How to Navigate Open Banking Uncertainty, as Battle Lines Harden Over CFPB Rule

What Is a ‘Consumer’?

The definition of a “consumer” is critical. Generally, the banking industry prefers a narrow definition of the term, the fintech industry a broad one.

Banks weren’t happy that the original regulation included parties authorized to access consumers’ information.

The Act “gives no indication that Congress intended to provide the CFPB the authority to compel banks to share their consumers’ information with third-party commercial actors,” wrote the Bank Policy Institute. “Throughout Section 1033, the word ‘consumer’ is used in a way that could only refer to the individual customer.”

“Congress did not intend for technology companies, data aggregators, payments processors, or fintech apps to have statutory rights to consumer data. The narrow language of Section 1033 grants this statutory right to data to consumers and those acting in a fiduciary-like capacity,” wrote JPMorgan Chase.

The original rule refers to “authorized third parties” which have complied with requirements on consumer consent. The Independent Community Bankers of America (ICBA) argued that these third parties are not obligated “to act in the best interests of the consumer” and asked that the new regulation narrow that group to only those using access to grant customers a product or service “that is in their interest to receive.”

This debate reflects a common view among banks that fintechs use much consumer data for their own purposes. In its letter, JPMorgan Chase referred to access used to build files for non-customer reasons.

The fintech side argues just as vehemently that they and other organizations are very much “consumers” under Section 1033’s definition of the term.

“The scope of who may act on behalf of a consumer is central to the operation of Section 1033 and the future of financial services in the United States,” said the Financial Technology Association. FTA maintained that Congress intended “consumer” to be broad. “Narrowing it to fiduciaries would incorrectly collapse the term’s meaning,” the association said.

“Third parties authorized by users may well be those users’ ‘agents,’ but they are certainly ‘representatives,’ and so, within the CFPA’s scheme, they are clearly consumers entitled to access under Section 1033. The bureau cannot now circumscribe those rights,” wrote the Blockchain Association. (CFPA stands for “Consumer Financial Protection Act,” a subpart of Dodd-Frank.)

“The bureau should confirm that any third-party representative properly authorized by the individual consumer is entitled to access data under Section 1033,” said Plaid in its letter.

Plaid, a leading data aggregator, noted that banking interests “have mischaracterized authorized third parties, including companies like Plaid, as untrustworthy middlemen, in an attempt to discredit the very entities helping Americans to better manage their financial lives. The incumbent financial institutions’ goal is clear: eliminate the statutory protection for consumer-authorized data sharing.”

The definition of “consumer” could influence the bureau’s decision on whether third parties can be charged for data access under the new regulation. The original regulation specifically barred fees for such access, and the JPMorgan Chase decision to begin charging was made before the original regulation would have gone into effect.

Read more from our open banking archive:

• With the Fate of Open Banking Unclear, What Should Banks Do? Stay the Course
• Should You Demand Fintechs Pay for Your Data Like Chase?
• What Banks Must Do While 1033 Open Banking Rules Hang in Legal Limbo
• Open Banking Isn’t Dead. The Battle Over Regulation 1033 Now Pits Banks vs. Fintechs

‘Fees Are an Anti-Competitive Gambit’ vs. ‘Fees Are Critical to Cover Costs’

The fintech camp leaves no doubt where it stands on fees that banks would like to charge for access to their customers’ data.

Plaid wasn’t vague: “Dominant financial institutions are pressing for fees now, not because of some new-found need to recover ‘costs’ on the very API technologies they insisted the market adopt, but rather because fees are yet another competition-killing weapon in their arsenal.” (API stands for application programming interface.)

Plaid — having announced the deal with Chase only about two months before filing its letter — wrote that Dodd-Frank makes it clear that consumers and their authorized third-party representatives “are entitled to receive information ‘upon request’ — not ‘upon the payment of a fee’. The statute is not written conditionally, nor does it contain any allowance from Congress for fees.”

“A prohibition on charging fees is … critical because it solves a significant market failure,” said the FTA. “Legacy data providers [i.e., banks] have a direct economic incentive to charge high, deterrent fees in order to block the transfer of data they would prefer to hold captive.” The association insisted that Dodd-Frank granted consumers and their third parties a “fundamental legal entitlement, not a conditional right contingent on paying access fees” and that statutory rights are not subject to “gatekeeping fees.”

The American Fintech Council is unusual in that its membership includes fintechs but also some banks. Still, its comment letter came down against fees.

“We are not diminishing the costs that our innovative bank members and other financial institutions face,” the group said. “However, given that our bank members are focused on being innovative, the specific infrastructure costs function as part of that broader innovation strategy and are necessary for remaining viable in the modern banking system.”

On the banking side, the American Bankers Association insisted that 1033 doesn’t state nor imply that fees are not allowed, even though the original regulation barred charging for data. As such, it said, the original regulation “compels data providers under penalty of noncompliance to subsidize the business models of data aggregators and third parties seeking to monetize the information.”

In fact, ABA disputes a key assumption: “Despite what is being alleged, it is not the data itself that is being charged for but rather developing and maintaining a costly system for access, refinement, monitoring, updates, and safeguarding of the data. Those who will use the API are not the consumers, but other companies who will provide a product/service based on the data they ingest, so it is reasonable they pay market value for such access.”

Park National Bank, a $9.9 billion-in-assets bank based in Newark, Ohio, called on the bureau to lift the original regulation’s ban on fees, calling it “unsustainable and inequitable.” The bank suggested the CFPB devised a tiered system of fees, with a cap: “This approach would allow institutions to recover costs while maintaining equitable access and avoiding anti-competitive practices.”

Read more: Open Finance Is Exploding Globally. Why is the U.S. Lagging?