Rule2024-12658
Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
June 11, 2024
Effective
July 11, 2024
Issuing agencies
Consumer Financial Protection Bureau
Abstract
The Consumer Financial Protection Bureau (CFPB) is finalizing in part its proposed rule on consumer data rights under section 1033 of the Consumer Financial Protection Act. This final rule establishes minimum attributes a standard-setting body must possess to receive CFPB recognition and to issue consensus standards when the full rule is finalized. The CFPB is also releasing its process for how standard setters apply for CFPB recognition.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 113 (Tuesday, June 11, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 113 (Tuesday, June 11, 2024)]
[Rules and Regulations]
[Pages 49084-49091]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-12658]
=======================================================================
-----------------------------------------------------------------------
CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Part 1033
[Docket No. CFPB-2023-0052]
RIN 3170-AA78
Required Rulemaking on Personal Financial Data Rights; Industry
Standard-Setting
AGENCY: Consumer Financial Protection Bureau.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Consumer Financial Protection Bureau (CFPB) is finalizing
in part its proposed rule on consumer data rights under section 1033 of
the Consumer Financial Protection Act. This final rule establishes
minimum attributes a standard-setting body must possess to receive CFPB
recognition and to issue consensus standards when the full rule is
finalized. The CFPB is also releasing its process for how standard
setters apply for CFPB recognition.
DATES: This final rule is effective July 11, 2024.
FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory
Implementation and Guidance Program Analyst, Office of Regulations, at
202-435-7700 or <a href="https://reginquiries.consumerfinance.gov/">https://reginquiries.consumerfinance.gov/</a>. If you
require this document in an alternative electronic format, please
contact <a href="/cdn-cgi/l/email-protection#5a191c0a18051b39393f292933383336332e231a393c2a38743d352c"><span class="__cf_email__" data-cfemail="ecafaabcaeb3ad8f8f899f9f858e8580859895ac8f8a9c8ec28b839a">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
I. Summary
The CFPB is finalizing certain provisions of its Required
Rulemaking on Personal Financial Data Rights (Personal Financial Data
Rights rule),\1\ which, among other proposed provisions in the rule,
sought to promote fair, open, and inclusive industry standard-setting.
The CFPB proposed that standards adopted by CFPB-recognized standard
setters might be used to facilitate implementation of a final Personal
Financial Data Rights rule. Today's rule revises and finalizes part of
proposed Sec. 1033.131 (definitions) and all of proposed Sec.
1033.141 (attributes a standard-setting body must demonstrate in order
to be recognized by the CFPB). Included with this rule is a step-by-
step guide for how standard setters apply for recognition and how the
CFPB will evaluate applications.
---------------------------------------------------------------------------
\1\ 88 FR 74796 (Oct. 31, 2023).
---------------------------------------------------------------------------
II. Background
A. Introduction
Consumer electronic access to personal financial data, including
and especially open banking,\2\ holds the potential to intensify
consumer-friendly competition and innovation. Fair, open, and inclusive
industry standard-setting play a critical role in ensuring the open
banking system reaches its full potential to benefit consumers and
competition.
---------------------------------------------------------------------------
\2\ This Federal Register document generally uses the term
``open banking'' to refer to the network of entities sharing
personal financial data with consumer authorization. Some
stakeholders use the term ``open finance'' because of the role of
nondepositories as important data sources. The CFPB views the two
terms as interchangeable, but generally uses ``open banking''
because that term is more commonly used in the United States.
---------------------------------------------------------------------------
By including section 1033 in the Consumer Financial Protection Act
of 2010 (CFPA),\3\ Congress explicitly recognized the importance of
personal financial data rights, and section 1033(d) recognizes the
importance of standardized formats, especially with regard to data
formats. In 2023, the CFPB issued a proposed rule to begin implementing
section 1033, with the goal of accelerating the shift to a more open
and decentralized system of consumer data access.
---------------------------------------------------------------------------
\3\ The CFPA is title X of the Dodd-Frank Wall Street Reform and
Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 2008
(2010).
---------------------------------------------------------------------------
The proposed rule reflected the CFPB's preliminary determination
that conformance with industry standards would constitute certain
evidence of compliance with various substantive provisions of the
proposed rule (or, in the case of data formats, would be sufficient for
a data provider to be deemed compliant), provided that such standards
were issued by a body recognized by the CFPB as possessing certain
attributes. The proposed rule set forth the CFPB's view that industry
standard setters that operate in a fair, open, and inclusive manner
have a critical role to play in ensuring a safe, secure, reliable, and
competitive data access framework. In the proposed rule, the CFPB noted
that Federal regulations with very granular technical requirements
could rapidly become obsolete, while industry-led standard-setting
would be better able to keep pace with changes in the market and
technology, as long as that standard-setting was fair, open, and
inclusive.
U.S. government agencies have been historically involved in the
development and use of standards to meet agency missions and
priorities. Office of Management and Budget (OMB) Circular A-119 \4\
reflects the U.S. government's commitment to a U.S. industry-led,
voluntary consensus standards system. Broad use of such standards
enhances the safety and security of products, reduces consumer costs,
and expands consumers' options in the marketplace. Additionally,
voluntary consensus standards ensure that no faction of industry can
use its market power to impose its preferences on the entire market.
Further, the use of consensus standards significantly reduces costs to
agencies that would otherwise be incurred if agencies had to develop
and maintain agency-unique standards.
---------------------------------------------------------------------------
\4\ OMB Circular A-119 was originally published in 1996; see
<a href="https://www.govinfo.gov/content/pkg/FR-1996-12-27/html/96-32917.htm">https://www.govinfo.gov/content/pkg/FR-1996-12-27/html/96-32917.htm</a>.
The current Circular, effective January 27, 2016, is available at
<a href="https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf">https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf</a>.
