CFPB Open Banking Rule (Section 1033)
Enacted United States · In force Jan 17, 2025 · next deadline Apr 1, 2027 (in 6 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.
- Who it applies to
- Depository and nondepository data providers holding covered Regulation E accounts or Regulation Z credit cards, and third parties and data aggregators that access consumer data. Depository institutions at or under the SBA size standard are exempt.
- Penalties
- Enforced under the Consumer Financial Protection Act (civil money penalties and other relief). Enforcement currently enjoined.
- Enforced by
- Consumer Financial Protection Bureau
- Official name
- Required Rulemaking on Personal Financial Data Rights (12 CFR Part 1033)
- Citation
- 89 FR 90838; 12 CFR Part 1033
- Topics
- data-access, financial, privacy, cybersecurity
Research notes
As of 2026-09-25 the eCFR text still shows the original compliance dates and no reconsideration NPRM appears in the Federal Register. The Fall 2025 Unified Agenda targeted an NPRM for July 2026 (RIN 3170-AB39). The ANPR states the CFPB plans to propose extending the compliance dates. Treat all compliance dates as unsettled.
Related
Questions about CFPB Open Banking Rule (Section 1033)
- What are the CFPB Open Banking Rule (Section 1033) compliance deadlines?
- Jan 17, 2025: Final rule effective. Jul 29, 2025: Court stays Forcht Bank litigation. Aug 22, 2025: Reconsideration ANPR published. Oct 21, 2025: Reconsideration comment period closes. Oct 29, 2025: Court enjoins enforcement. Jun 30, 2026: First compliance date (stayed, enjoined) (tentative). Apr 1, 2027: Tier 2 compliance date (original) (tentative). Apr 1, 2028: Tier 3 compliance date (original) (tentative). Apr 1, 2029: Tier 4 compliance date (original) (tentative). Apr 1, 2030: Tier 5 compliance date (original) (tentative).
- When does CFPB Open Banking Rule (Section 1033) take effect?
- CFPB Open Banking Rule (Section 1033) took effect on Jan 17, 2025. The next milestone is Apr 1, 2027: Tier 2 compliance date (original).
- Who does CFPB Open Banking Rule (Section 1033) apply to?
- Depository and nondepository data providers holding covered Regulation E accounts or Regulation Z credit cards, and third parties and data aggregators that access consumer data. Depository institutions at or under the SBA size standard are exempt.
- What are the penalties under CFPB Open Banking Rule (Section 1033)?
- Enforced under the Consumer Financial Protection Act (civil money penalties and other relief). Enforcement currently enjoined.