InfoBytes Blog
CFPB finalizes standards setting body component of open banking rule
On June 5, the CFPB announced it finalized in part its proposed Personal Financial Data Rights rule, thus establishing the minimum qualifications necessary for the Bureau to become a recognized industry standard setting body when the full rule becomes final. Last October, the CFPB proposed the Personal Financial Data Rights rule to implement Section 1033 of the CFPA (covered by InfoBytes here) which was intended to offer consumers more control over their financial data and more consumer protections for misused data.
After considering relevant public comments, the CFPB made several changes to the sections concerning standard setters and the standards they issue. Commenters asked for clarity regarding changes in standards, such as when a consensus standard ceases to have consensus status, and how it could potentially cause market uncertainty. In response, the Bureau replaced the term “qualified industry standard” with “consensus standard” and added a newly defined “recognized standard setter” term. The final rule defined “consensus standard” to clarify when a given standard will be a consensus standard, and also added that a “consensus standard” must be one that will be adopted and maintained by a recognized standard setter. In response to concerns about market uncertainty, the CFPB responded that they expect revocation of recognition for a standard setter to be a rare occurrence.
Regarding periodic review, the final rule extended the maximum duration of the CFPB’s recognition of a standard-setting body from the proposed duration of three years to five years. The Bureau expects this change will incentivize standard-setting bodies to obtain recognition. The final rule included “data recipients” as an interested party in response to commenter concern that certain fintech sectors may be excluded. Additionally, meeting the criteria in the final rule is just the starting point for approval, as the CFPB may also assess whether the standard-setting body will be committed to developing and upholding open banking standards.
The final rule also included a guide that detailed how standard setters can apply for CFPB recognition, how the Bureau will evaluate applications, and what standard setters can expect once recognized. The final rule will go into effect 30 days after publication in the Federal Register.