---------------------------------------------------------------------------
B. Summary of the Rulemaking Process
Outreach and Engagement
The CFPB published its proposed rule on October 31, 2023.\5\ The
public comment period on the proposed rule closed on December 29, 2023,
and the CFPB received comments from individuals and entities
representing various diverse interests. In addition, the CFPB also
considered comments received after the comment period closed via ex
parte submissions and meetings.\6\ Materials on the record, including
all ex parte submissions and summaries of ex parte meetings, are
available on the public docket for this rulemaking.\7\
---------------------------------------------------------------------------
\5\ 88 FR 74796 (Oct. 31, 2023). A description of the CFPB's
outreach and engagement before issuing the proposed rule, including
the CFPB's convening of a small business advisory review panel
pursuant to the Small Business Regulatory Enforcement Fairness Act
of 1996, is included in the proposal at 74801-02.
\6\ CFPB, Policy on Ex Parte Presentations in Rulemaking
Proceedings, 82 FR 18687 (Apr. 21, 2017).
\7\ See https://www. <a href="https://www.regulations.gov/docket/CFPB-2023-0052/comments">https://www.regulations.gov/docket/CFPB-2023-0052/comments</a>.
---------------------------------------------------------------------------
This final rule discusses those substantive comments relevant to
the attributes of standard-setting bodies or the process by which the
CFPB will recognize standard-setting bodies. For the most part,
commenters that addressed the issues discussed in this final rule and
in the appended application procedures supported the CFPB's plan to
recognize standard setters that are fair, open, and inclusive, and
generally agreed with the attributes the CFPB proposed to use to
determine whether a standard-setting body was
[[Page 49085]]
fair, open, and inclusive. Some commenters requested that the CFPB
alter, clarify, or remove specific provisions of the proposed
attributes, or made suggestions for how the CFPB should make its
determination as to whether to recognize a given standard-setting body.
Other commenters argued that the CFPB does not have legal authority to
recognize standard-setting bodies, or critiqued how the proposed rule
described a potential recognition process. The CFPB has considered
these comments in adopting this final rule. The CFPB will discuss and
address all other substantive comments when it finalizes the remainder
of the Personal Financial Data Rights rule, including the many comments
received concerning the role that adherence to a consensus standard
should or should not play in evaluating compliance with the particular
underlying provisions of the final rule.\8\ Comments focused on the
application procedures described in the appendix are discussed in
section IV.C.
---------------------------------------------------------------------------
\8\ Accordingly, the CFPB does not expect its finalization of
the remainder of the Personal Financial Data Rights rule to affect
the content of this rule. If in finalizing the remainder of the rule
the CFPB concludes that this rule should be amended, the CFPB would
do so.
---------------------------------------------------------------------------
Prior to issuing this final rule, in accordance with CFPA sections
1033(e) and 1022(b)(2)(B), the CFPB consulted on several occasions with
staff from the prudential regulators \9\ and the Federal Trade
Commission to discuss various aspects of the proposed rule, including
criteria for and processes with respect to standard-setting bodies.
---------------------------------------------------------------------------
\9\ Prudential regulators refer to the Board of Governors of the
Federal Reserve System, Federal Deposit Insurance Corporation,
National Credit Union Association, and Office of the Comptroller of
the Currency.
---------------------------------------------------------------------------
III. Legal Authority
The CFPB is issuing this final rule pursuant to its authority under
the CFPA. As set forth in section 1021 of the CFPA, Congress
established the CFPB to ensure that ``all consumers have access to
markets for consumer financial products and services and that markets
for consumer financial products and services are fair, transparent, and
competitive.'' Congress also authorized the CFPB to exercise its
authorities under Federal consumer financial law, including the CFPA,
to ensure that, with respect to consumer financial products and
services, consumers have ``timely and understandable information to
make responsible decisions about financial transactions,'' ``consumers
are protected from unfair, deceptive, or abusive acts and practices and
from discrimination,'' that ``markets for consumer financial products
and services operate transparently and efficiently to facilitate access
and innovation,'' and that ``Federal consumer financial law is enforced
consistently without regard to the status of a person as a depository
institution in order to promote fair competition.''
A. CFPA Section 1033
CFPA section 1033(a) and (b) provide that, subject to rules
prescribed by the CFPB, a covered person shall make available to a
consumer, upon request, information in the control or possession of the
covered person concerning the consumer financial product or service
that the consumer obtained from such covered person, subject to certain
exceptions. The information must be made available in an electronic
form usable by consumers. In addition, CFPA section 1033(d) provides
that the CFPB, by rule, shall prescribe standards applicable to covered
persons to promote the development and use of standardized formats for
information, including through the use of machine-readable files, to be
made available to consumers under this section. Recognition of
standard-setting bodies that are fair, open, and inclusive can
facilitate implementation of these authorities. Further, CFPA section
1033(e) requires that the CFPB consult with the prudential regulators
and the FTC to ensure, to the extent appropriate, that certain
objectives are met.
B. CFPA Section 1022(b)
CFPA section 1022(b)(1) authorizes the CFPB to, among other things,
prescribe rules and issue orders ``as may be necessary or appropriate
to enable the CFPB to administer and carry out the purposes and
objectives of the Federal consumer financial laws, and to prevent
evasions thereof.'' The CFPA is a Federal consumer financial law. This
rule carries out the purposes and objectives of the CFPA and prevents
evasions thereof, by requiring standard-setting bodies to apply through
the CFPB for recognition to adopt consensus \10\ standards.
---------------------------------------------------------------------------
\10\ The proposed rule referred to standards issued by a
recognized standard-setting body as ``qualified industry
standards.'' This final rule instead uses the term ``consensus
standards,'' to reflect better the intent of ensuring that the
standards are the product of fair, open, and inclusive standard-
setting. In addition, in this final rule a standard-setting body
recognized by the CFPB will be referred to as a ``recognized
standard setter.''
---------------------------------------------------------------------------
IV. Discussion of the Final Rule
A. Overview
This final rule identifies the attributes that a standard-setting
body must demonstrate in order to be recognized by the CFPB. It also
includes procedures for standard setters to apply for recognition by
the CFPB. The following addresses comments on the proposed rule
relevant to each topic.
B. Consensus Standards and Recognized Standard Setters
Definitions for Recognized Standard Setter and Consensus Standard
The CFPB proposed in Sec. 1033.131 to define a ``qualified
industry standard'' as a standard issued by a standard-setting body
that is fair, open, and inclusive in accordance with proposed Sec.
1033.141(a). The CFPB proposed in Sec. 1033.141 that a standard-
setting body is fair, open and inclusive when it satisfies seven
requisite attributes: openness, balance, due process, appeals,
consensus, transparency, and that the standard-setting body have been
recognized by the CFPB as an issuer of qualified industry standards
within the last three years.
Some commenters asked the CFPB to clarify when a standard issued by
a recognized standard-setting body becomes a consensus standard, and,
conversely, when a consensus standard ceases to have consensus status.
A trade group commenter suggested that the CFPB remove the language in
proposed Sec. 1033.141(a)(7) that a standard-setting body must have
been recognized by the CFPB within the last three years, suggesting
that this recognition period would make it difficult for industry to
use such standards or, appropriate, switch away from them. One
commenter expressed concern that the loss of a standard's status as a
consensus standard could cause market uncertainty, because the covered
financial institutions would need to identify a different recognized
standard setter and possibly have to modify its practices to conform
with the consensus standards of that recognized standard setter.
After considering these comments, the CFPB is making several
changes to Sec. Sec. 1033.131 and 1033.141 relating to both standard
setters and the standards they issue. First, this final rule replaces
the term ``qualified industry standard'' with ``consensus standard,''
and adds a definition of ``recognized standard setter,'' a term not
defined in the proposed rule. These editorial changes are intended to
better organize the structure of these key terms, enhance readability
of the final rule, and adopt terminology that more clearly describes
the defined terms.
The definition of ``consensus standard'' in final Sec. 1033.131
provides additional specificity regarding when a
[[Page 49086]]
given standard is a consensus standard. Final Sec. 1033.131 provides
that to be a ``consensus standard'' the standard must be one that is
adopted by a recognized standard setter, and that continues to be
maintained by that recognized standard setter. Regarding the
commenters' concern about market uncertainty, the CFPB expects
revocation of recognition for a standard setter to be a rare
occurrence, and in that event the CFPB would issue guidance to help
manage a transition.
The CFPB has determined that it is appropriate to require a
recognized standard setter to seek renewal of its recognition on a
periodic basis. However, in Sec. 1033.141(a), this final rule extends
the maximum duration of the CFPB's recognition of a standard-setting
body from the proposed duration of three years to five years. Periodic
review and re-recognition mitigate the risk of outdated standards,
which the CFPB's approach to industry standards was intended in part to
avoid. Additionally, periodic review by the CFPB will ensure standard
setters carefully mind their governance and procedures and keep them in
conformance with the attributes. However, extending the maximum
recognition period to five years in this final rule is warranted, for
two main reasons. First, a five-year recognition period will mean that,
should one or more standard-setting body receive early recognition from
the CFPB, such recognition--and by extension their standards' status as
consensus standards--would last further into the period during which
industry is initially coming into compliance with the forthcoming
Personal Financial Data Rights rule, providing additional certainty to
smaller data providers covered by the rule. Additionally, the CFPB
expects that reducing the frequency of periodic review and re-
recognition by the CFPB will encourage standard-setting bodies to
obtain recognition because their standards will retain consensus status
for a longer period without the burden of seeking re-recognition.
The CFPB's Authority To Recognize Standard-Setting Bodies
Several industry commenters disputed the Bureau's legal authority
to recognize standard-setting bodies that would then issue consensus
standards for purposes of facilitating implementation of a final
Personal Financial Data Rights rule. In response, the CFPB notes that,
as discussed above in this final rule, establishing a framework for
standard setting is authorized by CFPA section 1033(a) and (d) and the
CFPB's authority to issue rules under CFPA section 1022(b)(1). The CFPB
expects that individual recognition decisions will be authorized by
this final rule, by the CFPB's authority to issue orders under CFPA
section 1022(b)(1), and additionally by the CFPB's authority to issue
declaratory orders to ``to terminate a controversy or remove
uncertainty'' under section 554(e) of the Administrative Procedure
Act.\11\
---------------------------------------------------------------------------
\11\ 5 U.S.C. 554(e).
---------------------------------------------------------------------------
Attributes of Standard-Setting Bodies
Openness
The CFPB proposed to include ``openness'' as a necessary attribute
for CFPB recognition, and that a standard-setting body's openness would
be evaluated by reviewing whether the standard-setting body's sources,
procedures, and processes are open to all interested parties, and
whether those interested parties can meaningfully participate in
standards development on a non-discriminatory basis.
A few commenters addressed the proposed openness attribute.
Consumer advocate commenters supported the explicit inclusion of
consumer groups as an interested party for an open standard-setting
body. A small number of commenters recommended alterations to the
attribute. One industry trade group called for the CFPB to clarify that
only the members of the standard-setting body would need to
meaningfully participate in the standards development. Additionally,
some third-party industry commenters asked the CFPB to clarify that a
standard-setting body that is ``open'' for purposes of the attribute
includes all types of financial institutions, including financial
technology companies. In support of this consideration, one commenter
highlighted what it described as the undue influence of banks in
another country's standard-setting body due to the other country's
exclusion of financial technology voices in the standard-setting body.
This final rule adopts Sec. 1033.141(a)(1) mostly as proposed,
with some additional clarifying text. In response to commenter concern
that certain financial technology sectors might be excluded if not
explicitly mentioned, the CFPB has added explicit reference to ``data
recipients'' as an interested party in this final rule. The inclusion
of data recipients also helps ensure that data providers and recipients
are not forever compelled to rely on intermediaries with commercial
interests that may not consistently align with the advancement of open
banking standards. This final rule does not adopt commenters' request
to limit ``openness'' to only members of the standard-setting body. As
stated in this final rule, the sources of the standard-setting body
must be available to all interested parties. This language reiterates
that the CFPB expects an ``open'' standard-setting body to utilize
open-source materials that interested parties can reference. Such open-
source materials would not truly be open unless they were made
available outside the standard-setting body's membership.
