Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting, 49084-49091 [2024-12658]

Agencies

• CONSUMER FINANCIAL PROTECTION BUREAU

[Federal Register Volume 89, Number 113 (Tuesday, June 11, 2024)]
[Rules and Regulations]
[Pages 49084-49091]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-12658]


=======================================================================
-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU

12 CFR Part 1033

[Docket No. CFPB-2023-0052]
RIN 3170-AA78


Required Rulemaking on Personal Financial Data Rights; Industry 
Standard-Setting

AGENCY: Consumer Financial Protection Bureau.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB) is finalizing 
in part its proposed rule on consumer data rights under section 1033 of 
the Consumer Financial Protection Act. This final rule establishes 
minimum attributes a standard-setting body must possess to receive CFPB 
recognition and to issue consensus standards when the full rule is 
finalized. The CFPB is also releasing its process for how standard 
setters apply for CFPB recognition.

DATES: This final rule is effective July 11, 2024.

FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory 
Implementation and Guidance Program Analyst, Office of Regulations, at 
202-435-7700 or https://reginquiries.consumerfinance.gov/. If you 
require this document in an alternative electronic format, please 
contact [email protected].

SUPPLEMENTARY INFORMATION:

I. Summary

    The CFPB is finalizing certain provisions of its Required 
Rulemaking on Personal Financial Data Rights (Personal Financial Data 
Rights rule),\1\ which, among other proposed provisions in the rule, 
sought to promote fair, open, and inclusive industry standard-setting. 
The CFPB proposed that standards adopted by CFPB-recognized standard 
setters might be used to facilitate implementation of a final Personal 
Financial Data Rights rule. Today's rule revises and finalizes part of 
proposed Sec.  1033.131 (definitions) and all of proposed Sec.  
1033.141 (attributes a standard-setting body must demonstrate in order 
to be recognized by the CFPB). Included with this rule is a step-by-
step guide for how standard setters apply for recognition and how the 
CFPB will evaluate applications.
---------------------------------------------------------------------------

    \1\ 88 FR 74796 (Oct. 31, 2023).
---------------------------------------------------------------------------

II. Background

A. Introduction

    Consumer electronic access to personal financial data, including 
and especially open banking,\2\ holds the potential to intensify 
consumer-friendly competition and innovation. Fair, open, and inclusive 
industry standard-setting play a critical role in ensuring the open 
banking system reaches its full potential to benefit consumers and 
competition.
---------------------------------------------------------------------------

    \2\ This Federal Register document generally uses the term 
``open banking'' to refer to the network of entities sharing 
personal financial data with consumer authorization. Some 
stakeholders use the term ``open finance'' because of the role of 
nondepositories as important data sources. The CFPB views the two 
terms as interchangeable, but generally uses ``open banking'' 
because that term is more commonly used in the United States.
---------------------------------------------------------------------------

    By including section 1033 in the Consumer Financial Protection Act 
of 2010 (CFPA),\3\ Congress explicitly recognized the importance of 
personal financial data rights, and section 1033(d) recognizes the 
importance of standardized formats, especially with regard to data 
formats. In 2023, the CFPB issued a proposed rule to begin implementing 
section 1033, with the goal of accelerating the shift to a more open 
and decentralized system of consumer data access.
---------------------------------------------------------------------------

    \3\ The CFPA is title X of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 2008 
(2010).
---------------------------------------------------------------------------

    The proposed rule reflected the CFPB's preliminary determination 
that conformance with industry standards would constitute certain 
evidence of compliance with various substantive provisions of the 
proposed rule (or, in the case of data formats, would be sufficient for 
a data provider to be deemed compliant), provided that such standards 
were issued by a body recognized by the CFPB as possessing certain 
attributes. The proposed rule set forth the CFPB's view that industry 
standard setters that operate in a fair, open, and inclusive manner 
have a critical role to play in ensuring a safe, secure, reliable, and 
competitive data access framework. In the proposed rule, the CFPB noted 
that Federal regulations with very granular technical requirements 
could rapidly become obsolete, while industry-led standard-setting 
would be better able to keep pace with changes in the market and 
technology, as long as that standard-setting was fair, open, and 
inclusive.
    U.S. government agencies have been historically involved in the 
development and use of standards to meet agency missions and 
priorities. Office of Management and Budget (OMB) Circular A-119 \4\ 
reflects the U.S. government's commitment to a U.S. industry-led, 
voluntary consensus standards system. Broad use of such standards 
enhances the safety and security of products, reduces consumer costs, 
and expands consumers' options in the marketplace. Additionally, 
voluntary consensus standards ensure that no faction of industry can 
use its market power to impose its preferences on the entire market. 
Further, the use of consensus standards significantly reduces costs to 
agencies that would otherwise be incurred if agencies had to develop 
and maintain agency-unique standards.
---------------------------------------------------------------------------

    \4\ OMB Circular A-119 was originally published in 1996; see 
https://www.govinfo.gov/content/pkg/FR-1996-12-27/html/96-32917.htm. 
The current Circular, effective January 27, 2016, is available at 
https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf.
---------------------------------------------------------------------------

B. Summary of the Rulemaking Process

Outreach and Engagement
    The CFPB published its proposed rule on October 31, 2023.\5\ The 
public comment period on the proposed rule closed on December 29, 2023, 
and the CFPB received comments from individuals and entities 
representing various diverse interests. In addition, the CFPB also 
considered comments received after the comment period closed via ex 
parte submissions and meetings.\6\ Materials on the record, including 
all ex parte submissions and summaries of ex parte meetings, are 
available on the public docket for this rulemaking.\7\
---------------------------------------------------------------------------

    \5\ 88 FR 74796 (Oct. 31, 2023). A description of the CFPB's 
outreach and engagement before issuing the proposed rule, including 
the CFPB's convening of a small business advisory review panel 
pursuant to the Small Business Regulatory Enforcement Fairness Act 
of 1996, is included in the proposal at 74801-02.
    \6\ CFPB, Policy on Ex Parte Presentations in Rulemaking 
Proceedings, 82 FR 18687 (Apr. 21, 2017).
    \7\ See https://www. https://www.regulations.gov/docket/CFPB-2023-0052/comments.
---------------------------------------------------------------------------

