The large bank lobby is attempting to limit consumers’ ability to access the tools they rely on to manage their finances.
Contact: Laine Williams, (202) 897-4757, lwilliams@allonadvocacy.com
Washington, DC, October 21, 2025 – The Financial Data and Technology Association (FDATA), a trade association representing more than 30 financial technology companies and consumer-permissioned data access platforms in Canada and the United States, today submitted comments to the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) in response to its Advanced Notice of Proposed Rulemaking (“ANPR”) to reconsider the Personal Financial Data Rights Rule implementing section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act.
In today’s filing, FDATA underscored the importance of the CFPB’s section 1033 rulemaking to secure financial freedom for Americans – protecting peoples’ ability to use the financial apps and services they choose. FDATA warned that recent reversals and mixed signals around the rule—coupled with pushback from the largest financial institutions—is creating harmful uncertainty that undermines consumer choice, innovation and competition.
“Section 1033 of the Dodd-Frank Act created a critical foundation for open banking in the United States,” said Steve Boms, Executive Director of FDATA. “As the CFPB reopens the rule, it must protect the core of that foundation: a fee-free consumer right to access and share personal financial data, a broad, plain-meaning definition of ‘representative,’ and firm compliance timelines for the largest financial institutions. Anything less risks turning a legal right into a pay-to-play privilege and stalling U.S. leadership in fintech.”
FDATA urged the Bureau to build on the current rule—not slow the market—by prioritizing nine principles:
- Keep consumer-authorized data access free of charge and prohibit any data access fees that would turn a statutory right into a paid privilege.
- Affirm a broad definition of “representative.” Consumers must be able to designate any authorized third party to access their data.
- Maintain the July 1, 2026 compliance date for the 13 largest banks. Do not reward delay tactics that prolong anticompetitive behavior.
- Conduct a genuine small-business review before making any changes to the rule as even compliance timeline changes have a significant impact on small entities.
- Broaden what data and accounts are covered under the rule; any non-proprietary data available online or on statements should be in scope.
- Be technology-neutral while accelerating API adoption. Encourage API adoption by expanding scope, but do not prematurely prohibit legacy connections where APIs do not yet exist or function.
- Ensure security parity across the ecosystem. Apply interoperable, risk-based standards (e.g., FTC Safeguards Rule, NIST/ISO) with independent certification—preventing “security” from becoming a pretext for blocking access.
- Empower consumers to decide how and when to share their data. Treat uses expressly authorized by the consumer as permissible.
- Make data reauthorization/deletion rules workable. Avoid rigid 12-month expirations that break beneficial services; allow flexible re-permissioning and consumer-directed data retention. Examine Tokenized Account Numbers (TANs) to avoid failure modes and anticompetitive misuse.
“Around the world—from the United Kingdom and Europe Union to Brazil, India, Australia, and now Canada—open banking is advancing on the simple premise that people control their own financial data,” Boms added. “The United States should not fall behind because a handful of incumbents want to charge competitive tolls or slow-walk compliance. The CFPB can lock in a competitive, secure, and innovation-friendly framework by holding the line on fees, scope, and timelines.”
A full copy of the letter is available here.
