CFPB Moves to Vacate Its Own Open Banking Rule, Citing Legal Deficiencies and Overreach

On May 30, 2025, the Consumer Financial Protection Bureau (CFPB) took the rare step of asking the US District Court for the Eastern District of Kentucky to vacate the CFPB’s own final rule implementing Section 1033 of the Dodd-Frank Act.

The CFPB’s request, filed in a motion for summary judgment in ongoing litigation brought by a number of banking industry groups and a Kentucky bank, represents a reversal in the agency’s approach to “open banking” but is consistent with the Trump administration’s efforts to move away from Biden-era policies.

Background: The rule and the legal challenge

On October 22, 2024, the CFPB released its long-awaited final rule implementing Section 1033 of the Consumer Financial Protection Act (CFPA) concerning personal financial data rights. 

The final “open banking” rule sought to operationalize Section 1033 by requiring that certain financial institutions, card issuers and other payment facilitation providers make consumer data – including transaction data – more readily available to consumers and authorized third parties. It also placed consumer protection obligations on these entities, as well as on third parties authorized to collect and use that data.

Banking industry trade groups and a Kentucky community bank challenged the rule in court almost immediately, arguing that the CFPB exceeded its statutory authority and imposed arbitrary, burdensome requirements on financial institutions in its efforts to regulate “open banking.” In February 2025, following the change in administration, the plaintiffs and the CFPB filed a joint motion to stay proceedings while the CFPB reviewed its position on the rule. Shortly thereafter, a fintech trade group filed a motion to intervene, due to the uncertainty as to whether the CFPB would continue to defend its own rule in court, and the court granted the request.

The CFPB’s motion for summary judgment: A reversal

The CFPB’s motion asks the court to find the rule unlawful under the Administrative Procedure Act (APA) and vacate it in its entirety. The CFPB raises four arguments in support of its position:

1. The rule exceeds the CFPB’s authority

The CFPB contends that the rule exceeds its statutory authority because Section 1033 grants consumers the right to access their own data; it does not enable broad data sharing with third parties as mandated by the rule. By requiring banks to provide data to “authorized third parties,” and not just to “consumers,” the CFPB argued the rule improperly stretches the definition of “consumer” and goes beyond the language of the statute.

2. Unlawful fee prohibition

The CFPB asserts that the rule unlawfully prohibits data providers from charging fees for consumer data access. According to the CFPB, this prohibition lacks statutory support as Section 1033 is silent on fees. The CFPB further argues the fee ban is arbitrary and capricious because the CFPB offered only conclusory reasoning that any fee would impede consumers’ rights to access their data.

3. Risks to consumer data

The CFPB criticizes the handling of data privacy and security under the rule, stating that the CFPB failed to account for the cumulative risks posed by requiring disclosure of sensitive financial information. The rule permits third parties to delegate access to other entities and does not prohibit “screen scraping,” a practice the CFPB itself had acknowledged as risky. The CFPB also stated that the rule establishes a “lax” system for assessing and verifying the security practices of authorized third parties.

4. Arbitrary compliance deadlines

The CFPB also takes aim at the rule’s tiered compliance deadlines, arguing that the deadlines are not tied to the development or availability of consensus industry standards. The motion asserts that the deadlines effectively require banks to adhere to compliance requirements that do not yet exist – rendering the deadlines arbitrary and capricious.

The CFPB requested that the rule be vacated in its entirety, asserting that the unlawful portions are not severable because references to “third parties” and “authorized third parties” permeate it.

What’s next?

The CFPB’s retreat from the open banking rule is the latest in a growing list of actions that reflect a significant recalibration of the agency’s rulemaking and policymaking posture. The CFPB has increasingly emphasized restraint in rulemaking and a reduction in supervisory activities as part of a “slimmed-down” agency, showcased most recently by the CFPB’s withdrawal of almost seventy nonbinding guidance documents and its recent statement asserting a narrower role for state enforcement of federal law.

Despite the CFPB’s position on the rule, it remains statutorily required under Section 1033 to issue rules to effectuate consumer access to data and to “prescribe standards … to promote the development and use of standardized formats for information.^"1 The CFPB has not provided details on whether and how it would replace the previously finalized rule. In the meantime, the court has yet to rule on the CFPB’s motion as it awaits a filing from the intervenors due in June.

We will closely monitor this litigation and subsequent CFPB action for insights into how the CFPB intends to navigate its statutory mandate in an evolving legal and political landscape.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction, and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may have been generated with the assistance of artificial intelligence (AI) in accordance with our AI Principles, may be considered Attorney Advertising and is subject to our legal notices.