What are the CFPB Open Banking Rule (Section 1033) compliance deadlines?

Jan 17, 2025: Final rule effective. Jul 29, 2025: Court stays Forcht Bank litigation. Aug 22, 2025: Reconsideration ANPR published. Oct 21, 2025: Reconsideration comment period closes. Oct 29, 2025: Court enjoins enforcement. Jun 30, 2026: First compliance date (stayed, enjoined) (tentative). Apr 1, 2027: Tier 2 compliance date (original) (tentative). Apr 1, 2028: Tier 3 compliance date (original) (tentative). Apr 1, 2029: Tier 4 compliance date (original) (tentative). Apr 1, 2030: Tier 5 compliance date (original) (tentative).

When does CFPB Open Banking Rule (Section 1033) take effect?

CFPB Open Banking Rule (Section 1033) took effect on Jan 17, 2025. The next milestone is Apr 1, 2027: Tier 2 compliance date (original).

Who does CFPB Open Banking Rule (Section 1033) apply to?

Depository and nondepository data providers holding covered Regulation E accounts or Regulation Z credit cards, and third parties and data aggregators that access consumer data. Depository institutions at or under the SBA size standard are exempt.

What are the penalties under CFPB Open Banking Rule (Section 1033)?

Enforced under the Consumer Financial Protection Act (civil money penalties and other relief). Enforcement currently enjoined.

CFPB Open Banking Rule (Section 1033)

Enacted United States · In force Jan 17, 2025 · next deadline Apr 1, 2027 (in 5 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

ComplianceTentativeApr 1, 2027 · in 5 months · Source

Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.

ComplianceTentativeApr 1, 2028 · in 17 months · Source

Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.

ComplianceTentativeApr 1, 2029 · in 2.4 years · Source

Tier 4 compliance date (original)Banks with $1.5B to $3B in assets. Original date; subject to stay, extension and injunction.

ComplianceTentativeApr 1, 2030 · in 3.4 years · Source

Tier 5 compliance date (original)Banks with $850M to $1.5B in assets. Original date; subject to stay, extension and injunction.

Already passed

MilestoneTentativeJun 30 · 4 months ago · Source

First compliance date (stayed, enjoined)Largest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally 2026-04-01, moved 90 days by court stay. Not enforceable while the injunction stands.

EnforcementOct 29, 2025 · 12 months ago · Source

Court enjoins enforcementE.D. Ky. enjoins the CFPB from enforcing the rule until it completes its reconsideration.

ReportingOct 21, 2025 · 12 months ago · Source

Reconsideration comment period closesComments on the ANPR due.

MilestoneAug 22, 2025 · 14 months ago · Source

Reconsideration ANPR publishedCFPB seeks comment on representatives, fees, data security and privacy, and on extending compliance dates.

Transition endsJul 29, 2025 · 15 months ago · Source

Court stays Forcht Bank litigationE.D. Ky. stays the industry challenge after the CFPB says it will reconsider the rule; compliance dates stayed by 90 days.

Takes effectJan 17, 2025 · 21 months ago · Source

Final rule effectiveRule published 2024-11-18 takes effect.

Summaries for reference, not legal advice. Check the official text.

What it does

Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.

Who it applies to: Depository and nondepository data providers holding covered Regulation E accounts or Regulation Z credit cards, and third parties and data aggregators that access consumer data. Depository institutions at or under the SBA size standard are exempt.
Penalties: Enforced under the Consumer Financial Protection Act (civil money penalties and other relief). Enforcement currently enjoined.
Enforced by: Consumer Financial Protection Bureau
Official name: Required Rulemaking on Personal Financial Data Rights (12 CFR Part 1033)
Citation: 89 FR 90838; 12 CFR Part 1033
Topics: Data access and sharing, Financial, Privacy, Cybersecurity

Verified 2026-09-25 consumerfinance.gov federalregister.gov govinfo.gov reginfo.gov ecfr.gov

Research notes

As of 2026-09-25 the eCFR text still shows the original compliance dates and no reconsideration NPRM appears in the Federal Register. The Fall 2025 Unified Agenda targeted an NPRM for July 2026 (RIN 3170-AB39). The ANPR states the CFPB plans to propose extending the compliance dates. Treat all compliance dates as unsettled.

In forceUnited States

AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025

EnactedUnited States (Federal)

CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set

In forceUnited States (Federal)

CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days

AmendedUnited States (Federal)

COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000

In forceUnited States (Federal)

DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025

AmendedUnited States (Federal)

FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024

AmendedUnited States (Federal)

FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009

AmendedUnited States (Federal)

GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003

Questions about CFPB Open Banking Rule (Section 1033)

What are the CFPB Open Banking Rule (Section 1033) compliance deadlines?: Jan 17, 2025: Final rule effective. Jul 29, 2025: Court stays Forcht Bank litigation. Aug 22, 2025: Reconsideration ANPR published. Oct 21, 2025: Reconsideration comment period closes. Oct 29, 2025: Court enjoins enforcement. Jun 30, 2026: First compliance date (stayed, enjoined) (tentative). Apr 1, 2027: Tier 2 compliance date (original) (tentative). Apr 1, 2028: Tier 3 compliance date (original) (tentative). Apr 1, 2029: Tier 4 compliance date (original) (tentative). Apr 1, 2030: Tier 5 compliance date (original) (tentative).
When does CFPB Open Banking Rule (Section 1033) take effect?: CFPB Open Banking Rule (Section 1033) took effect on Jan 17, 2025. The next milestone is Apr 1, 2027: Tier 2 compliance date (original).
Who does CFPB Open Banking Rule (Section 1033) apply to?: Depository and nondepository data providers holding covered Regulation E accounts or Regulation Z credit cards, and third parties and data aggregators that access consumer data. Depository institutions at or under the SBA size standard are exempt.
What are the penalties under CFPB Open Banking Rule (Section 1033)?: Enforced under the Consumer Financial Protection Act (civil money penalties and other relief). Enforcement currently enjoined.

Deadlines

What it does

Related