On October 29, 2025, the US District Court for the Eastern District of Kentucky issued a preliminary injunction that prevents the Consumer Financial Protection Bureau (CFPB) from enforcing its Personal Financial Data Rights (PFDR) final rule until the CFPB completes its new rulemaking. The injunction, therefore, halts compliance deadlines that would have required certain financial institutions to implement new data-sharing standards as early as June 30, 2026.
The order is based on the Administrative Procedure Act, which permits a district court to “issue all necessary and appropriate process[es] to postpone the effective date of any agency action” to the “extent necessary to prevent irreparable injury.”[1] Specifically, the court concluded that plaintiffs Forcht Bank, the Kentucky Bankers Association and the Bank Policy Institute showed:
- They would likely succeed on the merits of their claims.
- They would incur irreparable injury due to unrecoverable compliance costs.
- The issuance of a preliminary injunction would not cause substantial harm to others.
- The public interest would be served by the injunction.
Background – in brief
The PFDR rule implements Section 1033 of the Dodd-Frank Act. The initial rule, issued during the Biden administration, would have required that certain financial institutions, card issuers and other payment facilitation providers, upon consumer request, share consumers’ personal financial data with both consumers and authorized third parties at no cost.
Several banking organizations challenged the rule, arguing that the CFPB exceeded its statutory authority and imposed arbitrary, burdensome requirements on financial institutions in its efforts to regulate open banking. Following the change in administration, in May, the CFPB asked the court to vacate its own final rule, and in July, announced that it would initiate a new rulemaking to reconsider the PFDR rule. In August, the CFPB released an advance notice of proposed rulemaking (ANPR) seeking public comment on four substantive aspects of the PFDR rulemaking. The two-month comment period for responding to the ANPR closed recently, with the CFPB receiving more than 13,900 responses.
What’s next?
For the time being, there is uncertainty as to when a new rule will be implemented. While the CFPB has indicated it will issue a notice of proposed rulemaking by December, the process of reviewing and incorporating such a high volume of comments may extend well into 2026. It is also possible the Financial Technology Association will appeal the injunction. In the interim, financial institutions and consumers must wait to see how the current CFPB will reshape the rights and requirements in the PFDR rule.
[1] 5 USC § 705.