Open Banking Process Launched by CFPB

The CFPB finalized a rule on Wednesday that outlines the process and qualifications to become a “recognized industry standard setting body” as it relates to the Bureau’s push to accelerate the shift to open banking in the United States and for organizations to comply with the upcoming Personal Financial Data Rights Rule.

According to a statement from the CFPB Wednesday morning, “Today’s rule identifies the attributes that standard setting bodies must demonstrate in order to be recognized by the CFPB. The rule also includes a step-by-step guide for how standard setters can apply for recognition and how the CFPB will evaluate applications.”

CFPB Director Rohit Chopra said, “Industry standards can be weaponized by dominant firms in order to maintain their market position, undermining competition for all. Today’s rule will prevent these firms from rigging standards in their favor by identifying attributes the CFPB will use to recognize standard setters.”

The new rule, according to the CFPB, identifies the attributes that standard setters must demonstrate in order to be recognized by the Bureau. “Consensus standards issued by recognized standard setters can help put the Personal Financial Data Rights rule into action and accelerate the financial system’s movement towards truly open banking,” the CFPB stated.

To be recognized by the CFPB, the standard setters must apply to the CFPB and display the following attributes:

• Openness: The CFPB will not recognize any standard-setting organization that is rigged in favor of any set of industry players. The process must be open to all interested parties, including public interest groups, app developers and a broad range of financial firms with a stake in open banking.
• Transparency: Procedures must be transparent to participants and publicly available.
• Balanced decision-making: The decision-making power to set standards must be balanced across all interested parties, including consumer and other public interest groups. There must also be meaningful representation for large and small commercial entities. No single special interest can dominate the decision-making process.
• Consensus: Standards development must proceed by consensus, though not necessarily unanimity. Comments and objections must be considered using fair and impartial processes.
• Due process and appeals: The standard-setting body must use documented and publicly available policies and procedures, provide adequate notice of meetings, sufficient time to review drafts and prepare views and objections, access to views and objections of other participants, and a fair and impartial process for resolving conflicting views. An appeals process is also available for the impartial handling of procedural appeals.

As part of the upcoming Personal Financial Data Rights rule, the CFPB said it expects to allow companies to use technical standards developed by standard-setting organizations recognized by the CFPB. Today’s rule kicks off the process for standard-setting organizations to seek formal recognition.

The proposed Personal Financial Data Rights rule activates a dormant provision of law enacted by Congress more than a decade ago. It would jumpstart competition by forbidding financial institutions from hoarding a person’s data and by requiring companies to share data at the person’s direction with other companies offering better products, according to the CFPB. “The proposed rule would allow people to break up with banks that provide bad service and would forbid companies that receive data from misusing or wrongfully monetizing the sensitive personal financial data,” the CFPB stated.

The CFPB announced the Personal Financial Data Rights rule in October 2023 and said it expects the rule to be finalized in the coming months.