[ Answers · Fintech ]

What is the CFPB 1033 rule?

By Ben Tabas, Intrica Research · Updated · US

Answer

The CFPB 1033 rule, the Personal Financial Data Rights rule published Nov. 18, 2024, requires banks, credit unions and other providers to make consumers' data available on request to consumers and authorized third parties. As of Oct. 28, 2026, the CFPB is barred from enforcing it while it reconsiders the rule, under an Oct. 29, 2025 order from the Eastern District of Kentucky.

What the 2024 rule says

  • Data providers must make consumers' data available upon request to consumers and authorized third parties in a secure and reliable manner (Federal Register abstract, final rule effective Jan. 17, 2025).
  • Third parties that access the data take on defined obligations, including privacy protections.
  • Compliance was phased, starting April 1, 2026 for the largest data providers, according to Cozen O'Connor's April 9, 2026 alert.
  • The rule implements section 1033 of the Consumer Financial Protection Act of 2010, which is where the name comes from.

Status as of Oct. 28, 2026

  1. Oct. 22, 2024: the CFPB released the final rule, per its personal financial data rights page.
  2. Aug. 22, 2025: the CFPB published an advance notice of proposed rulemaking to reconsider it, asking about who counts as a consumer's representative, fees, data security and data privacy.
  3. Oct. 29, 2025: in Forcht Bank v. CFPB, the Eastern District of Kentucky enjoined the CFPB from enforcing the rule until it completes its reconsideration, according to Moore and Van Allen.
  4. Aug. 6, 2026: the Consumer Finance Monitor blog reported that the CFPB had sent a proposed rule, Personal Financial Data Rights Reconsideration, to the White House Office of Information and Regulatory Affairs for review.
  5. Oct. 28, 2026: a search of the Federal Register showed no new 1033 proposed or final rule after the Aug. 22, 2025 notice.

What it means for a fintech today

While the injunction stands, the CFPB cannot enforce the 2024 rule, so data access terms come from the agreements between data providers and the apps and aggregators that connect to them.

The open questions in the August 2025 notice, especially fees for data access and who counts as a representative, decide the cost of any product that depends on bank data. Watch the Federal Register for the proposed rule and plan for a comment period.

See whether ChatGPT and Google AI name your company when buyers ask about open banking and account data access.

Run the free Answer ShareBook a call

Sources

  1. Required Rulemaking on Personal Financial Data Rights (final rule) · Federal Register, Nov. 18, 2024Supports: The rule's requirement to share data with consumers and authorized third parties, and its Jan. 17, 2025 effective date.
  2. Required Rulemaking on Personal Financial Data Rights · Consumer Financial Protection Bureau, Oct. 28, 2026Supports: Checked Oct. 28, 2026: the Oct. 22, 2024 final rule and the Aug. 22, 2025 reconsideration notice and its four topics.
  3. CFPB Enjoined from Enforcing Personal Financial Data Rights Rule 1033 · Moore and Van Allen, Nov. 13, 2025Supports: The Oct. 29, 2025 injunction in Forcht Bank v. CFPB, Eastern District of Kentucky.
  4. Section 1033 Compliance Date: Open Banking Rule Enjoined and Under Reconsideration · Cozen O'Connor, April 9, 2026Supports: Phased compliance starting April 1, 2026 for the largest data providers.
  5. CFPB Sends New Section 1033 Open Banking Proposal to OIRA for Review · Consumer Finance Monitor, Aug. 6, 2026Supports: The CFPB sent a reconsideration proposed rule to OIRA, with its contents not yet public.

Related questions

General information, not legal advice.

Intrica helps fintech companies get found in Google and named in AI answers. Fintech SEO →