Balance
The CFPB proposed to include ``balance'' as a necessary attribute
for CFPB recognition. The CFPB proposed that a standard-setting body's
balance would be evaluated by the CFPB reviewing whether the standard-
setting body's decision-making power is balanced across all interested
parties at all levels of the standard-setting body. Further, the
proposed attribute clarifies that balance could be impacted by entities
playing multiple roles, such as data provider and third party.
Additionally, the CFPB proposed that it could consider the ownership of
an entity when reviewing a standard setter's balance. Finally, the CFPB
proposed that balance would include meaningful representation of small
and large commercial entities.
A number of commenters addressed this attribute. One consumer
advocate commenter expressed their support for the proposed rule's
inclusion of consumer advocates as interested parties in an open
standard-setting body. Another consumer advocate commenter noted that
some current standards bodies do not provide the same voting rights
across categories of membership. A few commenters asked for
clarification as to what the CFPB will consider ``meaningful
representation,'' noting the importance of including small entity
voices in the decision-making processes. Additionally, one consumer
advocate commenter and one industry commenter recommended that a final
rule extend balanced representation considerations to any committee or
sub-committee involved in the standard setters decision-making
processes.
After considering these comments, the CFPB is finalizing the
requirement in Sec. 1033.141(a)(2) largely as proposed, with some
modifications. To address commenters' concerns about representation at
the committee and sub-committee level, the CFPB has revised this final
rule to state that balanced representation must be reflected at all
levels of the standard-
[[Page 49087]]
setting body. The additional ``reflected'' language provides a
standard-setting body with some flexibility to arrange adequate
committee and sub-committee representation, while also mitigating the
possibility that a particular committee or sub-committee's
representation become so unbalanced that it hinders the overall
decision-making of the standard-setting body. This final rule does not
further define ``meaningful representation'' because after
consideration the CFPB concludes that the additional language reading
``[n]o single interest or set of interests dominates decision-making''
sufficiently describes the scope of meaningful representation. Finally,
to address concerns about weighting of voting rights, this final rule
clarifies that if a participant plays multiple roles, the weight of
that participant's role will be factored into the balance
consideration. As such, if a participant has a vote as a data provider
but their primary business is as a third party, this could suggest that
the standard-setting body is not balanced. Similarly, the CFPB can look
at the ownership of a participant to determine to what degree the role
and form of that entity's participation in the standard-setting body
furthers or hinders the body's balance.
Due Process and Appeals
The CFPB proposed to include ``due process'' and ``appeals'' as
necessary attributes for CFPB recognition. The proposed due process
attribute would consider whether a standard-setting body uses
documented and publicly available policies and procedures and provides
a fair and impartial process for resolving conflicting views. The
proposed appeals attribute would consider whether the standard-setting
body provides an appeals process for the impartial handling of appeals.
A small number of commenters addressed these attributes. A few
industry trade groups recommended that a final due process attribute
should protect the anonymity of participant dialogue to encourage open
dialogue among the members of the standard-setting body. One consumer
advocate commenter recommended that a final appeals attribute focus on
the process of creating standards, rather than on the standards
themselves.
The CFPB is finalizing the proposed due process and appeals
attributes with minimal change and a non-substantive structural
modification. The structural modification is to combine the appeals and
due process attributes into one attribute (now at Sec.
1033.141(a)(3)), because both address similar issues of procedural
fairness. Additionally, the CFPB is finalizing a modification to the
appeals attribute that clarifies that the appeals process is available
for the impartial handling of procedural appeals. The CFPB is
finalizing the remainder of the attribute as proposed. Specifically,
this final rule does not add requested language about anonymity within
the standard-setting body. While anonymity may in some circumstances
help create open dialogue, the CFPB is not including in this final rule
the explicit availability of participant viewpoint anonymity because
such protection is already provided by this final rule. Standard-
setting bodies are not precluded from making viewpoints anonymous, so
long as such anonymity policies do not have the potential to undermine
a final openness, transparency, or due process attribute.
Consensus
The CFPB proposed to include ``consensus'' as a necessary attribute
for CFPB recognition. Specifically, the proposed attribute looks at
whether the standards development processes would proceed by consensus,
defined as general agreement but not unanimity.
The CFPB received little commenter input concerning the consensus
attribute. One third-party trade group recommended that a final rule
consider consensus to be when there is consensus within a particular
sector. The commenter suggested that if all third parties or all data
providers oppose a standard, then that standard should not be adopted.
Additionally, one data provider commenter recommended that a final rule
consider that the majority of the standards proposed in the Personal
Financial Data Rights rulemaking are obligations on data providers,
and, as such, consensus should require data providers to be in
agreement with a particular decision-making process of the standard-
setting body.
The CFPB is finalizing the attribute largely as proposed, and
adding language stating that consensus does not necessarily require
unanimity. This modification is to clarify that general agreement can
include unanimous decisions by the members of the standard-setting
body. This final rule does not include language stating that a single
class of standard-setting group members (like data providers or third
parties) could have unilateral power in a standard-setting body. While
consensus is important, privileging one group of members would
inappropriately give that group unwarranted influence. The provision is
also renumbered to Sec. 1033.141(a)(4) to reflect organizational
changes.
Transparency
The CFPB proposed to include ``transparency'' as an attribute for
CFPB recognition consideration. Specifically, the proposed attribute
would look at whether the procedures or processes for participating in
standards development and for developing standards are transparent to
participants and publicly available.
Several industry trade groups recommended that a final transparency
attribute protect the anonymity of participant dialogue to encourage
open dialogue among the participants in the setting of consensus
standards. As stated above in the discussion of the proposed due
process provision, standard-setting bodies are not precluded from
making viewpoints anonymous, so long as such anonymity policies do not
have the potential to undermine a final openness, transparency, or due
process attribute. Accordingly, for the reasons discussed in the
proposal, the CFPB is finalizing the transparency attribute as
proposed. The provision is also renumbered to Sec. 1033.141(a)(5) to
reflect organizational changes.
