Washington, D.C. – The Bank Policy Institute, Forcht Bank and the Kentucky Bankers Association filed a motion today with the U.S. District Court for the Eastern District of Kentucky making their case for why the CFPB’s Section 1033 rule is unlawful and should be vacated — an admission that the CFPB itself made in a filing with the Court.
In the motion, the plaintiffs wrote:
“This case involves an agency that drastically overstepped its statutory authority, injected itself into a well-functioning ecosystem that was thriving under private industry initiatives, and installed a burdensome, irrational and risky regulatory framework in its place. That regime is unlawful many times over.”
The plaintiffs highlighted a robust and competitive data-sharing environment that already exists in the U.S., irrespective of the Section 1033 rule. This ecosystem enables hundreds of millions of consumers to safely share their data, driven in large part by investments in secure technology by banks. However, the rule could significantly disrupt the existing ecosystem and place sensitive consumer financial data at risk:
“Banks welcome the new opportunities to serve their customers that open banking has created. But there are obvious risks. Consumer financial data can be extremely damaging in the wrong hands, especially if it can be used to move money out of consumers’ accounts. As a matter of both business necessity and regulatory obligation, banks place the highest priority on protecting their customers’ financial information. … [T]he Rule’s framework places customers’ most sensitive financial data at risk, while simultaneously handcuffing banks in their ability to mitigate that risk and assuming no role for the Bureau itself in policing it.”
Litigation Timeline
The Bureau proposed its rule on October 31, 2023. It received over 11,000 comments, many of which criticized fundamental aspects of the Bureau’s proposal. Yet the CFPB proceeded to finalize the rule largely as proposed on October 22, 2024. The CFPB has since acknowledged the rule violates the law, and the Financial Technology Association has intervened to defend the rule. A timeline for the case is outlined below.
Upcoming Deadlines:
- June 29, 2025 – The deadline for the defendants’ combined opposition and cross-motion for summary judgment. (Note: The CFPB filed its Motion for Summary Judgment on May 30, ahead of the June 29 deadline. June 29 is the deadline for the FTA to file.)
- July 29, 2025 – The deadline for the plaintiffs’ combined reply and opposition to the defendants’ cross-motion.
- August 29, 2025 – The deadline for the defendants’ reply.
Past Filings:
- October 22, 2024 – Banks challenge CFPB rule jeopardizing the security and privacy of consumer financial data.
- February 12, 2025 – FTA files Motion to Intervene.
- February 25, 2025 – Judge denies FTA’s Motion to Intervene.
- February 25, 2025 – Plaintiffs and Defendants filed a joint motion to stay proceedings for 30 days, including a tolling of compliance deadlines.
- February 25, 2025 – Motion to stay granted. Compliance deadlines for each phase were extended from April 1 to May 1.
- March 26, 2025 – CFPB and BPI file a joint motion to extend the stay by 60 days.
- March 26, 2025 – FTA files Renewed Motion to Intervene.
- March 27, 2025 – Court grants a 60-day extension.
- May 12, 2025 – Plaintiffs file response to FTA Motion to Intervene.
- May 12, 2025 – CFPB files response to FTA Motion to Intervene.
- May 14, 2025 – Motion to Intervene granted.
- May 23, 2025 – CFPB indicates in status report that the Section 1033 rule is unlawful and should be set aside.
- May 30, 2025 – CFPB files Motion for Summary Judgment.
- May 30, 2025 – The deadline for the plaintiffs’ Motion for Summary Judgment with supporting memorandum.
###
About Bank Policy Institute.
The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks and the major foreign banks doing business in the United States. The Institute produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.
Media Contacts
- Austin Anton, Bank Policy Institute, austin.anton@bpi.com
