A federal court yesterday granted a stay in a lawsuit challenging the Consumer Financial Protection Bureau’s financial data sharing rule after the bureau requested time to work on a replacement, but it left in place the deadlines for complying with the current rule.
The 2024 rule implemented Section 1033 of the Dodd-Frank Act, which requires banks and other financial institutions to make a consumer’s financial information available to them or a third party at the consumer’s direction. The Kentucky Bankers Association joined the Bank Policy Institute and a community bank in challenging the rule in U.S. District Court for Eastern Kentucky, arguing it jeopardized consumers’ privacy and account security. Earlier this year, a trade association representing fintechs and data aggregators has since intervened in the case, urging the court to uphold the current rule.
The CFPB asked the court for a stay in the lawsuit to give it time to issue new rulemaking, and the interveners did not object to the request as long as the compliance deadlines for the current rule remain in place. The court granted the stay but left in place the current rule’s compliance dates. The current compliance dates are spread between July 1, 2026, and July 1, 2030, depending on the size of the institution. The dates reflect a 90-day tolling previously ordered by the court added to the regulatory timeframes; however, the bureau has not yet memorialized the change in the Federal Register
The parties were also directed to submit a joint status report every 45 days from the date of the stay and within seven days of final bureau action on the rule.
In its request, the CFPB said it will “engage in an accelerated rulemaking process” to “reconsider the Rule with a view to substantially revising it.” The bureau set a target of three weeks for an advanced notice of proposed rulemaking to serve as the starting point.
Editor’s note: This story has been updated to reflect the current compliance dates.
