Federal: AFC Comment Letter on Personal Financial Data Rights ANPR

The Honorable Russell Vought
Acting Director
Consumer Financial Protection Bureau
1700 G Street NW,
Washington, DC 20552

Re: Advance Notice of Proposed Rulemaking on Personal Financial Data Rights Reconsideration—Docket No. CFPB-2025-0037

Dear Acting Director Vought,

On behalf of The American Fintech Council (AFC),  I am submitting this comment letter in response to the Consumer Financial Protection Bureau’s (CFPB or the Bureau) Advance Notice of Proposed Rulemaking on Personal Financial Data Rights Reconsideration—Docket No. CFPB-2025-0037 (ANPR).

AFC’s mission is to promote an innovative, transparent, inclusive, and customer-centric financial system by fostering responsible innovation in financial services and encouraging sound public policy. AFC members are at the forefront of fostering competition in consumer finance and pioneering ways to better serve underserved consumer segments and geographies. Our members are also improving access to financial services and increasing overall competition in the financial services industry by supporting the responsible growth of lending and lowering the cost of financial transactions, allowing them to help meet demand for high-quality, affordable financial products. Specifically, our membership differs from the other trade associations in this space, as we represent a significant number of both innovative banks and fintech companies. By having such a diverse membership in the open banking ecosystem, AFC is uniquely qualified to discuss open banking issues that may impact banks and fintech companies individually, as well as jointly.

AFC respects the Bureau’s decision to reconsider the previously issued final rule on Personal Financial Data Rights (Final Rule),  as we recognize that several aspects of the Final Rule needed reform, namely the limitations associated with the secondary use of data and annual reauthorization requirements. However, we strongly believe that it is crucial for the CFPB to preserve the rights of consumers, and those companies acting on their behalf to access the data and maintain the existing prohibition upon charging fees for access to consumer data.

Simply put, through prudent reconsideration of the Final Rule, the Bureau has the distinct opportunity to ensure that the U.S. financial services industry remains the envy of the world and that innovative banks, fintech companies, and digital assets providers can thrive. As will be detailed further below, by preserving the rights to access and prohibition on charging fees for that access, as well as pursuing the aforementioned pragmatic reforms, the CFPB will be able help the Trump Administration fulfil its innovation agenda and foster a robust open banking market for innovators in traditional financial services and digital assets.  It is in service of this mission that AFC respectfully offers the below comments for the Bureau’s consideration as it works through its personal financial data rights rulemaking process.

I. To remain Faithful to the Strict Interpretation of the Dodd-Frank Act, AFC Respectfully Recommends the CFPB Preserve the Final Rule’s Prohibition on Fees for Access to Consumers’ Data

To ensure a robust open banking ecosystem in the United States, the CFPB must strictly adhere to the statutory language and congressional of Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). Specifically, within Section 1033 of the Dodd-Frank Act, it states that “a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person”.  In this context, the use of the phrase “shall make available” constitutes an absolute demand upon the “covered entity” (i.e. the banks, under the Final Rule) to provide the data to the consumer, free from impingement. Further, in so crafting the language of Section 1033 of the Dodd-Frank Act without caveat or qualification regarding financial institutions’ abilities to charge fees for granting access to the data, the Congress implicitly reiterated the absolute quality of its statement that consumers have access to their data in an unimpeded manner from financial institutions.

Relatedly, the Dodd-Frank Act, defines “consumer” as “an individual or an agent, trustee, or representative acting on behalf of an individual”.  Per the definition, in the context of Section 1033, a “representative acting on behalf of an individual” would not experience a fundamental distinction as it relates to the right to receive consumers’ data in an unimpeded manner. To that end, AFC believes that the Final Rule maintains a proper interpretation of the statute when broadly prohibiting fees from financial institutions to consumers, including those who use representatives, who, in practice are generally fintech companies, to obtain access to their data.

Further, within the ANPR, the Bureau poses questions regarding if a representative should be interpreted as “an entity with fiduciary duties”.  Based on a holistic reading of the “consumer” definition in the Dodd-Frank Act and a plain-language understanding of the terms used therein, there is nothing to suggest that the Congress intended to ascribe fiduciary duties upon a representative acting on behalf of an individual. Bringing this issue from the theoretical to the practical, if the Bureau were to ascribe fiduciary duties to representatives acting on behalf of the individual, it would severely inhibit the viability of a robust open banking market, because individual consumers would be required to manually download and re-upload their data, a cumbersome and insecure process that would hinder access to competitive financial tools. In turn, this action would inhibit the free-flowing and efficient movement of data that underpins the open banking ecosystem and thus curtail the innovation that the Trump Administration seeks to encourage through its agenda.

