A new regulation is setting protections around personal financial information and making it easier to leave banks.
The U.S. Consumer Financial Protection Bureau said Tuesday it finalized its Personal Financial Data Rights Rule, establishing tougher data protections and requiring banks to transfer financial information upon a customer's request to a competitor or other third party for free.
That transferrable personal financial data includes information on transactions, account balances, sending payments, upcoming bills and basic account verification, the CFPB said.
Large financial businesses have until April 2026 to obey the new rule, while the smallest have until April 2030. The CFPB sues, fines and bans financial businesses it finds violating its rules.
A move to "open banking"
The rule is part of a push for an "open banking" system in the U.S., the CFPB said, where it is easier for customers to switch banks after shopping around for better service, interest rates and credit offers.
Around 13% of customers said they planned to switch to a different bank in 2024, according to a survey by research firm J.D. Power.
The CFPB said an easier exchange of information will boost competition and help people build credit and get loans.
“Too many Americans are stuck in financial products with lousy rates and service,” CFPB Director Rohit Chopra said.
More control and protection of personal financial data
The rule also sets rights against data collection and rights for having information deleted.
- Stricter data use: Financial businesses can only collect, use and keep data to deliver the product the customer requested. For example, some lenders use customer data to advertise loans. "The rule does not prohibit any particular uses of data, but it requires that all use be driven by what is necessary to deliver the product sought by the consumer," the CFPB said.
- Simpler data deletion: Within one year, financial businesses have to stop accessing and delete personal financial data after their customer revokes access. "The process to revoke access must be simple and straightforward," the CFPB said.
The CFPB's widening reach
The new rule has been a long time in the works.
The Personal Financial Data Rights Rule "is part of the CFPB’s efforts to finally activate" the power that Congress granted the government agency in 2010, the regulator said.
In June, the CFPB said it finalized a separate rule to recognize the agency as an "industry standard setting body," meaning it will issue guidelines for companies to follow in meeting its rules on personal financial information.