, and revocation handling, none of which compress well.
For a fuller treatment of the phased deadlines, see our earlier piece on what the CFPB's personal financial data rights rule requires, and when compliance deadlines hit. The dates in the final rule govern; if the rule's status changes through litigation or amendment, the changed instrument governs. That caveat is not boilerplate — major bureau rules have faced legal challenge before implementation completes, and a team that builds to a date without tracking the docket builds to a moving target. For related coverage, see What the CFPB's Personal Financial Data Rights Rule Requires, and When Compliance Deadlines Hit.
How does this fit the bureau's other rules?
The data rights rule does not float free. It interacts with the bureau's existing electronic-payments framework: Regulation E already fixes error timelines, liability limits, and dispute steps for electronic payments, and data sharing will generate more electronic transactions subject to those rules. A data recipient that moves money on the strength of shared account data inherits whatever liability regime applies to the movement itself. We covered a connected angle in Regulation E Explained: Error Timelines, Liability Limits, and Dispute Steps for Electronic Payments.
It also sits alongside the bureau's unfair, deceptive, and abusive acts or practices authority. Our explainer on the three legal tests behind unfair, deceptive, and abusive practices covers the standard the bureau applies when data is used outside the scope of a consumer's authorization. Misuse of authorized data is the fact pattern most likely to convert a compliance question into an enforcement question.
The procedural backdrop matters too. This rule went through the ordinary notice-and-comment process described in How Federal Rulemaking Works: From Notice and Comment to a Final Rule, which means the record of comments and the bureau's responses is part of the interpretive material courts will look at if the rule is challenged.
What this means in practice
Three operational consequences follow from the sourced record.
- Map products against the rule's definitions now. Coverage is definitional, and a firm that discovers late that a product is a covered data provider inherits the interface and revocation obligations with the calendar already running.
- Track the instrument, not the commentary. The rule text, the bureau's releases, and any litigation docket are the authoritative sources for dates and scope. Summaries age badly.
- Build revocation as a first-class feature. A consumer right that can be exercised can also be withdrawn, and the operational ability to cut off a third party's access on request is part of the compliance surface, not an afterthought.
What the record establishes is the statutory basis, the bureau's authority, and the shape of the obligations. What it does not settle, for any individual firm, is whether that firm is covered and when its deadline falls — those answers live in the final rule's definitions and compliance schedule, read against the firm's own product set.
One more data point on the bureau's capacity to enforce what it writes: USAFacts reports that the CFPB spent $2.74 billion in fiscal year 2025, about 0.039% of federal spending, and that its spending has grown faster than the federal budget overall since 2011. A rule is only as real as the supervision behind it, and the bureau's resourcing is part of any realistic compliance timeline.
