Banks have been working constructively with fintechs and data-sharing middlemen for years to help establish the competitive and safe data-sharing ecosystem that exists today. That collaboration aims to strike a balance: allow consumers to share their data with third parties but set up guardrails for fintechs and other data middlemen designed to ensure the security of consumers’ sensitive financial data. Unfortunately, the Biden Administration’s CFPB delivered a rule purporting to implement Section 1033 of the Dodd-Frank Act that mandates banks to share consumer data with fintechs and aggregators without establishing fundamental safeguards, thereby putting Americans’ financial data at risk. In response, the Bank Policy Institute, Forcht Bank and the Kentucky Bankers Association filed a lawsuit last October challenging the rule.
Ironically, the rule’s loudest proponents today are the same voices who previously criticized it for not requiring banks to share enough sensitive consumer data — data fintechs and aggregators could monetize.[1] Those stakeholders have repeatedly and mistakenly claimed that banks are “undercutting innovation and limiting choice.”
Let’s set the record straight: a robust, competitive data-sharing environment already exists in the U.S., and it’s working. Consumers have more than 4,000 banks and thousands of fintech companies to choose from when it comes to managing their finances, saving for retirement, preparing their tax returns or making payments. The current data-sharing ecosystem grew out of heavy investment from banks in developing systems and establishing partnerships with fintechs. Financial institutions have spent years building infrastructure that enables safe, API-based data sharing. Over 120 data aggregators currently connect financial data across providers. Plaid alone connects to more than 200 million bank accounts. Financial Data Exchange, a nonprofit created through a bank-fintech partnership, has built a secure API linking more than 114 million accounts.
Banks fully support a competitive market that enables consumers to share their data safely. The CFPB’s data-sharing rule makes the data-sharing process riskier by failing to require sufficient data security safeguards and immunizing fintechs and aggregators from any kind of accountability when things go wrong and consumer data is compromised. As outlined in the banks’ complaint, the rule:
- Allows unsafe practices like screen scraping to persist — a practice that requires the customer to hand over their sensitive username and login information;
- Increases the likelihood of fraud and scams by failing to require oversight or supervision of fintechs or their data security practices— while also limiting banks’ ability to cut off bad actors from their systems; and
- Fails to hold fintechs accountable when things go wrong, leaving customers with little to no recourse in the event of a breach. Instead, banks are expected to police the ecosystem for bad actors and offer customer support for products and services offered by third parties.
Responsible financial services providers should be concerned about these outcomes. Yet for some, the priority may not be protecting consumers. Rather, the priority is protecting the ability to collect and monetize data from banks without liability, cost or regulatory obligation. This begs a fundamental question: are fintechs and data aggregators really concerned about preserving consumer choice, or are they interested in protecting and even expanding their business models?
Fintech firms and aggregators have long resisted bank-like oversight. While they often claim to be well-regulated, that assertion doesn’t hold up. A 2022 Treasury Department report found that “… there is virtually no regulatory oversight of data aggregators’ storage of consumer financial information akin to the supervision of [banks’] data security.”
BPI’s position is simple: fintechs that handle sensitive personal and financial data about bank customers must be required to adhere to the same rigorous standards and duties as banks. And if fintechs want to partner with banks to help consumers conduct their financial affairs, banks have demonstrated their absolute willingness to do so, so long as proper safeguards are in place.
Recent news reports have indicated that the CFPB may be rethinking the Section 1033 rule. If so, we urge the CFPB to acknowledge and address the fundamental problems raised in our complaint. Until the rule complies with the law and strengthens fundamental safeguards, BPI will continue to take necessary actions to protect the existing competitive and safe data-sharing ecosystem where all participants — including fintechs — are held accountable.
[1] Financial Technology Association: “With respect to consumer benefits, secondary uses of financial data may include holistic consideration of the consumer’s financial health and tailored recommendations for more appropriate products and services that better meet the consumer’s financial goals and which may not be within the scope of services initially requested or may not be known to the consumer to exist as an alternative. Some of these tailored offerings may be part of cross-selling efforts, which are commonly desired by consumers.”
