Banking Groups seek extension for CFPB Data Rule compliance

Specifically, the extension concerns a compliance deadline related to the Consumer Financial Protection Bureau’s (CFPB) new rule on consumer financial data, known as Section 1033. In a letter addressed to the CFPB, these organisations propose that banks in the initial compliance phase be granted a minimum of two years to adjust to the new requirements. This proposed extension aims to provide banks with adequate time to develop and implement the necessary systems and processes and for a standard-setting organisation to be officially recognized by the CFPB. 

The letter details several significant challenges that banks face under the new rule. Banks will be required to undertake substantial upgrades to their technology infrastructure, which includes standardising data formats and developing new operational policies and procedures. Additionally, they must build new functionalities into their systems, collaborate with third-party partners, and update public-facing resources to reflect the changes.

Working with third parties 

Coordination with third parties is an important aspect, as existing agreements with these entities will need to be reviewed and amended to comply with the new regulations. This process involves renegotiating terms and ensuring that all parties align with the new requirements. 

The letter also highlights the extended timeline necessary for the establishment of a standard-setting organisation. The CFPB has recently finalised a rule for recognising such organisations, but this process is expected to be lengthy. The development of consensus standards by these organisations will also require additional time, further extending the timeline for full implementation. 

To address these challenges, the associations suggest that the compliance deadlines for subsequent groups of entities be extended by 18 months. This recommendation is consistent with the CFPB’s proposed phased approach, which aims to provide all stakeholders with sufficient time to meet the new regulatory requirements without causing disruptions.