CBA Urges CFPB to Protect Consumers in Re-Examining Its Personal Financial Data Rights Financial Rule

WASHINGTON, D.C. – The Consumer Bankers Association (CBA) today submitted a comment letter to the Consumer Financial Protection Bureau (CFPB) in response to its advance notice of proposed rulemaking (ANPR) related to reconsidering the Personal Financial Data Rights (PFDR) final rule that implemented Section 1033 of the Dodd-Frank Act under the Biden Administration.

Why It Matters

The Biden Administration’s final PFDR rule introduced uncertainty and potential security risks to a system that has long worked effectively for consumers and innovators alike, and failed to reflect market, technological, and practical realities. Moreover, many parts of the rule extended far beyond statutory requirements.

CBA supports the CFPB’s reconsideration of the final PFDR rule as it is an opportunity to restore balance by establishing a framework that is grounded in law, safeguards consumer data, and allows the free market to continue driving progress. 

Policy Recommendations

To assist the CFPB in its reconsideration of the PFDR rule, CBA recommends that the CFPB specifically re-examine several areas including:

• Consumer and Representative: The CFPB should conclude that third parties and data aggregators are not “consumers” under section 1033 of the Dodd-Frank Act because they are not “representative[s] acting on behalf of an individual” due to the fact they are operating with the consumer in a business relationship, one often premised on monetizing that consumer’s data, rather than a fiduciary relationship.
• Costs & Fees: The PFDR rule incorrectly prohibited data providers from imposing fees on third parties and data aggregators accessing consumer data, and the CFPB should reverse this decision to permit all market participants in the data access ecosystem to charge fees as part of their business model, should they choose to do so.
• Information Security: Any reconsidered PFDR rule should explicitly prohibit screen scraping and bank data providers should be afforded clearer guidance on third-party risk management practices under the PFDR rule that aligns with expectations of their prudential regulators.
• Data Privacy: The CFPB should maintain its secondary use limitations for third parties, but also provide clarity on the consumer consent and revocation process, as well as limit data aggregators’ access to and practices with consumer data.
• Compliance Dates: The CFPB is the only agency able to immediately delay the PFDR rule compliance dates, as they are imminently approaching. Data providers must make decisions and resource allocations now in anticipation of complying with the current PFDR rule, even though the CFPB intends to revise it. As such, CBA recommends the CFPB extend the compliance dates for the current PFDR rule a minimum of one year following finalization of any re-proposal, inclusive of a final resolution of the litigation regarding the rulemaking, or suspend the compliance dates altogether.

Dive Deeper

To read the full letter, click HERE.

CBA Advocacy

• On Aug. 21, 2025, CBA welcomed the Trump Administration’s CFPB’s decision to re-examine the Biden Administration’s Section 1033 rule.
• On July 24, 2025, trade associations representing fintech and digital asset companies sent a letter to President Trump urging him to uphold the PFDR rule. CBA, along with several bank trade associations, responded with a public statement to address the falsehoods contained in that letter. Those same institutions filed another letter on Aug. 14, 2025, which industry responded to, calling out their double standards.
• On July 15, 2025, CBA President and CEO Lindsey Johnson testified before the U.S. House Financial Services Committee hearing entitled “Dodd-Frank Turns 15: Lessons Learned and the Road Ahead.” In her written testimony, Johnson emphasized that “CBA would support the CFPB reproposing a Section 1033 rule that conforms to the confines of the statutory text set out by Congress…”
• CBA submitted a comment in response to an Office of Management and Budget Request for Information on Deregulation highlighting concerns over the PFDR rule, available HERE. 
• CBA, along with other industry trades, submitted a letter to the CFPB reemphasizing anticipated complications with the compliance dates in the NPRM on July 16, 2024. 
• CBA submitted comments on the NPRM on Dec. 29, 2023.
• In October 2023, CBA – along with 14 other trade associations – submitted a letter to the CFPB urging the agency to extend the comment deadline for the NPRM in light of the complexity of the issues. The CFPB failed to grant an extension.
• CBA submitted comments on the SBREFA Outline on Jan. 25, 2023.