The Consumer Financial Protection Bureau (CFPB) is poised to use an emergency interim final rule to carry out its new open banking framework, rather than completing the normal multi-step rulemaking process. It’s because the CFPB is under significant financial pressure and is caught in political disputes over how much funding it should receive. And for this reason, the agency has not been able to proceed with implementing Section 1033 of the Dodd-Frank Act, which addresses consumer access to financial data.

In this article, we explain why the CFPB is resorting to an “interim final” rule, how funding fights and dismantling attempts are stalling it, and what it means for banks, fintechs, and the timeline for open banking.

Background: Section 1033 and the Open Banking Rule

Section 1033 of the Dodd-Frank Act (2010) obligates financial institutions to make consumer financial data available to customers and their authorized third parties. In October 2024, under the prior CFPB leadership, the agency finalized a Personal Financial Data Rights rule to implement this data-rights mandate. That rule required banks with more than $850 million in assets to provide API access to account information (balances, transactions, payment schedules, etc.) on standardized, secure terms.

Under the published schedule, the largest banks would have to comply by April 2026, with smaller banks phased in through April 2030. The goal was to create an open banking ecosystem similar to Europe’s PSD2: consumers could authorize third-party apps to access data from their banks, fostering fintech innovation and competition.

However, the 2024 rule quickly became embroiled in controversy. Major banks and industry groups sued, arguing that the CFPB exceeded its authority and that the mandate was unduly burdensome. A federal judge in Kentucky delayed the rule’s effective dates and issued an injunction preventing enforcement until the litigation is resolved. In 2025, a new administration took over the CFPB, with different priorities. The bureau signaled it would reopen the rulemaking, seeking comments on narrowing who may access data, whether banks can recover costs through fees, and what security or privacy changes to require.

Why an Interim Final Rule?

An interim final rule is an unusual “shortcut.” The agency issues a rule that takes effect immediately while still accepting comments, instead of waiting for the usual notice-and-comment period. The CFPB says it needs this emergency measure because its funding is exhausted. In legal filings, the bureau told a federal court it expects to “run out of money” by the end of 2025 and will not have funds to finish a regular rulemaking.

The bureau noted it currently has cash to operate through December 31, 2025, but beyond that, the White House has refused to replenish its budget. Under federal law, the CFPB draws funding from Federal Reserve earnings. But an October 2025 Department of Justice opinion found that no Fed balances are available to transfer to the bureau. After this yea,r the CFPB will effectively have no funds until Congress acts.

The agency’s acting director, Russell Vought, who also heads the Office of Management and Budget, has publicly signaled he intends to “close down” much of the CFPB and downsize it dramatically. Faced with this cash crunch, the CFPB has told courts it will skip some steps and swiftly finalize an open banking rule.

Funding Battles and the Fight to Dismantle the CFPB

The need for an interim rule is rooted in a bitter funding and political fight over the CFPB itself. Since early 2023, Republican lawmakers and the new administration have sought to curtail the bureau’s budget and authority. In Congress, House Republicans have voted to slash CFPB funding, proposing to cut the agency’s cap on Fed earnings from 12% to just 5%. This would remove roughly $250 million in resources (about 70% of its budget) and return it to a pre-2011 level.

Republicans even introduced a “Defund the CFPB Act” to cap its funding at zero. The stated goal is fiscal restraint, but critics say it amounts to a legislative effort to starve the bureau of funds altogether.

These moves follow a federal court’s ruling blocking the Trump administration’s attempt to eliminate CFPB staff through layoffs. Since that order, the administration’s strategy has shifted to using budget legislation to disable the agency. At the same time, President Trump and other conservative officials have said outright that the CFPB should be dismantled as an unelected regulator.

Acting CFPB Director Vought, a former aide to Trump, has repeatedly assailed the agency’s mission and slashed its operations. He reportedly told bureau employees that almost no one will be working there, aside from Republican appointees, as it winds down.

Because the CFPB was created by Congress, dismantling it fully would require legislative action. In the interim, Congress’s decision not to appropriate new funds has effectively paused the bureau’s work. Nonprofit groups and unionized CFPB staff have sued to force Congress to restore funding, but so far those efforts have not succeeded. The result is that the CFPB is operating on a shoestring.

Congress’s recent proposals would leave the bureau with only 30% of its previous budget to fulfill all statutorily required tasks. This funding squeeze directly underlies the CFPB’s claim that it must issue an interim final rule under Section 1033.

What Would an Interim Open Banking Rule Require?

Because the CFPB is still collecting input for a new full rule, the interim rule is likely to focus on near-term mechanics rather than substantive changes. It could temporarily extend compliance deadlines and preserve existing data-sharing obligations, while the agency works out details through a revised rulemaking process. It could also be used to delay the original April 2026 start date for big banks.

In fact, the courts have already pushed the compliance dates out by 90 days, and the CFPB is considering further extensions. If an interim rule delays those deadlines (e.g., by one year), covered banks would have more time to build or adapt their data APIs, and fintech firms could adjust their rollout plans accordingly.

Banks should continue their preparations for eventual compliance. Even if the first enforcement date is pushed back, large banks still need to develop secure data-portability interfaces and adopt any required standards. Many large banks (such as Bank of America, Citibank, and U.S. Bank) already have open API systems in place, but smaller institutions will need additional lead time. Fintech companies, for their part, should maintain readiness to receive data through these new channels and keep their user-consent systems up to date.

