Where Section 1033 Actually Stands: A Plain-Language Guide for Financial Institutions

Last updated: October 2026. Section 1033 is a moving target. We refresh this post as the rulemaking advances.

If you lead compliance, product, or data strategy at a bank or credit union, you have probably asked some version of this question in the last few months: is Section 1033 happening or not?

The honest answer is that it is happening, but not on the timeline anyone expected two years ago. Here is what is confirmed, what is still unsettled, and what it means for your institution right now.

At its core, Section 1033 is a rule about consumer-permissioned data: who can access it, who can charge for it, and what standards govern how it moves. What Is Consumer-Permissioned Data? If you need a refresher on the term itself, that is the fastest place to start.

A quick recap of how we got here

Section 1033 of the Dodd-Frank Act gives consumers a right to access their own financial data and to direct that data, as consumer-permissioned data, to third parties they authorize. The Consumer Financial Protection Bureau finalized its rule implementing that right in October 2024. The rule set a phased compliance schedule, with the largest data providers facing an April 1, 2026 deadline.

Trade groups sued the same day the rule was finalized. A federal court later enjoined the CFPB from enforcing it while the Bureau reconsiders key parts of the framework. In August 2025, the CFPB opened that reconsideration formally with an Advance Notice of Proposed Rulemaking, asking for public input on how the rule should change.

Where the rule sits right now

On August 6, 2026, the CFPB submitted a new Notice of Proposed Rulemaking to the Office of Information and Regulatory Affairs (OIRA) for review. OIRA review is a required step before a significant rule can publish for public comment. The submission signaled that the Bureau had finished drafting its revised approach.

As of October 2026, the proposal is still under OIRA review. The CFPB’s own rulemaking page has not posted anything beyond the August 2025 Advance Notice of Proposed Rulemaking.

OIRA review under Executive Order 12866 runs up to 90 days for significant rules, though there is no hard deadline and reviews can extend past it. Some observers expected the Bureau to move faster here, given how often it has called this reconsideration a priority. That has not played out. The 90-day mark falls in early November 2026.

Once OIRA clears the rule, it moves to the Federal Register and opens for public comment, typically 60 days for a rule this size. That comment period, not the OIRA review, is when the substance of the new rule becomes public and financial institutions can weigh in directly.

What is actually up for debate

The 2025 ANPR laid out the issues the CFPB is reconsidering, and they are the same ones still in play today:

Data access fees. Should banks and other data providers be allowed to charge third parties for access to consumer-permissioned data? The original 2024 rule prohibited this. Reversing it would be one of the most consequential changes on the table, and it is the piece getting the most attention from trade groups on both sides.
Who counts as an authorized representative. The rule needs a workable definition of which third parties can request and receive a consumer’s permissioned data on their behalf.
The balance between competition, privacy, and security. The CFPB has signaled it wants a framework that supports innovation and consumer choice without loosening the standards that protect account holders’ data.
Compliance burden. Community banks and credit unions raised real concerns about the cost and complexity of the original technical requirements for handling consumer-permissioned data. Expect the revised rule to address this directly.

Why the compliance date confusion is so widespread

The compliance dates are not running. On October 29, 2025, the U.S. District Court for the Eastern District of Kentucky stayed the rule’s compliance deadlines and enjoined the CFPB from enforcing the rule until it completes its reconsideration. The first deadline for the largest data providers came and went in 2026 without becoming a binding enforcement trigger.

That is an unusual place for a rule to sit. The text remains written into the Code of Federal Regulations at 12 CFR Part 1033. The rule has not been vacated. An examiner cannot currently cite you for it, and the clock on the phased schedule is paused rather than ticking.

This is exactly why so many financial institutions are unsure what to do. Some have paused their open banking work entirely. Others are treating the pause as a planning window rather than a reason to stop. Legal counsel tracking the rulemaking have suggested the second approach is the safer one. The concepts behind Section 1033, consumer-permissioned data sharing and third-party access controls, are showing up in state-level legislation and private litigation even while the federal rule is in flux. Waiting for total certainty before building anything is not really an option.

The appeals are on hold too

Both the CFPB and the fintech trade group that intervened in the case appealed the preliminary injunction to the Sixth Circuit. Those appeals are not moving either.

