October 22, 2020
On October 22, 2020, the Consumer Financial Protection Bureau issued an Advance Notice of Proposed Rulemaking (ANPR) requesting information related to consumer access to financial records.
The Bureau issued the ANPR to solicit comments and information from the public to assist the Bureau in developing regulations to implement Section 1033 of the Dodd-Frank Act, which provides consumers access to their financial records.
Specifically, Section 1033 provides that, subject to rules prescribed by the Bureau, a consumer financial services provider must make available to a consumer information in the control or possession of the provider concerning the consumer financial product or service that the consumer obtained from the provider. This requirement includes information relating to any transaction, to any series of transactions, or to the account, including costs, charges, and usage data. Such information must be made available in an electronic form that is usable by consumers.
In the ANPR, the Bureau recognized that companies - including traditional financial institutions and non-bank financial technology (fintech) companies - increasingly access consumer data with consumers' authorization and provide services to consumers using data from the consumers' various financial accounts. This type of access to consumer financial records has benefits to both consumers and financial institutions; however, there are risks associated with consumers authorizing access to their financial records.
The ANPR seeks comments and information on ways that the Bureau might effectively and efficiently implement the financial record access rights described in Section 1033, recognizing that various market participants have helped authorized data access become more secure, effective, and subject to consumer control.
In the ANPR, the Bureau posed a series of questions seeking comments and information on topics, including costs and benefits of consumer data access, competitive incentives, standard-setting, access scope, consumer control and privacy, and data security and accuracy.
All comments are due within 90 days after the ANPR's publication in the Federal Register.