CFPB Addresses Regulating Consumer Access to Financial Data 

The Consumer Financial Protection Bureau (CFPB) has issued an advance notice of proposed rulemaking (ANPR) requesting input on regulating consumer access to financial records. 

With the ANPR, the CFPB is looking for suggestions on how the agency could most efficiently and effectively develop regulations implementing Section 1033 of the Dodd-Frank Act, which focuses on consumer rights regarding the access of financial records. The agency added the ANPR is specifically seeking comments and information on costs and benefits of consumer data access, competitive incentives, standard-setting, access scope, consumer control, and privacy and data security and accuracy. 

"When consumers use financial products and services, the providers of those products and services generally accumulate data about those consumers and their use of those products and services," the CFPB said in a press statement. "Consumer access to these data allow consumers to manage their financial accounts and can enhance consumers’ control of their financial matters. Consumers may realize these benefits by authorizing third parties to access these data on their behalf and allowing those third parties to deliver new or improved financial products and services. Use cases for consumer-authorized data include personal financial management, making and receiving payments, assisting consumers with improving savings outcomes, underwriting credit, and many other services."

In February of this year, the CFPB hosted a symposium titled “Consumer Access to Financial Records and Section 1033 of the Dodd-Frank Act.” In the report issued after the symposium’s conclusion, the CFPB observed that while consumers’ ability to access their financial records in electronic form “empowers them to better monitor their finances” while encouraging financial services companies to make the consumer experience more efficient, it also determined that “this kind of expanded access to consumer financial records raises a number of concerns, particularly with respect to data security, privacy, and unauthorized access.” 

The ANPR comments are due within 90 days after its publication in the Federal Register, with the ANPR identified by Docket No. CFPB-2020-0034 or RIN 3170-AA78.