The Consumer Financial Protection Bureau’s (CFPB) open banking rulemaking is at a pivotal moment. After the US District Court for the Eastern District of Kentucky enjoined enforcement of the CFPB’s Personal Financial Data Rights (PFDR) rule in October, the CFPB this week disclosed in a court filing that it will issue an interim final rule under Section 1033 of the Dodd-Frank Act.
The CFPB recently declared that it expects to run out of funding by the end of this year (and is not permitted to draw additional funds from the Federal Reserve, per an opinion from the Department of Justice’s Office of Legal Counsel). “In light of that development,” the CFPB stated in its filing this week that it “will undertake efforts to issue an interim final rule,” presumably before funding runs out.
The exact timing and substance of the interim final rule remains uncertain. The CFPB has signaled it will pursue substantive revisions to the PFDR framework, yet the accelerated timeline suggests the CFPB may instead leave portions of the original PFDR final rule unchanged in the interest of putting forth an interim final rule before the end of the year. Potential revisions to the rule may stem from the four core substantive issues the CFPB sought comment on in its August 2025 Advance Notice of Proposed Rulemaking:
- Definition of a “representative” authorized to access consumer data and whether it should include fintechs and other third parties.
- Charging fees for data access, specifically whether cost recovery should be permitted and whether caps or shared cost models are appropriate.
- Security risks and cost-benefit trade-offs and whether stronger safeguards beyond Gramm-Leach-Bliley Act compliance and discouragement of screen scraping are needed.
- Privacy risks associated with third-party data sharing and whether the PFDR provides adequate consumer privacy protections, especially against risks from inadvertent licensing or sale of sensitive personal information.
Stay tuned for updates on the interim final rule.