Additional Attributes
In response to the CFPB's request for comment on whether it should
include additional attributes when evaluating a standard setter for
recognition, at least one commenter suggested that a final rule should
adjust the attribute list to account for the relevance of standards
that a standard-setting body adopts.
This final rule does not include an additional ``relevance''
attribute. However, demonstrating the attributes in this final rule is
the minimum requirement for recognition; accordingly, the CFPB may
consider other information when reviewing an application for
recognition, including whether the standard-setting body will adopt and
maintain standards relevant to open banking.
C. Procedures for CFPB Recognition of Standard-Setting Bodies
High-Level Comment Summary
A number of commenters on the proposed rule encouraged the CFPB to
establish a process for recognizing standard setters as soon as
possible. Their comments generally focused on seeking clarity and
transparency from the CFPB about this process. Some industry commenters
requested that the CFPB publish its recognition procedures for comment.
In response to comments that the CFPB quickly establish a process
for recognizing standard-setting bodies, the
[[Page 49088]]
CFPB is publishing the procedures included at appendix A. These
constitute a rule of agency organization, procedure, or practice, and
thus do not require notice and comment under the Administrative
Procedure Act.\12\ As published, these procedures take account of
comments received on the proposed rule regarding procedures for
recognizing standard-setting bodies. The CFPB may publish amendments to
the procedures from time-to-time as it develops experience with this
recognition process and receives stakeholder feedback on them.
---------------------------------------------------------------------------
\12\ 5 U.S.C. 553(b).
---------------------------------------------------------------------------
Discussion of Procedures for Recognition
The CFPB is providing a plain language guide for how standard
setters should apply for recognition, how the CFPB evaluates
applications, and what standard setters can expect once recognized.
When submitting a request for recognition, the applicant should provide
information sufficient to enable a determination by the CFPB of whether
the applicant satisfies the requirements for recognition articulated in
Sec. 1033.141(a)(1) through (5). Other information provided, such as a
description of how the applicant's current and/or anticipated standards
relate to open banking, will help the CFPB understand the relevance of
the standard setter to open banking.
The procedures also allow for a pre-filing meeting with the CFPB
prior to submission of an application, so that the Bureau can provide
information about the application process and assist organizations with
submitting a complete application. During its review and discussions
with the applicant, the CFPB may request additional information from
the applicant necessary for the submission to be complete. Once it
receives a complete application, the CFPB may publish the application,
so as to enable stakeholders who believe the application is deficient
to bring the CFPB's attention to any evidence that might substantiate
such claims of deficiency.\13\ In this event, the CFPB expects to ask
the applicant to provide written responses to any such claims, which
the CFPB can then consider as part of its review and assessment of the
application. This procedure addresses comments requesting greater
public participation in the recognition process.
---------------------------------------------------------------------------
\13\ If an applicant believes that portions of its application
should be treated as confidential, it should consult the CFPB before
submitting its application.
---------------------------------------------------------------------------
The CFPB will consider the complete application, including any
adverse evidence provided to the CFPB, to evaluate whether the
applicant satisfies the recognition requirements articulated in Sec.
1033.141(a)(1) through (5). The CFPB will also evaluate whether the
information provided in the application is accurate and complete,
including regarding the applicant's policies and actual practices.
As part of its evaluation of an application, the CFPB will consider
how granting a recognition request might support its own role in open
banking pursuant to its CFPA section 1033 authority. However, the CFPB
is not adopting the recommendation of one trade association commenter
that a standard-setting body should not be eligible for CFPB
recognition unless it had already promulgated standards central to the
safe and efficient operation of open banking. Rather, the CFPB is
retaining the flexibility suggested by other commenters that will
enable the CFPB to recognize an organization at earlier stages of
standards development in a given area. The CFPB emphasizes, however,
that a recognition request from an entity that has not adopted, and
does not intend to adopt, standards relevant to the CFPB's statutorily-
authorized objectives for open banking is unlikely to be prioritized
and may not be approved.
In acting on an application, in addition to either recognizing or
not recognizing an applicant, the CFPB may provide contingent
recognition to an applicant that has presented a satisfactory written
plan specifying how and when it will address contingencies that the
CFPB has identified. Once the applicant presents sufficient evidence
that it has addressed such contingencies, the CFPB may recognize the
applicant. The CFPB expects to use contingent recognition, which is not
formal recognition under 12 CFR 1033.131, when it determines that an
applicant is close to realizing, but has not yet realized, recognition
requirements. The availability of contingent recognition responds to a
trade association comment on the proposed rule that advocated for a
phased approach to recognition, during which the CFPB would--before
granting full recognition--offer feedback on steps to full recognition
and support standard setters with garnering necessary stakeholder
participation for recognition.
Consistent with trade association comments requesting that the CFPB
publish a list of standard setters it recognizes, the CFPB will
publicly disclose on its website each recognition and contingent
recognition, along with the applicable terms and conditions of each.
Some terms and conditions may be tailored to the circumstances of the
applicant. For example, if the CFPB grants recognition based on the
intention of a standard setter to develop and publish a consensus
standard on a given subject matter, the CFPB may condition recognition
on good faith efforts to develop a consensus standard in the given
area.
Some commenters requested that the CFPB publish denials and include
in its procedures a process to appeal such denials. The CFPB will
publish denials as required by law, but applicants may also withdraw a
pending application at any time for any reason. The CFPB is not
providing a specialized appeals process. Consistent with the suggestion
of one industry trade association, the CFPB may permit consultation
with agency officials to help remedy issues after a submitted
application is denied--although the agency intends pre-decisional
consultation to minimize recourse to this option.
Next, the procedures describe the interaction between the CFPB and
a standard setter once it is recognized. As noted above, each
recognized standard setter must agree to a set of applicable terms and
conditions. The procedures highlight terms and conditions related to
CFPB observation or participation in standard-setting activities,
notification requirements on the part of the standard setter, and
monitoring of the standard setter by the CFPB. They also explain how a
standard setter may request re-recognition.
