Contact: Rebecca Mulholland, (703) 340-7215, rmulholland@allonadvisors.com
Washington, DC, Nov. 9, 2026 — The Financial Data and Technology Association (FDATA), a trade association representing 25 financial technology companies and consumer-permissioned data access platforms, has submitted comments to the Office of the Mississippi Secretary of State regarding proposed amendments to Mississippi Securities Act Rule 6.25 (EE).
Rule 6.25 (EE) governs investment adviser access to client accounts. The Secretary of State has proposed to repeal the requirement that a data aggregation software company maintain an agreement with the custodian or online account platform as a condition of permissible access. Noting that many Mississippi households rely on workplace-based accounts for their retirement nest eggs, FDATA praises this decision.
“In open finance, an individual’s right to access and share their own financial data should never depend on the commercial consent of the incumbent institution holding that data,” the comment letter argues. Repealing the data aggregation contract requirement “places the decision right where it belongs: with the investor, who should have the choice to determine whether to grant their adviser access to their financial data.”
Without repeal “investors may lose professional oversight of the accounts that matter most or be steered toward whatever advice the incumbent chooses to sell,” the letter concludes. To bring additional clarity to Rule 6.25 (EE), the FDATA letter makes two suggestions:
- Anchor the custodian interference standard in applicable law, not “reasonableness” since “reasonable” is one of the most elastic terms in legal usage. To address this issue, FDATA suggests the rules refer more explicitly to existing law, include federal and state laws that impose robust antifraud, data privacy, and cybersecurity obligations on custodians.
- Limit the liability provision to security breaches and data misuse. As drafted, the rule prohibits advisers from disclaiming responsibility for “any data breaches, data misuse, or other client harm” caused by use of the client’s identifying information by the adviser, its personnel, or its third-party technology provider. The term “other client harm” is undefined, however, leaving advisers uncertain what harm triggers liability and who is responsible when issues arise. Read broadly, this phrase could expose advisers and their technology providers to claims arising from routine market movements or from technical failures on the custodian’s side, discouraging advisers from using secure, client-authorized tools at all. FDATA recommends striking the term “other client harm.”
Read FDATA’s full comments.
About FDATA
FDATA represents more than 30 financial technology companies and consumer-permissioned data access platforms across the United States and Canada. FDATA advocates for policies that empower consumers and small businesses to securely access and share their financial data in order to improve financial outcomes and drive innovation.
