Blog Post

CFPB Seeks Input on Personal Financial Data Rights Rule Rewrite

Michael Christians • August 22, 2025

On July 29, 2025, the Consumer Financial Protection Bureau (CFPB) indicated in a court filing that it planned to engage in an "accelerated rulemaking process" to rewrite its personal financial data rights rule, finalized in October 2024. That process has now begun.

The agency published an advance notice of proposed rulemaking (ANPR) in the Federal Register on August 22^nd seeking comment on four specific issues it plans to address in the rewrite:

The Dodd-Frank Act permits a consumer and/or representative acting on behalf of the consumer to request covered data from a financial institution. The CFPB seeks comment on who should be allowed to serve as a representative acting on behalf of the consumer.
Under the final rule in its current form, a financial institution is prohibited from imposing any fee and/or charge on a consumer when fulfilling an information request. The ANPR asks whether the Dodd-Frank Act specifically requires this, and if so, what steps a financial institution should be allowed to take to defray some of its costs associated with fulfilling the information request.
The final rule requires financial institutions to have appropriate safeguards in place to protect against malicious actors in the use, retention, and transmission of consumer financial data. The CFPB seeks comment as to whether the final rule’s information security standards go far enough.
The final rule requires a financial institution to obtain express informed consent from the consumer before making his/her consumer financial data available to a third-party. The ANPR seeks comment as to whether the rule, in its current form, provides adequate consumer privacy protection.

Comments on the ANPR, available here, must be received by October 21, 2025.

Share this post

Recent Blog Posts

Budget Bill Slashes CFPB Funding

By Michael Christians • July 9, 2025

On July 4, 2025, President Trump signed H.R.1, The One Big Beautiful Bill Act into law. Among the many, many other things that the law does, it dramatically reduces the amount of funding available to the Consumer Financial Protection Bureau (CFPB). Under the Dodd-Frank Act of 2010, the CFPB could request from the Federal Reserve up to 12% of its total operating expenses in 2009. Each year, the 2009 amount is adjusted for inflation to determine the new amount of the CFPB’s maximum permissible withdrawal from the Federal Reserve. Under H.R.1, this cap has been reduced from 12% to 6.5%, a reduction of nearly half of the CFPB’s annual funding. Senate Republicans claim that the reduction in funding for the CFPB will save taxpayers around $2 billion. Under the temporary leadership of Russ Vought, we’ve seen the CFPB withdraw nearly 70 guidance documents, de-prioritize enforcement of its payday lending rule, vacate its credit card late fee rule, stop defending a number of rules in federal court, and terminate several pending enforcement actions for alleged violations of consumer financial protection law. All this to say that a 46% reduction in its annual budget shouldn’t be too difficult for the lame duck agency to manage.

FinCEN Issues Order Related to CIP Rule

By Michael Christians • June 28, 2025

Under 31 CFR 1020.220, a financial institution's Customer Identification Program (CIP) requires the collection of certain information in connection with the opening of a new account. Specifically, the rule requires the financial institution to collect the following from the customer : Name Date of birth (for an individual) Residential or business street address, and Identification number (e.g., taxpayer identification number) Under an order issued by the Financial Crimes Enforcement Network (FinCEN) on June 27, 2025, financial institutions are now permitted to collect a customer's taxpayer identification number (TIN) from a third-party, instead of directly from the customer. To utilize this alternative collection method, the financial institution must have written procedures that: a) enable the financial institution to obtain the customer's TIN prior to account opening, b) recognize the relevant risks associated with obtaining the customer's TIN from a third-party, and c) enable the financial institution to form a reasonable belief that it knows the true identity of the customer. Nothing in the order requires the financial institution to utilize this alternative collection method. You can access a copy of the FinCEN order here .

Small Business Lending Rule Delayed Again

By Michael Christians • June 18, 2025

Today, the Consumer Financial Protection Bureau (CFPB) published an interim final rule extending the mandatory compliance dates once again for its small business lending data collection rule under Section 1071 of the Dodd-Frank Act. The new mandatory compliance dates are as follows: Tier One Lenders (those that originated at least 2,500 covered credit transactions in both years of their determination period) July 1, 2026 Tier Two Lenders (those that originated between 500 and 2,499 covered credit transactions in both years of their determination period) January 1, 2027 Tier Three Lenders (those that originated between 100 and 499 covered credit transactions in both years of their determination period) October 1, 2027 The interim final rule also clarifies that a covered financial institution may use any of the following combinations for its determination period - 2022 and 2023, 2023 and 2024, or 2024 and 2025. The CFPB indicates that it plans to use this additional time to initiate a new Section 1071 rulemaking. The notice of proposed rulemaking, which we anticipate will make significant changes to the current small business lending data collection framework, will be issued as expeditiously as possible according to the agency.

Address

5438 South Prairie View Drive

West Des Moines, IA 50266

Phone

319-325-1171

Email

michael@mchristiansconsulting.com

Michael Christians Consulting, LLC

This website has been built to be accessible for all users. If you experience any difficulty in accessing this website, please contact us for assistance.

Powered by MyCase

Share by: