The CFPB has launched the process for independent standard-setting bodies to receive formal recognition, as part of its efforts to shift towards open banking in the United States.
On June 5, 2024, the CFPBfinalized a ruleoutlining the minimum attributes that standard-setting bodies must exhibit to issue standards in compliance with CFPB’s proposedPersonal Financial Data Rights Rule. The Personal Financial Data Rights Rule, proposed in October 2023, is the first federal legal framework for open banking under Section 1033 of the 2010 Consumer Financial Protection Act. This previously untapped legal authority gives consumers the right to control their personal financial data and assigns the task of implementing personal financial data sharing standards and protections to the CFPB.
As it is currently drafted, the Personal Financial Data Rights Rule would grant companies the ability to utilize technical standards developed by standard-setting organizations recognized by the CFPB. The CFPB “Industry standard-setting bodies that operate in a fair, open, and inclusive manner have a critical role to play in ensuring a safe, secure, reliable, and competitive data access framework,” stated the CFPB in the proposal.
Under the rule launching the approval process, industry standardard-setting bodies can apply to be recognized by the CFPB. Those seeking approval must demonstrate the following attributes:
- Openness: A standard-setting organization’s sources, procedures, and processes must be open to all interested parties, including public interest groups, consumer advocates, and app developers;
- Balanced-Decision Making: The decision-making power to set standards must be balanced across all interested parties. There must be meaningful representation for large and small commercial entities, and balanced representation must be reflected at all levels of the standard-setting body;
- Due Process: The standard-setting body must use documented and publicly available policies and procedures to provide a fair and impartial process. An appeals process is also available for the impartial handling of procedural appeals;
- Consensus: Standards development must proceed by consensus but not necessarily unanimity; and
- Transparency: Procedures must be transparent to participants and publicly available.
The CFPB also outlined the application process which involves requesting recognition, followed by additional information requests from the CFPB which may also involve public comment. Next, the CFPB will review the available information against the requirements listed above, make a decision on the application, and if approved, officially recognize the organization as a standards-setting body.
The CFPB also has the power to (a) revoke standard-setters’ recognition if they fail to meet the qualifications and (b) impose a maximum recognition duration of five years, after which recognized standard-setters will have to apply for re-recognition. This rule will take effect 30 days after its publication in the Federal Registrar.
Fair standards issued by standard-setters outside the agency will help companies comply with the proposed Personal Financial Data Rights Rule. Interested standard-setters are encouraged to begin ensuring their adherence to this new rule.
