On October 22, 2024, the Consumer Financial Protection Bureau (CFPB) issued a groundbreaking Final Rule that reshapes personal financial data rights. Known as the “Personal Financial Data Rights Final Rule,” this regulation, based on the framework of Regulation 1033, aims to empower consumers by granting them greater access to and control over their financial data. This rule mandates that financial data providers must make specific types of financial data available to consumers and, importantly, to authorized third parties, provided they meet a set of stringent requirements.
For merchants in the recurring payments industry, this rule presents both new responsibilities and fresh opportunities. As data transparency and customer-centric control become the norm, understanding and adapting to these changes will be key for staying compliant, building customer trust, and leveraging data for business growth.
What is Dodd-Frank Act Section 1033?
The Dodd-Frank Wall Street Reform and Consumer Protection Act, also known as Dodd-Frank, was enacted in 2010 as a direct response to the financial crisis of 2007-2008. Dodd-Frank established a series of rules and agencies with the goal of reducing risk in the banking system and making it safer for consumers and taxpayers.
Under the Dodd-Frank Act, Section 1033, businesses that offer financial products or services must, if asked, give consumers access to information they hold about those products or services. This information should be provided in an electronic format that consumers can use. Additionally, Congress required the CFPB to create rules that encourage the use of standardized formats for this data, making it easier for consumers to understand and use. In June 2024, the CFPB finalized a rule specifically focused on setting these data standards.
This rule was created to empower consumers to evaluate their account relationships and switch providers who are not benefiting them. It also enables consumers to authorize 3rd parties to access data on their behalf (perhaps a budgeting app) to provide valuable products and services they request. The hope is that this new consumer empowerment will lead to competition, that results in innovation, better rates, and improved customer services.
“This rule will increase competition, improve consumers’ choices, and drive momentum for future innovations that benefit consumers – like cash flow underwriting, stronger fraud tools, pay-by-bank, and personalized financial services – while fostering greater trust in the financial ecosystem.” FTA’s President and CEO Penny Lee
Who does Rule 1033 Cover?
Rule 1033 applies to “data providers,” which include depository institutions like banks and credit unions, as well as non-depository institutions that issue credit cards, manage transaction accounts, provide account-access devices, or offer other types of payment-related products and services. Notably, small depository institutions ($850 million and less) are exempt from this rule.
Under Rule 1033, data providers must make “covered data” (which encompasses all details related to transactions, fees, charges, and usage) available to authorized third parties, meet minimum response times, and are prohibited from charging fees for data access.
Key Provisions of the Final Rule
Data Accessibility for Consumers The rule requires financial data providers to ensure that consumers have easy, electronic access to their own data regarding certain financial products and services. This mandate is designed to increase data transparency and empower consumers with greater insight into their financial transactions. For recurring payments merchants, this means customers can readily access information related to their subscriptions, billing history, and payment details.
Authorized Third-Party Access Beyond direct consumer access, the Final Rule allows authorized third parties to access this data on behalf of consumers. However, these third parties must meet specific certification requirements, including demonstrating responsible data collection, secure usage, and proper retention of consumer financial information. This provision aims to protect consumers while enabling them to share their financial data with trusted service providers, such as budgeting apps or payment analytics platforms.
Strengthened Data Privacy and Security Requirements With the increased flow of financial data, the Final Rule emphasizes the importance of protecting consumer privacy and securing data. It mandates that data providers and authorized third parties maintain rigorous privacy and security practices. This provision is crucial for recurring payments merchants, as it ensures that customer data is handled with utmost care, minimizing the risk of data breaches and unauthorized access.
Preparing for the Changes
As this new rule takes effect, recurring payments merchants should start planning their approach to compliance and optimizing their operations in light of the data access requirements. Here are some key steps to consider:
Evaluate Current Data Management Practices: Review how your company currently stores, manages, and shares customer financial data. Ensure that your systems can securely handle increased access and that your data is organized in a way that meets regulatory requirements.
Assess Partnerships with Third-Party Providers: If you share consumer data with third-party vendors, verify that they meet the CFPB’s new authorization criteria. This may include requesting updated compliance certifications and ensuring they have robust data security measures in place.
Implement Data Access Controls: Establish clear protocols for data requests, access, and sharing to ensure that your processes align with the rule’s standards. This might involve training your team on new procedures for handling data requests from customers or authorized third parties.
By proactively preparing, recurring payments merchants can navigate these regulatory changes with ease.