    This final rule discusses those substantive comments relevant to 
the attributes of standard-setting bodies or the process by which the 
CFPB will recognize standard-setting bodies. For the most part, 
commenters that addressed the issues discussed in this final rule and 
in the appended application procedures supported the CFPB's plan to 
recognize standard setters that are fair, open, and inclusive, and 
generally agreed with the attributes the CFPB proposed to use to 
determine whether a standard-setting body was

[[Page 49085]]

fair, open, and inclusive. Some commenters requested that the CFPB 
alter, clarify, or remove specific provisions of the proposed 
attributes, or made suggestions for how the CFPB should make its 
determination as to whether to recognize a given standard-setting body. 
Other commenters argued that the CFPB does not have legal authority to 
recognize standard-setting bodies, or critiqued how the proposed rule 
described a potential recognition process. The CFPB has considered 
these comments in adopting this final rule. The CFPB will discuss and 
address all other substantive comments when it finalizes the remainder 
of the Personal Financial Data Rights rule, including the many comments 
received concerning the role that adherence to a consensus standard 
should or should not play in evaluating compliance with the particular 
underlying provisions of the final rule.\8\ Comments focused on the 
application procedures described in the appendix are discussed in 
section IV.C.
---------------------------------------------------------------------------

    \8\ Accordingly, the CFPB does not expect its finalization of 
the remainder of the Personal Financial Data Rights rule to affect 
the content of this rule. If in finalizing the remainder of the rule 
the CFPB concludes that this rule should be amended, the CFPB would 
do so.
---------------------------------------------------------------------------

    Prior to issuing this final rule, in accordance with CFPA sections 
1033(e) and 1022(b)(2)(B), the CFPB consulted on several occasions with 
staff from the prudential regulators \9\ and the Federal Trade 
Commission to discuss various aspects of the proposed rule, including 
criteria for and processes with respect to standard-setting bodies.
---------------------------------------------------------------------------

    \9\ Prudential regulators refer to the Board of Governors of the 
Federal Reserve System, Federal Deposit Insurance Corporation, 
National Credit Union Association, and Office of the Comptroller of 
the Currency.
---------------------------------------------------------------------------

III. Legal Authority

    The CFPB is issuing this final rule pursuant to its authority under 
the CFPA. As set forth in section 1021 of the CFPA, Congress 
established the CFPB to ensure that ``all consumers have access to 
markets for consumer financial products and services and that markets 
for consumer financial products and services are fair, transparent, and 
competitive.'' Congress also authorized the CFPB to exercise its 
authorities under Federal consumer financial law, including the CFPA, 
to ensure that, with respect to consumer financial products and 
services, consumers have ``timely and understandable information to 
make responsible decisions about financial transactions,'' ``consumers 
are protected from unfair, deceptive, or abusive acts and practices and 
from discrimination,'' that ``markets for consumer financial products 
and services operate transparently and efficiently to facilitate access 
and innovation,'' and that ``Federal consumer financial law is enforced 
consistently without regard to the status of a person as a depository 
institution in order to promote fair competition.''

A. CFPA Section 1033

    CFPA section 1033(a) and (b) provide that, subject to rules 
prescribed by the CFPB, a covered person shall make available to a 
consumer, upon request, information in the control or possession of the 
covered person concerning the consumer financial product or service 
that the consumer obtained from such covered person, subject to certain 
exceptions. The information must be made available in an electronic 
form usable by consumers. In addition, CFPA section 1033(d) provides 
that the CFPB, by rule, shall prescribe standards applicable to covered 
persons to promote the development and use of standardized formats for 
information, including through the use of machine-readable files, to be 
made available to consumers under this section. Recognition of 
standard-setting bodies that are fair, open, and inclusive can 
facilitate implementation of these authorities. Further, CFPA section 
1033(e) requires that the CFPB consult with the prudential regulators 
and the FTC to ensure, to the extent appropriate, that certain 
objectives are met.

B. CFPA Section 1022(b)

    CFPA section 1022(b)(1) authorizes the CFPB to, among other things, 
prescribe rules and issue orders ``as may be necessary or appropriate 
to enable the CFPB to administer and carry out the purposes and 
objectives of the Federal consumer financial laws, and to prevent 
evasions thereof.'' The CFPA is a Federal consumer financial law. This 
rule carries out the purposes and objectives of the CFPA and prevents 
evasions thereof, by requiring standard-setting bodies to apply through 
the CFPB for recognition to adopt consensus \10\ standards.
---------------------------------------------------------------------------

    \10\ The proposed rule referred to standards issued by a 
recognized standard-setting body as ``qualified industry 
standards.'' This final rule instead uses the term ``consensus 
standards,'' to reflect better the intent of ensuring that the 
standards are the product of fair, open, and inclusive standard-
setting. In addition, in this final rule a standard-setting body 
recognized by the CFPB will be referred to as a ``recognized 
standard setter.''
---------------------------------------------------------------------------

IV. Discussion of the Final Rule

A. Overview

    This final rule identifies the attributes that a standard-setting 
body must demonstrate in order to be recognized by the CFPB. It also 
includes procedures for standard setters to apply for recognition by 
the CFPB. The following addresses comments on the proposed rule 
relevant to each topic.

