CFPB Section 1033: Effective, Enjoined, and Under Reconsideration

TL;DR

• The CFPB’s 2024 personal financial data rights rule took effect January 17, 2025, and still sits in 12 CFR part 1033.
• On October 29, 2025, a federal court in Kentucky enjoined the CFPB from enforcing it until the Bureau finishes reconsidering the rule. Don’t describe that as “the rule never took effect.”
• The reconsideration started with an August 2025 ANPRM on four issues: consumer representatives, fees, data security, and data privacy.
• OIRA received a proposed rule on August 4, 2026. As of October 22, 2026, it was still pending review and no revised text had been published. Build the reusable plumbing now; don’t hard-code a fee model nobody has seen.

October 22, 2026 Status Update

Section 1033 has five status layers, and each one needs its own line in your regulatory change log:

The court’s December 10, 2025 order adds a wrinkle worth tracking: after the Justice Department’s Office of Legal Counsel concluded the CFPB could not request Federal Reserve funding at that time, the Bureau told the court it would work toward an interim final 1033 rule, and the judge ordered the CFPB to notify the court within five days of issuing one. What OIRA received in August is logged at the proposed-rule stage. Either path ends in Federal Register text — and that publication, not press coverage, is your rebaseline trigger.

What the 2024 Rule Actually Requires

You can’t scenario-plan changes to a rule you haven’t read. The current codified text at 12 CFR part 1033 is the baseline any revision will be measured against.

Who is a data provider

Section 1033.111 covers two product types — Regulation E accounts and Regulation Z credit cards — plus facilitating payments from them. A data provider is a Regulation E financial institution, a Regulation Z card issuer, or any other person that controls or holds information about a covered product the consumer obtained from it. The rule’s own example is a digital wallet provider.

Depository institutions at or below the SBA size standard are carved out of subparts B and C, measured on average total assets across the last four quarterly call reports. Once you cross the threshold, the obligations stick even if assets later dip.

What data must be available

Section 1033.211 lists six categories of covered data:

Interface, fee, and performance obligations

• No fees (§ 1033.301(c)): a data provider “must not impose any fees or charges” on a consumer or authorized third party for establishing or maintaining the interfaces or responding to data requests. This is the provision the banks most want revisited, and the ANPRM asked about fee assessment directly.
• Machine-readable data (§ 1033.301(b)): consumers and authorized third parties must be able to retain the file and transfer it to another system.
• Performance (§ 1033.311(c)): the developer interface’s response rate must be at least 99.5 percent in each calendar month, with responses within a commercially reasonable time.
• Access frequency (§ 1033.311(d)): a provider must not unreasonably restrict how often it responds to requests.

What authorized third parties must do

Section 1033.421 is the part fintechs and aggregators should be reading. Third parties may collect, use, and retain covered data only as reasonably necessary to provide the product the consumer asked for. Targeted advertising, cross-selling, and selling covered data are expressly not treated as part of any other product. Collection must stop one year after the consumer’s most recent authorization unless the consumer reauthorizes, and after revocation or lapse, retained data can be kept only if still reasonably necessary.

The compliance dates on paper

Section 1033.121(b) still lists tiered dates, starting April 1, 2026 for depository institutions with at least $250 billion in assets (and nondepositories with at least $10 billion in receipts) and running through April 1, 2030 for depositories between $850 million and $1.5 billion. Law firm summaries of the litigation report that earlier court orders had already pushed back the first deadline. With enforcement enjoined until reconsideration ends, treat every codified date as placeholder text: a revised rule is very likely to set new ones.

Effective Does Not Mean Enforceable Today

The 2024 rule reached its effective date. A later preliminary injunction barred CFPB enforcement. Those facts coexist.

Use precise language:

• Correct: “The rule is effective but currently enjoined from CFPB enforcement until the CFPB completes reconsideration.”
• Incorrect: “The rule never took effect” or “The rule was vacated.”
• Incomplete: “The rule was stayed,” without identifying what the order restrains and how long.

The injunction restrains the CFPB. It doesn’t touch your contracts with aggregators, your GLBA privacy and safeguards obligations, or your state privacy law exposure. Recheck the live docket before any legal or implementation decision.

The ANPRM Was Not a Replacement Rule

The reconsideration ANPRM asked for comment on four issues: who can act as a consumer’s “representative,” whether data providers may assess fees, data security, and data privacy. An advance notice can identify policy questions and solicit evidence. It does not:

• amend the existing regulation;
• publish proposed replacement text;
• complete notice-and-comment rulemaking; or
• establish a new compliance date.

Treat ANPRM themes as scenarios, not requirements. Use the CFPB’s rule-under-development page and the OIRA record for monitoring, but note the CFPB page had not been updated past the ANPRM as of this writing.

Scenario Planning Without Betting on Unpublished Text

Here’s how the four ANPRM issues map to decisions you’d otherwise be tempted to make early:

What Institutions Can Do Now

1. Keep the status ledger honest

Assign owners for the court docket, CFPB rulemaking, OIRA status, Federal Register publication, and implementation decisions. Record source and review date for each. If a board deck still says “compliance date April 2026,” fix it.

2. Map data and systems

Identify which of the six covered-data categories you hold, where they live, data quality constraints, interfaces, authentication, consent, revocation, retention, and deletion. This supports privacy, security, and third-party risk management work even if scope changes.

3. Inventory third-party access

Document aggregators, screen-scraping traffic, direct APIs, contracts, purposes, data fields, credentials, onward transfers, incidents, and termination rights. Aggregators are also a fourth-party risk problem: your customer’s fintech app may reach you through a vendor you’ve never contracted with. For nonbank third parties, the FTC Safeguards Rule already applies regardless of 1033.

4. Separate reusable work from rule-specific work

Reusable: data lineage, API security, consent evidence, vendor inventory, access logging, uptime monitoring. Rule-specific: exact covered-data fields, the 99.5 percent performance metric, authorization wording, fee treatment, and compliance dates. Avoid irreversible design choices in the second category.

5. Set evidence-based rebaseline triggers

Triggers: a Federal Register proposal or interim final rule, a final rule, a modified or dissolved injunction, or an official compliance-date action. OIRA review concluding is a monitoring event — the clock starts when text is public.

So What?

The 2024 rule is effective, enforcement is enjoined until reconsideration finishes, a proposed revision has sat at OIRA since August 4, and no revised text was public as of October 22, 2026. All of that belongs in the compliance record.

Keep doing the low-regret data-governance and interface work. Don’t redesign contracts around an unverified fee reversal or treat an OIRA title as proposed law.

The Data Privacy Compliance Kit can organize inventory, retention, third-party, and consumer-rights evidence. Section 1033 implementation still requires current court and rulemaking review.

Primary sources: 2024 final rule | 12 CFR part 1033 | 2025 reconsideration ANPRM | CFPB reconsideration page | OIRA pending-review record | Forcht Bank v. CFPB, Dec. 10, 2025 order