The Consumer Financial Protection Bureau's Section 1033 rule, finalized October 2024, requires covered financial institutions to, at the consumer's request, share account data — balances, transactions, and bill-payment information — with authorized third parties securely and without fees for the data access itself. The largest institutions, those with more than $250 billion in assets, face a compliance deadline of April 1, 2026, per the rule's published text. It binds banks and card issuers first; payment processors handling transactions for covered institutions follow later. Nuv Media publishes information, not financial or legal advice.
The rule is the first federal implementation of the 2010 Dodd-Frank provision that promised consumers a right to their own financial records. Fourteen years between statute and rule text explains much of the industry's fatigue with the topic.
Whom does the rule bind, and by when?
Compliance tiers by institution size, per the CFPB's published compliance dates: depository institutions above $250 billion in assets by April 1, 2026; above $10 billion by April 1, 2027; below $10 billion by April 1, 2028, with a further extension to April 1, 2030 available for institutions below $1.5 billion. Covered card issuers follow a parallel schedule tied to asset thresholds. Every tier obliges the same core duty: build and maintain a data-access interface an authorized third party can use.
The interface must meet the rule's qualified industry standard-setting body's specifications — a deliberately unusual piece of delegation under which the CFPB recognized a standard-setter to define the API plumbing rather than writing technical specs into regulation.
What does the rule change for banks operationally?
Three duties dominate implementation. Institutions must expose covered data categories — account information, transaction history, and bill-payment data among them — through interfaces that meet the recognized standard. They must obtain and track consumer authorizations, with revocation rights the rule makes explicit. And they face liability for the security of the handoff, which is why vendor contracts are being reopened across the industry.
One detail other coverage skipped: the rule prohibits covered institutions from charging fees for the data access itself, but it does not cap what third parties may charge consumers downstream — so the consumer-price effect depends on fintech pricing, not on bank tariffs.
What did the rule leave unresolved?
Screen scraping. The final rule does not ban credential-based scraping outright; the CFPB stated the expectation that it sunsets as standardized interfaces deploy, and the standard-setter's transition provisions govern how fast. Banks that spent a decade rate-limiting aggregators now share a regulated channel with them.
Litigation risk also survived finalization. Bank trade groups challenged the rule in federal court after publication, arguing the delegation to a private standard-setter exceeded the bureau's authority. The CFPB's own status — a subject of litigation about its funding structure that reached the Supreme Court in 2024 — adds a second layer of uncertainty no compliance calendar resolves.
What is firm and what is not?
Firm: the published compliance dates, the data categories, the fee prohibition on access, and the liability allocation, all from the rule text as finalized in October 2024. Not firm: whether the court challenge delays the calendar, and how the recognized standard's transition periods interact with each tier's deadline — the standard-setter's documents, not the regulation, control that last piece. Institutions building to the April 2026 date are building to a rule that exists in force; whether it exists on schedule is a question the courts, not the bureau, will answer first.
For more context, read CFPB's Regulation E Gives Banks a 10-to-45-Day Error Clock.
