CFPB finalizes personal financial data rights rule

https://www.eff.org/deeplinks/2024/10/no-matter-what-bank-says-its-your-money-your-data-and-your-choice

by hn_acker • 2 years ago

138 68 2 years ago

eff.org

toomuchtodo4• 2 years ago

CFPB Announcement: https://www.consumerfinance.gov/about-us/newsroom/cfpb-final...

Rule: https://files.consumerfinance.gov/f/documents/cfpb_personal-...

arunabha2• 2 years ago

And right on cue, wall street fights back! Expected, but still rankles as bit.

'JPMorgan CEO Jamie Dimon says 'it's time to fight back' on regulation' from https://www.reuters.com/business/finance/jpmorgan-ceo-says-i...

The comment from Dimon is the cherry on top.

'Dimon said he was not against open banking but noted that it could compromise consumer data and lead to fraudulent money transfers and he was set to fight it.'

His bank is happy to accept fraudulent checks and ACH transfers all day long, but his primary opposition to open banking rules is his overwhelming concern for his customers. Riiiight.

toomuchtodo4• 2 years ago

"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

You have an entire commercial banking industry that has been dependent on being able to capture inexpensive deposits from unsophisticated financial services consumers (they make the spread between the ~0% they offer on demand deposits and what they can lend at), as well as charging exorbitant fees to move value around, and that is all coming to an end with open banking and FedNow instant payments. Sad folks gonna sad. You're a utility, sorry to say.

(obligatory credit union plug here)

SoftTalker• 2 years ago

Credit Unions are typically better, but not always. Fees can still be high and interest rates low. You still have to comparison shop and do some due diligence.

tivert• 2 years ago

"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

I don't think the issue here is that he doesn't understand. I think the issue is he's lying.

He's almost certainly starting with the policy that he wants for his own self-interest, then working backwards from that to come up with BS arguments for it that sound good. He's not an idiot so almost certainly knows full well what he's doing.

politician2• 2 years ago

Banks are really dragging their heels on FedNow support.

jfengel• 2 years ago

Yeah, it was nice having a Consumer Financial Protection Bureau. It's on the chopping block under Project 2025:

"the next conservative President should order the immediate dissolution of the agency—pull down its prior rules, regulations and guidance"

So don't get too used to your new financial data rights. We'll know Tuesday if you'll ever get a chance to apply them.

sailfast• 2 years ago

The notion that a president can do this unilaterally without Congress is very strange. While I understand the laws and norms around executive authority are often pushed against, you cannot legally defund an entire agency by executive order. (Or create one for that matter - I'm looking at you "Government Efficiency Administration" or whatever the heck they keep talking about.

"Down with bureaucracy!" "Isn't that bureaucracy? A whole organization that focuses on waste?" "Yeah, but it's MINE. I only want down with YOUR bureaucracy."

mmooss• 2 years ago

To add context:

The large banks just destroyed, through intense lobbying, what was called Basel III Endgame - a long-planned, carefully implemented regulatory structure designed to prevent future catastrophes like 2008. The Federal Reserve pretty much openly said they gave into pressure.

The problem with capitulating to make peace is that you don't get peace: The attacker is emboldened and tries for more, and now has precedent and momentum in the eyes of third parties.

skybrian2• 2 years ago

Declaring defeat seems a bit much, considering that we haven't had another catastrophe similar to 2008. That seems pretty successful, so far? (The pandemic was bad, but banks mostly didn't collapse.)

teeray2• 2 years ago

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

ryandrake• 2 years ago

Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.

hollerith• 2 years ago

Of course it violates the terms of service written by your bank.

Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.

sq_• 2 years ago

I’ve been happy to see more and more of the banking-related services that I use stop requiring that and give each other actual API access.

I absolutely refuse to hand over my credentials and cannot wait for the practice to die.

Aspos• 2 years ago

The fact that plaid was allowed to exist and grow into a monster tells a lot about incompetence/impotence of the regulators.

eternityforest• 2 years ago

What would actually happen if Plaid or the like was hacked? Would people lose money or would they be able to reverse it all?

sjtgraham3• 2 years ago

It doesn't matter if it violates your bank's terms of service, it's not an enforceable term. For example, banks cannot refuse to pay out if you were a victim of fraud because you gave your credentials to an aggregator (regardless of whether or not the fraud was related). The EFTA has anti-waiver provisions that state a bank's Reg E obligation to make customers whole after unauthorized transactions cannot be waived by contract.

hggigg2• 2 years ago

Having seen how this shit works behind the scenes I’d rather do it manually.

buffington• 2 years ago

I'd love to hear what you saw that motivated this. Care to share?

hggigg2• 2 years ago

Account holder migration between two major international banks. Subcontracted out to the lowest bidding outsourcer who operate some major enterprise messaging bespoke piece of crap bought from IBM which is held together with sticky tape, string and smeared in dog shit and requires hand holding 24/7 due to the sheer amount of bugs in it.

I found this out because the company I was contracting for was trying to get the open banking API working against one of the banks and we ended up having to speak to four parties over an simple encoding issue that no one at any org could understand. It was basically the spider man pointing meme. One set of outsourcers blaming another set of outsourcers while their local managers were doing the same. No one even understood or communicated the issues.

When you do something at a bank and it takes longer than expected it’s that sort of shit happening.

Suppafly2• 2 years ago

I'd love to hear what you saw that motivated this. Care to share?

