CFPB Sets Rules for Industry Standard-Setting Body Recognition
The CFPB issued a rule outlining the requirements that an organization must meet to become a CFPB-recognized industry standard-setting body.
The proposed rule would finalize certain provisions of the CFPB's Personal Financial Data Rights Rule proposed in October 2023. (See related coverage.) The CFPB said that standard-setting bodies are permitted to "issue standards that companies can use to help them comply with the ... Personal Financial Data Rights Rule." The CFPB stated that it will finalize this rule "in the coming months."
According to the CFPB, to be a recognized industry standard-setter by the CFPB, organizations must (i) formally apply to the CFPB for recognition and (ii) demonstrate that the organization satisfies the following attributes:
- Openness. All recognized standard-setting organizations must be "open to all interested parties."
- Transparency. To satisfy this attribute, a recognized standard-setting organizations must make their procedures publicly available and transparent to all participants.
- Balanced decision-making. All recognized standard-setting organizations must demonstrate that the power to make decisions and set standards is "balanced across all interested parties." This attribute also requires that both "large and small commercial entities" be meaningfully represented. Further, this attribute prohibits any one singular special interest from "dominat[ing] the decision-making process."
- Consensus. This attribute requires that all recognized standard-setting organizations develop standards by consensus. The CFPB clarified, though, that unanimity is not required. However, comments and objections "must be considered using fair and impartial processes."
- Due process and appeals. The CFPB requires that all recognized standard-setting organizations have policies and procedures that are documented and publicly available, "provide adequate notice of meetings," and "provide sufficient time [for parties] to prepare views and objections." This attribute also requires that the standard setting organization provide access to the views and objections of all participants and ensure that conflicting views are resolved through a "fair and impartial process." Also, there must be a process available for "impartially handling procedural appeals."
The CFPB also emphasized that today's rule includes a provision that allows the CFPB to revoke a standard-setting organization's recognition, and another provision that limits the duration of an organization's recognition to five years. Under the proposed rule, when an organization's recognition expires, the organization must apply for re-recognition.
The proposed rule includes a "step-by-step guide for how standard setters can apply for recognition" and provides guidance regarding how the CFPB will evaluate applications.
The final rule will become effective 30 days after publication in the Federal Register.
Commentary
This final rule marks the latest step forward in the shift toward open banking in the United States.
In 2010, Congress passed into law new personal financial data rights for consumers as part of the Dodd-Frank Act. However, these rights have not taken full effect because the CFPB never issued an implementing rule. In October 2023, the CFPB finally issued a proposed rule to implement this statutory provision, and all signs indicate that the rule will be finalized before the election this fall, if not this summer.
This rule, which outlines the qualifications to become a recognized industry standard setting body, will kick start moves by standard-setting organizations to seek formal recognition from the CFPB. The CFPB would then allow companies to use technical standards developed by CFPB recognized standard-setting organizations, which will facilitate the financial system’s movement towards open banking. Of course, it remains to be seen how the CFPB will address how the "consensus standard" might play in evaluating compliance with the particular underlying provisions of the Personal Financial Data Rights final rule.