The 1033 rule: The next five years and beyond for open banking

By now, you've probably read more than one article about the CFPB's Open Banking, or "1033," rule. Formally called the Personal Financial Data Rights Rule, it activates dormant legal authority the CFPB has held since 2010 to accelerate open banking, with the goal of lowering the cost of loans and letting consumers "fire" bad service providers.

The rule was finalized in October 2024. Since then, its path has been anything but straightforward, and the timeline lenders were originally told to plan around is no longer the one that applies.

Key takeaways

• The CFPB's 1033 rule was finalized in 2024 with a phased compliance schedule beginning April 2026
• A federal court enjoined the CFPB from enforcing the rule in late 2025 while the agency reconsiders it
• The CFPB now argues in court that the rule is unlawful and should be vacated, a reversal from its original position
• A new rulemaking process is underway, and the original 2026-2030 compliance schedule is one of the things being reconsidered
• Lenders should prepare for open banking regardless of the rule's legal status, since the underlying market pressure toward data sharing isn't going away

What the 1033 rule says

The rule requires financial institutions to give consumers, and third parties consumers authorize, access to their financial data at no cost. The CFPB didn't specify exactly how that data should be shared, leaving the technical standards up to the private sector to work out.

You might've read the CFPB's original announcement when the rule was finalized, or commentary from writers like Alex Johnson and Simon Taylor. Their analysis of what the rule was meant to accomplish still holds up, even though its legal status has changed since they wrote it.

Where things stand now

The rule's original compliance schedule was set to phase in starting April 1, 2026, for the largest financial institutions, with smaller providers brought in over the following years. That date came and went without becoming a binding deadline.

In October 2025, a federal court in Kentucky issued a preliminary injunction blocking the CFPB from enforcing the rule while the agency reconsiders it. A federal court has enjoined the CFPB from enforcing the rule while the Bureau undertakes a reconsideration process, and the CFPB has initiated steps to reevaluate the rule, with the possibility of revising or replacing key aspects through further rulemaking.

What makes this different from a typical delay is the CFPB's own position. The CFPB has shifted away from its earlier efforts to defend the rule, instead requesting a stay so it can pursue new rulemaking, a move that could ultimately make the current legal proceedings moot if the revised rule addresses the plaintiffs' concerns. In practice, the agency that wrote the rule is now the one arguing parts of it need to change.

For lenders, that means the rule exists on paper but isn't currently enforceable, and the original 2026 to 2030 schedule shouldn't be treated as a planning assumption. We'll update this section as the rulemaking progresses.

What happened with the lawsuits

When the rule was first finalized, the pattern looked familiar: a new CFPB rule gets challenged in court, industry groups push back, and a revised version eventually takes effect on a later timeline. We'd seen a version of this before with the CFPB's Payday Lending Rule and with BNPL falling under Regulation Z.

That pattern mostly held, but it went further than expected. The Bank Policy Institute, Kentucky Bankers Association, and Forcht Bank sued shortly after the rule was finalized, and JP Morgan filed its own suit within hours. In an interview at the time, then-CFPB Director Rohit Chopra downplayed the lawsuits, joking that he hadn't read them and doubted the plaintiffs had read the rule.

Rather than defending the rule through to a final ruling, the CFPB changed course. It now argues in court that the rule exceeds its authority and should be vacated, siding with the same plaintiffs it was originally defending against. That's a more significant shift than a typical revise-and-narrow outcome, and it's a good example of why lenders should build for regulatory flexibility rather than betting on any single rule surviving intact.

New avenues for deceptive or abusive behavior

In an earlier interview with Fintech Takes' Alex Johnson, Rohit Chopra said a major point of focus in writing the rule was making sure open banking in the US didn't turn into "an underworld of data broker mining." That concern remains relevant regardless of the rule's current legal status.

With authorized third parties gaining easier access to consumer data, the risk isn't just outright fraud. It's also data miners offering some kind of legitimate-looking service as a means of accessing, reselling, and abusing consumer financial data. It's not hard to imagine unwary consumers granting access to companies they know little about, or lawmakers blaming banks when things go wrong, the same dynamic we've already seen play out with peer-to-peer payment tools like Venmo and Zelle.

The rule allows banks and creditors to deny some third parties access based on fraud risk, but it doesn't fully resolve who's liable when something goes wrong. Whatever shape the final rule takes, mitigating that risk in a way that keeps open banking useful and safe will take real effort from lenders, not just regulators.

Downstream effects

The rule wasn't written just to give consumers a clearer view of their own data. The CFPB's stated goal was to make it easier for people to "fire" financial companies that provide bad service, whether by switching providers more easily or by using their data to shop for better rates elsewhere.

If a version of this rule takes effect, it could make it meaningfully easier for consumers to move their accounts and financial history from one provider to another. It could also make it easier for consumers to grant data access to third parties, like budgeting tools or other lenders looking to extend better-informed credit offers.

Firing your bank

Switching banks isn't impossible without open banking, but it's inconvenient, and a new provider has no easy way to verify your financial history without you doing the legwork yourself. Direct access to that data would smooth the process, though some analysts see it as a marginal change rather than a fundamental shift. Jonah Crane of Klaros Group has pointed out that markets with open banking, like the UK, didn't see a sudden wave of account switching. The bigger benefit may be better-connected tools working together behind the scenes, rather than mass migration between providers.

Customer experience as the real differentiator

Even a marginal increase in switching matters in an industry that often runs on thin margins. If open banking does move forward in some form, retaining customers will depend less on rates alone and more on the overall experience lenders provide.

This is where LoanPro customers already have an advantage, regardless of how the 1033 rule shakes out. Personalized communication tools, configurable hardship programs, and flexible product terms all help lenders build the kind of loyalty that keeps borrowers from looking elsewhere in the first place.

Keeping up with the CFPB's ongoing policy goals

However this specific rulemaking ends, it's unlikely to be the CFPB's last word on open banking. The agency has pursued different consumer protection priorities under every administration since 2010, and this rule's rocky path is a clear example of how quickly regulatory direction can shift.

For credit providers, the practical lesson isn't about this rule specifically. It's about building on a platform flexible enough to adapt as rules change, whatever direction that ends up being.

To see how LoanPro keeps your operation compliant by default, regardless of which way this rule lands, reach out to us.