“If small and mid-size banks decide not to invest in open banking, the largest banks will be able to both easily pick off new customers and steer existing customers toward preferred partners,” former CFPB official Dan Murphy told Fintech Nexus
Fintechs take notice: the open banking rule saga at the CFPB is once again rearing its head, with serious implications for how banks and fintechs operate. The rule had been poised to open up the banking and financial services landscape to services like pay-by-bank as well as consumer-centered frameworks for data protection and sharing
On Friday, the Consumer Financial Protection Bureau (CFPB), currently led by acting director Russ Vought (architect of Project 2025), filed a motion for summary judgment to vacate the Section 1033 open banking rule. Now agreeing with the first point of the Bank Policy Institute’s lawsuit against the Bureau, the CFPB claims the rule “exceeds the Bureau’s statutory authority and is arbitrary and capricious.”
According to Dan Murphy, Founder of Sunset Park Advisory and former CFPB Fellow who helped lead the Bureau’s rulemaking on personal financial data rights, this legal development kneecaps years of open-banking rulemaking. The move is “at odds with a decade of rigorous, bipartisan, cross-industry work, including five separate public comment periods,” Murphy told Fintech Nexus.
Entities like the Financial Technology Association are intervening in this lawsuit. FTA President and CEO Penny Lee says, “actions by the largest banks will result in limiting competition and making the ecosystem less safe by cutting away important protections and control for consumers” and states the FTA will “respond in kind” to the CFPB’s filings. Fintech Nexus’s interview with Murphy outlines where things stand in the meantime — and digs into whether banks and fintechs can proceed on open banking without CFPB guidance.
The following has been edited for length and clarity.
CFPB leadership has announced that it deemed Rule 1033 to be “unlawful and should be set aside,” and it also agreed with the first point of the Bank Policy Institute’s lawsuit, which may prevent the CFPB from writing future open-banking rules without Congressional approval. Where does that leave the state of open banking?
The state of play is that the Trump Administration has now decided to go along with BPI’s effort to undermine not only the recently finalized 1033 rule, but also the longstanding statutory interpretation of section 1033 of the Dodd-Frank Act that much of the financial services industry has relied on and that underpins the CFPB’s ability to write a future rule. Essentially, the Trump Administration is now arguing that 1033 only means that banks must offer online banking to their customers, but provides no right for a consumer to share their data. This is an outlandish and legally questionable move, as it seems to rest on a convoluted new reading of the statute that is at odds with a decade of rigorous, bipartisan, cross-industry work, including five separate public comment periods.
The Trump Administration has really gone out on a limb here to do the banks a favor. Their new position is not only at odds with the Biden-era CFPB, but it is also at odds with the CFPB’s 2017 Principles, the view of recent House Financial Services Committee Chairman McHenry, and even the Trump Administration’s own 2018 recommendation. More importantly, it is at odds with a straightforward reading of the statute and the stated intent of the drafter of the statute.
In a recent op-ed, you wrote that the CFPB appeared on the cusp of delaying open-banking statutes by three or four years by bringing the rule-making process back to square one. Is that still the case following these recent legal proceedings?
Unfortunately, it’s even worse than that now. If this convoluted new interpretation of section 1033 were to be taken seriously by the court and upheld on appeal, it would limit the CFPB to writing a fairly pointless rule that simply mandates online banking. In that scenario, we could find ourselves waiting for a new act of Congress, some new rulemaking process, and (probably) another legal challenge from the banks. We could easily be facing a ten-year setback, or more, if the court agrees with big banks and the Trump Administration.
You also note that the Bank Policy Institute’s litigiousness against the CFPB suggests that “certain big banks appear to have had a change of heart on open banking.” What would explain their about-face, given their prior collaboration with regulators — including during the first Trump Administration — on this topic?
BPI’s sudden scorched earth posture is really disappointing. My sense is that there are a few different things going on here.
First, certain big banks seem to have recently woken up to the long-term threat that pay-by-bank could pose to their card businesses. Since open banking powers pay-by-bank, the banks are now in the unenviable position of having to pretend they haven’t been along for the ride on open banking the whole time. It’s notable that there are a number of inconsistencies between BPI’s 2023 comment letter to the 1033 rule proposal and their 2024 lawsuit. In particular, BPI’s comment letter never made the outlandish arguments their lawsuit makes in count 1. Sometime after writing their comment letters, the banks’ perspectives clearly and demonstrably changed.
Second, it’s clear that BPI sees Trump Administration officials as easy marks who might let them get away with something they never before thought possible. They seem to have calculated that in their deregulatory zeal, the Trump Administration either wouldn’t realize or wouldn’t mind that big banks’ sudden opposition to 1033 is actually an effort to consolidate their market position. The largest banks are already investing in open banking in ways that allow them to better control who their customers do business with. If small and mid-size banks decide not to invest in open banking, the largest banks will be able to both easily pick off new customers and steer existing customers toward preferred partners.
Third, it’s an open secret that it’s mainly two or three of the largest banks pushing for this, and not all of their peers were or are on board with BPI’s scorched earth approach. I have a lot of sympathy for the bankers who have been real leaders in open banking, only to have their own employers and lobbyists suddenly disparage years of their collaborative work with the rest of the industry.
The retreat of the CFPB could result in a splintering in regulatory authority to state agencies and attorneys general. Could we see open banking implemented through other means, or within a subset of geographies?
Depending on what happens in the lawsuit, you could certainly see state regulators and attorneys general enforce the 1033 rule, as provided for by section 1042 of the Dodd-Frank Act. More broadly, BPI’s approach opens up a question for the fintech industry and for state legislatures about whether new laws at the state level will be necessary. Everyone agrees that’s a suboptimal solution, but recent events inevitably lead to that conversation.
What other ripple effects have you identified arising from the CFPB’s dismantling and defunding? Do you think these consequences are permanent?
There are too many unintended consequences to count for consumers and the financial services industry. We know what happens when you take the cops off this beat altogether. More broadly, nothing good comes from an agency defying both Congress and the courts. Importantly, though, most of the changes we’re seeing today are not legal, and certainly not permanent.
Ironically, the Trump Administration is simultaneously arguing that a straightforward reading of section 1033 (that it previously agreed with) is outrageous, but that its own effort to defy the entirety of Title X of Dodd-Frank is completely fine. I don’t envy their lawyers.
