BILLING CODE: 4810-AM-P
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Part 1033
Docket No. CFPB-2023-0052
RIN 3170-AA78
Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting
AGENCY: Consumer Financial Protection Bureau.
ACTION: Final rule.
SUMMARY: The Consumer Financial Protection Bureau (CFPB) is finalizing in part its
proposed rule on consumer data rights under section 1033 of the Consumer Financial Protection
Act. This final rule establishes minimum attributes a standard-setting body must possess to
receive CFPB recognition and to issue consensus standards when the full rule is finalized. The
CFPB is also releasing its process for how standard setters apply for CFPB recognition.
DATES: This final rule is effective [INSERT DATE 30 DAYS AFTER DATE OF
PUBLICATION IN THE FEDERAL REGISTER].
FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory
Implementation and Guidance Program Analyst, Office of Regulations, at 202-435-7700 or
https://reginquiries.consumerfinance.gov/. If you require this document in an alternative
electronic format, please contact CFPB_Accessibility@cfpb.gov.
SUPPLEMENTARY INFORMATION:
I. Summary
The CFPB is finalizing certain provisions of its Required Rulemaking on Personal
Financial Data Rights (Personal Financial Data Rights rule),1 which, among other proposed
provisions in the rule, sought to promote fair, open, and inclusive industry standard-setting. The
CFPB proposed that standards adopted by CFPB-recognized standard setters might be used to

88 FR 74796 (Oct. 31, 2023).

facilitate implementation of a final Personal Financial Data Rights rule. Today’s rule revises and
finalizes part of proposed § 1033.131 (definitions) and all of proposed § 1033.141 (attributes a
standard-setting body must demonstrate in order to be recognized by the CFPB). Included with
this rule is a step-by-step guide for how standard setters apply for recognition and how the CFPB
will evaluate applications.
II. Background
A. Introduction
Consumer electronic access to personal financial data, including and especially open
banking,2 holds the potential to intensify consumer-friendly competition and innovation. Fair,
open, and inclusive industry standard-setting play a critical role in ensuring the open banking
system reaches its full potential to benefit consumers and competition.
By including section 1033 in the Consumer Financial Protection Act of 2010 (CFPA),3
Congress explicitly recognized the importance of personal financial data rights, and section
1033(d) recognizes the importance of standardized formats, especially with regard to data
formats. In 2023, the CFPB issued a proposed rule to begin implementing section 1033, with the
goal of accelerating the shift to a more open and decentralized system of consumer data access.
The proposed rule reflected the CFPB’s preliminary determination that conformance with
industry standards would constitute certain evidence of compliance with various substantive
provisions of the proposed rule (or, in the case of data formats, would be sufficient for a data
provider to be deemed compliant), provided that such standards were issued by a body
recognized by the CFPB as possessing certain attributes. The proposed rule set forth the CFPB’s
view that industry standard setters that operate in a fair, open, and inclusive manner have a

This Federal Register document generally uses the term “open banking” to refer to the network of entities sharing
personal financial data with consumer authorization. Some stakeholders use the term “open finance” because of the
role of nondepositories as important data sources. The CFPB views the two terms as interchangeable, but generally
uses “open banking” because that term is more commonly used in the United States.
3 The CFPA is title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. 111–203, 124
Stat. 1376, 2008 (2010).
critical role to play in ensuring a safe, secure, reliable, and competitive data access framework.
In the proposed rule, the CFPB noted that Federal regulations with very granular technical
requirements could rapidly become obsolete, while industry-led standard-setting would be better
able to keep pace with changes in the market and technology, as long as that standard-setting was
fair, open, and inclusive.
U.S. government agencies have been historically involved in the development and use of
standards to meet agency missions and priorities. Office of Management and Budget (OMB)
Circular A-1194 reflects the U.S. government’s commitment to a U.S. industry-led, voluntary
consensus standards system. Broad use of such standards enhances the safety and security of
products, reduces consumer costs, and expands consumers’ options in the marketplace.
Additionally, voluntary consensus standards ensure that no faction of industry can use its market
power to impose its preferences on the entire market. Further, the use of consensus standards
significantly reduces costs to agencies that would otherwise be incurred if agencies had to
develop and maintain agency-unique standards.
B. Summary of the Rulemaking Process
Outreach and Engagement
The CFPB published its proposed rule on October 31, 2023.5 The public comment period
on the proposed rule closed on December 29, 2023, and the CFPB received comments from
individuals and entities representing various diverse interests. In addition, the CFPB also
considered comments received after the comment period closed via ex parte submissions and
meetings.6 Materials on the record, including all ex parte submissions and summaries of ex parte
meetings, are available on the public docket for this rulemaking.7

