U.S. finalised the Open Banking rules!

Consumers will be able to more easily switch to providers with superior rates and services. „By fueling competition and consumer choice, the rule will help lower prices on loans and improve customer service across payments, credit, and banking markets.” – according to the press release. Larger firms are expected to comply by 1st April 2026, while smaller firms have the potential for an additional 4 years to meet the requirements.

The new rule from the Consumer Financial Protection Bureau will require U.S. banks to give customers free access to their financial data. This „open banking” rule is meant to promote competition, by making it easier for consumers to switch banks and potentially get better rates and services. While fintech companies stand to benefit from consumers’ ability to request, download and transfer data such as payment history, banking industry groups have expressed concern about potential liabilities from data breaches. Larger institutions must comply by April 1, 2026, while smaller ones have until April 1, 2030.

Today, the Consumer Financial Protection Bureau (CFPB) finalized a rule that will give consumers greater rights, privacy, and security over their personal financial data. The rule requires financial institutions, credit card issuers, and other financial providers to unlock an individual’s personal financial data and transfer it to another provider at the consumer’s request for free.

“Too many Americans are stuck in financial products with lousy rates and service,” said CFPB Director Rohit Chopra. “Today’s action will give people more power to get better rates and service on bank accounts, credit cards, and more.”

Today’s rule ensures consumers will be able to access and share data associated with bank accounts, credit cards, mobile wallets, payment apps, and other financial products. It aims to address market concentration that limits consumer choice over financial products and services.

„Consumers will be able to access, or authorize a third party to access, data such as transaction information, account balance information, information needed to initiate payments, upcoming bill information, and basic account verification information. Financial providers must make this information available without charging fees.” – CFPB explained.

The rule moves the United States closer to having a competitive, safe, secure, and reliable “open banking” system. Today’s rule is part of the CFPB’s efforts to finally activate Section 1033 of the Consumer Financial Protection Act, a dormant legal authority enacted by Congress in 2010.

This is the CFPB’s first significant rule to accelerate responsible open banking in the U.S., and the CFPB will be developing additional rules to address more products, services, and use cases. The rules will boost competition by giving people more freedom to switch banks or providers and shop around for the best deal. This increased choice will incentivize financial institutions to offer improved products that help them attract new customers and retain old customers.

Today’s rule also establishes strong privacy protections, requiring that personal financial data can only be used for the purposes requested by the consumer. It ensures that third parties cannot use consumer data for other purposes that benefit the third party, but that consumers do not want. It also helps move the industry away from “screen scraping,” a still common but risky practice that typically involves consumers providing their account passwords to third parties who use them to access data indiscriminately through online banking portals.

In giving consumers more control over their financial data, the Personal Financial Data Rights final rule will spur greater choice and increase competition by enabling people to:

Fire fintechs and banks that provide lousy service: Consumers will be able to transfer their bank data to another bank, ensuring consumers can keep much of their banking history as they switch to another financial institution. People will not have to pay fees or clear hurdles from companies that make it harder to switch providers.

Shop for better rates on products and credit: Consumers will be able to comparison shop and move to a competitor offering better rates, such as higher interest on deposits or lower interest on loans. It can also help people—including consumers with shorter credit histories, like young people—gain access to credit or obtain credit on better terms, by allowing lenders to make loans using data held by other institutions, such as information on income and expenses.

Make secure payments, including with “pay-by-bank”: The rule ensures consumers are able to securely share payments information, which can help enable what is sometimes referred to as pay-by-bank. Such products enable consumers to pay merchants, peers, and others, as well as move money between their own accounts. The rule will help bring greater competition to payments markets, which have long been an area of anti-competitive practices.

The final rule strengthens protections for consumers’ data by:

Banning bait-and-switch data harvesting: Third parties can only collect, use, or retain data to deliver the product the consumer requested. They cannot secretly collect, use, or retain consumers’ data for their own unrelated business reasons – for example, by offering consumers a loan using consumer data that they also use for targeted advertising. The rule does not prohibit any particular uses of data, but it requires that all use be driven by what is necessary to deliver the product sought by the consumer.

Creating revocation and deletion rights: When a person revokes access, the rule requires that data access end immediately, and deletion would be the default practice. Access can be maintained for no more than one year, absent express reauthorization. To prevent “dark patterns” from emerging, the process to revoke access must be simple and straightforward.

Compliance with the rule will be implemented in phases, with larger providers subject to the rule sooner than smaller ones. Financial firms will be required to comply based on their size; the largest institutions will have to comply by April 1, 2026, while the smallest covered institutions will have until April 1, 2030. Certain small banks and credit unions are not subject to this rule.

_____________

In June, the CFPB finalized a rule outlining the qualifications to become a recognized industry standard setting body, which can issue standards that companies can use to help them comply with the CFPB’s Personal Financial Data Rights Rule.

Read the regulatory text of the final Personal Financial Data Rights rule .

Read the notice of the final Personal Financial Data Rights rule.