What does the CFPB 1033 rule mean for lenders in 2026?

The CFPB’s open banking rule under Section 1033 is not in force. It was finalized in October 2024, a federal court blocked enforcement in late 2025, and the first compliance date, April 1, 2026, passed without effect. In August 2026, the CFPB sent a rewritten version to the White House for review, the last step before a proposal is published for public comment.

For lenders, the practical position holds: bank data shared with a borrower’s permission is usable today. The open questions are what rules will govern that access and whether banks will be allowed to charge for it.

This article is general information, not legal advice. Lenders should confirm their obligations with counsel.

What is the CFPB 1033 rule?

The CFPB’s Section 1033 rule, the Personal Financial Data Rights rule, would require banks and other data providers to share consumers’ financial data with authorized third parties, such as lenders, through secure interfaces. It was finalized in October 2024, but a federal court has enjoined enforcement, and in August 2026 the CFPB sent a revised proposal to White House review.

Section 1033 of the Dodd-Frank Act gives consumers the right to access their own financial data. The 2024 final rule turned that right into specific obligations for banks, card issuers and the third parties that receive the data.

Where does the rule stand in November 2026?

What was the rule meant to change for lenders?

• Standard access: Consumers could direct their bank to share balances, transactions and account details through secure developer interfaces instead of screen scraping.
• Consent and use limits: Lenders and other authorized third parties would have to get the consumer’s consent, use the data only for the purpose the consumer asked for, and follow retention limits.
• Free access: The 2024 rule barred data providers from charging for access. That prohibition is the most contested question in the rewrite.

What should lenders do while the rule is rewritten?

1. Keep using consumer-permissioned data. Lenders already access bank data with a borrower’s permission. The rule would set standard terms for that access, so a delay changes the terms you plan around, not your ability to use the data.
2. Move connections to bank APIs. The market is converging on the FDX API standard and away from screen scraping, whatever the rule’s legal status. API connections keep working when a bank redesigns its website. For how the two methods differ in practice, see open banking vs. screen scraping.
3. Record consent and purpose for every connection. Log what the borrower agreed to share, why, and for how long. These practices were central to the 2024 rule, and they’ll matter under any version that replaces it.
4. Get counsel’s view on FCRA before building underwriting models on bank data. Whether Fair Credit Reporting Act obligations apply depends on how the data is used in the credit decision and who supplies it.
5. Budget for data-access fees. Press reports say the revised proposal would let banks charge third parties for data access, and some large banks already charge aggregators under commercial agreements. The proposal’s text isn’t public yet, so model your data costs both with and without fees.
6. Ask your data providers three questions. Do they connect through FDX-aligned APIs? How would they pass bank access fees through to you? How do they record and refresh borrower consent?

Frequently asked questions

Is the CFPB 1033 rule in effect?

No. A federal court has enjoined the CFPB from enforcing it, and the CFPB is rewriting it. The April 1, 2026 compliance date for the largest institutions passed without becoming binding.

When will a revised 1033 rule take effect?

There’s no date yet. The revised proposal still has to be published for public comment, finalized, and given new compliance dates. That process usually takes well over a year from publication.

Will banks be allowed to charge for data access?

That’s undecided. The 2024 rule prohibited fees. Reports on the revised proposal say it would allow them, but the final answer depends on the published text and the comments that follow.

Does Section 1033 replace the FCRA?

No. The two laws operate separately. A lender using bank data in a credit decision should assess its obligations under both, with legal advice.

The bottom line

Section 1033 would formalize consumers’ right to share bank data with lenders, but the rule is enjoined and being rewritten, and no compliance date is binding. Lenders don’t need to wait. They can keep using consumer-permissioned data, move to API-based connections, document consent, plan for access fees, and get counsel’s view on FCRA before relying on bank data in credit decisions.

Aerosync, Aeropay’s bank-linking product, connects to more than 12,000 US banks and credit unions. It uses bank-authorized connections instead of screen scraping wherever the bank supports it. Customers log in directly with their bank, and the bank issues a secure token, so no passwords are shared with Aeropay. Aeropay is not a lender or credit bureau, and using its data does not by itself make a lender compliant with any rule.

Need permissioned bank data for your lending flow? See how Aerosync links US bank accounts in under 10 seconds.