A federal rulemaking works through a sequence set by the Administrative Procedure Act: an agency publishes a proposed rule, accepts public comment, responds to that comment, and then issues a final rule that carries the force of law. The most important qualification is that nothing in the middle is binding. A proposal is a statement of intent, not an obligation.
For a fintech or compliance team, the distinction matters operationally. A proposed rule signals what to plan for; a final rule, with its effective date, tells you what to build and by when. Confusing the two is how compliance projects get scoped against requirements that later change shape.
This explainer walks the notice-and-comment process for financial rules, what proposed versus final actually means, and where industry input fits. For the basic vocabulary, the sibling piece on what regulation actually means covers the difference between statutes, rules, and guidance; this article stays inside the rulemaking machinery itself.
What starts a federal rulemaking?
A rulemaking almost always begins with a statute. Congress passes a law that directs an agency — the Federal Reserve, the CFPB, the SEC, the OCC — to regulate some activity, and the statute typically leaves the details to the agency. The law says what must be achieved; the rule says how. That delegation is the whole reason the process exists.
Before a formal proposal, an agency often takes preliminary steps. It may issue an advance notice of proposed rulemaking, which asks the public open questions about a problem the agency has not yet decided how to solve. It may publish a request for information or hold outreach sessions. None of these steps produces obligations, and none commits the agency to proposing anything at all.
One definitional note for readers tracking terminology: the word federal describes the national level of government, as distinct from the states. Cambridge's dictionary entry for federal frames it as relating to a system of national government, and that distinction matters here, because state-level rulemaking — a New York or Colorado process, for instance — follows its own procedures rather than the federal sequence described below.
What does the proposed rule actually do?
The proposal is the first formal step. The agency publishes a notice of proposed rulemaking, usually in the Federal Register, setting out the text it intends to adopt, the statutory authority it claims, and an economic analysis of the rule's expected effects. The notice also opens a comment period, giving the public a stated window to respond.
A proposed rule is a draft under consideration, not a requirement. Firms are not obliged to comply with it, and no deadline in it is enforceable. What a proposal does do is signal direction. Compliance teams that read proposals early can scope systems, flag data gaps, and budget for work that may arrive — without committing spend to text that may not survive.
Proposals also change. Between the notice of proposed rulemaking and the final rule, the agency can rewrite provisions, drop them, or add new ones. A deadline quoted from a proposal is therefore a planning assumption at best, and it should be labelled as such in any internal compliance roadmap.
Where does industry input fit in?
The comment period is the formal channel for industry input, and it is open to anyone. Banks, fintech firms, trade associations, consumer groups, academics, and individuals all file comments. There is no eligibility test and no minimum threshold of standing.
Effective comments tend to share a few traits. They are specific: they quote the provision at issue and describe the operational consequence in concrete terms. They supply evidence the agency can use, such as data on implementation costs or on how a requirement would interact with existing systems. And they propose alternatives, because an agency that receives a workable alternative can adopt it and strengthen the record for the final rule.
Volume matters less than substance. A thousand form letters carry less weight than a handful of comments that engage with the rule's actual mechanics. Trade associations often file consolidated comments covering industry-wide concerns, while individual firms file on their own operational exposure. Both channels are legitimate, and both go on the public record.
There is a second, less visible channel: meetings. Agencies routinely meet with affected parties during a rulemaking, and many agencies disclose those meetings and their subject matter. What those meetings cannot do is substitute for the written record. The agency's legal obligation to consider input runs through the comment file, which is why serious participants put their arguments in writing even after a productive meeting.
What happens between proposal and final rule?
When the comment period closes, the agency reads the record. Staff analyse the comments, respond to significant points, and decide what to change. Under the Administrative Procedure Act, the final rule must include a statement of basis and purpose — the agency's explanation of what it decided, why, and how it handled the major objections. That response document is where the comment process leaves its mark. This connects to our earlier piece, Colorado AI Act After the Delay: What Deployers of Underwriting Models Must Build by June 30.
The agency cannot simply ignore adverse comment. If the record shows a serious objection, the agency must address it, and courts review that response when the rule is challenged. A rule adopted without a reasoned response to significant criticism is vulnerable on judicial review, which gives the comment process real teeth despite its unhurried pace.
In some cases the agency concludes that its proposal needs rework. It can issue a supplemental proposal, reopening comment on revised text, or withdraw the proposal entirely. Neither outcome is rare in financial regulation, where implementation cost estimates and legal-authority questions often reshape a rule between proposal and adoption.
The final rule, once adopted, is published with an effective date and, frequently, staggered compliance dates for firms of different sizes. That is the moment obligations attach. The compliance deadlines that follow are the ones that belong in a build plan.
What this means for compliance and legal-ops teams
Three practical implications follow from the record, each bounded by how the process actually operates.
- Track proposals as planning signals, not obligations. Read the notice of proposed rulemaking, scope the work it implies, and treat every date in it as provisional until the final rule confirms it.
- Comment where it counts. If a provision would be operationally unworkable, the comment period is the formal opportunity to say so with evidence — and the agency must respond on the record, which is the mechanism by which rules get fixed before they bind.
- Read the response-to-comments document, not just the final rule text. It explains why the agency settled on the final provisions, which is often the fastest way to understand what the rule actually requires and how a regulator is likely to read it.
The process is slow by design. That slowness is the trade for a record that courts can review and that affected firms can shape. The teams that treat the comment window as a working deadline — not a formality — are the ones whose concerns show up in the final text. For related reading, the coverage of what the CFPB's personal financial data rights rule requires shows this sequence in action, from proposal through staggered compliance deadlines. Readers following this should also see What the CFPB's Personal Financial Data Rights Rule Requires, and When Compliance Deadlines Hit.
Where the process ends and enforcement begins
A final rule ends the rulemaking but starts the compliance clock. Once the effective date passes, the agency can examine for compliance, bring enforcement actions, and issue supervisory findings against the rule's requirements. The rulemaking record, including the agency's own responses to comments, becomes interpretive material for how the rule will be read in practice.
What remains unknown in any given rulemaking is the litigation outcome. A final rule can be challenged in court, and challenges can delay or undo parts of it. Until a court rules or the agency amends the rule, the final text governs — which is why compliance teams monitor both the docket and the Federal Register after adoption, not just before it.