OMB Circular A-119 was originally published in 1996; see https://www.govinfo.gov/content/pkg/FR-1996-1227/html/96-32917.htm. The current Circular, effective January 27, 2016, is available at
https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf.
5 88 FR 74796 (Oct. 31, 2023). A description of the CFPB’s outreach and engagement before issuing the proposed
rule, including the CFPB’s convening of a small business advisory review panel pursuant to the Small Business
Regulatory Enforcement Fairness Act of 1996, is included in the proposal at 74801–02.
6 CFPB, Policy on Ex Parte Presentations in Rulemaking Proceedings, 82 FR 18687 (Apr. 21, 2017).
7 See https://www. https://www.regulations.gov/docket/CFPB-2023-0052/comments.
This final rule discusses those substantive comments relevant to the attributes of
standard-setting bodies or the process by which the CFPB will recognize standard-setting bodies.
For the most part, commenters that addressed the issues discussed in this final rule and in the
appended application procedures supported the CFPB’s plan to recognize standard setters that
are fair, open, and inclusive, and generally agreed with the attributes the CFPB proposed to use
to determine whether a standard-setting body was fair, open, and inclusive. Some commenters
requested that the CFPB alter, clarify, or remove specific provisions of the proposed attributes,
or made suggestions for how the CFPB should make its determination as to whether to recognize
a given standard-setting body. Other commenters argued that the CFPB does not have legal
authority to recognize standard-setting bodies, or critiqued how the proposed rule described a
potential recognition process. The CFPB has considered these comments in adopting this final
rule. The CFPB will discuss and address all other substantive comments when it finalizes the
remainder of the Personal Financial Data Rights rule, including the many comments received
concerning the role that adherence to a consensus standard should or should not play in
evaluating compliance with the particular underlying provisions of the final rule.8 Comments
focused on the application procedures described in the appendix are discussed in section IV.C.
Prior to issuing this final rule, in accordance with CFPA sections 1033(e) and
1022(b)(2)(B), the CFPB consulted on several occasions with staff from the prudential
regulators9 and the Federal Trade Commission to discuss various aspects of the proposed rule,
including criteria for and processes with respect to standard-setting bodies.
III. Legal Authority
The CFPB is issuing this final rule pursuant to its authority under the CFPA. As set forth
in section 1021 of the CFPA, Congress established the CFPB to ensure that “all consumers have

Accordingly, the CFPB does not expect its finalization of the remainder of the Personal Financial Data Rights rule
to affect the content of this rule. If in finalizing the remainder of the rule the CFPB concludes that this rule should be
amended, the CFPB would do so.
9 Prudential regulators refer to the Board of Governors of the Federal Reserve System, Federal Deposit Insurance
Corporation, National Credit Union Association, and Office of the Comptroller of the Currency.
access to markets for consumer financial products and services and that markets for consumer
financial products and services are fair, transparent, and competitive.” Congress also authorized
the CFPB to exercise its authorities under Federal consumer financial law, including the CFPA,
to ensure that, with respect to consumer financial products and services, consumers have “timely
and understandable information to make responsible decisions about financial transactions,”
“consumers are protected from unfair, deceptive, or abusive acts and practices and from
discrimination,” that “markets for consumer financial products and services operate transparently
and efficiently to facilitate access and innovation,” and that “Federal consumer financial law is
enforced consistently without regard to the status of a person as a depository institution in order
to promote fair competition.”
A. CFPA section 1033
CFPA section 1033(a) and (b) provide that, subject to rules prescribed by the CFPB, a
covered person shall make available to a consumer, upon request, information in the control or
possession of the covered person concerning the consumer financial product or service that the
consumer obtained from such covered person, subject to certain exceptions. The information
must be made available in an electronic form usable by consumers. In addition, CFPA section
1033(d) provides that the CFPB, by rule, shall prescribe standards applicable to covered persons
to promote the development and use of standardized formats for information, including through
the use of machine-readable files, to be made available to consumers under this section.
Recognition of standard-setting bodies that are fair, open, and inclusive can facilitate
implementation of these authorities. Further, CFPA section 1033(e) requires that the CFPB
consult with the prudential regulators and the FTC to ensure, to the extent appropriate, that
certain objectives are met.
B. CFPA section 1022(b)
CFPA section 1022(b)(1) authorizes the CFPB to, among other things, prescribe rules and
issue orders “as may be necessary or appropriate to enable the CFPB to administer and carry out

the purposes and objectives of the Federal consumer financial laws, and to prevent evasions
thereof.” The CFPA is a Federal consumer financial law. This rule carries out the purposes and
objectives of the CFPA and prevents evasions thereof, by requiring standard-setting bodies to
apply through the CFPB for recognition to adopt consensus10 standards.
IV. Discussion of the Final Rule
A. Overview
This final rule identifies the attributes that a standard-setting body must demonstrate in
order to be recognized by the CFPB. It also includes procedures for standard setters to apply for
recognition by the CFPB. The following addresses comments on the proposed rule relevant to
each topic.
B. Consensus standards and recognized standard setters
Definitions for Recognized Standard Setter and Consensus Standard
The CFPB proposed in § 1033.131 to define a “qualified industry standard” as a standard
issued by a standard-setting body that is fair, open, and inclusive in accordance with proposed
§ 1033.141(a). The CFPB proposed in § 1033.141 that a standard-setting body is fair, open and
inclusive when it satisfies seven requisite attributes: openness, balance, due process, appeals,
consensus, transparency, and that the standard-setting body have been recognized by the CFPB
as an issuer of qualified industry standards within the last three years.
Some commenters asked the CFPB to clarify when a standard issued by a recognized
standard-setting body becomes a consensus standard, and, conversely, when a consensus
standard ceases to have consensus status. A trade group commenter suggested that the CFPB
remove the language in proposed § 1033.141(a)(7) that a standard-setting body must have been
recognized by the CFPB within the last three years, suggesting that this recognition period would

