On October 29, the U.S. District Court for the Eastern District of Kentucky granted a preliminary injunction prohibiting the Consumer Financial Protection Bureau from enforcing its Personal Financial Data Rights Rule, also known as the open banking rule, until the Bureau completes its reconsideration of the rule. The court determined that the plaintiffs, a national bank and two banking associations, demonstrated a likelihood of success on several claims, including that the rule exceeds the Bureau’s authority under the Dodd-Frank Act and is arbitrary and capricious under the Administrative Procedure Act.
The court reasoned that Section 1033 authorizes banks to provide data to consumers and fiduciary-type representatives, not to commercial third parties such as fintech companies. It also explained that the Bureau did not adequately consider the cumulative data security risks created by overlapping provisions requiring the sharing of payment initiation data, delegation of third-party oversight, and restrictions on security-based denials. The court further noted that the Bureau’s prohibition on interface access fees lacked clear statutory support and that fixed compliance deadlines were unreasonable because they depend on future industry standards. Relying on its authority under the Administrative Procedure Act, the court postponed the rule’s effective date and enjoined its enforcement while the Bureau conducts a new rulemaking.
Putting It Into Practice: The injunction pauses implementation of the CFPB’s open banking framework (previously discussed here and here), which would have required financial institutions to provide consumers and authorized third parties with access to transaction data in a standardized, machine-readable format. The ruling reflects growing judicial scrutiny of how far the Bureau can extend its Section 1033 authority and leaves the open banking initiative on hold until new regulations are proposed. Financial institutions should follow the Bureau’s rulemaking process closely and begin assessing how future revisions could affect data-sharing and third-party access obligations.