By: Rashonda Harris
As technology continues to revolutionize financial services, the concept of open banking has gained momentum.[1] Open banking involves facilitating access to consumer financial data with the ultimate goal of networking that financial data across financial entities.[2] This provides consumers with increased choice and data portability for financial products such as bank accounts.[3] Building on that momentum, the Consumer Financial Protection Bureau (CFPB) has demonstrated a regulatory commitment to advancing open banking.[4] Citing increased competition in the banking sector and consumers’ choice, the CFPB promulgated the Personal Financial Rights Rule.[5]
The rule requires banks and other financial service companies to provide consumers and some third parties with free access to certain personal financial data in a standardized format.[6] It also provides a framework for aligning technical standards across affected industries.[7] Banks and other depository institutions are the primary financial services providers affected by the regulation.[8] They will now be required to provide consumers and other third parties with easy access to “covered data,” including transaction, payment, and account balance information.[9] In theory, this regulation will provide consumers with increased choice and enhance competition in the banking space.[10]
Banks, however, have met this rule with opposition, arguing that the CFPB’s attempt to require banks to share data with third parties is outside of the scope of the bureau’s authority.[11] Additionally, while the rule also establishes standards for standard-setting organizations to ensure data processing is standardized for interoperability, banks are left to manage the added liability on their own.[12] For example, the terms that might minimize liability in the event of a breach or fraud controls have not yet been determined.[13] Similarly, there are no limits on the amount of third-party data requests from authorized parties, and the bank’s existing third-party risk management practices may not anticipate the sharing of sensitive account information.[14] The CFPB has responded by asserting rulemaking authority under the Consumer Financial Protection Act.[15]
The Forcht Bank, joined by the Kentucky Bankers Association and the Bank Policy Institute, filed suit against the CFPB to limit the scope of the Open Banking Rule and challenged the CFPB’s authority to mandate sharing.[16] In May 2025, the fintech industry joined the CFPB in the litigation, arguing to keep the rule.[17] As third parties that would gain access to personal banking data, the industry has an interest in free and standard access to consumer data.[18] Forcht v. CFPB is the latest clash in financial services between highly regulated institutions and their less-regulated fintech counterparts.[19]
The CFPB’s Open Banking Rule reflects the Bureau’s forward-looking approach to financial services regulation, acknowledging the integral role that technology now plays in consumer finance. While this regulation has placed the old guard of depository institutions at odds with the booming fintech market, open access to standard data can promote innovation.
[1] See Rich Zukowsky, Open Banking, APIs, and Liability Issues, Davis Wright Tremaine LLP (Dec. 18, 2019), https://www.dwt.com/blogs/financial-services-law-advisor/2019/12/open-banking-api-liability [https://perma.cc/WU2J-W272]; see also Frank Gargano, Exclusive Research: Are Banks Welcoming Open Finance with Open Arms, Am. Banker (Jan. 26, 2026, at 14:03 ET), https://www.americanbanker.com/payments/news/exclusive-research-is-open-finance-growing-in-popularity [https://perma.cc/6DC3-TB5J] (detailing the increased popularity of open banking with both consumers and financial institutions).
[2] Open Banking: Definition, How It Works, and Risks, Investopedia (Aug. 2, 2025), https://www.investopedia.com/terms/o/open-banking.asp [https://perma.cc/8W2V-6ZNC] (describing open banking as allowing third-party providers with access to consumer financial data through application programming interfaces (APIs)).
[3] Id.
[4] Rohit Chopra, Director, Consumer Fin. Prot. Bureau, Prepared Remarks of CFPB Director Rohit Chopra at the Financial Data Exchange Global Summit (Mar. 13, 2024), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-at-the-financial-data-exchange-global-summit/ [https://perma.cc/HRW3-GYQY].
[5] CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services, Consumer Fin. Prot. Bureau (Oct. 22, 2024, at 05:00 ET), https://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-personal-financial-data-rights-rule-to-boost-competition-protect-privacy-and-give-families-more-choice-in-financial-services/ [https://perma.cc/69UJ-T8M9].
[5] Id.
[6] Id.
[7] Id.
[8] Coverage of Data Providers, 12 C.F.R. § 1033.111(a) (2026) (defining applicability to providers of accounts subject to Regulation E (Electronic Funds Transfer), Regulation Z credit cards, and payment facilitators from Regulation E or Z accounts); Covered Data, 12 C.F.R. § 1033.211 (2026) (outlining information included in covered data).
[9] See Availability and Prohibition Against Evasion, 12 C.F.R. § 1033.201(a) (2026).
[10] See Chopra, supra note 4 (discussing anticompetitive behavior against open banking).
[11] Our Take: Financial Services Regulatory Update, PwC (May 16, 2025), https://www.pwc.com/us/en/industries/financial-services/library/our-take/05-16-2025.html [https://perma.cc/A9LL-PLJR]; see Forcht Bank, N.A. v. CFPB, No. 5:24-304-DCR, 2025 WL 3019628, at *1 (E.D. Ky. 2025).
[12] Adam Maarec, The Next Wave of Open Banking: New Rules on Personal Financial Data Rights, Am. Bar Ass’n, (Mar. 3, 2025), https://www.americanbar.org/groups/business_law/resources/business-law-today/2025-march/new-rules-personal-financial-data-rights/ (on file with the American University Business Law Review).
[13] Id.
[14] Id.
[15] Forcht Bank, 2025 WL 3019628, at *2, *3, *6, *7.
[16] See id.
[17] Forcht Bank, N. A. v. CFPB, No. 5:24-304-DCR, 2025 WL 1402553 (E.D. Ky. 2025).
[18] Id.
[19] See Rosalia Mazza, The Fall of Banks? How Fintechs are Reshaping Finance, FinTech Weekly (Feb. 23, 2025), https://www.fintechweekly.com/magazine/articles/fintechs-vs-traditional-banking-who-will-survive [https://perma.cc/NGD8-XC4H].
