Cybersecurity Policy Report, Industry groups respond to fintech letter “misstatements” regarding CFPB 1033 rule, (Jul 28, 2025)
Organizations Mentioned:America's Credit Unions | American Bankers Association | Bank Policy Institute | Consumer Bankers Association | Consumer Financial Protection Bureau | Independent Community Bankers of America
The ABA, ICBA, CBA, BPI and ACU issued a joint statement correcting what they said were several misstatements in a letter from a group of fintech and retail organizations regarding the 1033 Rule.
Several banking industry associations have issued a joint statement in response to “falsehoods” contained in a letter from a group of fintech and retail organizations regarding the Consume Financial Protection Bureau’s Section 1033 rulemaking. American Bankers Association, Consumer Bankers Association, Independent Community Bankers of America, America's Credit Unions and Bank Policy Institute assert that the rule puts sensitive consumer data at risk by requiring banks to share consumer data with fintechs and aggregators without establishing fundamental data security safeguards. The statement also asserted that banks and credit unions employ robust data security practices to protect customer data, while many fintechs and data aggregators do not, which puts customer data at serious risk.
1033 Rule. The 2024 rule implemented Section 1033 of the Dodd-Frank Act, which requires banks and other financial institutions to make a consumer’s financial information available to them or a third party at the consumer’s direction. The CFPB’s current leadership in June asked a federal court to vacate the rule to end a lawsuit alleging that it jeopardized consumers’ privacy and account security.
Opposition to the rule centered on claims that it exceeded the CFPB’s authority, lacked proper liability and security safeguards, and barred banks from recovering necessary costs for building and maintaining the significant infrastructure necessary to securely share information with third party companies. The current administration asked the court to vacate the rule, calling it “unlawful.”
Fintech letter. A coalition of fintech, digital currency, and retail trade associations sent a letter dated July 23 to the White House, urging President Trump to defend the Consumer Financial Protection Bureau’s Section 1033 “open banking rule” in court, stating that big banks’ efforts to “unwind” it risks “debanking Americans from the financial services of the future. (see Banking and Finance Law Daily, Jul. 25, 2025)”.
The banking groups stated that their response was intended to correct several misstatements in the fintech coalition’s letter. The associations addressed a few different issues. First, they noted that the current 1033 rule was proposed in October 2023 by the Biden Administration, not the Trump Administration. Further, the Bureau initiated the first steps towards a rulemaking under 1033 under former Director Richard Cordray, an Obama appointee, seeking input from the public in October 2016. The groups stated that the 1033 rule “puts sensitive consumer data at risk by requiring banks to share consumer data with fintechs and aggregators without establishing fundamental data security safeguards. Fintechs and aggregators that handle sensitive personal and financial data about bank customers must be required to adhere to the same rigorous standards and duties as banks and credit unions.”
According to the joint statement, banks and credit unions employ robust data security practices to protect customer data, but “many fintechs and data aggregators do not, which puts customer data at serious risk.” Banks and credit unions meet stringent information security standards established by the federal banking regulators for how they collect, use and retain data. By contrast, fintechs and aggregators are not subject to stringent information security standards or to any regulatory oversight. The associations state that “these middlemen mine, extract and store data, often continuously and at high volumes, with the intent to keep and resell it” … “The security of the data-sharing ecosystem depends on banks’ and credit unions’ strong safeguards.”
Banks and credit unions are currently and continuously sharing data with fintechs and data aggregators, and have invested to build secure systems that allow the current data sharing ecosystem to thrive, according to the statement.
“A robust, competitive data-sharing environment already exists in the U.S., and it’s working.” According to the statement, financial institutions have spent years building infrastructure that enables safe, API-based data sharing.
In response to assertions in the fintech companies’ letter, the association state that large aggregators have access to these systems, despite claims of being shut out by banks. “Banks charge fees to ensure those businesses share in the cost of keeping consumers’ data safe and secure and for the increased liability risks banks and credit unions face from sharing that data with fintechs and aggregators that may use and retain the data without appropriate safeguards in place.”
The groups assert that fintechs and data aggregators “are profiting from access and re-use of consumers’ sensitive data.”
Companies: American Bankers Association; Bank Policy Institute; America's Credit Unions; Consumer Bankers Association; Independent Community Bankers of America
RegulatoryActivity: BankingOperations CFPB CommunityDevelopment CyberPrivacyFeed DataPrivacy DoddFrankAct EqualCreditOpportunity FinancialStability FinTech Loans Privacy DataSecurity