B. Consensus Standards and Recognized Standard Setters

Definitions for Recognized Standard Setter and Consensus Standard
    The CFPB proposed in Sec.  1033.131 to define a ``qualified 
industry standard'' as a standard issued by a standard-setting body 
that is fair, open, and inclusive in accordance with proposed Sec.  
1033.141(a). The CFPB proposed in Sec.  1033.141 that a standard-
setting body is fair, open and inclusive when it satisfies seven 
requisite attributes: openness, balance, due process, appeals, 
consensus, transparency, and that the standard-setting body have been 
recognized by the CFPB as an issuer of qualified industry standards 
within the last three years.
    Some commenters asked the CFPB to clarify when a standard issued by 
a recognized standard-setting body becomes a consensus standard, and, 
conversely, when a consensus standard ceases to have consensus status. 
A trade group commenter suggested that the CFPB remove the language in 
proposed Sec.  1033.141(a)(7) that a standard-setting body must have 
been recognized by the CFPB within the last three years, suggesting 
that this recognition period would make it difficult for industry to 
use such standards or, appropriate, switch away from them. One 
commenter expressed concern that the loss of a standard's status as a 
consensus standard could cause market uncertainty, because the covered 
financial institutions would need to identify a different recognized 
standard setter and possibly have to modify its practices to conform 
with the consensus standards of that recognized standard setter.
    After considering these comments, the CFPB is making several 
changes to Sec. Sec.  1033.131 and 1033.141 relating to both standard 
setters and the standards they issue. First, this final rule replaces 
the term ``qualified industry standard'' with ``consensus standard,'' 
and adds a definition of ``recognized standard setter,'' a term not 
defined in the proposed rule. These editorial changes are intended to 
better organize the structure of these key terms, enhance readability 
of the final rule, and adopt terminology that more clearly describes 
the defined terms.
    The definition of ``consensus standard'' in final Sec.  1033.131 
provides additional specificity regarding when a

[[Page 49086]]

given standard is a consensus standard. Final Sec.  1033.131 provides 
that to be a ``consensus standard'' the standard must be one that is 
adopted by a recognized standard setter, and that continues to be 
maintained by that recognized standard setter. Regarding the 
commenters' concern about market uncertainty, the CFPB expects 
revocation of recognition for a standard setter to be a rare 
occurrence, and in that event the CFPB would issue guidance to help 
manage a transition.
    The CFPB has determined that it is appropriate to require a 
recognized standard setter to seek renewal of its recognition on a 
periodic basis. However, in Sec.  1033.141(a), this final rule extends 
the maximum duration of the CFPB's recognition of a standard-setting 
body from the proposed duration of three years to five years. Periodic 
review and re-recognition mitigate the risk of outdated standards, 
which the CFPB's approach to industry standards was intended in part to 
avoid. Additionally, periodic review by the CFPB will ensure standard 
setters carefully mind their governance and procedures and keep them in 
conformance with the attributes. However, extending the maximum 
recognition period to five years in this final rule is warranted, for 
two main reasons. First, a five-year recognition period will mean that, 
should one or more standard-setting body receive early recognition from 
the CFPB, such recognition--and by extension their standards' status as 
consensus standards--would last further into the period during which 
industry is initially coming into compliance with the forthcoming 
Personal Financial Data Rights rule, providing additional certainty to 
smaller data providers covered by the rule. Additionally, the CFPB 
expects that reducing the frequency of periodic review and re-
recognition by the CFPB will encourage standard-setting bodies to 
obtain recognition because their standards will retain consensus status 
for a longer period without the burden of seeking re-recognition.
The CFPB's Authority To Recognize Standard-Setting Bodies
    Several industry commenters disputed the Bureau's legal authority 
to recognize standard-setting bodies that would then issue consensus 
standards for purposes of facilitating implementation of a final 
Personal Financial Data Rights rule. In response, the CFPB notes that, 
as discussed above in this final rule, establishing a framework for 
standard setting is authorized by CFPA section 1033(a) and (d) and the 
CFPB's authority to issue rules under CFPA section 1022(b)(1). The CFPB 
expects that individual recognition decisions will be authorized by 
this final rule, by the CFPB's authority to issue orders under CFPA 
section 1022(b)(1), and additionally by the CFPB's authority to issue 
declaratory orders to ``to terminate a controversy or remove 
uncertainty'' under section 554(e) of the Administrative Procedure 
Act.\11\
---------------------------------------------------------------------------

    \11\ 5 U.S.C. 554(e).
---------------------------------------------------------------------------

Attributes of Standard-Setting Bodies
Openness
    The CFPB proposed to include ``openness'' as a necessary attribute 
for CFPB recognition, and that a standard-setting body's openness would 
be evaluated by reviewing whether the standard-setting body's sources, 
procedures, and processes are open to all interested parties, and 
whether those interested parties can meaningfully participate in 
standards development on a non-discriminatory basis.
    A few commenters addressed the proposed openness attribute. 
Consumer advocate commenters supported the explicit inclusion of 
consumer groups as an interested party for an open standard-setting 
body. A small number of commenters recommended alterations to the 
attribute. One industry trade group called for the CFPB to clarify that 
only the members of the standard-setting body would need to 
meaningfully participate in the standards development. Additionally, 
some third-party industry commenters asked the CFPB to clarify that a 
standard-setting body that is ``open'' for purposes of the attribute 
includes all types of financial institutions, including financial 
technology companies. In support of this consideration, one commenter 
highlighted what it described as the undue influence of banks in 
another country's standard-setting body due to the other country's 
exclusion of financial technology voices in the standard-setting body.
    This final rule adopts Sec.  1033.141(a)(1) mostly as proposed, 
with some additional clarifying text. In response to commenter concern 
that certain financial technology sectors might be excluded if not 
explicitly mentioned, the CFPB has added explicit reference to ``data 
recipients'' as an interested party in this final rule. The inclusion 
of data recipients also helps ensure that data providers and recipients 
are not forever compelled to rely on intermediaries with commercial 
interests that may not consistently align with the advancement of open 
banking standards. This final rule does not adopt commenters' request 
to limit ``openness'' to only members of the standard-setting body. As 
stated in this final rule, the sources of the standard-setting body 
must be available to all interested parties. This language reiterates 
that the CFPB expects an ``open'' standard-setting body to utilize 
open-source materials that interested parties can reference. Such open-
source materials would not truly be open unless they were made 
available outside the standard-setting body's membership.
Balance
    The CFPB proposed to include ``balance'' as a necessary attribute 
for CFPB recognition. The CFPB proposed that a standard-setting body's 
balance would be evaluated by the CFPB reviewing whether the standard-
setting body's decision-making power is balanced across all interested 
parties at all levels of the standard-setting body. Further, the 
proposed attribute clarifies that balance could be impacted by entities 
playing multiple roles, such as data provider and third party. 
Additionally, the CFPB proposed that it could consider the ownership of 
an entity when reviewing a standard setter's balance. Finally, the CFPB 
proposed that balance would include meaningful representation of small 
and large commercial entities.
    A number of commenters addressed this attribute. One consumer 
advocate commenter expressed their support for the proposed rule's 
inclusion of consumer advocates as interested parties in an open 
standard-setting body. Another consumer advocate commenter noted that 
some current standards bodies do not provide the same voting rights 
across categories of membership. A few commenters asked for 
clarification as to what the CFPB will consider ``meaningful 
representation,'' noting the importance of including small entity 
voices in the decision-making processes. Additionally, one consumer 
advocate commenter and one industry commenter recommended that a final 
rule extend balanced representation considerations to any committee or 
sub-committee involved in the standard setters decision-making 
processes.
    After considering these comments, the CFPB is finalizing the 
requirement in Sec.  1033.141(a)(2) largely as proposed, with some 
modifications. To address commenters' concerns about representation at 
the committee and sub-committee level, the CFPB has revised this final 
rule to state that balanced representation must be reflected at all 
levels of the standard-

[[Page 49087]]

setting body. The additional ``reflected'' language provides a 
standard-setting body with some flexibility to arrange adequate 
committee and sub-committee representation, while also mitigating the 
possibility that a particular committee or sub-committee's 
representation become so unbalanced that it hinders the overall 
decision-making of the standard-setting body. This final rule does not 
further define ``meaningful representation'' because after 
consideration the CFPB concludes that the additional language reading 
``[n]o single interest or set of interests dominates decision-making'' 
sufficiently describes the scope of meaningful representation. Finally, 
to address concerns about weighting of voting rights, this final rule 
clarifies that if a participant plays multiple roles, the weight of 
that participant's role will be factored into the balance 
consideration. As such, if a participant has a vote as a data provider 
but their primary business is as a third party, this could suggest that 
the standard-setting body is not balanced. Similarly, the CFPB can look 
at the ownership of a participant to determine to what degree the role 
and form of that entity's participation in the standard-setting body 
furthers or hinders the body's balance.
Due Process and Appeals
    The CFPB proposed to include ``due process'' and ``appeals'' as 
necessary attributes for CFPB recognition. The proposed due process 
attribute would consider whether a standard-setting body uses 
documented and publicly available policies and procedures and provides 
a fair and impartial process for resolving conflicting views. The 
proposed appeals attribute would consider whether the standard-setting 
body provides an appeals process for the impartial handling of appeals.
    A small number of commenters addressed these attributes. A few 
industry trade groups recommended that a final due process attribute 
should protect the anonymity of participant dialogue to encourage open 
dialogue among the members of the standard-setting body. One consumer 
advocate commenter recommended that a final appeals attribute focus on 
the process of creating standards, rather than on the standards 
themselves.
    The CFPB is finalizing the proposed due process and appeals 
attributes with minimal change and a non-substantive structural 
modification. The structural modification is to combine the appeals and 
due process attributes into one attribute (now at Sec.  
1033.141(a)(3)), because both address similar issues of procedural 
fairness. Additionally, the CFPB is finalizing a modification to the 
appeals attribute that clarifies that the appeals process is available 
for the impartial handling of procedural appeals. The CFPB is 
finalizing the remainder of the attribute as proposed. Specifically, 
this final rule does not add requested language about anonymity within 
the standard-setting body. While anonymity may in some circumstances 
help create open dialogue, the CFPB is not including in this final rule 
the explicit availability of participant viewpoint anonymity because 
such protection is already provided by this final rule. Standard-
setting bodies are not precluded from making viewpoints anonymous, so 
long as such anonymity policies do not have the potential to undermine 
a final openness, transparency, or due process attribute.
Consensus
    The CFPB proposed to include ``consensus'' as a necessary attribute 
for CFPB recognition. Specifically, the proposed attribute looks at 
whether the standards development processes would proceed by consensus, 
defined as general agreement but not unanimity.
    The CFPB received little commenter input concerning the consensus 
attribute. One third-party trade group recommended that a final rule 
consider consensus to be when there is consensus within a particular 
sector. The commenter suggested that if all third parties or all data 
providers oppose a standard, then that standard should not be adopted. 
Additionally, one data provider commenter recommended that a final rule 
consider that the majority of the standards proposed in the Personal 
Financial Data Rights rulemaking are obligations on data providers, 
and, as such, consensus should require data providers to be in 
agreement with a particular decision-making process of the standard-
setting body.
    The CFPB is finalizing the attribute largely as proposed, and 
adding language stating that consensus does not necessarily require 
unanimity. This modification is to clarify that general agreement can 
include unanimous decisions by the members of the standard-setting 
body. This final rule does not include language stating that a single 
class of standard-setting group members (like data providers or third 
parties) could have unilateral power in a standard-setting body. While 
consensus is important, privileging one group of members would 
inappropriately give that group unwarranted influence. The provision is 
also renumbered to Sec.  1033.141(a)(4) to reflect organizational 
changes.
Transparency
    The CFPB proposed to include ``transparency'' as an attribute for 
CFPB recognition consideration. Specifically, the proposed attribute 
would look at whether the procedures or processes for participating in 
standards development and for developing standards are transparent to 
participants and publicly available.
    Several industry trade groups recommended that a final transparency 
attribute protect the anonymity of participant dialogue to encourage 
open dialogue among the participants in the setting of consensus 
standards. As stated above in the discussion of the proposed due 
process provision, standard-setting bodies are not precluded from 
making viewpoints anonymous, so long as such anonymity policies do not 
have the potential to undermine a final openness, transparency, or due 
process attribute. Accordingly, for the reasons discussed in the 
proposal, the CFPB is finalizing the transparency attribute as 
proposed. The provision is also renumbered to Sec.  1033.141(a)(5) to 
reflect organizational changes.
Additional Attributes
    In response to the CFPB's request for comment on whether it should 
include additional attributes when evaluating a standard setter for 
recognition, at least one commenter suggested that a final rule should 
adjust the attribute list to account for the relevance of standards 
that a standard-setting body adopts.
    This final rule does not include an additional ``relevance'' 
attribute. However, demonstrating the attributes in this final rule is 
the minimum requirement for recognition; accordingly, the CFPB may 
consider other information when reviewing an application for 
recognition, including whether the standard-setting body will adopt and 
maintain standards relevant to open banking.

C. Procedures for CFPB Recognition of Standard-Setting Bodies

High-Level Comment Summary
    A number of commenters on the proposed rule encouraged the CFPB to 
establish a process for recognizing standard setters as soon as 
possible. Their comments generally focused on seeking clarity and 
transparency from the CFPB about this process. Some industry commenters 
requested that the CFPB publish its recognition procedures for comment.
    In response to comments that the CFPB quickly establish a process 
for recognizing standard-setting bodies, the

[[Page 49088]]

CFPB is publishing the procedures included at appendix A. These 
constitute a rule of agency organization, procedure, or practice, and 
thus do not require notice and comment under the Administrative 
Procedure Act.\12\ As published, these procedures take account of 
comments received on the proposed rule regarding procedures for 
recognizing standard-setting bodies. The CFPB may publish amendments to 
the procedures from time-to-time as it develops experience with this 
recognition process and receives stakeholder feedback on them.
---------------------------------------------------------------------------

    \12\ 5 U.S.C. 553(b).
---------------------------------------------------------------------------

Discussion of Procedures for Recognition
    The CFPB is providing a plain language guide for how standard 
setters should apply for recognition, how the CFPB evaluates 
applications, and what standard setters can expect once recognized. 
When submitting a request for recognition, the applicant should provide 
information sufficient to enable a determination by the CFPB of whether 
the applicant satisfies the requirements for recognition articulated in 
Sec.  1033.141(a)(1) through (5). Other information provided, such as a 
description of how the applicant's current and/or anticipated standards 
relate to open banking, will help the CFPB understand the relevance of 
the standard setter to open banking.
    The procedures also allow for a pre-filing meeting with the CFPB 
prior to submission of an application, so that the Bureau can provide 
information about the application process and assist organizations with 
submitting a complete application. During its review and discussions 
with the applicant, the CFPB may request additional information from 
the applicant necessary for the submission to be complete. Once it 
receives a complete application, the CFPB may publish the application, 
so as to enable stakeholders who believe the application is deficient 
to bring the CFPB's attention to any evidence that might substantiate 
such claims of deficiency.\13\ In this event, the CFPB expects to ask 
the applicant to provide written responses to any such claims, which 
the CFPB can then consider as part of its review and assessment of the 
application. This procedure addresses comments requesting greater 
public participation in the recognition process.
---------------------------------------------------------------------------

    \13\ If an applicant believes that portions of its application 
should be treated as confidential, it should consult the CFPB before 
submitting its application.
---------------------------------------------------------------------------

    The CFPB will consider the complete application, including any 
adverse evidence provided to the CFPB, to evaluate whether the 
applicant satisfies the recognition requirements articulated in Sec.  
1033.141(a)(1) through (5). The CFPB will also evaluate whether the 
information provided in the application is accurate and complete, 
including regarding the applicant's policies and actual practices.
    As part of its evaluation of an application, the CFPB will consider 
how granting a recognition request might support its own role in open 
banking pursuant to its CFPA section 1033 authority. However, the CFPB 
is not adopting the recommendation of one trade association commenter 
that a standard-setting body should not be eligible for CFPB 
recognition unless it had already promulgated standards central to the 
safe and efficient operation of open banking. Rather, the CFPB is 
retaining the flexibility suggested by other commenters that will 
enable the CFPB to recognize an organization at earlier stages of 
standards development in a given area. The CFPB emphasizes, however, 
that a recognition request from an entity that has not adopted, and 
does not intend to adopt, standards relevant to the CFPB's statutorily-
authorized objectives for open banking is unlikely to be prioritized 
and may not be approved.
    In acting on an application, in addition to either recognizing or 
not recognizing an applicant, the CFPB may provide contingent 
recognition to an applicant that has presented a satisfactory written 
plan specifying how and when it will address contingencies that the 
CFPB has identified. Once the applicant presents sufficient evidence 
that it has addressed such contingencies, the CFPB may recognize the 
applicant. The CFPB expects to use contingent recognition, which is not 
formal recognition under 12 CFR 1033.131, when it determines that an 
applicant is close to realizing, but has not yet realized, recognition 
requirements. The availability of contingent recognition responds to a 
trade association comment on the proposed rule that advocated for a 
phased approach to recognition, during which the CFPB would--before 
granting full recognition--offer feedback on steps to full recognition 
and support standard setters with garnering necessary stakeholder 
participation for recognition.
    Consistent with trade association comments requesting that the CFPB 
publish a list of standard setters it recognizes, the CFPB will 
publicly disclose on its website each recognition and contingent 
recognition, along with the applicable terms and conditions of each. 
Some terms and conditions may be tailored to the circumstances of the 
applicant. For example, if the CFPB grants recognition based on the 
intention of a standard setter to develop and publish a consensus 
standard on a given subject matter, the CFPB may condition recognition 
on good faith efforts to develop a consensus standard in the given 
area.
    Some commenters requested that the CFPB publish denials and include 
in its procedures a process to appeal such denials. The CFPB will 
publish denials as required by law, but applicants may also withdraw a 
pending application at any time for any reason. The CFPB is not 
providing a specialized appeals process. Consistent with the suggestion 
of one industry trade association, the CFPB may permit consultation 
with agency officials to help remedy issues after a submitted 
application is denied--although the agency intends pre-decisional 
consultation to minimize recourse to this option.
    Next, the procedures describe the interaction between the CFPB and 
a standard setter once it is recognized. As noted above, each 
recognized standard setter must agree to a set of applicable terms and 
conditions. The procedures highlight terms and conditions related to 
CFPB observation or participation in standard-setting activities, 
notification requirements on the part of the standard setter, and 
monitoring of the standard setter by the CFPB. They also explain how a 
standard setter may request re-recognition.
    In view of a trade association comment noting the need for market 
participants to have adequate time to transition from a consensus 
standard if the associated standard setter's recognition expires, the 
procedures state that recognized standard setters intending to apply 
for re-recognition should do so at least 180 days before their 
recognition expires. The CFPB may temporarily extend a recognition 
while a re-recognition application is pending. Both provisions related 
to re-recognition are intended to reduce the likelihood that a 
consensus standard loses its status due to a recognition expiring 
before re-recognition is granted.
    Finally, the procedures describe the circumstances under which the 
CFPB may modify or revoke recognition. One advocacy organization 
indicated that the CFPB should revoke recognition when requirements of 
recognition are no longer met. Other industry commenters stated that 
the CFPB should clarify the circumstances under which recognition may 
be revoked, and also allow for the standard setter to cure 
deficiencies.

[[Page 49089]]

    The CFPB expects to base a modification or revocation decision, 
which it would publish on its website, on whether the standard-setting 
body has failed to comply with applicable terms and conditions, 
otherwise no longer meets the required attributes, or otherwise no 
longer warrants recognition. The CFPB also expects to inform the 
standard setter of reasons for modification or revocation, and to 
provide the standard setter with an opportunity to address concerns.

V. Effective Date

    The CFPB is adopting an effective date of 30 days after the 
publication of this final rule in the Federal Register, consistent with 
section 553(d) of the Administrative Procedure Act.\14\ No later 
effective date is necessary because this final rule does not impose any 
obligations on any party other than an applicant for recognition, which 
can choose when to submit its own application. Separately, the CFPB 
notes that an applicant may request that a pre-filing meeting, 
consistent with appendix A, be held before the effective date.
---------------------------------------------------------------------------

    \14\ 5 U.S.C. 553(d). Because appendix A is not a substantive 
rule, appendix A is not subject to this requirement, but the CFPB is 
aligning its effective date with the effective date of Sec. Sec.  
1033.131 and 1033.141. Id.
---------------------------------------------------------------------------

VI. CFPA Section 1022(b) Analysis

    In developing this final rule, the CFPB has considered the 
potential benefits, costs, and impacts as required by section 
1022(b)(2)(A) of the CFPA. Specifically, section 1022(b)(2)(A) of the 
CFPA requires the CFPB to consider the potential benefits and costs of 
a regulation to consumers and covered persons, including the potential 
reduction of access by consumers to consumer financial products or 
services, the impact on depository institutions and credit unions with 
$10 billion or less in total assets as described in section 1026 of the 
CFPA, and the impact on consumers in rural areas. The Bureau consulted 
with appropriate prudential regulators and other Federal agencies 
regarding the consistency of this final rule with prudential, market, 
or systemic objectives administered by such agencies as required by 
section 1022(b)(2)(B) of the CFPA.\15\
---------------------------------------------------------------------------

    \15\ Whether section 1022(b)(2)(A) and section 1022(b)(2)(B) are 
applicable to appendix A is unclear, but in order to inform the 
rulemaking more fully the Bureau performed the described analysis 
and consultations.
---------------------------------------------------------------------------

    This final rule creates an application and recognition process for 
industry standard setters but does not impose any compliance 
requirements based on the standards set by recognized standard setters. 
There are also no existing laws or rules that reference such standards. 
The CFPB anticipates finalizing the proposed rule of which this current 
rule was a part. If such a future rule were to reference industry 
standards set by recognized standard setters in connection with 
compliance requirements, the impacts of such requirements would be 
attributed to and assessed as part of that rule. Absent such a future 
rule, the CFPB does not anticipate changes in industry standards 
attributable to this final rule. As a result, relative to the baseline 
of current law used for this analysis, this final rule does not have 
impacts on consumers or industry participants other than standard 
setters that choose to apply for recognition.
    In response to the proposal, one industry commenter stated that 
additional guidelines for recognized standard setters should be 
published, including a full cost-benefit analysis. The analysis in this 
part reflects the full consideration of benefits and costs attributable 
to this final rule. As noted, only a limited number of provisions from 
the proposal are being finalized in this rule, none of which impose 
substantive compliance requirements. As a result, any analysis of the 
benefits and costs of substantive compliance requirements based on 
industry standards prior to the finalization of such requirements would 
be speculative and would not be accurate absent a future rule 
finalizing those provisions.
Impacts on Consumers
    The CFPB does not anticipate changes in industry standards 
attributable to this final rule and, thus, no benefits or costs to 
consumers. The CFPB is finalizing this rule to ease compliance with 
potential future rulemakings.
Impacts on Covered Persons \16\
---------------------------------------------------------------------------

    \16\ This analysis does not address whether or not standard 
setters satisfy the statutory definition of a covered person under 
the CFPA. 12 U.S.C. 5481(6). To the extent standard setters may not 
satisfy that standard, the CFPB elects to include them in its 
analysis.
---------------------------------------------------------------------------

    This final rule will impact standard setters that choose to apply 
for recognition. The CFPB expects such standard setters may incur costs 
associated with assembling and submitting application materials and 
responding to any follow up requests or clarifications in the 
application process. The submitted materials and follow up requests 
would differ across applicants, so the cost estimates in this analysis 
reflect an estimated average.
    Standard setters may have members that are covered persons and 
members that are not covered persons. The CFPB expects any costs 
incurred by standard setters would be spread across their membership.
    Based on industry outreach and responses to the CFPB's proposed 
rule, few standard setters exist that maintain standards directly 
relevant to the Personal Financial Data Rights rule. As a result, the 
CFPB expects nine or fewer standard setters to apply for recognition.
    Those standard setters that apply may incur an estimated $10,604 in 
labor costs, on average. This estimate assumes 120 staff labor hours at 
an average total hourly compensation of $88.37. This total hourly 
compensation reflects an average of May 2023 wages from the Bureau of 
Labor Statistics for compliance officers ($38.55), lawyers ($84.84), 
and general and operations managers ($62.18), adjusted for non-wage 
compensation (30 percent of all compensation for private industry 
workers).\17\ If nine standard setters apply, the estimated total costs 
to industry would be $95,436.
---------------------------------------------------------------------------

    \17\ These data reflect the mean hourly wages by occupation 
according to the 2023 Occupational Employment Statistics compiled by 
the Bureau of Labor Statistics. See U.S. Bureau of Labor Stat., U.S. 
Dep't of Labor, Occupational Employment and Wages (May 2023), 
https://www.bls.gov/oes/current/oes_stru.htm.
---------------------------------------------------------------------------