On March 30, 2026, the Sixth Circuit granted the banking plaintiffs’ motion to hold briefing in abeyance in the consolidated appeals, pausing them while the CFPB completes its new rulemaking. The plaintiffs argued that a ruling was unlikely to have practical effect, since the Bureau had already conceded the existing rule was unlawful and was working to replace it. The CFPB and the intervenor both opposed a blanket pause and preferred periodic extensions so the court could monitor progress.

The practical takeaway for your institution: the rulemaking is the thing to watch, not the courtroom. Nothing about the legal posture changes until the CFPB publishes.

States are not waiting

New York lawmakers introduced companion bills in March 2026 that would create a state-level financial data access regime. Assembly Bill 10640 arrived on March 13 and Senate Bill 9483 on March 17. Both remain in committee.

The New York Financial Data Rights Act would add a new Article 14-C to the state banking law. Three provisions stand out against the federal rule:

It would prohibit fees for transferring covered data to authorized third parties, the same question the CFPB has reopened at the federal level.
It would extend data access rights to small business accounts. The federal rule covers consumer accounts only.
It would carry penalties up to $10,000 per violation, enforced by the Superintendent of Financial Services.

The bills apply to out-of-state institutions serving New York residents, so the reach goes well past New York-chartered banks. If New York enacts something, other states are likely to follow, and institutions could face a patchwork rather than a single federal standard.

What this means for your institution this week

Do not treat this as dead. The rule is moving again, and the OIRA submission suggests publication could come faster than the 90-day maximum window.
Watch the fee question closely. If data access fees become permissible, it changes the economics of every data-sharing relationship your institution has or is building.
Use the pause to get your house in order. Review vendor agreements, confirm your data access architecture does not depend on legacy credential sharing, and make sure your team understands where accountability sits if something goes wrong.
Do not wait for the final rule to modernize your data infrastructure. Whatever the CFPB decides on fees or authorized representatives, the underlying expectation, that account holders can access and share their own consumer-permissioned data securely, is not going away.

Built for consumer-permissioned data, regardless of how the rule lands

“The specifics of the final rule will matter a lot to the industry, but the direction has been clear for years. Consumers expect their financial data to move with them, safely and on their terms. We built Bloom’s consumer-permissioned data infrastructure around that expectation rather than around any single version of the rule. Whatever the CFPB finalizes on fees or authorized representatives, our financial institution partners are not starting over.” – Christa Degnan, Chief Product Officer, Bloom Credit

The bottom line

Section 1033 is not stalled. It is in a specific, well-defined stage of the federal rulemaking process, and the next real milestone is Federal Register publication and the start of a public comment period. For financial institutions, the smartest move right now is to keep building toward the outcome that was always coming: secure, consumer-permissioned data access, whether that arrives through this rule, a revised version of it, or the state laws filling the gap in the meantime.

Want the fuller definition of consumer-permissioned data and how it fits into Bloom’s platform? Start with What Is Consumer-Permissioned Data?

Sources:

Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights. Retrieved August 2026, from https://www.consumerfinance.gov/personal-financial-data-rights/

Consumer Bankers Association. Main Street Ledger: What’s at Stake as the CFPB Reconsiders Its Personal Financial Data Rights Rule. https://consumerbankers.com/blog/main-street-ledger-whats-at-stake-as-the-cfpb-reconsiders-its-personal-financial-data-rights-rule/

Berry, K. American Banker. What We Know About the CFPB’s Forthcoming Open-Banking Rule. https://www.americanbanker.com/news/what-we-know-about-the-cfpbs-forthcoming-open-banking-rule

Cozen O’Connor. Section 1033 Compliance Date: Open Banking Rule Enjoined and Under Reconsideration. https://www.cozen.com/news-resources/publications/2026/section-1033-compliance-date-open-banking-rule-enjoined-and-under-reconsideration

Consumer Finance Monitor. CFPB Sends New Section 1033 “Open Banking” Proposal to OIRA for Review. https://www.consumerfinancemonitor.com/2026/08/06/cfpb-sends-new-section-1033-open-banking-proposal-to-oira-for-review/