CFPB Section 1033: Will it Stay or Will it Go?

We all know the classic song by The Clash from the 80s: 'Should I Stay or Should I Go?' This time, the question revolves around the recently published open banking regulation, issued on October 22, 2024, by the Consumer Financial Protection Bureau (CFPB), now referred to as Section 1033 of the Dodd-Frank At.

Will it stay or will it go?

With only a few days remaining until the new administration officially begins on January 20, 2025, the financial industry is widely speculating about the fate of this regulation: will it stay or will it go?

Two challenges threatens its existence in the short term:

The Congressional review Act legislation
The lawsuit filed, on the same day of the Section 1033 published by the CFPB, Forcht Bank, the Kentucky Bankers Association (KBA), and the Bank Policy Institute filed a 55-page lawsuit against the CFPB, arguing that it has overstepped its statutory authority.

1. How the CRA Works?

The Congressional Review Act (CRA) is a legislative tool that allows Congress to oversee and potentially nullify federal regulations issued by government agencies.

The CRA has been used to overturn federal regulations, particularly during transitions between administrations with differing policy agendas. For instance, in early 2017, Congress utilized the CRA to nullify several regulations issued in the final months of the Obama administration.

It's important to note that the CRA's expedited procedures are time-sensitive, and the window for congressional action is limited. Therefore, the timing of a rule's submission to Congress can significantly impact the likelihood of a successful disapproval.

Here's an overview of how the CRA process works:

Submission of Rules:

Federal agencies must submit each new rule to both houses of Congress and the Government Accountability Office (GAO). This submission includes the rule's text, a concise description, and its proposed effective date.

Congressional Review Period:

Upon receipt, Congress has a specified period—typically 60 legislative days—to review the rule. During this time, Congress can evaluate the rule's implications and decide whether to take action.

Resolution of Disapproval:

If Congress opposes the rule, a member can introduce a "joint resolution of disapproval." This resolution, if passed, expresses Congress's disapproval of the rule.

Expedited Consideration in the Senate:

The CRA provides an expedited process in the Senate for considering the disapproval resolution. If the committee to which the resolution is referred does not act within 20 calendar days, it can be discharged upon a petition by 30 Senators. The resolution is then placed on the calendar, and a motion to proceed is in order. Debate is limited to 10 hours, and no amendments are allowed, facilitating a timely vote.

Presidential Approval:

For the disapproval to take effect, the joint resolution must be passed by both the House and Senate and then signed by the President. If the President vetoes the resolution, Congress can override the veto with a two-thirds majority in both chambers.

Effect of Disapproval:

If a rule is disapproved under the CRA, it is nullified and cannot take effect. Additionally, the agency is prohibited from reissuing the same or a substantially similar rule without explicit authorization from Congress.

So what?

Can the CRA be used? Yes, it can, as it applies to rules enacted in the last six months of the outgoing presidential administration
Congress may repeal the rule through a joint resolution of disapproval.

The 119th Congress has until mid-March 2025 (a 60-day review period) to act, coinciding with a busy time as the new administration establishes itself.

Given the CRA’s requirements for simple majority votes and the volume of rules issued by the outgoing administration, prioritization will play a critical role in determining whether this rule is addressed.

The bipartisan support for the rule, including from former US Representative Patrick McHenry, the then-chair of the House Financial Services Committee, during its drafting phase suggests it may not face universal opposition, but the CRA process remains a critical hurdle.

2. The current lawsuit

On October 22, the same day the Consumer Financial Protection Bureau released the long-anticipated Section 1033, Forcht Bank, the Kentucky Bankers Association (KBA), and the Bank Policy Institute filed a 55-page lawsuit against the CFPB, arguing that it has overstepped its statutory authority.

The primary points of contention include, according to our reading:

Exceeding Statutory Authority:

Plaintiffs claim Section 1033 mandates only that banks provide consumers with their own financial information upon request. They argue the rule extends this obligation to sharing data with third parties which isn't explicitly authorized by the statute.

Increased Security Risks:

Consumer Data: Plaintiffs contend that the rule introduces significant risks by mandating banks share sensitive consumer data with third parties, potentially increasing the risk of data breaches.
Screen Scraping: Despite acknowledging the risks of screen scraping, the CFPB's rule does not ban it, leaving consumers' data vulnerable.

Unrealistic Compliance Requirements:

Plaintiffs argue the compliance deadlines are too short and disconnected from the timeline for establishing necessary technical standards by private organizations.
Economic Impact and Fee Prohibition:
Prohibition on Fees: The rule forbids banks from charging third parties for accessing customer data, forcing banks to absorb the costs, which plaintiffs argue is not supported by Section 1033.
Economic Burden: The plaintiffs believe the rule will impose significant compliance costs on banks, potentially stifling innovation and increasing financial risks.

The CFPB filed an answer to the amended complaint on 27 December 2024, but the new CFPB director could influence the outcome by consenting to an injunction that would prevent the rule from taking effect.

Conclusions and Implications

Section 1033 is a significant step forward in bringing the U.S. on par with global counterparts. Despite these challenges, open banking as a concept is expected to persist, driven by existing private-sector data-sharing initiatives. Furthermore, on Wednesday January 8, 2025, the Consumer Financial Protection Bureau (CFPB) has recognized Financial Data Exchange, Inc. (FDX) as a standard-setting body under its Personal Financial Data Rights rule. This recognition is a significant step forward to make open banking pervasive in the US.

Implications:

For Financial Institutions: Banks should prepare for potential compliance requirements while monitoring legislative and legal developments.
For Consumers: Open banking’s future could impact how individuals access and control their financial data.
For Market Participants: The evolving regulatory environment creates opportunities and risks, particularly for fintechs and data providers engaged in open banking.

While it is impossible to predict with certainty the fate of Section 1033, as the rule's implementation remains uncertain, the broader adoption of open banking seems inevitable.