The proposed rule referred to standards issued by a recognized standard-setting body as “qualified industry
standards.” This final rule instead uses the term “consensus standards,” to reflect better the intent of ensuring that
the standards are the product of fair, open, and inclusive standard-setting. In addition, in this final rule a standardsetting body recognized by the CFPB will be referred to as a “recognized standard setter.”
make it difficult for industry to use such standards or, appropriate, switch away from them. One
commenter expressed concern that the loss of a standard’s status as a consensus standard could
cause market uncertainty, because the covered financial institutions would need to identify a
different recognized standard setter and possibly have to modify its practices to conform with the
consensus standards of that recognized standard setter.
After considering these comments, the CFPB is making several changes to §§ 1033.131
and 1033.141 relating to both standard setters and the standards they issue. First, this final rule
replaces the term “qualified industry standard” with “consensus standard,” and adds a definition
of “recognized standard setter,” a term not defined in the proposed rule. These editorial changes
are intended to better organize the structure of these key terms, enhance readability of the final
rule, and adopt terminology that more clearly describes the defined terms.
The definition of “consensus standard” in final § 1033.131 provides additional specificity
regarding when a given standard is a consensus standard. Final § 1033.131 provides that to be a
“consensus standard” the standard must be one that is adopted by a recognized standard setter,
and that continues to be maintained by that recognized standard setter. Regarding the
commenters’ concern about market uncertainty, the CFPB expects revocation of recognition for
a standard setter to be a rare occurrence, and in that event the CFPB would issue guidance to
help manage a transition.
The CFPB has determined that it is appropriate to require a recognized standard setter to
seek renewal of its recognition on a periodic basis. However, in § 1033.141(a), this final rule
extends the maximum duration of the CFPB’s recognition of a standard-setting body from the
proposed duration of three years to five years. Periodic review and re-recognition mitigate the
risk of outdated standards, which the CFPB’s approach to industry standards was intended in part
to avoid. Additionally, periodic review by the CFPB will ensure standard setters carefully mind
their governance and procedures and keep them in conformance with the attributes. However,
extending the maximum recognition period to five years in this final rule is warranted, for two

main reasons. First, a five-year recognition period will mean that, should one or more standardsetting body receive early recognition from the CFPB, such recognition—and by extension their
standards’ status as consensus standards—would last further into the period during which
industry is initially coming into compliance with the forthcoming Personal Financial Data Rights
rule, providing additional certainty to smaller data providers covered by the rule. Additionally,
the CFPB expects that reducing the frequency of periodic review and re-recognition by the CFPB
will encourage standard-setting bodies to obtain recognition because their standards will retain
consensus status for a longer period without the burden of seeking re-recognition.
The CFPB’s authority to recognize standard-setting bodies
Several industry commenters disputed the Bureau’s legal authority to recognize standardsetting bodies that would then issue consensus standards for purposes of facilitating
implementation of a final Personal Financial Data Rights rule. In response, the CFPB notes that,
as discussed above in this final rule, establishing a framework for standard setting is authorized
by CFPA section 1033(a) and (d) and the CFPB’s authority to issue rules under CFPA section
1022(b)(1). The CFPB expects that individual recognition decisions will be authorized by this
final rule, by the CFPB’s authority to issue orders under CFPA section 1022(b)(1), and
additionally by the CFPB’s authority to issue declaratory orders to “to terminate a controversy or
remove uncertainty” under section 554(e) of the Administrative Procedure Act.11
Attributes of standard-setting bodies
Openness
The CFPB proposed to include “openness” as a necessary attribute for CFPB recognition,
and that a standard-setting body’s openness would be evaluated by reviewing whether the
standard-setting body’s sources, procedures, and processes are open to all interested parties, and

5 U.S.C. 554(e).

whether those interested parties can meaningfully participate in standards development on a nondiscriminatory basis.
A few commenters addressed the proposed openness attribute. Consumer advocate
commenters supported the explicit inclusion of consumer groups as an interested party for an
open standard-setting body. A small number of commenters recommended alterations to the
attribute. One industry trade group called for the CFPB to clarify that only the members of the
standard-setting body would need to meaningfully participate in the standards development.
Additionally, some third-party industry commenters asked the CFPB to clarify that a standardsetting body that is “open” for purposes of the attribute includes all types of financial institutions,
including financial technology companies. In support of this consideration, one commenter
highlighted what it described as the undue influence of banks in another country’s standardsetting body due to the other country’s exclusion of financial technology voices in the standardsetting body.
This final rule adopts § 1033.141(a)(1) mostly as proposed, with some additional
clarifying text. In response to commenter concern that certain financial technology sectors might
be excluded if not explicitly mentioned, the CFPB has added explicit reference to “data
recipients” as an interested party in this final rule. The inclusion of data recipients also helps
ensure that data providers and recipients are not forever compelled to rely on intermediaries with
commercial interests that may not consistently align with the advancement of open banking
standards. This final rule does not adopt commenters’ request to limit “openness” to only
members of the standard-setting body. As stated in this final rule, the sources of the standardsetting body must be available to all interested parties. This language reiterates that the CFPB
expects an “open” standard-setting body to utilize open-source materials that interested parties
can reference. Such open-source materials would not truly be open unless they were made
available outside the standard-setting body’s membership.
Balance

