On August 22, 2025, the CFPB issued an advance notice of proposed rulemaking to inform its consideration of four issues related to the implementation of section 1033 of the Dodd-Frank Act. Section 1033 outlines the requirement for “covered persons” to make financial transaction data available to consumers and authorized third parties upon request, under rules prescribed by the Bureau.
On November 18, 2024, the Bureau published the Personal Financial Data Rights final rule (PFDR Rule), requiring financial institutions to provide consumers with access to information about their transactions and costs upon request. The rule also establishes procedures for third parties seeking to access this data. A lawsuit challenging the PFDR Rule was filed by several banking associations, but on July 29, 2025, the court agreed to stay the proceedings while the Bureau sought to reexamine the rule with stakeholders.
The CFPB is now seeking comments and data on the following issues related to Section 1033 implementation:
The proper understanding of who can serve as a “representative” making a request on behalf of the consumer;
The optimal approach to the assessment of fees to defray the costs incurred by a “covered person” in responding to a customer-driven request;
The threat and cost-benefit pictures for data security associated with section 1033 compliance; and
The threat picture for data privacy associated with Section 1033 compliance.
Comments will be accepted until October 21, 2025.
The ANPR can be found here.