CFPB Issues Rule on Consumer Access to Financial Data

The CFPB issued a final rule requiring financial institutions, including banks, credit unions and other financial service providers, to make consumers' financial data available to the relevant consumer upon request and in a secure, electronic format. (See previous coverage.)

The final rule implements Section 1033 of the Consumer Financial Protection Act of 2010 ("Dodd-Frank Title X"), and specifies that data providers, such as those defined under Regulation E ("Exemption for Securities of Small Business Investment Companies") and Regulation Z ("Truth in Lending"), must make available consumer transaction data and account details to both consumers and to a consumer's authorized third parties. To facilitate this, data providers are required to implement both a consumer and developer interface and establish written policies that ensure the accurate and reliable sharing of data.

The rule is scheduled to take effect 60 days after publication in the Federal Register, with compliance dates beginning April 2026 and extending through 2030 based on the size of the institution.