Navigating the CFPB Section 1033 Open Banking Rule: A Guide for US Merchants

The landscape of American consumer finance is undergoing a fundamental shift. At the heart of this transformation is Section 1033 of the Dodd-Frank Act, the statutory foundation for what is commonly known as "open banking." While the concept of sharing financial data has existed for decades, the Consumer Financial Protection Bureau (CFPB) is currently working to codify these practices into a formal regulatory framework. For US merchants, particularly those operating in the fintech, e-commerce, and lending sectors, understanding the nuances of Section 1033 is no longer optional—it is a strategic necessity.

Understanding Section 1033 and the Open Banking Shift

Open banking is the practice of sharing customer financial data between banks and third-party providers (TPPs) via secure channels, typically Application Programming Interfaces (APIs). As noted by industry leaders, this process requires explicit customer consent and aims to save businesses time on tasks such as processing financial data and developing targeted financial products Open Banking Regulation Explained.

Section 1033 specifically directs the CFPB to prescribe rules that promote the development and use of standardized formats for information sharing Required Rulemaking on Personal Financial Data Rights. The goal is to move the industry away from legacy methods like "screen scraping"—where third parties use consumer credentials to log into accounts and scrape data—toward a more secure, API-driven ecosystem. This transition is intended to bolster market-driven efforts by mandating consistent data sharing for financial services providers across the industry Technical Guide to CFPB Section 1033 - Ozone API.

The Current Legal Status: Enjoined and Under Reconsideration

Merchants must be aware that the regulatory path for Section 1033 has been volatile. The CFPB finalized its initial Personal Financial Data Rights rule in October 2024, with a phased compliance schedule originally set to begin on April 1, 2026, for the largest depository institutions Cozen O’Connor: Section 1033 Compliance Date: Open Banking Rule Enjoined and Under Reconsideration.

However, as of mid-2026, the rule is not currently in force. A federal court has enjoined the CFPB from enforcing the rule, and the Bureau is now in the process of rewriting it Section 1033 Status & Timeline (2026): Is the Open Banking Rule in Effect?. The CFPB issued a motion to stay in July 2025, citing marketplace events and a decision to reconsider certain aspects of the rulemaking CFPB Section 1033 Open Banking Rule Stayed as CFPB Initiates New Rulemaking. A new Notice of Proposed Rulemaking (NPRM) was anticipated for July 2026, signaling that the final requirements are still in flux CFPB Releases 2026 Regulatory Agenda Detailing Planned Rulemakings.

Key Compliance Pillars and Merchant Impact

Despite the current legal stay, the core objectives of the CFPB remain clear. Merchants who rely on aggregating, storing, or analyzing user financial data will eventually face new requirements in several key areas:

1. API Standards and Technical Implementation

The creation of open banking ecosystems is inextricably linked to standardized APIs. The CFPB has recognized the need for consensus-based industry standards, specifically highlighting the Financial Data Exchange (FDX) as a primary standard-setting body Technical Guide to CFPB Section 1033 - Ozone API. Merchants will likely need to ensure their technical stacks align with these emerging API specifications to maintain access to consumer data.

2. Data Security and Privacy

Regulators are increasingly treating cybersecurity as a core compliance issue. The Section 1033 rule is expected to set boundaries around data use, retention, and third-party sharing 2026 Fintech Regulation Guide for Startups. The CFPB is currently exploring whether current protections are sufficient and how the costs of establishing secure information architecture scale with institution size CFPB Releases New Advance Notice of Proposed Rulemaking on Section 1033 Open Banking Rule.

3. The Fee Debate

One of the most contentious aspects of the original rule was the prohibition on data providers charging fees for providing required data access. The CFPB is now reconsidering this stance, seeking input on potential cost-sharing mechanisms and whether covered persons should be allowed to recover costs for establishing and maintaining interfaces CFPB Releases New Advance Notice of Proposed Rulemaking on Section 1033 Open Banking Rule. For merchants, this could mean a shift from free data access to a model involving variable costs.

What Merchants Should Do

While the final rule is being rewritten, merchants should take proactive steps to prepare for the eventual implementation of Section 1033:

• Audit Data Dependencies: Identify all products or services that rely on third-party financial data. Determine if these connections currently use screen scraping or API-based integrations.
• Review Vendor Relationships: Engage with data aggregators (such as Plaid or Ozone API) to understand their roadmap for Section 1033 compliance and their alignment with FDX standards Open finance - Secure open banking APIs & data sharing - Plaid.
• Enhance Consent Management: Prepare to implement clear consumer disclosures and robust consent management workflows. The rule will likely require third parties to obtain express informed consent and limit data collection to what is strictly necessary 2026 Fintech Regulation Guide for Startups.
• Monitor Regulatory Updates: Stay informed on the CFPB's 2026 regulatory agenda. The upcoming NPRM will likely provide revised deadlines and updated requirements regarding data access fees and security standards CFPB Releases 2026 Regulatory Agenda Detailing Planned Rulemakings.

ONKORE Perspective

At ONKORE, we view the Section 1033 rulemaking not just as a compliance hurdle, but as a catalyst for innovation. The shift toward standardized APIs and secure data sharing will ultimately lower the barrier to entry for new fintech products and provide merchants with more reliable, real-time insights into consumer behavior. However, the current period of "regulatory limbo" requires a balanced approach. Merchants must build for flexibility, ensuring their data architecture can adapt to the final standards while remaining vigilant about the evolving debate over data access fees. By prioritizing transparency and security now, merchants can turn regulatory compliance into a competitive advantage in the burgeoning open finance economy.

In conclusion, while the April 2026 deadline has passed without binding enforcement, the momentum toward open banking in the US is irreversible. Merchants who use this time to modernize their data practices and align with industry standards like FDX will be best positioned to thrive when the CFPB's revised rule finally takes effect.