Vendor Spotlight: How CFPB’s Rule 1033 Could Affect Data Rights and Open Banking
Editor's Note: The following article was written by Bradley Wallace, director of compliance at CSI. CSI is an LBA Associate Member and you can find more information about them in LBA's Associate Member Resources Guide.
The Consumer Financial Protection Bureau estimates that 100 million consumers have authorized third parties to access their data. That data drives endless business decisions and capabilities. But financial institutions and technology developers must also be aware of regulations regarding consumers and their rights over their data.
One such proposed regulation, Rule 1033, would require financial institutions and other data providers to help consumers access and share their data securely using application programming interfaces or APIs.
What is CFPB’s Rule 1033?
Section 1033 of the Consumer Financial Protection Act of 2010 was sent for comment in October 2023 and is expected to be finalized in the fall of 2024. This proposed rule would require depository and non-depository entities to:
- Make available to consumers and authorized third parties certain data relating to consumers’ transactions and accounts
- Establish obligations for third parties accessing a consumer’s data, including important privacy protections for that data
- Provide basic standards for data access
- Promote fair, open and inclusive industry standards
Compliance dates for this rule will be staggered based on institutional asset size, ranging from six months to four years from the date of the final rule publication.
Rule 1033’s Potential Impact on Financial Data Rights
The proposed rule is designed to address challenges with open banking by defining the:
- Scope of data that third parties can access on a consumer’s behalf
- Terms on which data is made available
- Mechanics of accessing the data, proposed to be consumer permission based
It seeks to impose a framework in which data transfers occur via APIs instead of existing methods, such as screen scraping or credential sharing. Data providers would be required to maintain a digital interface for consumers and developers, both of which must meet certain performance specifications to receive and respond to data access requests.
This approach aims to ensure third parties are acting on behalf of consumers when accessing their data and respect their privacy interests. Rule 1033 also promotes security and reliability, as it would apply a set of consistent standards across the market for sharing data.
Third party access proposals would require these companies to provide an authorization disclosure to inform the consumer of key terms of access and obtain the consumers’ informed consent. According to the CFPB, the proposed rule would “forbid companies that receive data from misusing or wrongfully monetizing the sensitive personal financial data.”
What Data Does Rule 1033 Cover?
The rule includes a definition of the types of data that providers, such as card issuers and financial institutions, would need to make available upon request. According to the proposed rule, covered data includes:
- Transaction information, including historical data (at least 24 months)
- Account balances
- Terms and conditions
- Upcoming bill information
- Basic account verification information, such as name, address, email, etc.
It excludes confidential commercial information, algorithms, information used to prevent fraud or money laundering or other crimes and information that is required confidential under other laws, as well as other information that the provider cannot retrieve in the ordinary course of business.
At the request of a consumer or authorized third party, providers must make covered data available in a machine-readable format that can be retained by the consumer or authorized by a third party and transferred for processing into separate information systems—all without imposing fees or charges.
How Rule 1033 is Accelerating Open Banking
So, what does Rule 1033 have to do with open banking? Open banking uses APIs to enable developers to access an institution’s data, which includes customer data. The technological approach enables banks to offer new products or services without building them internally or relying on a single provider. Rule 1033 aims to place data rights in the hands of consumers, expanding the definition of open banking and giving them more control.
While that control could make customers less “sticky,” it could be welcome news for institutions that prioritize a relationship-based approach to customer service, like community banks. As consumers exercise more control over their data, they’re more able to switch to banks that provide personalized service and their desired products, instead of remaining with those that hoard all their financial data but provide poor service and lacking products.
Data Rights Considerations in Open Banking
As with any technology partnership, concerns may arise regarding data sharing and third-party data breaches. However, there are ways to mitigate risk for your institution. And the opportunities that open banking provides—from improving customer experience to expanding revenue lines—can better position your institution against the competition.
As a data steward, your bank should consider several factors to protect your customers and remain compliant. Safeguard your digital services, core platform and any other sectors placed into your open banking ecosystem. Your bank should also ensure you have secure processes in place, including handling file transfers without opening yourself up to any vulnerabilities.
To maximize your security and incident preparedness, develop and maintain policies and procedures for preventing and managing a security breach. Additionally, make sure you understand data retention and data deletion obligations.
How to Qualify an Open Banking Vendor
Partnering with third-party vendors to enhance your offerings is a key part of open banking, but you must stay vigilant and keep bad actors out of your open banking network.
Here are a few considerations your institution should keep in mind when qualifying a vendor:
- Qualified sources: Ensure you’re looking for vendors and applications from reputable industry sources.
- Standard due diligence: Audit procedures should follow your institution’s established policies.
- Adequate testing phase: Deploy a testing phase to ensure how your institution’s data is accessed and used through the vendor’s apps.
- Security, audits and reporting: Verify the vendor uses secure methods to access and store your institution’s data, especially consumer-related data. Understand what they offer in terms of audit support and reporting capabilities.
Sharing Data in the Digital Era
When it comes to Rule 1033, your bank has a choice to make. Will you simply implement measures to ensure compliance once required and deliver data upon request? Or will you embrace open banking to better serve current and prospective customers? Developing the right open banking strategy for your institution can provide long-term benefits for your bank.