On July 29, 2025, the Consumer Financial Protection Bureau (CFPB) stated in a legal briefing that it has decided to reconsider an agency rule “with a view to substantially revis[e] it and provid[e] a robust justification.” The federal district court hearing the case granted the motion, thus pausing the lawsuit for now.
The rule at issue is the Final Section 1033 Open Banking Rule (the Rule), which the CFPB issued in October 2024 under the Biden administration. This section is a part of the Dodd-Frank Act, more commonly known as the Consumer Financial Protection Act of 2010.
The Rule would implement Section 1033 and introduce requirements for financial institutions regarding consumer financial data access and sharing. The CFPB intended to promote and regulate an open banking system under which consumers have greater control over their financial information.
For instance, under the Rule, upon consumer request, financial institutions would be required to unlock a consumer’s personal financial data and transfer it to another provider without charging any fee. The Rule would also require financial institutions to develop and maintain interfaces to facilitate authorized third-party access to consumer financial information.
According to the CFPB, the Rule was intended to encourage and enable responsible open banking and to improve customer service in the financial services space, especially in terms of allowing customers to switch financial service providers with greater ease.
However, the Rule was met with immediate criticism from the financial sector, with many financial institutions arguing that it unreasonably increased banks’ liabilities and that compliance costs were disproportionate to its intended outcomes.
The same day the final Rule was issued in October 2024, Forcht Bank, a Kentucky lender, in conjunction with banking trade groups, the Kentucky Bankers Association, and the Bank Policy Institute, filed a complaint arguing that the CFPB exceeded its statutory authority. In the complaint, the plaintiffs asserted that “open banking [in the United States] is already flourishing through a private, market-based ‘consumer data sharing ecosystem,’” but that the CFPB’s proposed regime would create a “fundamentally insecure mandatory data-sharing framework.”
Throughout 2025, there were several notable steps in the litigation. In February 2025, the plaintiffs and the CFPB, under the new Trump administration, filed a joint motion to stay proceedings. In response, the Financial Technology Association (FTA), a trade association, promptly filed a motion to intervene.
In May 2025, a district court judge held that the FTA could intervene because neither party to the lawsuit would sufficiently represent FTA’s members’ interests. In June 2025, the CFPB requested the court to vacate the Rule. Yet, on July 29, 2025, the CFPB shifted its position and filed the motion to stay, citing its intent to significantly change the Rule.
As of now, it is unclear what changes the CFPB will propose. On July 25, 2025, a coalition of financial technology organizations wrote a letter to the White House, urging President Trump to support an open banking regime.
In response, on July 28, 2025, a group of banking associations issued a joint statement asserting that data aggregators and financial technology organizations are not required to follow strict security standards and that financial institutions already maintain a functional private data-sharing ecosystem to create safeguards in sharing financial information with such middlemen organizations. The current administration faces pressure from and has received feedback from organizations who both oppose and support an open banking regime.
Though it is uncertain which way the CFPB under this administration will lean, the agency will surely have to propose a new version of the Rule. Section 1033 of the Consumer Financial Protection Act includes a provision stating that the CFPB “shall prescribe standards…to promote the development and use of standardized formats for information.” 12 U.S.C. § 5533(d).
In simple terms, this provision creates a statutory obligation for the CFPB to promulgate regulations on consumer access to financial data. That means the CFPB must propose some version of the Rule. What exactly the revised regulations will entail remains to be seen.