The CFPB's Section 1033 rule was finalized in October 2024 but is not in force. A federal court has enjoined the CFPB from enforcing it, and the CFPB is rewriting the rule — including reopening whether banks can charge fees for data access. The April 2026 compliance deadline passed without becoming a binding enforcement trigger.
Section 1033 of the Dodd-Frank Act is the statutory basis for open banking in the United States. For years it was dormant; the CFPB's 2024 Personal Financial Data Rights rule was supposed to turn it into a working framework with deadlines. Instead, the rule has been reopened and blocked — making the live regulatory state, not the rulebook on paper, the variable that matters for anyone planning a US build. This page tracks what has actually happened, with sources, and is updated as the picture changes.
Section 1033 timeline
The CFPB finalizes the Personal Financial Data Rights rule implementing Section 1033, with a phased compliance schedule running from 2026 to 2030.
The CFPB recognizes Financial Data Exchange (FDX) as the first standard-setting body under the 1033 framework, a five-year recognition through January 2030.
The final rule's effective date arrives (60 days after Federal Register publication). Compliance is still phased in later by institution size.
In litigation brought by the Bank Policy Institute, Kentucky Bankers Association and Forcht Bank (E.D. Kentucky), the CFPB tells the court it now views the rule as unlawful and that it should be vacated — siding with the bank plaintiffs.
The CFPB asks the court to stay the case, announcing it will initiate a new rulemaking to "substantially revise" the rule. The court grants the stay, which also pauses the looming compliance deadline.
The CFPB publishes an Advance Notice of Proposed Rulemaking reopening four areas: who can be an authorized third party, data security, data privacy, and — critically — whether data providers may charge fees to respond to data requests. Comments were due Oct 21, 2025.
The Eastern District of Kentucky grants the plaintiffs a preliminary injunction, finding them likely to succeed and barring the CFPB from enforcing the rule until it completes its reconsideration. The rule is enjoined, not formally vacated.
The original first compliance deadline (depositories ≥ $250B in assets; nondepository data providers ≥ $10B in receipts) arrives but, under the injunction and pending reconsideration, does not become a binding enforcement trigger.
The (suspended) compliance deadlines
The 2024 rule set five tiered deadlines, all on April 1. They remain on the books but are effectively suspended while the rule is enjoined and reconsidered. A common error is to cite a "June 30, 2026" deadline — there is no such date; every tier falls on April 1.
| Tier | Original deadline | Who it covers |
|---|---|---|
| Tier 1 | April 1, 2026 | Depositories ≥ $250B assets; nondepository data providers ≥ $10B receipts |
| Tier 2 | April 1, 2027 | Depositories $10B–$250B in assets |
| Tier 3 | April 1, 2028 | Depositories $3B–$10B in assets |
| Tier 4 | April 1, 2029 | Depositories $1.5B–$3B in assets |
| Tier 5 | April 1, 2030 | Depositories $850M–$1.5B in assets |
Institutions below roughly the $850M SBA size standard are exempt from the original rule.
The reopened fee question
The 2024 rule effectively barred data providers from charging for access. The August 2025 reconsideration put that prohibition back in play — at the same moment banks began charging aggregators commercially (JPMorgan and Plaid struck a paid data-access deal in September 2025). Whether US open banking ends up free-by-rule or fee-bearing is now one of the deciding variables.
Read: Open banking data access fees →What it means if you build in the US
- Don't plan against the deadlines. The April-1 dates are technically in place but not safe to build a roadmap around while the rule is enjoined.
- Build to FDX. Regardless of the rule's legal status, the market is converging on the FDX API standard for regulated access, away from screen scraping.
- Assume access economics are unsettled. Data-access fees, not just availability, are now a planning variable.
- Watch for the rewritten rule. A new proposed rule (and likely revised deadlines) will follow the reconsideration; this tracker is updated as it does.
Frequently asked questions
Not in practice. The CFPB finalized the Personal Financial Data Rights rule in October 2024, but as of mid-2026 a federal court has enjoined the CFPB from enforcing it, and the CFPB is rewriting the rule. The first compliance deadline (April 1, 2026) passed without becoming a binding enforcement trigger.
Sources
- CFPB — Personal Financial Data Rights reconsideration (rule under development)
- CFPB — Final rule press release (Oct 2024)
- Federal Register — Personal Financial Data Rights Reconsideration ANPR (Aug 22, 2025)
- CFPB — FDX standard-setter recognition order (Jan 2025)
- ABA Banking Journal — Kentucky court enjoins CFPB from enforcing 1033 rule (Nov 2025)
- Cozen O'Connor — 1033 compliance date: rule enjoined and under reconsideration (Apr 2026)