The Open Banking Rule Is Enjoined and Being Rewritten. The Fight Is Now About Fees.

The rule that would give Americans a legal right to move their bank data to another app is not in force. It has been enjoined since a federal court in the Eastern District of Kentucky barred the Consumer Financial Protection Bureau from enforcing it, and the Bureau is now rewriting it. In August 2026 a proposal titled 'Personal Financial Data Rights Reconsideration' went to the White House's Office of Information and Regulatory Affairs for review.

How it got here

• October 22, 2024: the CFPB releases the Personal Financial Data Rights final rule under Section 1033 of the Dodd-Frank Act, requiring data providers to make covered data available to consumers and authorised third parties in electronic form.
• August 22, 2025: the CFPB issues an Advance Notice of Proposed Rulemaking reopening four questions - the definition of 'representative' for making requests, how fees may be assessed, data security threats and costs, and privacy.
• April 1, 2026: the first compliance date under the original rule, applying to the largest depository institutions and certain large nondepository data providers.
• August 2026: a proposed reconsideration rule reaches OIRA. The appeal in the litigation is stayed while the Bureau revises the regulation.

What the court found

The Kentucky court concluded that the challengers were likely to succeed on claims that the rule exceeded the Bureau's authority and was arbitrary and capricious. That is a preliminary finding sufficient to support an injunction, not a final judgment on the merits.

The fee question

How the rule treats charges is the centre of the rewrite. Banks argue that Section 1033 itself does not prohibit reasonable cost recovery, and that maintaining secure APIs and the infrastructure behind third-party access is a substantial continuing expense. Data aggregators and the fintechs that rely on them, who pull the data on consumers' behalf, would be on the other side of that bill. PYMNTS reports the CFPB is weighing a middle position: allowing data providers to charge only after fulfilling a certain number of requests without charge.

Why it matters

Section 1033 governs the connection between a bank account and everything a consumer might plug into it: budgeting apps, lenders that underwrite on cash flow, payroll advances, account-to-account payments. Whether access is free, metered or charged per request becomes a cost of running those products, and where that cost lands shapes which of them remain viable to offer.