Required Rulemaking on Personal Financial Data Rights; Industry Standard-Setting (2024)

I. Summary

The CFPB is finalizing certain provisions of its Required Rulemaking on Personal Financial Data Rights (Personal Financial Data Rights rule),^[1] which, among other proposed provisions in the rule, sought to promote fair, open, and inclusive industry standard-setting. The CFPB proposed that standards adopted by CFPB-recognized standard setters might be used to facilitate implementation of a final Personal Financial Data Rights rule. Today's rule revises and finalizes part of proposed § 1033.131 (definitions) and all of proposed § 1033.141 (attributes a standard-setting body must demonstrate in order to be recognized by the CFPB). Included with this rule is a step-by-step guide for how standard setters apply for recognition and how the CFPB will evaluate applications.

II. Background

A. Introduction

Consumer electronic access to personal financial data, including and especially open banking,^[2] holds the potential to intensify consumer-friendly competition and innovation. Fair, open, and inclusive industry standard-setting play a critical role in ensuring the open banking system reaches its full potential to benefit consumers and competition.

By including section 1033 in the Consumer Financial Protection Act of 2010 (CFPA),^[3] Congress explicitly recognized the importance of personal financial data rights, and section 1033(d) recognizes the importance of standardized formats, especially with regard to data formats. In 2023, the CFPB issued a proposed rule to begin implementing section 1033, with the goal of accelerating the shift to a more open and decentralized system of consumer data access.

The proposed rule reflected the CFPB's preliminary determination that conformance with industry standards would constitute certain evidence of compliance with various substantive provisions of the proposed rule (or, in the case of data formats, would be sufficient for a data provider to be deemed compliant), provided that such standards were issued by a body recognized by the CFPB as possessing certain attributes. The proposed rule set forth the CFPB's view that industry standard setters that operate in a fair, open, and inclusive manner have a critical role to play in ensuring a safe, secure, reliable, and competitive data access framework. In the proposed rule, the CFPB noted that Federal regulations with very granular technical requirements could rapidly become obsolete, while industry-led standard-setting would be better able to keep pace with changes in the market and technology, as long as that standard-setting was fair, open, and inclusive.

U.S. government agencies have been historically involved in the development and use of standards to meet agency missions and priorities. Office of Management and Budget (OMB) Circular A-119 ^[4] reflects the U.S. government's commitment to a U.S. industry-led, voluntary consensus standards system. Broad use of such standards enhances the safety and security of products, reduces consumer costs, and expands consumers' options in the marketplace. Additionally, voluntary consensus standards ensure that no faction of industry can use its market power to impose its preferences on the entire market. Further, the use of consensus standards significantly reduces costs to agencies that would otherwise be incurred if agencies had to develop and maintain agency-unique standards.

B. Summary of the Rulemaking Process

Outreach and Engagement

The CFPB published its proposed rule on October 31, 2023.^[5] The public comment period on the proposed rule closed on December 29, 2023, and the CFPB received comments from individuals and entities representing various diverse interests. In addition, the CFPB also considered comments received after the comment period closed via ex parte submissions and meetings.^[6] Materials on the record, including all ex parte submissions and summaries of ex parte meetings, are available on the public docket for this rulemaking.^[7]

This final rule discusses those substantive comments relevant to the attributes of standard-setting bodies or the process by which the CFPB will recognize standard-setting bodies. For the most part, commenters that addressed the issues discussed in this final rule and in the appended application procedures supported the CFPB's plan to recognize standard setters that are fair, open, and inclusive, and generally agreed with the attributes the CFPB proposed to use to determine whether a standard-setting body was ( print page 49085) fair, open, and inclusive. Some commenters requested that the CFPB alter, clarify, or remove specific provisions of the proposed attributes, or made suggestions for how the CFPB should make its determination as to whether to recognize a given standard-setting body. Other commenters argued that the CFPB does not have legal authority to recognize standard-setting bodies, or critiqued how the proposed rule described a potential recognition process. The CFPB has considered these comments in adopting this final rule. The CFPB will discuss and address all other substantive comments when it finalizes the remainder of the Personal Financial Data Rights rule, including the many comments received concerning the role that adherence to a consensus standard should or should not play in evaluating compliance with the particular underlying provisions of the final rule.^[8] Comments focused on the application procedures described in the appendix are discussed in section IV.C.

