New rule establishes process for recognizing data sharing standards and prevents dominant incumbents from squelching startups
Today, the Consumer Financial Protection Bureau (CFPB) finalized a rule outlining the qualifications to become a recognized industry standard setting body, which can issue standards that companies can use to help them comply with the CFPB’s upcoming Personal Financial Data Rights Rule. Today’s rule identifies the attributes that standard setting bodies must demonstrate in order to be recognized by the CFPB. The rule also includes a step-by-step guide for how standard setters can apply for recognition and how the CFPB will evaluate applications.
“Industry standards can be weaponized by dominant firms in order to maintain their market position, undermining competition for all,” said CFPB Director Rohit Chopra. “Today’s rule will prevent these firms from rigging standards in their favor by identifying attributes the CFPB will use to recognize standard setters.”
The CFPB is working to accelerate the shift to open banking in the United States. In 2010, Congress passed into law new personal financial data rights for consumers. Guaranteeing a consumer’s right to their data will open up more opportunities for smaller financial institutions and startups offering products and services. However, these new rights have not taken full effect, because the CFPB never issued a rule. In October 2023, the CFPB proposed a rule to implement these rights and will finalize it in the coming months.
As part of the upcoming Personal Financial Data Rights rule, the CFPB expects to allow companies to use technical standards developed by standard-setting organizations recognized by the CFPB. Today’s rule kicks off the process for standard-setting organizations to seek formal recognition.
The new rule identifies the attributes that standard setters must demonstrate in order to be recognized by the CFPB. Consensus standards issued by recognized standard setters can help put the Personal Financial Data Rights rule into action and accelerate the financial system’s movement towards truly open banking.
To be recognized by the CFPB, the standard setters must apply to the CFPB and display the following attributes:
- Openness: The CFPB will not recognize any standard-setting organization that is rigged in favor of any set of industry players. The process must be open to all interested parties, including public interest groups, app developers, and a broad range of financial firms with a stake in open banking.
- Transparency: Procedures must be transparent to participants and publicly available.
- Balanced decision-making: The decision-making power to set standards must be balanced across all interested parties, including consumer and other public interest groups. There must also be meaningful representation for large and small commercial entities. No single special interest can dominate the decision-making process.
- Consensus: Standards development must proceed by consensus, though not necessarily unanimity. Comments and objections must be considered using fair and impartial processes.
- Due process and appeals: The standard-setting body must use documented and publicly available policies and procedures, provide adequate notice of meetings, sufficient time to review drafts and prepare views and objections, access to views and objections of other participants, and a fair and impartial process for resolving conflicting views. An appeals process is also available for the impartial handling of procedural appeals.
Today’s rule also includes a mechanism for the CFPB to revoke the recognition of standard setters and a maximum recognition duration of five years, after which recognized standard setters will have to apply for re-recognition. These protections will ensure recognized standard setters’ ongoing adherence to the attributes codified by the CFPB today. The rule also contains a step-by-step guide to help interested standard setters apply for recognition. The guide describes five steps in the application and recognition process, and the CFPB invites interested standard setters to begin engaging with us when they are ready to demonstrate their adherence to the attributes the CFPB codified today.
Read today’s rule on recognition of standard-setting organizations.
Read the proposed rule on Personal Financial Data Rights.
Read the step-by-step guide for how standard setters can apply for recognition.
Consumers can submit complaints about financial products or services by visiting the CFPB’s website or by calling (855) 411-CFPB (2372).
Employees of companies who believe their company has violated federal consumer financial laws are encouraged to send information about what they know to whistleblower@cfpb.gov.