On October 22, the US Consumer Financial Protection Bureau (CFPB) finalized Section 1033 of the Consumer Financial Protection Act, introducing a landmark rule on consumer-authorized financial data sharing. The regulation is designed to enhance consumers' rights, privacy, and control over their personal financial information.

By encouraging competition and empowering consumer choice, the rule aims to transform the payments, credit, and banking sectors for a better customer experience. The finalized rule introduced key changes to the initially proposed rule, including revised implementation timelines, updates to the scope of data providers and third parties, stricter data retention policies, and a shift toward consensus-based standards.

However, within hours of its release, several banking associations filed a lawsuit, arguing that the rule oversteps the CFPB's authority under the Administrative Procedure Act (APA). While the result remains uncertain, industry preparations for compliance are already underway. In this article I will explore what this rule means for the industry; how this affects consumers, banks and fintechs; when we expect to see the impact, and why major banks respond with a lawsuit.

Background to the 1033 ruling