On October 22, 2024, the CFPB issued its final rule implementing the federal law established in 2010 by the Consumer Financial Protection Act giving consumers the right to access certain personal financial data from their financial services institutions (depository and non-depository) including credit unions. However, the final rule does not apply to all credit unions. Both the scope and the compliance deadlines will be determined by asset size. This article will give you the highlights of the new 600-page final rule.
The final rule is codified as Section 1033 of Title 12 of the Code of Federal Regulations. It requires a “data provider” (defined below) to make available to consumers, or their authorized third parties, covered data about certain financial products or services that the consumer obtained from the data provider. This information must be provided upon request, at no cost, and in a secure and standardized electronic format.
In order for a party to be considered an “authorized third party” they must comply with the authorization procedures set forth in subpart D of Section 1033.
Generally, “covered data” encompasses transaction, account balance and account verification information, as well as information needed to initiate one-time payments and process recurring bill payments. However, a data provider is not required to provide confidential commercial information, information it collects for the sole purpose of fraud management, information that must be kept confidential by any other law, or information that cannot be retrieved in the ordinary course of business.
The purpose of the rule is to give consumers the flexibility to easily switch financial service providers and transfer their financial data, foster a more open market for financial products and services and promote competition through data transmission standardization.
The requirements of this rule intersect with data security and privacy requirements of the Gramm-Leach-Bliley Act (“GLBA”) and other applicable federal and state privacy laws. The CFPB maintains that the data accessibility requirements of this rule are intended to complement the requirements of existing privacy laws and covered data providers are required to comply with all applicable laws.
The definition of “data providers” includes depository institutions, such as credit unions, which hold transaction accounts, issue credit cards, issue devices to access an account or provide other types of payment facilitation products or services. Also, to be considered a “data provider” the institution would have to have at least $850 million in assets on average according to its call report submissions for third-quarter 2023 through second-quarter 2024.
Compliance deadlines are scheduled in phases based on asset size. While the largest data providers must begin complying with the final rule by April 1, 2026, according to NCUA Call Report data, the largest California credit unions would fall within the second tier and they have until April 1, 2027, to begin complying with the final rule. The smaller credit unions above the minimum asset size threshold will have until April 1, 2030, to comply. Below is a complete chart of compliance deadlines:
| Compliance Deadline | Asset Size |
| April 1, 2026 | Holds at least $250 billion in total assets based on an average of its Q3 2023 through Q2 2024 call report submissions. |
| April 1, 2027 | Holds at least $10 billion in total assets but less than $250 billion in total assets based on an average of its Q3 2023 through Q2 2024 call report submissions. |
| April 1, 2028 | Holds at least $3 billion in total assets but less than $10 billion in total assets based on an average of its Q3 2023 through Q2 2024 call report submissions. |
| April 1, 2029 | Holds at least $1.5 billion in total assets but less than $3 billion in total assets based on an average of its Q3 2023 through Q2 2024 call report submissions. |
| April 1, 2030 | Holds less than $1.5 billion in total assets but more than $850 million in total assets based on an average of its Q3 2023 through Q2 2024 call report submissions. |
If this new rule applies to your credit union, read on.
As a data provider your credit union must make covered data available to your member or their authorized third party upon request. The rule has additional requirements for how the information can be requested, the response to those requests, making information readily identifiable and record keeping. No matter who is requesting the information, the credit union is prohibited from imposing any fees or costs in connection with such a request.
Receiving and Responding to the Request
If the request for information is coming from the member, the credit union must allow the request to be made in electronic form using a reliable interface. The member must provide sufficient verification information to authenticate their identity and the scope of the data requested. Once authenticated, the information must then be provided to the member through that same interface in an electronic form that the member can retain and readily transfer.
If the request comes from an authorized third party, they must provide the credit union with sufficient information to authenticate the member’s identity, the third party’s authorization and that the third party complied with the requirements of the final rule in obtaining that authorization. Also, the third party should not be allowed to access a member’s data using that member’s access credentials. Aside from that, the credit union must follow more specific rules when dealing with third parties. For example, the credit union must use a reliable interface (with a minimum response rate of 99.5%) that presents the data in standardized and machine-readable format. Finally, the credit union must ensure that the disclosure of information to a third party complies with the credit union’s information security program mandated by the GLBA. To protect against overwhelming requests from third parties, the credit union will be allowed to impose frequency limitations that limit the number of requests, but they must be reasonable and applied consistently without discrimination.
Denying the Request
Note that the member’s right to their personal financial data is not unconditional. The credit union may deny access to the covered information if denying access is necessary to comply with internal policies and procedures relating to data safety required by regulators, the security standard imposed by GLBA, or other applicable laws or regulations applicable to risk management.
Other reasons for denying a request for personal financial information subject to the final rule are that the identity of the member cannot be verified, or that the authorization of a third party cannot be verified, has been revoked or is expired. Also, the credit union is not required to comply with a request if the data is not in the credit union’s custody or control, or the interface is not available.
The denial of any such request must be reasonable and applied consistently and without discrimination.
Readily Available Information
The final rule requires the credit union to display its identifying information and instructions for the member to exercise these rights. Specifically, the credit union will be required to provide members, both in human-readable form and machine-readable formats, with the following:
Record keeping
Credit unions have the flexibility to design and implement record keeping policies and procedures that are appropriate for the size and complexity of its organization, which will demonstrate compliance with the final rule and that are not inconsistent with its other legal obligations. However, the following must be included in its record keeping:
Members may authorize the credit union as a third party to request and receive the member’s financial data from another financial services provider. The rule sets forth the requirements to become an authorized third party.
For example, the credit union must provide the member with a written disclosure seeking authorization containing specific content such as a certification that the credit union agrees to certain obligations set forth in the final rule, and a method to revoke the authorization. The member must give their express consent by signing the authorization either electronically or in writing.
Also, the credit union must limit the data it collects on its member’s behalf to that which will satisfy the purpose requested by the member.
Finally, the credit union must also have policies and procedures in place to ensure they are maintaining records for a reasonable amount of time that demonstrate compliance with this final rule.
The CFPB’s final rule on consumer data access marks a shift towards increased transparency and consumer empowerment in the financial services sector. By establishing clear guidelines for data accessibility, it allows consumers to interact more freely with various financial institutions and manage their financial information across platforms. Credit unions must adapt by strengthening data management protocols, authorization procedures, and record-keeping practices to comply with this rule, though many of these requirements may overlap with a covered credit union’s existing policies, procedures and controls.
Credit unions are strongly encouraged to seek guidance from knowledgeable legal counsel, data privacy and security experts, as well as IT and systems integration specialists, to ensure proper implementation and compliance with this final rule.
Article by Haydee Hooten, Partner at Moore, Brewer & Wolfe.
Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:
Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!
Additionally, other League-member compliance resources include:
For more information, email Lisa Quaranta.
Powered by ViClarity, a California and Nevada Credit Union Leagues company.
