CFPB Summary: Advanced Notice of Proposed Rulemaking re: Consumer Access to Financial Records
12 CFR Chapter X
Prepared by the Legislative & Regulatory Affairs Division
November 2020
Section 1033 of Dodd Frank provides that subject to rules prescribed by the Consumer Financial Protection Bureau (CFPB), a consumer financial services provider must make available to a consumer information in the control or possession of the provider concerning the consumer financial product/service that the consumer obtained from the provider. The Bureau is issuing this ANPR to solicit comments and information to assist the Bureau in developing regulations to implement Section 1033.
Comments must be received by February 4, 2021. The ANPR can be found here.
Summary
The Bureau is issuing this ANPR to solicit stakeholder input on ways that the Bureau might effectively and efficiently implement the financial record access rights described in Section 1033, recognizing that various market participants have helped authorized data access become more secure, effective, and subject to consumer control. The Bureau is also seeking information regarding the possible scope of data that might be made subject to protected access, as well as information that might bear on other terms of access, such as those relating to security, privacy, effective consumer control over access and accessed data, and accountability for data errors and unauthorized access. The Bureau is also interested in comment on whether and how issues of potential regulatory uncertainty with respect to Section 1033 and its interaction with other statutes within the Bureau’s jurisdiction, such as the Fair Credit Reporting Act, may be impacting this market to the potential detriment of consumers, and seeks information that may help resolve such uncertainty. The Bureau invites comment on all aspects of this ANPR from all interested parties, including consumers, consumer advocacy groups and other members of the public.
The ANPR is divided into five sections:
- Section I summarizes the Dodd-Frank Act’s description of consumer rights to access financial records
- Section II provides defined terms for the ANPR
- Section III provides an overview of data access, with a particular focus on the authorized data access ecosystem, including players involved, modes of access, competitive incentives and standard-setting and consumer impacts
- Section IV summarizes the Bureau’s actions to date relating to consumer-authorized data access, which include several stakeholder engagement activities.
- Section V includes a series of questions about whether and how the Bureau might most effectively provide regulatory guidance in this area.
Section 1033 is also comprised of five subsections:
- Section 1033(a) provides that, subject to rules prescribed by the Bureau, a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person, including information relating to any transaction, series of transactions, or to the account including costs, charges, and usage data. The information is to be made available in an electronic form usable by consumers.
- Section 1033(b) then outlines certain exceptions from these general access rights.
- Section 1033(c) establishes that Section 1033 does not “impose any duty on a covered person to maintain or keep any information about a consumer.”
- Section 1033 (d) state that “the Bureau, by rule, shall prescribe standards to promote the development and use of standardized formats for information, including through the use of machine-readable files, to be made available to consumers under this section.
- Section 1033 (e) requires that the Bureau consult with the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the Federal Trade Commission to ensure that any rule pursuant to Section 1033 imposes substantively similar requirements on covered persons, takes into account conditions under which covered persons do business both in the US and other countries and does not require or promote the use of any particular technology in order to develop systems for compliance.
Definitions
The ANPR relies upon several terms defined in the Dodd Frank Act and provides definitions for additional terms. Those terms are:
- “Authorized data” means data initially sourced from a data holder as a result of authorized data access.
- “Authorized data access” (or “consumer-authorized data access”) means third-party access to consumer financial data pursuant to the relevant consumer’s authorization.
- “Authorized entities” are entities or persons with authorized data access to particular consumer financial data.
- “Consumer data access” means authorized data access and direct access
- “Consumer financial data” (or “consumer data”) means “information in the control or possession of a covered person concerning a consumer financial product or service that the consumer obtained from such covered person, including information relating to any transaction, series of transactions, or to the account, including costs, charges and usage data.”
- “Data aggregator” (or “aggregator”) means an entity that supports data users and/or data holders in enabling authorized data access.
- “Data holder” means a covered person with control or possession of consumer financial data.
- “Data user” means a third party that uses consumer-authorized data acc4ess to provide either (i) products/services to the authorizing consumer or (ii) services used by entities that provide products/services to the authorizing consumer.
- “Direct access” means direct access by the individual consumer to consumer data rather than by an authorized entity.
Comments Requested
The Bureau intends to use the comments received to determine how it might formulate potential regulatory interventions to better effectuate consumer access to financial records as described in Section 1033. The Bureau has grouped its questions into several categories detailed below. The Bureau requests that, wherever possible, commenters support their responses with information about market practices (both in the US and elsewhere) and/or other empirical data and analysis. The Bureau encourages commenters to include in their responses any relevant information regarding the potential costs and benefits of consumer data access to consumers and covered persons. The Bureau has grouped its questions into several categories reflected below. The specific questions asked can be found in Section V entitled “Topics on Which the Bureau Seeks Comments.” The ANPR can be found here.
- Benefits and Costs of Consumer Data Access
- Competitive Incentives and Authorized Data Access
- Standard-Setting
- Access Scope
- Consumer Control and Privacy
- Legal Requirements Other Than Section 1033
- Data Security
- Data Accuracy
- Other Information