By David O’Neill, Chief Operating Officer at APIContext
The creation of the Consumer Financial Protection Bureau (CFPB) in the Dodd-Frank bill was a landmark response to the 2008 Global Financial Crash. A rare US bipartisan agreement called for stronger consumer protections and greater oversight of an industry that claimed to largely self-regulate.
In recent years, the CFPB has been focused on enforcing rules to enshrine open banking standards within the patchy structure of US banking, with the most recent being the finalisation of the “1033” rule. However, the outcome of the most recent US presidential election will impact both the rule making and the CFPB and almost all areas of the financial industry, from stock and share prices, to eventually open banking regulations.
CFPB’s open banking rule 1033
Under the CFPB’s rule 1033, finalized in October 2024, financial institutions are required to grant consumers the right to access their financial data and share it with third-party services like budgeting apps, payment platforms, or financial advisors. This initiative aims to foster innovation and consumer empowerment in financial services. Financial institutions are expected to comply with these requirements beginning in April 2026, with APIs playing a critical role in securely enabling data sharing.
Looking ahead to 2025, it is highly unlikely that the CFPB will be dissolved under the new US administration, as this would require an act of Congress to abolish it. More likely, new regulations are merely going to be ignored or deprioritized and whomever replaces the current Secretary, Rohit Chopra, is going to be focused on removing rules, not enforcing new ones. Furthermore, open banking regulations are unlikely to be prioritized for elimination, as attention will instead focus on other limitations the agency imposes on financial institutions. We can expect the new administration to delay or defer consumer protections, but there are more obvious targets for adjustment. For instance, earlier this year the CFPB closed a late fee loophole exploited by large credit card issuers, reducing the typical fee from $32 to $8. While rules like this serve the best interests of consumers, they do not benefit banks and financial institutions.
While there is some opposition in the industry to the open banking regulations of the CFPB, most of all the industry does want open banking APIs to be standardized. As a result of this industry support, open banking will likely go into effect on its current timeline. Banks also support open banking because it ensures seamless data exchange and interoperability, ultimately delivering a high-quality and user-friendly customer experience. Most importantly, standardizing APIs help banks and financial institutions to reduce costs, improve security and improve scalability.
Complying With CFPB’s Data Privacy and Security Standards
The CFPB’s rule 1033 has dramatically impacted data privacy and security standard requirements for financial institutions. These rules impose stricter obligations on financial institutions, requiring the industry to adopt advanced security measures and comply with clear privacy standards.
Banks and financial institutions will continue to implement modern API structures based on open standards, and outsource to aggregators or core banking infrastructure providers, to align their systems with CFPB’s updates and future regulatory requirements. Financial institutions that operate transnationally may find it easier to stay compliant, as they are accustomed to meeting regulatory frameworks and requirements across different countries.
However, abiding by the security requirements of the CFPB 1033 rules may appear voluntary for the financial industry, as it seems unlikely that the CFPB will enforce fines to financial institutions for not meeting compliance standards. Banks and financial institutions will only comply with security requirements but for the purpose of avoiding incidents such as major data breaches that could lead to costly class action lawsuits.
The likely outcome will be a watering down of the security and privacy provisions, I suspect through lack of enforcement and ultimately a tightening later on in the event of a data breach.
Next Steps
Notably, the CFPB’s rule 1033 does not address a specific security standard such as the Financial-grade API (FAPI) standard used by many other jurisdictions. Instead it references existing IT security rules, recognizing the significant costs involved for institutions in the industry to implement the required security solutions. Yet, financial institutions are at greater risk of a breach, due to the lack of adequate security controls.
Financial institutions must implement API standardization with a robust security system. Which means there is a need to ensure good governance across the financial ecosystem. Absent a strong regulator, banks and financial institutions will need to find a way to follow the same standards. Ideally financial institutions would benefit from an independent governance tool that is not part of the financial services ecosystem, acting as an external voice to ensure standards are being met that are outside the chain of delivery.
