The Consumer Financial Protection Bureau (CBFB) has issued its long-awaited final rule on open banking — with a major tweak. 

The rule would require financial institutions, credit card issuers and other firms to transfer personal financial data to other providers for free at the consumer’s request. But while last year’s proposal applied to data linked to bank accounts, credit cards and mobile wallets, the final rule applies to payment apps, too. 

Rules surrounding the transfer of financial data, such as transaction records and information needed to initiate payments, are meant to ensure consumers maintain control of their banking history if they switch from one financial institution to another. 

The CFPB asserts the increased freedom of movement will boost competition by helping consumers comparison-shop to earn higher interest on deposits or get loans with lower interest rates. That, in turn, will jolt providers into offering better products, the agency argued. 

The rule also may help users with shorter credit histories obtain credit by allowing lenders to access income- and expense-related data held on other platforms, the CFPB said. The framework also may boost security of “pay-by-bank” transactions, the agency said. 

Under the rule, third parties can only collect, use or retain data to deliver the product the consumer requested, the CFPB said. That means they can’t secretly use or keep consumers’ data for unrelated business reasons – marking a pivot away from some of the consequences generated by screen scraping. 

The rule permits third parties to engage some secondary uses of consumer-authorized data, such as those to improve the requested product or service. 

There would be a time limit on data access. Financial providers can maintain access for no more than a year without express reauthorization. Consumers can revoke access, also – with immediate effect. 

In another change from the proposed rule, the CFPB is delaying the compliance timeline for the rule by 10 months, compared with initial estimates. Compliance will be phased in gradually, with the largest institutions due to comply by April 1, 2026, and the smallest by April 1, 2030. 

Banks and credit unions with less than $850 million in assets will be exempt, but nondepository entities of any size must comply. 

Banking trade groups decried the rule saying the CFPB is exceeding its statutory authority and didn’t incorporate industry feedback from the public comment period which has resulted in “an even less durable final rule that does not reflect market, technological, and practical realities.”