In view of a trade association comment noting the need for market
participants to have adequate time to transition from a consensus
standard if the associated standard setter's recognition expires, the
procedures state that recognized standard setters intending to apply
for re-recognition should do so at least 180 days before their
recognition expires. The CFPB may temporarily extend a recognition
while a re-recognition application is pending. Both provisions related
to re-recognition are intended to reduce the likelihood that a
consensus standard loses its status due to a recognition expiring
before re-recognition is granted.
Finally, the procedures describe the circumstances under which the
CFPB may modify or revoke recognition. One advocacy organization
indicated that the CFPB should revoke recognition when requirements of
recognition are no longer met. Other industry commenters stated that
the CFPB should clarify the circumstances under which recognition may
be revoked, and also allow for the standard setter to cure
deficiencies.
[[Page 49089]]
The CFPB expects to base a modification or revocation decision,
which it would publish on its website, on whether the standard-setting
body has failed to comply with applicable terms and conditions,
otherwise no longer meets the required attributes, or otherwise no
longer warrants recognition. The CFPB also expects to inform the
standard setter of reasons for modification or revocation, and to
provide the standard setter with an opportunity to address concerns.
V. Effective Date
The CFPB is adopting an effective date of 30 days after the
publication of this final rule in the Federal Register, consistent with
section 553(d) of the Administrative Procedure Act.\14\ No later
effective date is necessary because this final rule does not impose any
obligations on any party other than an applicant for recognition, which
can choose when to submit its own application. Separately, the CFPB
notes that an applicant may request that a pre-filing meeting,
consistent with appendix A, be held before the effective date.
---------------------------------------------------------------------------
\14\ 5 U.S.C. 553(d). Because appendix A is not a substantive
rule, appendix A is not subject to this requirement, but the CFPB is
aligning its effective date with the effective date of Sec. Sec.
1033.131 and 1033.141. Id.
---------------------------------------------------------------------------
VI. CFPA Section 1022(b) Analysis
In developing this final rule, the CFPB has considered the
potential benefits, costs, and impacts as required by section
1022(b)(2)(A) of the CFPA. Specifically, section 1022(b)(2)(A) of the
CFPA requires the CFPB to consider the potential benefits and costs of
a regulation to consumers and covered persons, including the potential
reduction of access by consumers to consumer financial products or
services, the impact on depository institutions and credit unions with
$10 billion or less in total assets as described in section 1026 of the
CFPA, and the impact on consumers in rural areas. The Bureau consulted
with appropriate prudential regulators and other Federal agencies
regarding the consistency of this final rule with prudential, market,
or systemic objectives administered by such agencies as required by
section 1022(b)(2)(B) of the CFPA.\15\
---------------------------------------------------------------------------
\15\ Whether section 1022(b)(2)(A) and section 1022(b)(2)(B) are
applicable to appendix A is unclear, but in order to inform the
rulemaking more fully the Bureau performed the described analysis
and consultations.
---------------------------------------------------------------------------
This final rule creates an application and recognition process for
industry standard setters but does not impose any compliance
requirements based on the standards set by recognized standard setters.
There are also no existing laws or rules that reference such standards.
The CFPB anticipates finalizing the proposed rule of which this current
rule was a part. If such a future rule were to reference industry
standards set by recognized standard setters in connection with
compliance requirements, the impacts of such requirements would be
attributed to and assessed as part of that rule. Absent such a future
rule, the CFPB does not anticipate changes in industry standards
attributable to this final rule. As a result, relative to the baseline
of current law used for this analysis, this final rule does not have
impacts on consumers or industry participants other than standard
setters that choose to apply for recognition.
In response to the proposal, one industry commenter stated that
additional guidelines for recognized standard setters should be
published, including a full cost-benefit analysis. The analysis in this
part reflects the full consideration of benefits and costs attributable
to this final rule. As noted, only a limited number of provisions from
the proposal are being finalized in this rule, none of which impose
substantive compliance requirements. As a result, any analysis of the
benefits and costs of substantive compliance requirements based on
industry standards prior to the finalization of such requirements would
be speculative and would not be accurate absent a future rule
finalizing those provisions.
Impacts on Consumers
The CFPB does not anticipate changes in industry standards
attributable to this final rule and, thus, no benefits or costs to
consumers. The CFPB is finalizing this rule to ease compliance with
potential future rulemakings.
Impacts on Covered Persons \16\
---------------------------------------------------------------------------
\16\ This analysis does not address whether or not standard
setters satisfy the statutory definition of a covered person under
the CFPA. 12 U.S.C. 5481(6). To the extent standard setters may not
satisfy that standard, the CFPB elects to include them in its
analysis.
---------------------------------------------------------------------------
This final rule will impact standard setters that choose to apply
for recognition. The CFPB expects such standard setters may incur costs
associated with assembling and submitting application materials and
responding to any follow up requests or clarifications in the
application process. The submitted materials and follow up requests
would differ across applicants, so the cost estimates in this analysis
reflect an estimated average.
Standard setters may have members that are covered persons and
members that are not covered persons. The CFPB expects any costs
incurred by standard setters would be spread across their membership.
Based on industry outreach and responses to the CFPB's proposed
rule, few standard setters exist that maintain standards directly
relevant to the Personal Financial Data Rights rule. As a result, the
CFPB expects nine or fewer standard setters to apply for recognition.
Those standard setters that apply may incur an estimated $10,604 in
labor costs, on average. This estimate assumes 120 staff labor hours at
an average total hourly compensation of $88.37. This total hourly
compensation reflects an average of May 2023 wages from the Bureau of
Labor Statistics for compliance officers ($38.55), lawyers ($84.84),
and general and operations managers ($62.18), adjusted for non-wage
compensation (30 percent of all compensation for private industry
workers).\17\ If nine standard setters apply, the estimated total costs
to industry would be $95,436.
---------------------------------------------------------------------------
\17\ These data reflect the mean hourly wages by occupation
according to the 2023 Occupational Employment Statistics compiled by
the Bureau of Labor Statistics. See U.S. Bureau of Labor Stat., U.S.
