ICYMI from CBA’s Fritzsche: CFPB Could, And Should, Revise Open Banking Rulemaking

WASHINGTON, D.C. – Consumer Bankers Association (CBA) Vice President, Associate General Counsel Brian Fritzsche last week penned an op-ed in Law360 outlining industry concerns the Consumer Financial Protection Bureau (CFPB) should consider when finalizing its “Open Banking” rulemaking relating to Section 1033 of the Dodd-Frank Act later this year. As Fritzsche explains, the statutory authority of the CFPB’s current proposal is vague and relies on inaccurate rhetoric regarding the robust competition in the industry marketplace. You can read the full op-ed HERE or below.

Expert Analysis - Opinion: CFPB Could, And Should, Revise Open Banking Rulemaking

Law360

Brian Fritzsche

May 3, 2024

In the 1993 film "Jurassic Park," Dr. Ian Malcolm, played by Jeff Goldblum, remarks that the park's creators "were so preoccupied with whether or not they could that they didn't stop to think if they should."

Unlike the scientists in "Jurassic Park," the Consumer Financial Protection Bureau faces questions about both whether it could and whether it should use its notice of proposed rulemaking, announced in October 2023, on personal financial data rights implementing Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act to advance the principles of "open banking" in the U.S.

In light of continued global developments in open banking, such as Canada's annual federal budget announced in April stating that a framework legislation for open banking will be introduced soon, the treatment of open banking in the U.S. merits careful attention, particularly given the anticipated publication of the final Section 1033 rule this October.

First, let's turn to the "could." Under Section 1033, entities offering consumer financial products or services are required to "make available to a consumer, upon request, information in the control or possession of the covered person … including information relating to any transaction, series of transactions, or to the account including costs, charges and usage data." Such information is to "be made available in an electronic form usable by consumers."

It is not clear that these two sentences in Section 1033 — which is centered on making information available to consumers in an electronic form — grant the CFPB authority to pursue many of the ambitions found in the proposal, in which the CFPB has dictated the creation and attributes of an entire data access ecosystem for data holders, consumers, third parties and data aggregators in the name of facilitating open banking.

Nor is it clear that the language of Section 1033 grants the CFPB the authority to, among other things, limit the ability of participants in the ecosystem to recoup costs for the creation of new interfaces to facilitate the sharing of data. In other words, there is an open question as to whether the CFPB "could."

Now consider whether the CFPB "should." The CFPB asserts throughout the proposal that "commercial actors are able to use their market power and incumbency to privilege their concerns and interests above fair competition that could benefit consumers."

CFPB Director Rohit Chopra's remarks introducing the proposal magnify this inaccurate rhetoric, describing consumer finance markets as "structured in ways that don't allow consumers to exercise their power," and asserting that a Section 1033 rule "would help address many of the root causes of sticky banking — by giving people more power to walk away from bad service and enabling small community banks and nascent competitors to peel away customers through better products and services with more favorable rates."

At the Consumer Bankers Association's annual conference in March 2024, Chopra reiterated that "[t]he proposed rule would also allow consumers to more easily walk away from companies that offer bad terms and service, which itself creates a fresh incentive for companies to treat consumers well."

While industry largely supports the underlying principles of open banking and how it may enhance consumer experiences, the CFPB should avoid relying on inaccurate assertions about competition in the market to support its rulemaking efforts.

The U.S. has one of the largest, most diverse and most competitive financial industries in the world, especially compared to other advanced economies that have highly concentrated and coordinated banking markets, with roughly 4,000 competing daily for consumers' business.

This competitiveness is especially evident in the consumer credit card and deposit account markets, the two primary areas of focus of the proposal. Competitiveness has also been magnified by the growing share of nonbank participants. For example, a 2023 report found that nearly nine out of 10 people use some type of fintech app and that the average person uses three to four apps to manage their financial lives.

So "should" the CFPB? Perhaps, but it should not rely on mischaracterizations of already-competitive markets to support its required rulemaking objectives.

Even if the CFPB "could" and "should" use the language of Section 1033 to advance the principles of open banking, the actual proposal needs to be revised before finalization of the rule. For example, the CFPB needs to revisit the ability of data providers to recoup costs for creating and maintaining developer interfaces used by third parties and data aggregators. The CFPB severely underestimates the costs that will be associated with these developer interfaces, costs that will be borne exclusively by data providers.

Additionally, under the proposal as drafted, data aggregators are still permitted to charge fees to downstream parties, which are likely to be passed on to consumers, creating an anti-competitive windfall for data aggregators.

Moreover, Congress has historically been very clear when it wants fees to be treated in a certain manner and when it is empowering a regulator to set fees related to consumer finance. For example, the Credit Card Accountability Responsibility and Disclosure Act amended the Truth in Lending Act to, among other things, outline requirements related to late fees and prohibit certain types of fees, such as double-cycle billing and penalties for on-time payments. Section 1033 contains no comparable language.

To be clear, the recoupment of costs should be tied to the parties accessing the developer interface, which would not be consumers. The recoupment can be targeted to be borne by the third parties and data aggregators most benefiting from these interfaces.

For example, a fee schedule could be targeted based on data usage, which would ensure that third parties accessing the most covered data carry the largest share of the third-party contribution to the development of the data access ecosystem. This approach would also encourage data minimization by incentivizing third parties and data aggregators to only request — and pay to access — the data they need.

Although the implementation of Section 1033 will affect life in a different way than the resurrection of dinosaurs in "Jurassic Park," before finalizing a rule, the CFPB should reexamine the particulars of the proposal and, unlike the founders of the ill-fated eponymous dinosaur park, evaluate whether it could and whether it should, and which aspects of the proposal require thoughtful reconsideration following the comments provided by industry.