On October 22, 2024, the CFPB finalized a rule that will give consumers greater rights, privacy, and security over their personal financial data. The rule requires financial institutions, credit card issuers, and other financial providers to unlock an individual’s personal financial data and transfer it to another provider at the consumer’s request for free.
The final rule is part of the CFPB’s efforts to finally activate Section 1033 of the Consumer Financial Protection Act, a dormant legal authority enacted by Congress in 2010. According to the CFPB, the new final rule:
Ensures consumers will be able to access and share data associated with bank accounts, credit cards, mobile wallets, payment apps, and other financial products;
Aims to address market concentration that limits consumer choice over financial products and services;
Will boost competition by giving people more freedom to switch banks or providers and shop around for the best deal; and
Establishes strong privacy protections, requiring that personal financial data can only be used for the purposes requested by the consumer.
The final rule strengthens protections for consumers’ data by banning bait-and-switch data harvesting and creating revocation and deletion rights. In addition, the Personal Financial Data Rights final rule will provide greater choice and improve competition by allowing people to:
Fire fintechs and banks that provide lousy service;
Shop for better rates on products and credit; and
Make secure payments, including with “pay-by-bank”.
The new rule will be implemented in phases wherein larger financial firms must follow the rule sooner than smaller ones. The biggest institutions need to comply by April 1, 2026, while the smallest covered institutions have until April 1, 2030. Some small banks and credit unions do not have to follow this rule.
Read the CFPB’s announcement here.
The final rule can be found here.