Dep't of Labor, Occupational Employment and Wages (May 2023),
<a href="https://www.bls.gov/oes/current/oes_stru.htm">https://www.bls.gov/oes/current/oes_stru.htm</a>.
---------------------------------------------------------------------------
Consideration of Alternatives
The CFPB considered potential alternatives to this rule, including
waiting to finalize provisions related to standard setter recognition
until such time as substantive compliance requirements such as those in
the full proposed rule were finalized.
In comments on the proposal related to standard setting, industry
commenters generally noted that a lack of clarity on industry standards
would make compliance with the proposal more costly and difficult. The
comments indicated that having a standard setter recognized early
relative to the compliance date for the proposal's substantive
requirements could reduce industry costs. Based on these comments, the
CFPB expects that the alternative of waiting to finalize the provisions
in this final rule would have increased costs to industry of complying
with any substantive compliance requirements finalized in a potential
future rulemaking.
Potential Impacts on Depository Institutions and Credit Unions With $10
Billion or Less in Total Assets, as Described in Section 1026
The only impacts attributable to this final rule on depository
institutions and credit unions with $10 billion or less in total assets
would be through their roles
[[Page 49090]]
as members of standard setters that choose to apply for recognition.
The CFPB expects these costs would be the same as the costs faced by
any members of such standard setters, as described earlier in this
part.
Potential Impacts on Consumers in Rural Areas, as Described in Section
1026
The CFPB does not anticipate changes in industry standards
attributable to this final rule and, thus, no impacts on consumers in
rural areas.
VII. Regulatory Flexibility Act Analysis
The Regulatory Flexibility Act (RFA), as amended by the Small
Business Regulatory Enforcement Fairness Act of 1996, requires each
agency to consider the potential impact of its regulations on small
entities, including small businesses, small governmental units, and
small not-for-profit organizations. The RFA defines a ``small
business'' as a business that meets the size standard developed by the
Small Business Administration pursuant to the Small Business Act.
The RFA generally requires an agency to conduct an initial
regulatory flexibility analysis (IRFA) and a final regulatory
flexibility analysis (FRFA) of any rule subject to notice-and-comment
rulemaking requirements, unless the agency certifies that the rule
would not have a significant economic impact on a substantial number of
small entities. The Bureau also is subject to certain additional
procedures under the RFA involving the convening of a panel to consult
with small business representatives before proposing a rule for which
an IRFA is required.
The CFPB convened a panel of small business representatives and
conducted an IRFA as part of the proposal. However, this final rule
includes only a limited number of provisions from that proposal, and
none of the provisions being finalized impose significant compliance
costs on small entities. As a result, the CFPB is not conducting a FRFA
as part of this final rule. The CFPB would satisfy the requirements of
the RFA by conducting a FRFA when it finalizes any provisions imposing
significant compliance costs on small entities.
Some standard setters may be small entities, or may have members
that are small entities. However, the CFPB expects nine or fewer
standard setters to apply for recognition, which is not a substantial
number of entities relative to all industry standard setters.
From a cost perspective, the CFPB expects any costs incurred by
standard setters to be spread across all members, including both small
entities and larger entities. This implies per-member costs
substantially lower than the $10,604 in per-standard setter costs
estimated above. Such costs will not be a significant economic impact
on small entity members of standard setters.
Accordingly, the Director certifies that this final rule will not
have a significant economic impact on a substantial number of small
entities.
VIII. Paperwork Reduction Act
Under the Paperwork Reduction Act of 1995 (PRA), Federal agencies
are generally required to seek, prior to implementation, approval from
the Office of Management and Budget (OMB) for information collection
requirements. Under the PRA, the Bureau may not conduct or sponsor,
and, notwithstanding any other provision of law, a person is not
required to respond to, an information collection unless the
information collection displays a valid control number assigned by OMB.
The Bureau has determined that this final rule does not contain any
new or substantively revised information collection requirements.
IX. Congressional Review Act
Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.),
the CFPB will submit a report containing this rule and other required
information to the U.S. Senate, the U.S. House of Representatives, and
the Comptroller General of the United States prior to the rule taking
effect. The Office of Information and Regulatory Affairs has designated
this rule as not a ``major rule'' as defined by 5 U.S.C. 804(2).
X. Severability
If any provision in Sec. Sec. 1033.101, 1033.131, 1033.141, or
appendix A, or any application of a provision, is stayed or determined
to be invalid, the remaining provisions or applications are severable
and shall continue in effect.
List of Subjects 12 CFR Part 1033
Banks, banking, Consumer protection, Credit, Credit unions,
Electronic funds transfers, National banks, Privacy, Reporting and
recordkeeping requirements, Savings associations, Voluntary standards.
Authority and Issuance
0
For the reasons set forth in the preamble, the CFPB adds 12 CFR part
1033, as follows:
PART 1033--PERSONAL FINANCIAL DATA RIGHTS
Subpart A--General
Sec.
1033.101 Authority, purpose, and organization.
1033.111 [Reserved].
1033.121 [Reserved].
1033.131 Definitions.
1033.141 Standard-setting bodies.
Subpart B--[Reserved]
Subpart C--[Reserved] Subpart D--[Reserved]
Appendix A--How To Apply for Recognition as a Standard Setter
Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5532; 12
U.S.C. 5533.
Subpart A--General
Sec. 1033.101 Authority, purpose, and organization.
(a) Authority. The regulation in this part is issued by the
Consumer Financial Protection Bureau (CFPB) pursuant to the Consumer
Financial Protection Act of 2010 (CFPA), Public Law 111-203, tit. X,
124 Stat. 1955.
(b) Purpose. This part implements the provisions of section 1033 of
the CFPA, in part, by utilizing industry standards developed by
standard-setting bodies recognized by the CFPB.
(c) Organization. This part is organized as follows:
(1) Subpart A establishes the authority, purpose, organization, and
definitions applicable to this part, and is reserved for other
purposes.
(2) Subpart B is reserved.
(3) Subpart C is reserved.
(4) Subpart D is reserved.
(5) Appendix A provides instructions for how a standard-setting
body would apply for CFPB recognition.
Sec. 1033.111 [Reserved].