Consideration of Alternatives
    The CFPB considered potential alternatives to this rule, including 
waiting to finalize provisions related to standard setter recognition 
until such time as substantive compliance requirements such as those in 
the full proposed rule were finalized.
    In comments on the proposal related to standard setting, industry 
commenters generally noted that a lack of clarity on industry standards 
would make compliance with the proposal more costly and difficult. The 
comments indicated that having a standard setter recognized early 
relative to the compliance date for the proposal's substantive 
requirements could reduce industry costs. Based on these comments, the 
CFPB expects that the alternative of waiting to finalize the provisions 
in this final rule would have increased costs to industry of complying 
with any substantive compliance requirements finalized in a potential 
future rulemaking.
Potential Impacts on Depository Institutions and Credit Unions With $10 
Billion or Less in Total Assets, as Described in Section 1026
    The only impacts attributable to this final rule on depository 
institutions and credit unions with $10 billion or less in total assets 
would be through their roles

[[Page 49090]]

as members of standard setters that choose to apply for recognition. 
The CFPB expects these costs would be the same as the costs faced by 
any members of such standard setters, as described earlier in this 
part.
Potential Impacts on Consumers in Rural Areas, as Described in Section 
1026
    The CFPB does not anticipate changes in industry standards 
attributable to this final rule and, thus, no impacts on consumers in 
rural areas.

VII. Regulatory Flexibility Act Analysis

    The Regulatory Flexibility Act (RFA), as amended by the Small 
Business Regulatory Enforcement Fairness Act of 1996, requires each 
agency to consider the potential impact of its regulations on small 
entities, including small businesses, small governmental units, and 
small not-for-profit organizations. The RFA defines a ``small 
business'' as a business that meets the size standard developed by the 
Small Business Administration pursuant to the Small Business Act.
    The RFA generally requires an agency to conduct an initial 
regulatory flexibility analysis (IRFA) and a final regulatory 
flexibility analysis (FRFA) of any rule subject to notice-and-comment 
rulemaking requirements, unless the agency certifies that the rule 
would not have a significant economic impact on a substantial number of 
small entities. The Bureau also is subject to certain additional 
procedures under the RFA involving the convening of a panel to consult 
with small business representatives before proposing a rule for which 
an IRFA is required.
    The CFPB convened a panel of small business representatives and 
conducted an IRFA as part of the proposal. However, this final rule 
includes only a limited number of provisions from that proposal, and 
none of the provisions being finalized impose significant compliance 
costs on small entities. As a result, the CFPB is not conducting a FRFA 
as part of this final rule. The CFPB would satisfy the requirements of 
the RFA by conducting a FRFA when it finalizes any provisions imposing 
significant compliance costs on small entities.
    Some standard setters may be small entities, or may have members 
that are small entities. However, the CFPB expects nine or fewer 
standard setters to apply for recognition, which is not a substantial 
number of entities relative to all industry standard setters.
    From a cost perspective, the CFPB expects any costs incurred by 
standard setters to be spread across all members, including both small 
entities and larger entities. This implies per-member costs 
substantially lower than the $10,604 in per-standard setter costs 
estimated above. Such costs will not be a significant economic impact 
on small entity members of standard setters.
    Accordingly, the Director certifies that this final rule will not 
have a significant economic impact on a substantial number of small 
entities.

VIII. Paperwork Reduction Act

    Under the Paperwork Reduction Act of 1995 (PRA), Federal agencies 
are generally required to seek, prior to implementation, approval from 
the Office of Management and Budget (OMB) for information collection 
requirements. Under the PRA, the Bureau may not conduct or sponsor, 
and, notwithstanding any other provision of law, a person is not 
required to respond to, an information collection unless the 
information collection displays a valid control number assigned by OMB.
    The Bureau has determined that this final rule does not contain any 
new or substantively revised information collection requirements.

IX. Congressional Review Act

    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the CFPB will submit a report containing this rule and other required 
information to the U.S. Senate, the U.S. House of Representatives, and 
the Comptroller General of the United States prior to the rule taking 
effect. The Office of Information and Regulatory Affairs has designated 
this rule as not a ``major rule'' as defined by 5 U.S.C. 804(2).

X. Severability

    If any provision in Sec. Sec.  1033.101, 1033.131, 1033.141, or 
appendix A, or any application of a provision, is stayed or determined 
to be invalid, the remaining provisions or applications are severable 
and shall continue in effect.

List of Subjects 12 CFR Part 1033

    Banks, banking, Consumer protection, Credit, Credit unions, 
Electronic funds transfers, National banks, Privacy, Reporting and 
recordkeeping requirements, Savings associations, Voluntary standards.

Authority and Issuance

0
For the reasons set forth in the preamble, the CFPB adds 12 CFR part 
1033, as follows:

PART 1033--PERSONAL FINANCIAL DATA RIGHTS

Subpart A--General
Sec.
1033.101 Authority, purpose, and organization.
1033.111 [Reserved].
1033.121 [Reserved].
1033.131 Definitions.
1033.141 Standard-setting bodies.
Subpart B--[Reserved]
Subpart C--[Reserved] Subpart D--[Reserved]
Appendix A--How To Apply for Recognition as a Standard Setter

    Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5532; 12 
U.S.C. 5533.

Subpart A--General


Sec.  1033.101  Authority, purpose, and organization.

    (a) Authority. The regulation in this part is issued by the 
Consumer Financial Protection Bureau (CFPB) pursuant to the Consumer 
Financial Protection Act of 2010 (CFPA), Public Law 111-203, tit. X, 
124 Stat. 1955.
    (b) Purpose. This part implements the provisions of section 1033 of 
the CFPA, in part, by utilizing industry standards developed by 
standard-setting bodies recognized by the CFPB.
    (c) Organization. This part is organized as follows:
    (1) Subpart A establishes the authority, purpose, organization, and 
definitions applicable to this part, and is reserved for other 
purposes.
    (2) Subpart B is reserved.
    (3) Subpart C is reserved.
    (4) Subpart D is reserved.
    (5) Appendix A provides instructions for how a standard-setting 
body would apply for CFPB recognition.


