Letter to the CFPB on the Advanced Notice of Proposed Rulemaking re: Personal Financial Data Rights Reconsideration

Dear Acting Director Vought,

The American Bankers Association (ABA) appreciates the opportunity to respond to the Consumer Financial Protection Bureau's (CFPB or Bureau)'s Advance Notice of Proposed Rulemaking (ANPR) on Personal Financial Data Rights (PFDR or Section 1033) Reconsideration published in the Federal Register on August 22, 2025. ABA and our members have expressed significant concerns with several aspects of the current regulation and we are grateful that new CFPB leadership recognizes the need to make substantial revisions thereto.

The Bureau specifically requested feedback on the following issues: 1) the proper understanding of who can serve as a "representative" making a request to access data on behalf of the consumer; 2) the optimal approach to the assessment of fees incurred by a "covered person" in responding to a customer driven request; 3) the threat and cost-benefit picture for data security associated with Section 1033 compliance; and 4) the threat picture for data privacy associated with Section 1033 compliance. The CFPB also inquired about appropriate compliance dates.

In addition to the areas specifically solicited, ABA is providing feedback on other aspects of the existing PFDR rule (codified at 12 CFR 1033), including pay-by-bank , industry standard-setting, and other matters of vital importance to our members.

The November 2024 PFDR rule was overbroad and built on a dubious legal foundation, ultimately picking winners (fintechs and data aggregators) and losers (banks and consumers) in the process. The rule simply cannot stand, either as a matter of jurisprudence or policy. In order to help the CFPB with its crucial goal of fixing the PFDR rule in its re-proposal, ABA makes a number of recommendations throughout this letter.

Before launching into our substantive response, we wish to emphasize at the outset the urgency for the CFPB to take formal action to suspend the compliance dates of the November 2024 PFDR rule immediately. According to the effective version of the PFDR rule finalized in November 2024, the first tranche of compliance dates for banks that hold at least $250 billion in total assets is April 1, 2026 (although the Eastern District of Kentucky tolled this, and other compliance tiers, for a total of 90 days each during the now-stayed Forcht Bank litigation against the CFPB). The CFPB has clearly stated its intention to revisit and revise the severely flawed 2024 PFDR rule, both in the aforementioned litigation and as evidenced by this ANPR.

This letter will go into greater detail regarding the appropriate compliance dates in Section VIII, but those dates will be for the amended PFDR final rule. Significant back-office work, costing time and resources (both in material and personnel), is currently being devoted to building a compliance regime for the November 2024 PFDR rule.

Download the comment letter to read the full text.