Working adjacent to medicine,banking, supply chain, and some other fields, I'd say that most people don't realize that everything is just csv files and sftp servers underneath. You'd assume these fields would be using realtime web services to communicate with each other, but even the ones that seem roughly realtime are often using scheduled file transfers of batched data. A lot of the integration is essentially bat files and shell scripts converting between one type of csv to another. It's bandaids and bailing wire all the way down.

AshamedCaptain• 2 years ago

ah, you mean there are still more than two banks customer can choose from? and for how long?

stronglikedan• 2 years ago

Unless you have a very narrow use case, there has always been a plethora of banks to choose from.

bob1029• 2 years ago

Banking with a more local institution can make all of the difference in the experience. It would probably blow your mind if you've never done it. Maybe try a mid-size bank that operates in a few states if you are concerned with going too small.

If you are banking with Wells Fargo or BoA, you are getting exactly what you signed up for. A customer base so large that they have no choice but to treat you like a row in a database (i.e., a piece of shit).

koolba• 2 years ago

There's four banks with over $1T in assets, eight with over $500B, nineteen with over $200B, and 29 with over $100B: https://www.federalreserve.gov/releases/lbr/current/

I'd argue there's exactly four banks to choose from if you plan on holding more than the FDIC limits at any one bank as I'm not as confident the rest would have an implicit "too-big-to-fail" guarantee.

0cf8612b2e1e• 2 years ago

I hate that I am so pessimistic, but I will hold my breath until the Supreme Court says why nobody has the authority to tell banks what to do.

Molitor5901• 2 years ago

Unfortunately it will still come down to the bank wanting to do business with you. I believe at the end of the day, if you don't agree to what the bank wants of you, and from you, they will debank you. There is no right, or even a law, that the bank has to give you an account.

This is a good decision by the CFPB but it's a drop in the bucket.

jerf• 2 years ago

The Supreme Court did not say that no Federal agency can do anything, ever.

You can tell by the way the Federal agencies are still, you know, there. Doing things.

skybrian2• 2 years ago

Dismissing fraud as a problem makes it sound like there’s no tradeoff here. I think we all know that in real life, fraud actually is a pretty big problem? Though they’re self-interested, I expect that banks know it too.

It doesn’t mean you shouldn’t be able to export your data, but this is a sensitive operation that maybe shouldn’t be too easy. People are definitely going to be tricked. The individualistic, libertarian assumption (that customers are responsible adults who know what they’re doing) is known to be false by anyone who has worked in a customer support role.

throwaway48476• 2 years ago

Fraud is only a problem for international transactions. The rest can be handled by lawyers.

Nifty3929• 2 years ago

At great time and expense, while you have bills to pay and someone else has your money.

ilaksh2• 2 years ago

If you don't like what banks do, then learn about the technologies that can replace them today.

barumrho• 2 years ago

Do you mean bitcoin/crypto or did you have something else in mind?

ilaksh2• 2 years ago

I think most people don't really know what those things are, or what the fundamental concepts are, so I recommend people research decentralized technologies that are related to money from scratch.

politician2• 2 years ago

Banks are 95% law and maybe 5% technology.

immibis3• 2 years ago

Although you're obviously talking about crypto, I support the message of learning how shit things work underneath and maybe someone will come up with a way to improve them.

renewiltord• 2 years ago

This seems impossible without Chevron Deference. I doubt one can exercise one’s rights under this.

monocularvision2• 2 years ago

What does Chevron Deference have to do with this?

Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so.

This entirely fits within the current Supreme Court doctrine around regulatory agencies.

Now, that’s not to say there might not be some other constitutional objection the the law itself…

sjtgraham3• 2 years ago

Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so.

Actually it didn't. S1033 of the CFPA states a financial institution will upon request of a consumer provide covered information about their financial accounts in a digital format usable by consumers. The rule relies on an expansive interpretation of the statutory definition of "consumer", which is a natural person or "an agent, trustee, or representative" thereof. The agency asserts that representative can be any third party and off of this says banks have to make a developer interface available for them to access, that ironically it does not mandate actual consumers, i.e. natural persons like you and I, can access.

This expansive interpretation will not survive judicial review. The canons of statutory interpretation do not allow it, e.g. agent and trustee are fiduciary relationships, as they are mentioned before "representative" it limits the potential scope to other types of fiduciary relationship (ejusdem generis and noscitur a sociis). A fintech is not a fiduciary and has no obligation to act in your interest. It's a typical arms-length commercial transaction.

Whether or not the agency's goal is noble is besides the point. It has plainly and obviously gone way beyond the statutory authority granted to it by Congress.

daft_pink• 2 years ago

Does anyone else feel like Apple’s app store rules have more teeth than this? Lobbyists have already or will soon be gutting this for sure.

Snuupy• 2 years ago

Until this comes to fruition and banks actually implement it with software (like Actual Budget) supporting it, I will continue using SimpleFIN Bridge. Hopefully this becomes ubiquitous like GoCardless in the EU.

fowl2• 2 years ago

Wonder how this compares with the Consumer Data Right in Australia. The standards and discussions around them are right there on GitHub [1] - pretty surreal seeing accounts for the big banks. Of course it's mostly completely useless for anything DIY as semi-understandably access to any real data is gated behind certification requirements.

[1] https://consumerdatastandardsaustralia.github.io/standards/#...

CFPB finalizes personal financial data rights rule

Related Stories