Sec.  1033.111   [Reserved].


Sec.  1033.121   [Reserved].


Sec.  1033.131   Definitions.

    For purposes of this part, the following definitions apply:
    Consensus standard means a standard that is adopted by a recognized 
standard setter and that continues to be maintained by that recognized 
standard setter.
    Recognized standard setter means a standard-setting body that has 
been recognized by the CFPB under Sec.  1033.141.

[[Page 49091]]

Sec.  1033.141   Standard-setting bodies.

    (a) Recognition of a standard-setting body. A standard-setting body 
may request CFPB recognition. Recognition will last up to five years, 
absent revocation. The CFPB will not recognize a standard-setting body 
unless it demonstrates that it satisfies the following attributes:
    (1) Openness: The sources, procedures, and processes used are open 
to all interested parties, including: consumer and other public 
interest groups with expertise in consumer protection, financial 
services, community development, fair lending, and civil rights; 
authorized third parties; data providers; data recipients; data 
aggregators and other providers of services to authorized third 
parties; and relevant trade associations. Parties can meaningfully 
participate in standards development on a non-discriminatory basis.
    (2) Balance: The decision-making power is balanced across all 
interested parties, including consumer and other public interest 
groups, and is reflected at all levels of the standard-setting body. 
There is meaningful representation for large and small commercial 
entities within these categories. No single interest or set of 
interests dominates decision-making. Achieving balance requires 
recognition that, even when a participant may play multiple roles, such 
as data provider and authorized third party, the weight of that 
participant's commercial concerns may align primarily with one set of 
interests. The ownership of participants is considered in achieving 
balance.
    (3) Due process and appeals: The standard-setting body uses 
documented and publicly available policies and procedures, and it 
provides adequate notice of meetings and standards development, 
sufficient time to review drafts and prepare views and objections, 
access to views and objections of other participants, and a fair and 
impartial process for resolving conflicting views. An appeals process 
is available for the impartial handling of procedural appeals.
    (4) Consensus: Standards development proceeds by consensus, which 
is defined as general agreement, though not necessarily unanimity. 
During the development of consensus, comments and objections are 
considered using fair, impartial, open, and transparent processes.
    (5) Transparency: Procedures or processes for participating in 
standards development and for developing standards are transparent to 
participants and publicly available.

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--[Reserved]

Appendix A to Part 1033--Personal Financial Data Rights Rule: How To 
Apply for Recognition as a Standard Setter

    If you want the CFPB to designate your organization as a 
recognized standard setter, you should follow the steps described 
below.
    We may amend this process from time to time.

Step One: Requesting Recognition

    Submit a written request for recognition.\1\
---------------------------------------------------------------------------

    \1\ Sensitive personal information should not be provided.
---------------------------------------------------------------------------

    This should include key contact information, evidence of your 
organization's policies and practices,\2\ and an explanation of how 
your organization satisfies each of the requirements in the Personal 
Financial Data Rights rule to be a recognized standard setter.\3\ 
Your request should also describe how current and/or anticipated 
standards issued by your organization relate to open banking.
---------------------------------------------------------------------------

    \2\ Evidence may include (but is not limited to) charters, 
bylaws, policies, procedures, fee schedules, meeting minutes, 
membership lists, financial statements/disclosures, publicly 
available materials, and issued standards.
    \3\ Relevant legal requirements are described at 12 CFR 
1033.141. When explaining how your organization meets these 
requirements, you should reference relevant elements of the evidence 
you submit in support of your application.
---------------------------------------------------------------------------

    In advance of filing your request, you can seek a pre-filing 
meeting with us. We can walk you through the application process and 
help you make a complete submission.
    Send formal submissions, as well as requests for pre-filing 
meetings, to: [email protected].

Step Two: Additional Information and Public Comment

    After reviewing your submission, we may request additional 
information to ensure that your application is complete.
    We may publish your application.
    We may also seek public input on your application and invite 
your responses to any information we receive on that basis.

Step Three: Our Review

    When reviewing your application, we consider whether your 
policies and practices meet all the requirements for recognition. We 
also evaluate whether your application is accurate and complete.
    We prioritize and review applications based on the extent to 
which recognizing your organization helps us to implement open 
banking.\4\
---------------------------------------------------------------------------

    \4\ Section 1033 of the Consumer Financial Protection Act, 12 
U.S.C. 5533, describes the CFPB's role in implementing open banking.
---------------------------------------------------------------------------

Step Four: Application Decision

    CFPB recognition will be publicly disclosed on our website, 
along with the applicable terms and conditions of such recognition, 
such as its duration.
    If the CFPB declines to recognize your organization, we will 
notify you.
    You may withdraw your application at any time or for any reason.
    If we determine that your organization is close to meeting, but 
does not yet meet, the requirements for CFPB recognition, we may ask 
you to provide a written plan specifying how and when you will take 
the steps required for full recognition. If that plan is 
satisfactory, we may state on our website that your organization has 
received contingent recognition. Once you provide us with evidence 
that you have successfully executed on that plan (or otherwise 
addressed the relevant contingences), the CFPB may extend full 
recognition.

Step Five: Recognition

    There are several points to keep in mind about recognition.
    As a recognized standard setter, you agree that the CFPB may 
monitor your organization and that you will provide information that 
we request.
    You must also provide us, within 10 days, written explanation of 
any material change to information that was submitted with your 
application or during recognition, as well as any reason your 
organization may no longer meet underlying requirements for 
recognition.
    In addition, you must meet any other specified terms and 
conditions of your recognition, which may include our reserving the 
right to observe or participate in standard setting.
    If your recognition is set to expire, you can apply for re-
recognition by re-starting at Step One at least 180 days before 
expiration. We may temporarily extend your recognition while we 
consider your request for re-recognition.
    We may modify or revoke your recognition. The CFPB expects to 
notify you of the reasons it intends to revoke or modify 
recognition, and to provide your organization with an opportunity to 
address the CFPB's concerns.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-12658 Filed 6-10-24; 8:45 am]
BILLING CODE 4810-am-P