The CFPB proposed to include “balance” as a necessary attribute for CFPB recognition.
The CFPB proposed that a standard-setting body’s balance would be evaluated by the CFPB
reviewing whether the standard-setting body’s decision-making power is balanced across all
interested parties at all levels of the standard-setting body. Further, the proposed attribute
clarifies that balance could be impacted by entities playing multiple roles, such as data provider
and third party. Additionally, the CFPB proposed that it could consider the ownership of an
entity when reviewing a standard setter’s balance. Finally, the CFPB proposed that balance
would include meaningful representation of small and large commercial entities.
A number of commenters addressed this attribute. One consumer advocate commenter
expressed their support for the proposed rule’s inclusion of consumer advocates as interested
parties in an open standard-setting body. Another consumer advocate commenter noted that
some current standards bodies do not provide the same voting rights across categories of
membership. A few commenters asked for clarification as to what the CFPB will consider
“meaningful representation,” noting the importance of including small entity voices in the
decision-making processes. Additionally, one consumer advocate commenter and one industry
commenter recommended that a final rule extend balanced representation considerations to any
committee or sub-committee involved in the standard setters decision-making processes.
After considering these comments, the CFPB is finalizing the requirement in
§ 1033.141(a)(2) largely as proposed, with some modifications. To address commenters’
concerns about representation at the committee and sub-committee level, the CFPB has revised
this final rule to state that balanced representation must be reflected at all levels of the standardsetting body. The additional “reflected” language provides a standard-setting body with some
flexibility to arrange adequate committee and sub-committee representation, while also
mitigating the possibility that a particular committee or sub-committee’s representation become
so unbalanced that it hinders the overall decision-making of the standard-setting body. This final
rule does not further define “meaningful representation” because after consideration the CFPB

concludes that the additional language reading “[n]o single interest or set of interests dominates
decision-making” sufficiently describes the scope of meaningful representation. Finally, to
address concerns about weighting of voting rights, this final rule clarifies that if a participant
plays multiple roles, the weight of that participant’s role will be factored into the balance
consideration. As such, if a participant has a vote as a data provider but their primary business is
as a third party, this could suggest that the standard-setting body is not balanced. Similarly, the
CFPB can look at the ownership of a participant to determine to what degree the role and form of
that entity’s participation in the standard-setting body furthers or hinders the body’s balance.
Due Process and Appeals
The CFPB proposed to include “due process” and “appeals” as necessary attributes for
CFPB recognition. The proposed due process attribute would consider whether a standard-setting
body uses documented and publicly available policies and procedures and provides a fair and
impartial process for resolving conflicting views. The proposed appeals attribute would consider
whether the standard-setting body provides an appeals process for the impartial handling of
appeals.
A small number of commenters addressed these attributes. A few industry trade groups
recommended that a final due process attribute should protect the anonymity of participant
dialogue to encourage open dialogue among the members of the standard-setting body. One
consumer advocate commenter recommended that a final appeals attribute focus on the process
of creating standards, rather than on the standards themselves.
The CFPB is finalizing the proposed due process and appeals attributes with minimal
change and a non-substantive structural modification. The structural modification is to combine
the appeals and due process attributes into one attribute (now at § 1033.141(a)(3)), because both
address similar issues of procedural fairness. Additionally, the CFPB is finalizing a modification
to the appeals attribute that clarifies that the appeals process is available for the impartial
handling of procedural appeals. The CFPB is finalizing the remainder of the attribute as

proposed. Specifically, this final rule does not add requested language about anonymity within
the standard-setting body. While anonymity may in some circumstances help create open
dialogue, the CFPB is not including in this final rule the explicit availability of participant
viewpoint anonymity because such protection is already provided by this final rule. Standardsetting bodies are not precluded from making viewpoints anonymous, so long as such anonymity
policies do not have the potential to undermine a final openness, transparency, or due process
attribute.
Consensus
The CFPB proposed to include “consensus” as a necessary attribute for CFPB
recognition. Specifically, the proposed attribute looks at whether the standards development
processes would proceed by consensus, defined as general agreement but not unanimity.
The CFPB received little commenter input concerning the consensus attribute. One
third-party trade group recommended that a final rule consider consensus to be when there is
consensus within a particular sector. The commenter suggested that if all third parties or all data
providers oppose a standard, then that standard should not be adopted. Additionally, one data
provider commenter recommended that a final rule consider that the majority of the standards
proposed in the Personal Financial Data Rights rulemaking are obligations on data providers,
and, as such, consensus should require data providers to be in agreement with a particular
decision-making process of the standard-setting body.
The CFPB is finalizing the attribute largely as proposed, and adding language stating that
consensus does not necessarily require unanimity. This modification is to clarify that general
agreement can include unanimous decisions by the members of the standard-setting body. This
final rule does not include language stating that a single class of standard-setting group members
(like data providers or third parties) could have unilateral power in a standard-setting body.
While consensus is important, privileging one group of members would inappropriately give that

group unwarranted influence. The provision is also renumbered to § 1033.141(a)(4) to reflect
organizational changes.
Transparency
The CFPB proposed to include “transparency” as an attribute for CFPB recognition
consideration. Specifically, the proposed attribute would look at whether the procedures or
processes for participating in standards development and for developing standards are
transparent to participants and publicly available.
Several industry trade groups recommended that a final transparency attribute protect the
anonymity of participant dialogue to encourage open dialogue among the participants in the
setting of consensus standards. As stated above in the discussion of the proposed due process
provision, standard-setting bodies are not precluded from making viewpoints anonymous, so
long as such anonymity policies do not have the potential to undermine a final openness,
transparency, or due process attribute. Accordingly, for the reasons discussed in the proposal, the
CFPB is finalizing the transparency attribute as proposed. The provision is also renumbered to
§ 1033.141(a)(5) to reflect organizational changes.
Additional attributes
In response to the CFPB’s request for comment on whether it should include additional
attributes when evaluating a standard setter for recognition, at least one commenter suggested
that a final rule should adjust the attribute list to account for the relevance of standards that a
standard-setting body adopts.
This final rule does not include an additional “relevance” attribute. However,
demonstrating the attributes in this final rule is the minimum requirement for recognition;
accordingly, the CFPB may consider other information when reviewing an application for
recognition, including whether the standard-setting body will adopt and maintain standards
relevant to open banking.