As noted above, AFC’s diverse membership of innovative banks and fintech companies affords us a unique understanding of the practical implications of the Bureau maintaining a strict interpretation, in accordance with the Final Rule, regarding the prohibition of fees by financial institutions for access to the data. AFC recognizes that there are costs associated with establishing the infrastructure needed to make consumer data available to them in a secure and easily accessible manner. We are not diminishing the costs that our innovative bank members and other financial institutions face. However, given that our bank members are focused on being innovative, the specific infrastructure costs function as part of that broader innovation strategy and are necessary for remaining viable in the modern banking ecosystem.

In addition, these strategic costs create an improved open banking ecosystem for both industry and consumers and allows for a market focused on continued innovation for the benefit of consumers. For example, innovative banks and fintech companies have invested heavily in developing a modern API infrastructure. AFC recognizes that early open banking efforts leveraged less secure methods of data collection, such as “screen scraping.” However, due to the significant investment of responsible innovators, fintech companies have now developed robust API infrastructure that ensures data is collected in a safe and secure manner. AFC strongly aligns with these market movements by proactively advocating for a continued transition to modern APIs that have enhanced data security and consumer protections. This effort and other investments in the infrastructure that underpins the open banking infrastructure provide an overall improvement to the financial services industry for large and small financial institutions alike, as well as fintech companies—all in the service of improving the customer experience.

To promulgate a rule that would reinterpret the fee prohibition would undercut the strategic work conducted by these innovative banks and would unduly favor the large legacy financial institutions who opted to avoid innovating. In turn, this would continue to unfairly advantage these institutions at the cost of the innovative banks and fintech companies. Thus, inhibiting the Trump Administration’s focus on encouraging innovation in financial services.

Due to the importance of maintaining a strict interpretation of Section 1033 of the Dodd-Frank Act and ensuring that innovative banks and fintech companies are not unfairly disadvantaged in the market, AFC respectfully recommends that the Bureau preserve the Final Rule’s prohibitions on financial institutions’ ability to charge fees for access to consumer data.

II. AFC Respectfully Recommends the Bureau Reconsider the Limitations to the Secondary Use of Consumers’ Data Promulgated by the Final Rule

Though outside the specific questions posed in the ANPR, AFC recognizes the importance of the Bureau reviewing all aspects of the Final Rule that may inhibit the open banking ecosystem and harm innovation in financial services. To that end, the issue of how innovative banks and fintech companies may or may not leverage consumer data for “secondary uses” remains an issue of critical importance for ensuring that the U.S. open banking ecosystem remains strong. Under the Final Rule, the CFPB pursued provisions that significantly limited the use of consumer data for legitimate business purposes, namely the use of consumer data for cross-selling products and for targeted advertising.  As written, these provisions stymie the ability for financial products and services to sustainably grow and innovate. Further, the provisions limit the ability for consumers to make responsible decisions about the consumer financial products and services they chose to use, particularly in areas that have been traditionally underserved. AFC agrees with the importance of creating a robust disclosure regime to ensure that consumers remain aware of how the data they provide to financial services providers is being used and stored. However, AFC believes that the Bureau’s existing regulatory regime in the Final Rule regarding the secondary use of data could severely inhibit innovation and competition in the financial services industry, ultimately to the detriment of consumers.

In the context of modern data collection and usage practices, customers are offered significant benefits, such as the ability to access affordable loans and other banking services not previously available to them. Innovative fintech companies are able to offer these products responsibly to consumers by leveraging the consumer-provided data collected on the fintech company’s platform. For example, AFC members leverage anonymized consumer data to help develop and train algorithms that more accurately underwrite consumers than traditional models. In virtue of the increased accuracy found in these models, these companies are able to provide much needed loans at responsible rates to individuals that have been traditionally excluded from access to financial services due to the inefficient and ineffective modeling techniques of the past. Ultimately, this could lead to negative outcomes for both innovative financial services products, as well as consumers in general. For example, a consumer may permit the use of their data to determine their eligibility for a personal loan. As a result of the existing limitations in the Final Rule, responsible innovators find it difficult to develop the new and more accurate models described to continue operating in the financial services industry. Therefore, AFC respectfully requests that the CFPB remove the limitations to the secondary use of data for cross-selling products and targeted advertising under its reconsideration of the Final Rule.

