What is the CFPB 1033 open banking rule, and is it in force?

#What is section 1033?

Section 1033 is a short part of the Dodd-Frank Act, the big US financial reform law. It says that, subject to rules from the Consumer Financial Protection Bureau (CFPB), a financial company must make available to a consumer, on request, information about the product or service the consumer got from it, including transactions, costs, charges and usage data, in an electronic form the consumer can use⁠^[1]. In plain words: your financial data is yours to get, and to pass on.

The law needed a detailed rule to work in practice, and that rule arrived only in 2024. If you are new to the idea of sharing bank data with apps, start with what is open banking; this article focuses on the US version.

#What did the 2024 rule require banks to do?

The CFPB announced the final Personal Financial Data Rights rule on 22 October 2024⁠^[2] and published it in the Federal Register on 18 November 2024. It requires data providers to make consumers' data available on request to consumers and to authorised third parties in a secure and reliable manner, and it prohibits fees or charges for that access⁠^[3].

The rule covers consumer accounts governed by Regulation E (such as checking accounts), credit cards governed by Regulation Z, and products that facilitate payments from those accounts or cards⁠^[4]. The data that must be shared falls into six categories⁠^[5]:

Banks must offer a developer interface, meaning an API that apps connect to, in a standardised, machine-readable format. The interface must answer properly at least 99.5% of requests in each calendar month, not counting scheduled downtime, and a bank must not let a third party use your own login credentials to access it⁠^[6]. That last line is how the rule shuts the door on screen scraping as a way of complying⁠^[3].

#What rules apply to the apps that receive your data?

The rule also binds the third parties. They must limit the collection, use and retention of your data to what is reasonably necessary to provide the product or service you asked for. A permission lasts a maximum of one year; to keep collecting data, the app must get a new authorisation no later than the anniversary of the last one⁠^[3]. When you revoke access, the CFPB described deletion as the default⁠^[2].

#Who had to comply, and by when?

The rule set staggered compliance dates by size. Depository institutions (banks and credit unions) at or below the Small Business Administration size standard are excluded entirely⁠^[4]. The others were given dates from 2026 to 2030⁠^[7]:

To help firms agree on technical formats, the CFPB also created a process to recognise industry standard-setting bodies. On 8 January 2025 it recognised Financial Data Exchange (FDX) as a standard-setting body under the rule⁠^[8]. Our guide to how banking APIs work explains what such standards contain.

#Why is the 1033 rule on hold?

A bank and two trade associations sued in the US District Court for the Eastern District of Kentucky. In 2025 the CFPB changed course: on 29 July 2025 the court stayed the case after the Bureau said it would reconsider the rule, and on 22 August 2025 the CFPB published an advance notice asking for comments on four topics: who counts as a consumer's representative, whether banks may charge fees to cover costs, information security, and privacy risks⁠^[9]. Earlier, the court had already extended the compliance deadlines, moving the first from 1 April to 30 June 2026⁠^[10].

On 29 October 2025 the court granted a preliminary injunction stating that the CFPB is enjoined from enforcing the Personal Financial Data Rights Rule until it has completed its reconsideration⁠^[10]. A law firm analysis from April 2026 described the rule as enjoined while the Bureau reviews whether it should be modified or withdrawn⁠^[11]. The CFPB's regulatory agenda, published on 14 August 2026, still lists a rulemaking to reconsider certain aspects of the November 2024 rule⁠^[12]. On 4 August 2026 the White House Office of Information and Regulatory Affairs (OIRA) received a CFPB proposed rule titled Personal Financial Data Rights Reconsideration for review, and on 3 October 2026 OIRA still listed it as pending review⁠^[13]. A revised proposal may therefore be published for comment, but until the CFPB completes its reconsideration the court order stands.

#What does the pause mean for you as a consumer?

The injunction stops the CFPB from enforcing the rule⁠^[10]; it does not make data sharing illegal. Apps that already connect to banks may keep working under the arrangements they had before. What you lose for now is the guarantee that the rule's specific protections, such as free access, the one-year permission limit and the ban on password-based access, can be enforced by the CFPB. That makes your own checks more important.

#How does the US approach compare with Europe's?

Europe built open banking into payments law: PSD2 created regulated account information and payment initiation services and applies since 2018⁠^[14]. The US rule focuses on a consumer's right to data and how third parties may use it, and its future shape depends on the CFPB's reconsideration. If you want to see how the data then moves money, read pay by bank explained and the payments guide to ACH, wire and instant payments.