The Consumer Financial Protection Bureau (CFPB) has submitted its rewritten open banking proposal to the White House's Office of Information and Regulatory Affairs (OIRA), American Banker reported, the final procedural step before the Bureau can release it publicly. The rule isn't public yet, but the submission itself signals that anoverhaul of Section 1033 is imminent.
That's a genuinely significant milestone, not because of any single provision in the rule, but because of how long it's taken to get here, and what the market has done in the meantime while Washington worked through it.
The CFPB finalized its original Personal Financial Data Rights rule in October 2024, with compliance staged to begin in April 2026 for the largest institutions. Needless to say, it never got that far. In response to litigation, a federal court blocked the CFPB from enforcing it while the Bureau reconsidered the rule. As one commentator summarized it, the rule has been “paused, contested, and being rewritten, but the direction of travel remains clear,” a description that's held up for the better part of two years.
Last August's advance notice of proposed rulemaking, seeking input on the scope of the new rule, drew close to 14,000 comments, a genuine measure of how much is riding on the outcome for banks, aggregators, and consumers alike.
Two years of federal limbo hasn't meant two years of no action elsewhere. New York's Assembly Bill 10640, introduced in March 2026, would establish state-level financial data rights broadly consistent with the federal framework but going further in scope and penalty structure. It's still in committee, but it's a preview of what happens across more states the longer federal rulemaking stays unsettled: a market that converges on one national standard if Washington moves, or fragments state by state if it doesn't.
None of this is really about what's in the rule's text, which still isn't public. It's about what a cleared OIRA review represents: a concrete signal that the CFPB really is moving forward with a 1033 proposal, rather than remain the kind of permanent limbo that's made both banks and third-party providers hesitant to build for a rulebook that might change again.
A proposed rule should be the signal for market participants in the US to start building in earnest. Invela expects the proposal to remove any ambiguity over whether 1033 is happening, giving banks certainty that 1033 does, in fact, apply to third party data sharing.
That doesn't mean Washington needs to solve every open finance problem directly. Invela's own position in its CFPB comment letters has been that government doesn't need to legislate liability and risk management in detail, that's exactly the kind of infrastructure the industry itself is built to provide, but the Bureau does need to remove the ambiguity over whether 1033 applies at all to get the rest of the market moving again. It's also worth being honest that this doesn't guarantee the legal fight is over: whatever the CFPB proposes could still face further challenges, and there's no strong reason to assume this round is immune to the kind of relitigation that shaped the last one.
None of that is a reason to wait for final text before acting. If the applicability question was never seriously in doubt, the practical work in front of banks doesn't change, it just loses its excuse for waiting. That means dusting off the API build plans that got shelved when the original rule was enjoined, rather than starting from zero once the rule is final. It means getting ahead of the third-party risk management and liability allocation questions a live data-sharing mandate raises, instead of treating those as problems to solve later.
Some of the largest banks already have infrastructure in reasonably good shape. The bigger question is the large regionals and mid-sized institutions still sitting on the sidelines, waiting for clarity on a point that was never seriously in question. An OIRA-cleared proposal is the moment to stop waiting and start building.
See how the Invela Network applies standardized accreditation and continuous risk monitoring, so banks rebuilding their open finance infrastructure now don't have to solve third-party risk and liability allocation from scratch.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place. Open finance, covered.
-p-2000.jpg)
