CFPB’s Section 1033 Retreat Is a Victory for Rule of Law and Market Integrity

Originally posted at Americans for Tax Reform.

​​The Consumer Financial Protection Bureau (CFPB) has taken the rare step of reversing a major regulatory initiative. In a significant concession, the Bureau now says it will ask a federal court in Kentucky to vacate its recently finalized Section 1033 rule—an “open banking” mandate that would have forced banks and financial institutions to share consumer data with third-party fintech companies.

This reversal is more than procedural. It reflects the growing recognition that the rule lacked legal authority, imposed major risks to privacy and competition, and failed to undergo proper cost–benefit analysis. In short, the CFPB conceded what critics warned from the start: the rule was unlawful and unworkable.

Finalized last year under former Director Rohit Chopra, the Section 1033 rule imposed sweeping, mandatory data-sharing requirements on financial institutions. While promoted as a way to enhance consumer choice and competition, the rule ignored serious legal, economic, and technological concerns. It would have weakened existing privacy protections, unfairly advantaged some firms over others, and created new vulnerabilities in the financial system—all in the name of regulatory “openness.”

At the center of the legal pushback is a lawsuit filed in the U.S. District Court for the Eastern District of Kentucky. The complaint alleges that the CFPB overstepped its statutory authority and failed to analyze its rule’s costs and consequences properly. In particular, the suit raises alarms about how liability would be handled for data breaches by third-party firms, especially once sensitive information leaves the control of banks.

This litigation—and the CFPB’s retreat—has placed the entire fintech and banking ecosystem in limbo. Institutions that had begun recalibrating compliance strategies, investing in new data-sharing systems, and preparing for a wave of technical implementation are now forced to pause. Many are left wondering how much sunk cost will go unrecovered and how best to navigate future regulatory risk.

This moment offers an important lesson: Durable reform must be rooted in legislative clarity, not bureaucratic ambition.

New mandates that affect consumer data, competition, and systemic risk should come from Congress, not federal agencies acting unilaterally. When regulators try to force the adoption of specific technologies or frameworks—especially in fast-moving sectors like financial tech—they risk distorting the market and stifling innovation. Consumers suffer when agencies pick winners and losers in the name of efficiency.

Another core issue is accountability. While Section 1033 centered on empowering consumers to share their data, it never answered the fundamental question of who is responsible when things go wrong. If financial data is compromised after being shared with a third party, who bears the liability? Regulators must ensure that responsibility follows the data. Anything less invites risk, confusion, and erosion of trust.

The good news is that there’s a better way forward. As we found in our recent analysis of the rule’s impact, voluntary industry standards for secure data sharing have already emerged through market pressure and consumer demand. APIs and partnerships between banks and fintech allow consumers to safely connect their accounts to apps and services they choose without a government mandate. The private sector has shown that innovation can deliver real portability, privacy, and convenience.

What’s needed now is a clear framework grounded in market incentives and the rule of law. Any new data-sharing policy must begin with explicit legislative authorization, include thorough cost–benefit analysis, and ensure that privacy and liability protections are not afterthoughts.

The CFPB’s reversal is a welcome acknowledgment that its original approach was flawed. But the underlying lesson is broader: Freedom to share financial data must come with freedom from regulatory overreach. By respecting market dynamics and protecting consumer rights, we can build a financial system that is both open and secure.

This is how we let people prosper—through competition, clarity, and trust.