CFPB to Rework Data-Sharing Rules Following Industry Challenge and Legal Pause

The U.S. Consumer Financial Protection Bureau (CFPB) plans to initiate a new rulemaking process to revise federal open banking regulations, according to court documents this week. The move follows a decision by U.S. District Judge Danny Reeves to grant a stay in ongoing litigation brought by banking industry groups seeking to invalidate the original rule.

The current regulatory framework, developed under the administration of former President Joe Biden, aimed to establish formal standards for consumer financial data sharing between banks and third-party financial technology firms. Its goal was to facilitate data portability and interoperability across the financial services sector.

However, legal challenges from banking institutions argued that the regulation posed potential risks to customer privacy and data security. The fintech sector took a different position, contending that the regulation provided a secure structure for data exchange and that nullifying it would strengthen incumbents at the expense of competition.

In May, the CFPB informed the court that it believed the regulation may have exceeded its statutory authority under the Dodd-Frank Act. This week, the agency reversed its earlier position of simply discarding the rule, opting instead to substantially revise it through a new, expedited rulemaking process. The CFPB stated that the upcoming process will consider changes in the financial services landscape and will include engagement with relevant stakeholders.

According to the court filing, the new rulemaking is expected to begin within three weeks. Industry trade groups have expressed mixed reactions. The Bank Policy Institute opposed the decision to pause litigation, while several fintech organizations indicated interest in participating in the new regulatory process.

Separately, recent industry developments have drawn renewed attention to the issue of data access. JPMorgan Chase, according to media reports earlier this month, is planning to charge third-party fintech firms for access to customer data, reflecting a broader shift in how traditional financial institutions are managing data-sharing arrangements.

The CFPB’s decision to redesign the rule comes as data access and control increasingly shape competitive dynamics in the U.S. financial sector, particularly for firms operating in intermediary roles between consumers and banks. The agency’s next version of the rule is expected to reflect a recalibrated balance between operational oversight, data governance, and cross-industry interoperability.