Overview
On August 22, 2025, the Consumer Financial Protection Bureau (CFPB) published an Advance Notice of Proposed Rulemaking (ANPR) inviting comment on a series of major changes to the Open Banking Rule that the CFPB finalized in late 2024 (Final Rule).1
This step is the latest development in the implementation of Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), which requires providers of consumer financial services to make data regarding consumer use of financial products or services available to consumers. After the release of the final rule, a coalition of opponents led by the Bank Policy Institute, Forcht Bank, and the Kentucky Bankers Association sued to block the rule, alleging violations of the Administrative Procedure Act and claiming the rule exceeds the CFPB's statutory authority.2 Since the suit was filed in late 2024, the CFPB has shifted from defending the rule to arguing that it "is unlawful and should be set aside."3 The Financial Technology Association, a fintech trade group, has stepped in to defend the rule. Reformulating the final rule will require the CFPB to rebalance the priorities of providers of financial data who opposed the rule, such as large financial institutions, and users of that data, often fintech firms.
The ANPR invites comment on four key areas in which the CFPB will evaluate changes to the final rule:
- The rule's definitions of "consumer" and "representative," which determine who can get access to data;
- Whether a financial institution may impose a fee or charge for providing data or setting up the required systems to make data sharing possible;
- The costs of providing secure access to data and the final rule’s treatment of information security issues; and
- Whether the rule adequately protects consumer privacy, and particularly on privacy concerns raised by the licensing or sale of a consumer’s financial information without the consumer's knowledge.4
Finally, the ANPR notes that the CFPB will issue a notice of proposed rulemaking to extend the compliance dates for subparts B, which make covered data available, and subparts C, which outline requirements for data provider interfaces and responses to requests, of the final rule.
The ANPR represents an important opportunity for the constituency affected by the final rule to inform the CFPB's analysis of this issue. Steptoe's Financial Innovation and Regulation practice is available to assist firms interested in submitting comments, which are due by October 21, 2025.
1 90 Fed. Reg. 40,986 (Aug. 22, 2025). Steptoe wrote about the Open Banking final rule here.
2 Forcht Bank, N.A. v. Consumer Financial Protection Bureau, No. 5:24-cv-304-DCR (E.D. Ky.).
3 Defendants' Status Report at 1, Forcht Bank, N.A. v. Consumer Financial Protection Bureau, No. 5:24-cv-304-DCR (E.D. Ky. May 23, 2025), Dkt. No. 57.
