Open banking (CFPB §1033 rule)

Section 1033 of the Dodd-Frank Act requires a covered person to make available to a consumer, on request, information about the financial product or service the consumer obtained — transactions, costs, charges. The CFPB's Personal Financial Data Rights rule, published in November 2024 as 12 CFR part 1033, turned that into an obligation for banks, credit unions and other providers to share account data with consumers and authorized third parties through secure interfaces, with compliance dates phased from 2026 to 2030 by institution size.

The rule has not settled. Banks challenged it in federal court in Kentucky; in August 2025 the CFPB opened a reconsideration covering who may act as a consumer's representative, whether providers may charge for access, data security and privacy. A court order pushed the compliance dates back, and as of September 2026 no replacement rule had been proposed. In practice, consumer-permissioned data keeps flowing through aggregators and bilateral agreements while the rule is rewritten.

For underwriting, account data changes the quality of the file: income and spending read from the source, with history, instead of declared. Thin-file applicants with an active checking account become visible. What bank data cannot show is how a person uses a vehicle, who they are connected to, or whether behavior changed outside the bank — the questions behavioral signal answers alongside it.