C. Procedures for CFPB recognition of standard-setting bodies
High-level comment summary
A number of commenters on the proposed rule encouraged the CFPB to establish a
process for recognizing standard setters as soon as possible. Their comments generally focused
on seeking clarity and transparency from the CFPB about this process. Some industry
commenters requested that the CFPB publish its recognition procedures for comment.
In response to comments that the CFPB quickly establish a process for recognizing
standard-setting bodies, the CFPB is publishing the procedures included at appendix A. These
constitute a rule of agency organization, procedure, or practice, and thus do not require notice
and comment under the Administrative Procedure Act.12 As published, these procedures take
account of comments received on the proposed rule regarding procedures for recognizing
standard-setting bodies. The CFPB may publish amendments to the procedures from time-totime as it develops experience with this recognition process and receives stakeholder feedback
on them.
Discussion of procedures for recognition
The CFPB is providing a plain language guide for how standard setters should apply for
recognition, how the CFPB evaluates applications, and what standard setters can expect once
recognized. When submitting a request for recognition, the applicant should provide information
sufficient to enable a determination by the CFPB of whether the applicant satisfies the
requirements for recognition articulated in § 1033.141(a)(1) through (5). Other information
provided, such as a description of how the applicant’s current and/or anticipated standards relate
to open banking, will help the CFPB understand the relevance of the standard setter to open
banking.

5 U.S.C. 553(b).

The procedures also allow for a pre-filing meeting with the CFPB prior to submission of
an application, so that the Bureau can provide information about the application process and
assist organizations with submitting a complete application. During its review and discussions
with the applicant, the CFPB may request additional information from the applicant necessary
for the submission to be complete. Once it receives a complete application, the CFPB may
publish the application, so as to enable stakeholders who believe the application is deficient to
bring the CFPB’s attention to any evidence that might substantiate such claims of deficiency.13
In this event, the CFPB expects to ask the applicant to provide written responses to any such
claims, which the CFPB can then consider as part of its review and assessment of the application.
This procedure addresses comments requesting greater public participation in the recognition
process.
The CFPB will consider the complete application, including any adverse evidence
provided to the CFPB, to evaluate whether the applicant satisfies the recognition requirements
articulated in § 1033.141(a)(1) through (5). The CFPB will also evaluate whether the information
provided in the application is accurate and complete, including regarding the applicant’s policies
and actual practices.
As part of its evaluation of an application, the CFPB will consider how granting a
recognition request might support its own role in open banking pursuant to its CFPA section
1033 authority. However, the CFPB is not adopting the recommendation of one trade association
commenter that a standard-setting body should not be eligible for CFPB recognition unless it had
already promulgated standards central to the safe and efficient operation of open banking.
Rather, the CFPB is retaining the flexibility suggested by other commenters that will enable the
CFPB to recognize an organization at earlier stages of standards development in a given area.
The CFPB emphasizes, however, that a recognition request from an entity that has not adopted,

If an applicant believes that portions of its application should be treated as confidential, it should consult the
CFPB before submitting its application.
and does not intend to adopt, standards relevant to the CFPB’s statutorily-authorized objectives
for open banking is unlikely to be prioritized and may not be approved.
In acting on an application, in addition to either recognizing or not recognizing an
applicant, the CFPB may provide contingent recognition to an applicant that has presented a
satisfactory written plan specifying how and when it will address contingencies that the CFPB
has identified. Once the applicant presents sufficient evidence that it has addressed such
contingencies, the CFPB may recognize the applicant. The CFPB expects to use contingent
recognition, which is not formal recognition under 12 CFR 1033.131, when it determines that an
applicant is close to realizing, but has not yet realized, recognition requirements. The availability
of contingent recognition responds to a trade association comment on the proposed rule that
advocated for a phased approach to recognition, during which the CFPB would—before granting
full recognition—offer feedback on steps to full recognition and support standard setters with
garnering necessary stakeholder participation for recognition.
Consistent with trade association comments requesting that the CFPB publish a list of
standard setters it recognizes, the CFPB will publicly disclose on its website each recognition
and contingent recognition, along with the applicable terms and conditions of each. Some terms
and conditions may be tailored to the circumstances of the applicant. For example, if the CFPB
grants recognition based on the intention of a standard setter to develop and publish a consensus
standard on a given subject matter, the CFPB may condition recognition on good faith efforts to
develop a consensus standard in the given area.
Some commenters requested that the CFPB publish denials and include in its procedures
a process to appeal such denials. The CFPB will publish denials as required by law, but
applicants may also withdraw a pending application at any time for any reason. The CFPB is not
providing a specialized appeals process. Consistent with the suggestion of one industry trade
association, the CFPB may permit consultation with agency officials to help remedy issues after

a submitted application is denied—although the agency intends pre-decisional consultation to
minimize recourse to this option.
Next, the procedures describe the interaction between the CFPB and a standard setter
once it is recognized. As noted above, each recognized standard setter must agree to a set of
applicable terms and conditions. The procedures highlight terms and conditions related to CFPB
observation or participation in standard-setting activities, notification requirements on the part of
the standard setter, and monitoring of the standard setter by the CFPB. They also explain how a
standard setter may request re-recognition.
In view of a trade association comment noting the need for market participants to have
adequate time to transition from a consensus standard if the associated standard setter’s
recognition expires, the procedures state that recognized standard setters intending to apply for
re-recognition should do so at least 180 days before their recognition expires. The CFPB may
temporarily extend a recognition while a re-recognition application is pending. Both provisions
related to re-recognition are intended to reduce the likelihood that a consensus standard loses its
status due to a recognition expiring before re-recognition is granted.
Finally, the procedures describe the circumstances under which the CFPB may modify or
revoke recognition. One advocacy organization indicated that the CFPB should revoke
recognition when requirements of recognition are no longer met. Other industry commenters
stated that the CFPB should clarify the circumstances under which recognition may be revoked,
and also allow for the standard setter to cure deficiencies.
The CFPB expects to base a modification or revocation decision, which it would publish
on its website, on whether the standard-setting body has failed to comply with applicable terms
and conditions, otherwise no longer meets the required attributes, or otherwise no longer
warrants recognition. The CFPB also expects to inform the standard setter of reasons for
modification or revocation, and to provide the standard setter with an opportunity to address
concerns.

