The Consumer Financial Protection Bureau's Personal Financial Data Rights Rule, finalized in 2024 under Dodd-Frank Section 1033, requires covered financial institutions to make consumer financial data available through a developer interface and points the market toward the FDX standard. It is the US's mandated open-banking rule — and, as of writing, the subject of active legal challenge that leaves its future uncertain.
CFPB Personal Financial Data Rights Rule
The CFPB Personal Financial Data Rights Rule is the regulation that finally tried to turn Dodd-Frank §1033 from a dormant right into an operating mandate. Finalized in 2024, it requires covered institutions to make a consumer’s financial data available to authorized third parties through a developer interface, and it recognizes industry standards — principally FDX — as the way to do it.
- A developer interface, not screen-scraping - The rule pushes the market off credential-sharing and onto authorized, consented API access, the same move PSD2 made in Europe years earlier.
- Standard-setting by reference - Rather than write a spec, the CFPB points to recognized industry standards (FDX) as qualified interfaces — a lighter touch than the UK’s OBIE or Australia’s DSB.
- Contested, and consequential - The rule is under active legal and political challenge; its survival is the single biggest open question in US open banking.
I have called this rule the US market’s coin-flip. If it survives and is enforced, it drags the long, human-only tail of US banks toward a standard and commoditizes the consumer-data surface the aggregators currently rent out. If it dies, the fragmentation persists and the rails stay privately held. Either way, the finding holds: a rule that merely points at a standard, in a market with no delivery body, will struggle to reach past existence to usefulness.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of US Banking APIs
The rule the report calls the market's coin-flip — whether it survives decides whether the aggregator-owned rails get pried open.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at contracts.apievangelist.com.
FDX
The Financial Data Exchange standard the rule leans on as the recognized interface for compliant data sharing.