One crucial question is whether the interim rule will change the substance of data sharing in the short term. The Biden-era rule banned banks from charging customers for sharing their data. Under the interim rule, the CFPB might allow at least a temporary continuation of fee-free access.

The agency is separately considering, in its advance notice, whether banks should be allowed to recoup costs through “reasonable” fees, a debate sparked by recent bank announcements that they plan to charge fintechs for data access. For now, absent a new final rule, the existing prohibition on fees may effectively remain in place.

Similarly, the 2024 rule broadly defined who counts as an authorized “representative” for a consumer (including non-fiduciary fintechs). The new CFPB leadership is reconsidering whether to narrow it to fiduciaries only. An interim rule likely won’t resolve that question immediately; that will come in a later final rule.

But fintechs should be aware that who can request data on a user’s behalf may change. Banks and other data holders will continue to process any legitimate requests they currently receive under 1033, but an interim rule may hold the line rather than expand the regime.

What Can We Expect in the Near Term

• Deadlines may shift: The interim rule could extend the compliance deadlines for banks. In that case, the compliance schedule (originally set for April 2026 for the largest banks) will be pushed out, perhaps to 2027. Both banks and fintechs should plan for a later start to full-scale data sharing.
• Continue readiness: Institutions subject to Section 1033 should continue to build out APIs, security, and consent tools. Even if enforcement is delayed, the technical and operational work of open banking goes on. Developing standardized data formats (e.g,. FDX or similar) and rigorous security controls now will ease the eventual rollout. Fintech developers should stay engaged with the rulemaking process and ensure their systems can handle data from all major banks.
• Monitor fee and privacy rules: The CFPB is soliciting input on whether to allow cost-based fees and how to tighten privacy controls. If the final rule permits banks to recover costs via fees, fintech apps may face new charges for data access. Industry groups are sharply divided: banks argue fees are needed to cover expenses, while consumer advocates warn they would become a “toll on consumers.” Whatever happens, banks should be ready to comply with any fee regimen, and fintechs may need to adjust their pricing models if data access is no longer free.
• Data security remains critical: The CFPB’s advance notice also questioned existing security standards. Banks and fintechs must continue to adhere to robust security standards (e.g., by discouraging screen scraping and complying with GLBA safeguards). In the interim, both sides should use this extra time to strengthen protections and mitigate privacy risks.
• Legal limbo persists: Until the CFPB issues a final rule after comment, the precise obligations remain unsettled. Both banks and fintechs should monitor litigation and agency updates, as the court could impose additional stays or the bureau could further extend deadlines through the interim rule.

Shifting the Timeline for Open Banking

With the interim rule delaying the process, the overall timeline for Section 1033 implementation will slip. The initially published schedule (large banks by April 2026, smaller banks by 2030) was based on the 2024 rule. In mid-2025, the CFPB had already paused those dates by 90 days while it reopened the rulemaking. Now, the bureau is openly asking whether that timeframe remains feasible if it revises the rule.

It seems likely that the first compliance deadlines will be pushed out by at least a year. If reopening the rule took nine months previously, a new full rule after ANPR (August 2025) could realistically emerge in early 2026 or later. Large banks might then be given until sometime in 2027 to enable open banking APIs.

In any event, the staggered schedule (with full implementation by around 2030) will probably be preserved, but shifted later. Even if delayed, the “open banking” framework will still be phased in by the early 2030s.

Not everyone views the delay as purely negative. Fintech advocates argue that pushing out deadlines avoids rushed rollouts and gives stakeholders more time to prepare robust systems. The Financial Technology Association, which intervened to defend the 2024 rule in court, told the judge that “delays in full implementation of Section 1033 harm the public interest” and urged the CFPB to let the rulemaking proceed on its own timeline.

In other words, if open banking is ultimately good for competition and consumers, then ensuring the rule is well-crafted and implementable may justify the extra wait.

The first meaningful compliance dates (for the largest banks) will no longer arrive in 2026 as initially planned. CFPB officials have acknowledged they will likely not issue the final rule until 2026 at the earliest, pushing significant data-sharing obligations into 2027 or later.

Looking Ahead

In its filings, the CFPB has affirmed that it ultimately intends to finalize the open banking rule. A spokesperson told reporters that the Section 1033 framework “will absolutely be finalized,” even if the process is being accelerated and truncated in parts. This means that once the funding impasse is resolved (or workarounds are implemented), the bureau still expects to implement a permanent rule to ensure consumer financial data rights.

For now, however, open banking progress depends on the outcome of political and legal battles. If the funding freeze persists, the interim rule may serve as a stopgap for months to come. Banks should focus on system readiness and compliance planning. At the same time, fintech companies should engage with regulators and be prepared for both favorable and adverse policy changes (e.g., changes to allowable fees or access restrictions). Consumers hoping to use future apps for budgeting or account aggregation will have to remain patient until this regulatory saga concludes.

Conclusion

The CFPB’s move to an interim final rule is a direct consequence of its funding crisis and the broader campaign to curtail the bureau. It pauses the aggressive timeline for data-sharing but does not cancel Congress’s directive on open banking.

Ultimately, Section 1033 remains viable, but its implementation will depend on both the shifting political winds and the following chapters of CFPB rulemaking.

Frequently Asked Questions