V. Effective Date
The CFPB is adopting an effective date of 30 days after the publication of this final rule
in the Federal Register, consistent with section 553(d) of the Administrative Procedure Act.14 No
later effective date is necessary because this final rule does not impose any obligations on any
party other than an applicant for recognition, which can choose when to submit its own
application. Separately, the CFPB notes that an applicant may request that a pre-filing meeting,
consistent with appendix A, be held before the effective date.
VI. CFPA Section 1022(b) Analysis
In developing this final rule, the CFPB has considered the potential benefits, costs, and
impacts as required by section 1022(b)(2)(A) of the CFPA. Specifically, section 1022(b)(2)(A)
of the CFPA requires the CFPB to consider the potential benefits and costs of a regulation to
consumers and covered persons, including the potential reduction of access by consumers to
consumer financial products or services, the impact on depository institutions and credit unions
with $10 billion or less in total assets as described in section 1026 of the CFPA, and the impact
on consumers in rural areas. The Bureau consulted with appropriate prudential regulators and
other Federal agencies regarding the consistency of this final rule with prudential, market, or
systemic objectives administered by such agencies as required by section 1022(b)(2)(B) of the
CFPA.15
This final rule creates an application and recognition process for industry standard setters
but does not impose any compliance requirements based on the standards set by recognized
standard setters. There are also no existing laws or rules that reference such standards. The CFPB
anticipates finalizing the proposed rule of which this current rule was a part. If such a future rule
were to reference industry standards set by recognized standard setters in connection with

5 U.S.C. 553(d). Because appendix A is not a substantive rule, appendix A is not subject to this requirement, but
the CFPB is aligning its effective date with the effective date of §§ 1033.131 and 1033.141. Id.
Whether section 1022(b)(2)(A) and section 1022(b)(2)(B) are applicable to appendix A is unclear, but in order to
inform the rulemaking more fully the Bureau performed the described analysis and consultations.
compliance requirements, the impacts of such requirements would be attributed to and assessed
as part of that rule. Absent such a future rule, the CFPB does not anticipate changes in industry
standards attributable to this final rule. As a result, relative to the baseline of current law used for
this analysis, this final rule does not have impacts on consumers or industry participants other
than standard setters that choose to apply for recognition.
In response to the proposal, one industry commenter stated that additional guidelines for
recognized standard setters should be published, including a full cost-benefit analysis. The
analysis in this part reflects the full consideration of benefits and costs attributable to this final
rule. As noted, only a limited number of provisions from the proposal are being finalized in this
rule, none of which impose substantive compliance requirements. As a result, any analysis of the
benefits and costs of substantive compliance requirements based on industry standards prior to
the finalization of such requirements would be speculative and would not be accurate absent a
future rule finalizing those provisions.
Impacts on Consumers
The CFPB does not anticipate changes in industry standards attributable to this final rule
and, thus, no benefits or costs to consumers. The CFPB is finalizing this rule to ease compliance
with potential future rulemakings.
Impacts on Covered Persons16
This final rule will impact standard setters that choose to apply for recognition. The
CFPB expects such standard setters may incur costs associated with assembling and submitting
application materials and responding to any follow up requests or clarifications in the application
process. The submitted materials and follow up requests would differ across applicants, so the
cost estimates in this analysis reflect an estimated average.

This analysis does not address whether or not standard setters satisfy the statutory definition of a covered person
under the CFPA. 12 U.S.C. 5481(6). To the extent standard setters may not satisfy that standard, the CFPB elects to
include them in its analysis.
Standard setters may have members that are covered persons and members that are not
covered persons. The CFPB expects any costs incurred by standard setters would be spread
across their membership.
Based on industry outreach and responses to the CFPB’s proposed rule, few standard
setters exist that maintain standards directly relevant to the Personal Financial Data Rights rule.
As a result, the CFPB expects nine or fewer standard setters to apply for recognition.
Those standard setters that apply may incur an estimated $10,604 in labor costs, on
average. This estimate assumes 120 staff labor hours at an average total hourly compensation of
$88.37. This total hourly compensation reflects an average of May 2023 wages from the Bureau
of Labor Statistics for compliance officers ($38.55), lawyers ($84.84), and general and
operations managers ($62.18), adjusted for non-wage compensation (30 percent of all
compensation for private industry workers).17 If nine standard setters apply, the estimated total
costs to industry would be $95,436.
Consideration of Alternatives
The CFPB considered potential alternatives to this rule, including waiting to finalize
provisions related to standard setter recognition until such time as substantive compliance
requirements such as those in the full proposed rule were finalized.
In comments on the proposal related to standard setting, industry commenters generally
noted that a lack of clarity on industry standards would make compliance with the proposal more
costly and difficult. The comments indicated that having a standard setter recognized early
relative to the compliance date for the proposal’s substantive requirements could reduce industry
costs. Based on these comments, the CFPB expects that the alternative of waiting to finalize the
provisions in this final rule would have increased costs to industry of complying with any
substantive compliance requirements finalized in a potential future rulemaking.