III. AFC Respectfully Recommends the CFPB Reconsider the Final Rule’s Provisions on Annual Consumer Reauthorizations

As written, the Final Rule’s provisions regarding the maximum duration and reauthorization requirements present the need for additional nuance in order to ensure the most effective outcome for consumers and the usability of the financial products and services with which they engage.  Specifically, the Final Rule’s provision of a 12-month mandatory reauthorization window partially achieves adequate consumer protection without introducing undue friction into the user journey, but AFC recommends that the while the Bureau is reconsidering the Final Rule, it should clearly provide that any instance in which a consumer refreshes their data, including a refresh authorized by the consumer as part of an active membership or ongoing service that specifically contemplates a recurring refresh (e.g. self-contributing tradelines to a credit file), or facilitates a payment with an authorized third party constitutes a new authorization for the purpose of restarting the 12-month reauthorization window.

Also, the Final Rule’s requirement of “affirmative” or “opt-in” annual reauthorization can negatively impact consumers. For example, some covered financial products and services may use data solely for the purpose of benefiting consumers. Services that solely pull positive data from a Data Provider in order to improve a person’s credit score or provide additional positive information on their credit reports. In practice, these services should and do require a consumer to initially opt-into the service. Further, once consumers are enrolled, they receive periodic updates about the benefits they are receiving from receiving the services. Consumers enrolled in these types of services can “set and forget” their participation in the service, and still benefit from it. If a consumer opts into this type of service, then it seems that requiring a 12-month mandatory reauthorization through affirmative engagement with the consumer seems to introduce unnecessary frictions that could ultimately expel consumers from this beneficial service without their knowledge. To this end, AFC recommends that as the Bureau reconsiders the provisions of the Final Rule, that it develops an exemption for the mandatory reauthorization provisions in the Final Rule for data collected for use in products or services that are solely for the purpose of benefiting consumers.

IV. AFC Respectfully Recommends the CFPB Considers Developing a Risk-Based Liability Framework for the Open Banking Ecosystem

As the CFPB continues to reconsider the personal financial data rights issue, it is important for the Bureau to review how liability is assessed within the open banking ecosystem. Crucially, each entity operating within the open banking ecosystem presents differing levels of engagement with consumer data. While some data recipients collect and store data, others simply function as a conduit for the data. In practice, these differing activities have an impact on the risk profiles associated with the entities involved in the ecosystem. Liability structures have an inherent impact on the ability for entities to innovate. Much of the Trump Administration’s innovation agenda efforts rely on regulatory and liability regimes that do not overly burden entities based on their level of engagement and types of innovative activities. The open banking ecosystem is no different in this regard. Therefore, to help develop an appropriate liability structure for the open banking ecosystem that encourages responsible innovation, AFC respectfully recommends that the CFPB consider developing a risk-based liability framework for the open banking ecosystem.

* * *

AFC appreciates the opportunity to comment the Consumer Financial Protection Bureau’s Advance Notice of Proposed Rulemaking on Personal Financial Data Rights Reconsideration. While we respect the decision of the Bureau to reconsider the Final Rule, in an effort to look beyond the existing limitations of the Final Rule and discussions within the ANPR, we also encourage the CFPB to continue its efforts in open banking by engaging in future rulemakings to expand the scope of the existing personal financial data rights regulatory structure beyond what was discussed in the Final Rule. We welcome continued engagement on this matter and thank you for your consideration of our views.

Sincerely,

Ian P. Moloney

SVP, Head of Policy and Regulatory Affairs
American Fintech Council

‍

[1] American Fintech Council’s (AFC) membership spans EWA providers, lenders, banks, payments providers, loan servicers, credit bureaus, and personal financial management companies.
[2] Consumer Financial Protection Bureau, “Advance Notice of Proposed Rulemaking on Personal Financial Data Rights Reconsideration”, Fed. Reg. 90, no. 161 (Aug. 22, 2025): 40986.
[3]Consumer Financial Protection Bureau, “Required Rulemaking on Personal Financial Data Rights”, Fed. Reg. 89, no. 222 (Nov. 18, 2024): 900838.
[4]See, The White House, “Technology & Innovation,” accessed: Oct. 4, 2025, available at https://www.whitehouse.gov/issues/tech-innovation/ and The White House. Winning the Race: America's AI Action Plan. Washington, D.C.: The White House, July 2025 available at. https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf.
[5] Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 1033, 124 Stat. 1376, 2008 (2010).
[6]Ibid., § 1002(4).
[7] Ibid., Advance Notice of Proposed Rulemaking
[8] Ibid., Required Rulemaking on Personal Financial Data Rights § 1033.421.
[9] Ibid.
‍