CFPB Sends Its Open Banking Rewrite to the White House, With Data-Access Fees in Play

The Consumer Financial Protection Bureau has finished a rewritten version of its open banking rule and sent it to the White House's regulatory office for clearance. The notice, titled "Personal Financial Data Rights Reconsideration," would replace the Biden-era Section 1033 framework that banks challenged in court the day it was issued.

Where the rewrite stands

The CFPB submitted the proposal to the Office of Information and Regulatory Affairs in the first week of August 2026. Its contents are not public yet. OIRA reviews of this type can run up to 90 days, though they often finish sooner, and once cleared the bureau can publish a notice of proposed rulemaking in the Federal Register for comment.

The path here has been long. The original rule was finalized in October 2024, and trade associations sued the same day. In August 2025 the bureau issued an advance notice announcing a comprehensive reconsideration. By January 2026, reporting indicated the CFPB would use a full notice-and-comment process for the rewrite after pressure from credit unions, rather than trying a shortcut.

The fight is over fees

Section 1033 of Dodd-Frank gives consumers a right to access their financial data and to authorize others to retrieve it. In practice that means a banking customer can let an aggregator or fintech app pull account information through a secure API. The 2024 rule generally barred banks from charging for required data access. Banks argue that the statute does not prohibit reasonable cost recovery and that building and maintaining secure APIs is expensive.

The advance notice asked whether institutions should be able to charge reasonable fees to authorized third parties. Press coverage of the draft says it addresses that question, and one report says it contemplates cost-based fees tied to high-volume commercial API requests. Because the text is unpublished, treat that as reporting, not a settled design. The bureau also asked who may qualify as a consumer's authorized representative, which determines which apps can act on a customer's behalf.

Why it matters

Data fees would change the economics for the whole ecosystem. Aggregators and the fintechs built on them, from budgeting tools to lenders that underwrite on cash-flow data, depend on cheap, reliable access. If large banks can meter that access, some business models get costlier, and the largest banks gain leverage over competitors. Banks counter that free access shifts infrastructure costs onto them while others profit.

The rewrite also resets compliance timelines. Data providers had to build capabilities for the original rule, and third parties had to prepare disclosures and data-handling obligations. Observers expect those core obligations to survive in some form, with fees and representative status the main changes.

The stakeholders

Four groups have the most at stake. Large banks want the right to recover costs and to limit which parties can tap their systems. Data aggregators, which sit between banks and apps, want a stable, standardized access path and have pushed for secure API access over older methods that rely on consumers handing over login credentials. Fintechs, from budgeting apps to cash-flow lenders, want predictable pricing. Consumer advocates worry that if access becomes costly or restricted, customers lose the ability to move their data and switch providers, which was the core promise of the statute.

Credit unions and community banks occupy a middle position. They are data providers with smaller technology budgets, and reporting from January 2026 credited their lobbying with steering the bureau toward a full rulemaking in which they can file comments. A proposal that eases their compliance burden while keeping the data-sharing right intact is the likeliest compromise, though that is analysis, not a published term.

There is also a timing issue for the rule's first obligations. Compliance dates in the 2024 version were staggered by institution size, with the biggest providers first. Any new schedule will determine whether banks that already spent money on API work were right to move early or should have waited for the rewrite.

What to watch

• The OIRA clock. A clearance within weeks would put the proposal out for comment before year-end; a full 90 days pushes it later.
• The fee language. Whether any charge is limited to commercial, high-volume use will decide how much damage small fintechs take.
• The lawsuit. The industry suit over the 2024 rule is still the backdrop; a rewrite could moot parts of it.
• Credit unions. Smaller data providers pushed for the full rulemaking and will want compliance relief.

Sources

1. CFPB Sends New Section 1033 Open Banking Proposal to OIRA for Review — Consumer Finance Monitor
2. CFPB Shifts to Full Rulemaking for Section 1033 Rewrite After Credit Union Push — CU Times
3. CFPB Seeks Comments and Data on Revised Open Banking Rule — Holland & Knight