These data reflect the mean hourly wages by occupation according to the 2023 Occupational Employment
Statistics compiled by the Bureau of Labor Statistics. See U.S. Bureau of Labor Stat., U.S. Dep’t of Labor,
Occupational Employment and Wages (May 2023), https://www.bls.gov/oes/current/oes_stru.htm.
Potential Impacts on Depository Institutions and Credit Unions With $10 Billion or Less in Total
Assets, as Described in Section 1026
The only impacts attributable to this final rule on depository institutions and credit unions
with $10 billion or less in total assets would be through their roles as members of standard setters
that choose to apply for recognition. The CFPB expects these costs would be the same as the
costs faced by any members of such standard setters, as described earlier in this part.
Potential Impacts on Consumers in Rural Areas, as Described in Section 1026
The CFPB does not anticipate changes in industry standards attributable to this final rule
and, thus, no impacts on consumers in rural areas.
VII. Regulatory Flexibility Act Analysis
The Regulatory Flexibility Act (RFA), as amended by the Small Business Regulatory
Enforcement Fairness Act of 1996, requires each agency to consider the potential impact of its
regulations on small entities, including small businesses, small governmental units, and small
not-for-profit organizations. The RFA defines a “small business” as a business that meets the
size standard developed by the Small Business Administration pursuant to the Small Business
Act.
The RFA generally requires an agency to conduct an initial regulatory flexibility analysis
(IRFA) and a final regulatory flexibility analysis (FRFA) of any rule subject to notice-andcomment rulemaking requirements, unless the agency certifies that the rule would not have a
significant economic impact on a substantial number of small entities. The Bureau also is subject
to certain additional procedures under the RFA involving the convening of a panel to consult
with small business representatives before proposing a rule for which an IRFA is required.
The CFPB convened a panel of small business representatives and conducted an IRFA as
part of the proposal. However, this final rule includes only a limited number of provisions from
that proposal, and none of the provisions being finalized impose significant compliance costs on
small entities. As a result, the CFPB is not conducting a FRFA as part of this final rule. The

CFPB would satisfy the requirements of the RFA by conducting a FRFA when it finalizes any
provisions imposing significant compliance costs on small entities.
Some standard setters may be small entities, or may have members that are small entities.
However, the CFPB expects nine or fewer standard setters to apply for recognition, which is not
a substantial number of entities relative to all industry standard setters.
From a cost perspective, the CFPB expects any costs incurred by standard setters to be
spread across all members, including both small entities and larger entities. This implies permember costs substantially lower than the $10,604 in per-standard setter costs estimated above.
Such costs will not be a significant economic impact on small entity members of standard setters.
Accordingly, the Director certifies that this final rule will not have a significant economic
impact on a substantial number of small entities.
VIII. Paperwork Reduction Act
Under the Paperwork Reduction Act of 1995 (PRA), Federal agencies are generally
required to seek, prior to implementation, approval from the Office of Management and Budget
(OMB) for information collection requirements. Under the PRA, the Bureau may not conduct or
sponsor, and, notwithstanding any other provision of law, a person is not required to respond to,
an information collection unless the information collection displays a valid control number
assigned by OMB.
The Bureau has determined that this final rule does not contain any new or substantively
revised information collection requirements.
IX. Congressional Review Act
Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the CFPB will submit a
report containing this rule and other required information to the U.S. Senate, the U.S. House of
Representatives, and the Comptroller General of the United States prior to the rule taking effect.
The Office of Information and Regulatory Affairs has designated this rule as not a “major rule”
as defined by 5 U.S.C. 804(2).

X. Severability
If any provision in §§ 1033.101, 1033.131, 1033.141, or appendix A, or any application
of a provision, is stayed or determined to be invalid, the remaining provisions or applications are
severable and shall continue in effect.
List of Subjects 12 CFR Part 1033
Banks, banking, Consumer protection, Credit, Credit unions, Electronic funds transfers,
National banks, Privacy, Reporting and recordkeeping requirements, Savings associations,
Voluntary standards.
Authority and Issuance
For the reasons set forth in the preamble, the CFPB adds 12 CFR part 1033, as follows:
PART 1033—PERSONAL FINANCIAL DATA RIGHTS
Subpart A—General
Sec.
1033.101 Authority, purpose, and organization.
1033.111 [Reserved].
1033.121 [Reserved].
1033.131 Definitions.
1033.141 Standard-setting bodies.
Subpart B—[Reserved]
Subpart C—[Reserved]Subpart D—[Reserved]
Appendix A— How to Apply for Recognition as a Standard Setter
Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5532; 12 U.S.C. 5533.
Subpart A—General
§ 1033.101 Authority, purpose, and organization.
(a) Authority. The regulation in this part is issued by the Consumer Financial Protection
Bureau (CFPB) pursuant to the Consumer Financial Protection Act of 2010 (CFPA), Public Law
111-203, tit. X, 124 Stat. 1955.
(b) Purpose. This part implements the provisions of section 1033 of the CFPA, in part,
by utilizing industry standards developed by standard-setting bodies recognized by the CFPB.