Sec. 1033.121 [Reserved].
Sec. 1033.131 Definitions.
For purposes of this part, the following definitions apply:
Consensus standard means a standard that is adopted by a recognized
standard setter and that continues to be maintained by that recognized
standard setter.
Recognized standard setter means a standard-setting body that has
been recognized by the CFPB under Sec. 1033.141.
[[Page 49091]]
Sec. 1033.141 Standard-setting bodies.
(a) Recognition of a standard-setting body. A standard-setting body
may request CFPB recognition. Recognition will last up to five years,
absent revocation. The CFPB will not recognize a standard-setting body
unless it demonstrates that it satisfies the following attributes:
(1) Openness: The sources, procedures, and processes used are open
to all interested parties, including: consumer and other public
interest groups with expertise in consumer protection, financial
services, community development, fair lending, and civil rights;
authorized third parties; data providers; data recipients; data
aggregators and other providers of services to authorized third
parties; and relevant trade associations. Parties can meaningfully
participate in standards development on a non-discriminatory basis.
(2) Balance: The decision-making power is balanced across all
interested parties, including consumer and other public interest
groups, and is reflected at all levels of the standard-setting body.
There is meaningful representation for large and small commercial
entities within these categories. No single interest or set of
interests dominates decision-making. Achieving balance requires
recognition that, even when a participant may play multiple roles, such
as data provider and authorized third party, the weight of that
participant's commercial concerns may align primarily with one set of
interests. The ownership of participants is considered in achieving
balance.
(3) Due process and appeals: The standard-setting body uses
documented and publicly available policies and procedures, and it
provides adequate notice of meetings and standards development,
sufficient time to review drafts and prepare views and objections,
access to views and objections of other participants, and a fair and
impartial process for resolving conflicting views. An appeals process
is available for the impartial handling of procedural appeals.
(4) Consensus: Standards development proceeds by consensus, which
is defined as general agreement, though not necessarily unanimity.
During the development of consensus, comments and objections are
considered using fair, impartial, open, and transparent processes.
(5) Transparency: Procedures or processes for participating in
standards development and for developing standards are transparent to
participants and publicly available.
Subpart B--[Reserved]
Subpart C--[Reserved]
Subpart D--[Reserved]
Appendix A to Part 1033--Personal Financial Data Rights Rule: How To
Apply for Recognition as a Standard Setter
If you want the CFPB to designate your organization as a
recognized standard setter, you should follow the steps described
below.
We may amend this process from time to time.
Step One: Requesting Recognition
Submit a written request for recognition.\1\
---------------------------------------------------------------------------
\1\ Sensitive personal information should not be provided.
---------------------------------------------------------------------------
This should include key contact information, evidence of your
organization's policies and practices,\2\ and an explanation of how
your organization satisfies each of the requirements in the Personal
Financial Data Rights rule to be a recognized standard setter.\3\
Your request should also describe how current and/or anticipated
standards issued by your organization relate to open banking.
---------------------------------------------------------------------------
\2\ Evidence may include (but is not limited to) charters,
bylaws, policies, procedures, fee schedules, meeting minutes,
membership lists, financial statements/disclosures, publicly
available materials, and issued standards.
\3\ Relevant legal requirements are described at 12 CFR
1033.141. When explaining how your organization meets these
requirements, you should reference relevant elements of the evidence
you submit in support of your application.
---------------------------------------------------------------------------
In advance of filing your request, you can seek a pre-filing
meeting with us. We can walk you through the application process and
help you make a complete submission.
Send formal submissions, as well as requests for pre-filing
meetings, to: <a href="/cdn-cgi/l/email-protection#036c73666d61626d686a6d647077626d676271677043606573612d646c75"><span class="__cf_email__" data-cfemail="204f50454e42414e4b494e475354414e444152445360434650420e474f56">[email protected]</span></a>.
Step Two: Additional Information and Public Comment
After reviewing your submission, we may request additional
information to ensure that your application is complete.
We may publish your application.
We may also seek public input on your application and invite
your responses to any information we receive on that basis.
Step Three: Our Review
When reviewing your application, we consider whether your
policies and practices meet all the requirements for recognition. We
also evaluate whether your application is accurate and complete.
We prioritize and review applications based on the extent to
which recognizing your organization helps us to implement open
banking.\4\
---------------------------------------------------------------------------
\4\ Section 1033 of the Consumer Financial Protection Act, 12
U.S.C. 5533, describes the CFPB's role in implementing open banking.
---------------------------------------------------------------------------
Step Four: Application Decision
CFPB recognition will be publicly disclosed on our website,
along with the applicable terms and conditions of such recognition,
such as its duration.
If the CFPB declines to recognize your organization, we will
notify you.
You may withdraw your application at any time or for any reason.
If we determine that your organization is close to meeting, but
does not yet meet, the requirements for CFPB recognition, we may ask
you to provide a written plan specifying how and when you will take
the steps required for full recognition. If that plan is
satisfactory, we may state on our website that your organization has
received contingent recognition. Once you provide us with evidence
that you have successfully executed on that plan (or otherwise
addressed the relevant contingences), the CFPB may extend full
recognition.
Step Five: Recognition
There are several points to keep in mind about recognition.
As a recognized standard setter, you agree that the CFPB may
monitor your organization and that you will provide information that
we request.
You must also provide us, within 10 days, written explanation of
any material change to information that was submitted with your
application or during recognition, as well as any reason your
organization may no longer meet underlying requirements for
recognition.
In addition, you must meet any other specified terms and
conditions of your recognition, which may include our reserving the
right to observe or participate in standard setting.
If your recognition is set to expire, you can apply for re-
recognition by re-starting at Step One at least 180 days before
expiration. We may temporarily extend your recognition while we
consider your request for re-recognition.
We may modify or revoke your recognition. The CFPB expects to
notify you of the reasons it intends to revoke or modify
recognition, and to provide your organization with an opportunity to
address the CFPB's concerns.
Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-12658 Filed 6-10-24; 8:45 am]
BILLING CODE 4810-am-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on June 11, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.