Washington, D.C. — The Clearing House Association and Bank Policy Institute (BPI) and submitted recommendations to the Consumer Financial Protection Bureau (CFPB) on Friday in response to a proposed rule establishing how banks, data aggregators and other third parties can safely share consumer financial data. The rule seeks to discourage unsafe practices such as screen scraping and give consumers more control over how, with whom and for what purpose their data is shared. The Associations argue that the proposal does not go far enough in protecting sensitive consumer financial data or requiring data recipients to comply with these rules.

“Our members welcome the competition brought about by innovative financial technology firms and are prepared to support the ability of bank customers to connect their bank accounts to the third-party apps of their choice, but such competition cannot come at the expense of data security,” the Associations wrote in their letter. “It is critical that consumers’ personal and financial information remains secure when it is shared between financial institutions and third parties and when it is stored outside of the financial institution.”

The Associations call on the CFPB to take the following actions to strengthen its proposal:

• Strengthen consumer protections: Many of the requirements in the proposed rule designed to protect consumers and their data, such as the requirements related to consumer authorization and the permissible uses of consumer data, should apply to all third parties and data aggregators in the ecosystem, and to all data.
• Ban screen scraping: Screen scraping should be prohibited once a data provider has made a developer interface available.
• Set unambiguous regulatory requirements and supervise for compliance: The CFPB should impose direct requirements on authorized third parties and data aggregators and articulate its intent to supervise those entities for compliance.
• Clearly define liability: Aggregators and other data recipients should be liable for unauthorized transactions or failing to protect consumer data once data is within their possession.
• Customers must explicitly authorize how their data is accessed and used: The proposal would require third parties to obtain consumer authorization before accessing their data. Data providers must have the right to obtain their own consumer authorizations before sharing consumer data with an authorized third party or data aggregator.
• Permit data provider compensation: Data providers should be allowed to receive compensation from third parties to recover their commercially reasonable costs and a margin to cover the cost of enabling data sharing. By prohibiting only data providers from charging fees, the proposed rule arbitrarily distorts the marketplace and creates an unfair allocation of benefits to data aggregators and an unrecoupable cost to data providers.
• Recognize the utility of standard-setting bodies: The final rule should continue to recognize that a standard-setting body is best positioned to develop a standardized format for data sharing. The final rule should extend to the CFPB’s expectations with respect to the use of standard data formats by data aggregators to ensure efficiencies and support competition.

The current rulemaking process began in October 2016 with a request for information and, most recently, the CFPB issued the formal proposal in October 2023. While the rulemaking is often labeled as necessary to facilitate “open banking,” in the United States, the financial services industry has already enabled millions of consumers to share their data safely and securely. The current proposal, if strengthened as we suggest, would help ensure that consumers and their data remain safe and secure regardless of whether it is accessed or held by banks or nonbanks.

The CFPB will review comments on the proposal and is expected to issue a final rule in 2024.

##

The Bank Policy Institute (BPI) is a nonpartisan public policy, research and advocacy group, representing the nation’s leading banks and their customers. Our members include universal banks, regional banks and the major foreign banks doing business in the United States. Collectively, they employ almost 2 million Americans, make nearly half of the nation’s small business loans, and are an engine for financial innovation and economic growth.

The Clearing House Association, L.L.C., the country’s oldest banking trade association, is a nonpartisan organization that provides informed advocacy and thought leadership on critical payments-related issues.  Its sister company, The Clearing House Payments Company L.L.C. owns and operates core payments system infrastructure in the United States, clearing and settling more than $2 trillion each day. See The Clearing House’s website at www.theclearinghouse.org.