(c) Organization. This part is organized as follows:
(1) Subpart A establishes the authority, purpose, organization, and definitions applicable
to this part, and is reserved for other purposes.
(2) Subpart B is reserved.
(3) Subpart C is reserved.
(4) Subpart D is reserved.
(5) Appendix A provides instructions for how a standard-setting body would apply for
CFPB recognition.
§ 1033.111 [Reserved].
§ 1033.121 [Reserved].
§ 1033.131 Definitions.
For purposes of this part, the following definitions apply:
Consensus standard means a standard that is adopted by a recognized standard setter and
that continues to be maintained by that recognized standard setter.
Recognized standard setter means a standard-setting body that has been recognized by
the CFPB under § 1033.141.
§ 1033.141 Standard-setting bodies.
(a) Recognition of a standard-setting body. A standard-setting body may request CFPB
recognition. Recognition will last up to five years, absent revocation. The CFPB will not
recognize a standard-setting body unless it demonstrates that it satisfies the following attributes:
(1) Openness: The sources, procedures, and processes used are open to all interested
parties, including: consumer and other public interest groups with expertise in consumer
protection, financial services, community development, fair lending, and civil rights; authorized
third parties; data providers; data recipients; data aggregators and other providers of services to
authorized third parties; and relevant trade associations. Parties can meaningfully participate in
standards development on a non-discriminatory basis.

(2) Balance: The decision-making power is balanced across all interested parties,
including consumer and other public interest groups, and is reflected at all levels of the standardsetting body. There is meaningful representation for large and small commercial entities within
these categories. No single interest or set of interests dominates decision-making. Achieving
balance requires recognition that, even when a participant may play multiple roles, such as data
provider and authorized third party, the weight of that participant's commercial concerns may
align primarily with one set of interests. The ownership of participants is considered in achieving
balance.
(3) Due process and appeals: The standard-setting body uses documented and publicly
available policies and procedures, and it provides adequate notice of meetings and standards
development, sufficient time to review drafts and prepare views and objections, access to views
and objections of other participants, and a fair and impartial process for resolving conflicting
views. An appeals process is available for the impartial handling of procedural appeals.
(4) Consensus: Standards development proceeds by consensus, which is defined as
general agreement, though not necessarily unanimity. During the development of consensus,
comments and objections are considered using fair, impartial, open, and transparent processes.
(5) Transparency: Procedures or processes for participating in standards development and
for developing standards are transparent to participants and publicly available.
Subpart B—[Reserved]
Subpart C—[Reserved]
Subpart D—[Reserved]
Appendix A to Part 1033-Personal Financial Data Rights Rule: How to Apply for Recognition
as a Standard Setter
If you want the CFPB to designate your organization as a recognized standard setter, you
should follow the steps described below.
We may amend this process from time to time.

STEP ONE: REQUESTING RECOGNITION
Submit a written request for recognition.1
This should include key contact information, evidence of your organization’s policies and
practices,2 and an explanation of how your organization satisfies each of the requirements in the
Personal Financial Data Rights rule to be a recognized standard setter.3 Your request should also
describe how current and/or anticipated standards issued by your organization relate to open
banking.
In advance of filing your request, you can seek a pre-filing meeting with us. We can walk
you through the application process and help you make a complete submission.
Send formal submissions, as well as requests for pre-filing meetings, to:
openbankingstandards@cfpb.gov.
STEP TWO: ADDITIONAL INFORMATION AND PUBLIC COMMENT
After reviewing your submission, we may request additional information to ensure that
your application is complete.
We may publish your application.
We may also seek public input on your application and invite your responses to any
information we receive on that basis.
STEP THREE: OUR REVIEW
When reviewing your application, we consider whether your policies and practices meet
all the requirements for recognition. We also evaluate whether your application is accurate and
complete.
We prioritize and review applications based on the extent to which recognizing your

Sensitive personal information should not be provided.

Evidence may include (but is not limited to) charters, bylaws, policies, procedures, fee schedules, meeting minutes,
membership lists, financial statements/disclosures, publicly available materials, and issued standards.
Relevant legal requirements are described at 12 CFR 1033.141. When explaining how your organization meets
these requirements, you should reference relevant elements of the evidence you submit in support of your
application.
organization helps us to implement open banking.4
STEP FOUR: APPLICATION DECISION
CFPB recognition will be publicly disclosed on our website, along with the applicable
terms and conditions of such recognition, such as its duration.
If the CFPB declines to recognize your organization, we will notify you.
You may withdraw your application at any time or for any reason.
If we determine that your organization is close to meeting, but does not yet meet, the
requirements for CFPB recognition, we may ask you to provide a written plan specifying how
and when you will take the steps required for full recognition. If that plan is satisfactory, we may
state on our website that your organization has received contingent recognition. Once you
provide us with evidence that you have successfully executed on that plan (or otherwise
addressed the relevant contingences), the CFPB may extend full recognition.
STEP FIVE: RECOGNITION
There are several points to keep in mind about recognition.
As a recognized standard setter, you agree that the CFPB may monitor your organization
and that you will provide information that we request.
You must also provide us, within 10 days, written explanation of any material change to
information that was submitted with your application or during recognition, as well as any reason
your organization may no longer meet underlying requirements for recognition.
In addition, you must meet any other specified terms and conditions of your recognition,
which may include our reserving the right to observe or participate in standard setting.
If your recognition is set to expire, you can apply for re-recognition by re-starting at Step
One at least 180 days before expiration. We may temporarily extend your recognition while we
consider your request for re-recognition.

Section 1033 of the Consumer Financial Protection Act, 12 U.S.C. 5533, describes the CFPB’s role in
implementing open banking.
We may modify or revoke your recognition. The CFPB expects to notify you of the
reasons it intends to revoke or modify recognition, and to provide your organization with an
opportunity to address the CFPB’s concerns.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.

[FR Doc. 2024-12658 Filed: 6/10/2024 8:45 am; Publication Date: 6/11/2024]