1033 final rule
Forcht Bank, N.A. v. Consumer Financial Protection Bureau
Date: Oct. 29, 2025
Issue: Whether the Consumer Financial Protection Bureau’s 1033 final rule exceeds its statutory authority and violates the Administrative Procedure Act (APA).
Case Summary: Judge Danny Reeves of the Eastern District of Kentucky issued a preliminary injunction preventing CFPB from enforcing its 1033 final rule.
Dodd-Frank Act Section 1033 affords consumers the right to access their financial records either directly or via an authorized agent (with some exceptions), and the data-sharing ecosystem has flourished in recent years. This ecosystem includes banks, credit unions, fintech firms and data aggregators. In October 2024, CFPB finalized its first rule regulating the ecosystem. CFPB previously finalized a portion of its 1033 proposal in June 2024 to create a process for recognition of standard-setting bodies to demonstrate evidence of compliance with certain substantive requirements
Forcht Bank N.A., the Kentucky Bankers Association and the Bank Policy Institute (plaintiffs) sued CFPB to block the 1033 final rule. Plaintiffs argued CFPB overstepped its statutory authority and finalized a rule that jeopardizes consumers’ privacy, financial data and account security. Plaintiffs alleged the rule requires no oversight of third parties using bank customer data; increases the likelihood of fraud and scams by failing to address weak safeguarding practices; screen scraping and other unsafe practices are allowed to persist; fails to hold third parties accountable; enable third parties to profit, at no cost, from systems built and maintained by banks; and imposes an unreasonable implementation timeline.
On March 27, 2025, the court granted the parties’ joint motion to stay proceedings and toll the 1033 final rule’s compliance deadlines, extending them by 60 days. On July 29, 2025, CFPB sought another stay, announcing plans for an accelerated rulemaking process and pledging to issue an advanced notice of proposed rulemaking within three weeks as the first step toward a substantially revised 1033 final rule. On Aug. 13, 2025, plaintiffs moved to lift the stay to postpone the 1033 final rule’s compliance deadlines and block its enforcement, arguing the 1033 final rule is likely unlawful, would cause irreparable harm, and that the equities overwhelmingly favor interim relief.
Judge Danny Reeves of the Eastern District of Kentucky granted plaintiffs’ motion for a preliminary injunction, concluding they are likely to succeed on all four of their claims. First, the court determined that the 1033 final rule likely exceeds CFPB’s statutory authority because Section 1033 permits data sharing only with consumers or fiduciary-like agents, not commercial third parties — based on the statute’s text, structure, and legislative history. Second, the court concluded that the rule is likely arbitrary and capricious under the APA because the CFPB failed to evaluate how its overlapping provisions, including mandatory sharing of sensitive information and narrow limits on access denials, collectively increase data security risks. Third, the court concluded the CFPB likely lacked statutory authority to prohibit interface-access fees, explaining that such a broad economic mandate requires clear congressional authorization. Finally, the court concluded the rule’s fixed compliance deadlines are likely arbitrary and capricious because they rely on “consensus standards” that do not yet exist, making compliance impractical.
On irreparable harm, the court concluded plaintiffs would suffer irreparable harm absent an injunction. Plaintiffs showed that they must already begin costly preparations to comply with the 1033 final rule, including updating systems, hiring staff, and building compliant interfaces. Although intervenor FTA claimed the harm was speculative and lacked specific figures, the court found it unreasonable to force plaintiffs to spend millions complying with a rule the CFPB itself acknowledged was unlawful and is now rewriting.
Finally, the court determined the remaining factors favor granting an injunction. Because the government is the defendant, the court evaluated potential harm to others and the public interest together. The court explained CFPB would not be harmed by pausing enforcement of a rule it is already revising, while plaintiffs face immediate, unrecoverable compliance costs.
Bottom Line: The court concluded that a temporary stay of the 1033 final rule was the proper remedy. Plaintiffs asked to halt all compliance deadlines and enforcement for one year after the case concludes, but the court agreed with the FTA that this request was overly broad because many members face no immediate deadlines, and nonparties would benefit.
Document: Complaint