Prior to issuing this final rule, in accordance with CFPA sections 1033(e) and 1022(b)(2)(B), the CFPB consulted on several occasions with staff from the prudential regulators ^[9] and the Federal Trade Commission to discuss various aspects of the proposed rule, including criteria for and processes with respect to standard-setting bodies.

III. Legal Authority

The CFPB is issuing this final rule pursuant to its authority under the CFPA. As set forth in section 1021 of the CFPA, Congress established the CFPB to ensure that “all consumers have access to markets for consumer financial products and services and that markets for consumer financial products and services are fair, transparent, and competitive.” Congress also authorized the CFPB to exercise its authorities under Federal consumer financial law, including the CFPA, to ensure that, with respect to consumer financial products and services, consumers have “timely and understandable information to make responsible decisions about financial transactions,” “consumers are protected from unfair, deceptive, or abusive acts and practices and from discrimination,” that “markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation,” and that “Federal consumer financial law is enforced consistently without regard to the status of a person as a depository institution in order to promote fair competition.”

A. CFPA Section 1033

CFPA section 1033(a) and (b) provide that, subject to rules prescribed by the CFPB, a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person, subject to certain exceptions. The information must be made available in an electronic form usable by consumers. In addition, CFPA section 1033(d) provides that the CFPB, by rule, shall prescribe standards applicable to covered persons to promote the development and use of standardized formats for information, including through the use of machine-readable files, to be made available to consumers under this section. Recognition of standard-setting bodies that are fair, open, and inclusive can facilitate implementation of these authorities. Further, CFPA section 1033(e) requires that the CFPB consult with the prudential regulators and the FTC to ensure, to the extent appropriate, that certain objectives are met.

B. CFPA Section 1022(b)

CFPA section 1022(b)(1) authorizes the CFPB to, among other things, prescribe rules and issue orders “as may be necessary or appropriate to enable the CFPB to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof.” The CFPA is a Federal consumer financial law. This rule carries out the purposes and objectives of the CFPA and prevents evasions thereof, by requiring standard-setting bodies to apply through the CFPB for recognition to adopt consensus ^[10] standards.

IV. Discussion of the Final Rule

A. Overview

This final rule identifies the attributes that a standard-setting body must demonstrate in order to be recognized by the CFPB. It also includes procedures for standard setters to apply for recognition by the CFPB. The following addresses comments on the proposed rule relevant to each topic.

B. Consensus Standards and Recognized Standard Setters

Definitions for Recognized Standard Setter and Consensus Standard

The CFPB proposed in § 1033.131 to define a “qualified industry standard” as a standard issued by a standard-setting body that is fair, open, and inclusive in accordance with proposed § 1033.141(a). The CFPB proposed in § 1033.141 that a standard-setting body is fair, open and inclusive when it satisfies seven requisite attributes: openness, balance, due process, appeals, consensus, transparency, and that the standard-setting body have been recognized by the CFPB as an issuer of qualified industry standards within the last three years.

Some commenters asked the CFPB to clarify when a standard issued by a recognized standard-setting body becomes a consensus standard, and, conversely, when a consensus standard ceases to have consensus status. A trade group commenter suggested that the CFPB remove the language in proposed § 1033.141(a)(7) that a standard-setting body must have been recognized by the CFPB within the last three years, suggesting that this recognition period would make it difficult for industry to use such standards or, appropriate, switch away from them. One commenter expressed concern that the loss of a standard's status as a consensus standard could cause market uncertainty, because the covered financial institutions would need to identify a different recognized standard setter and possibly have to modify its practices to conform with the consensus standards of that recognized standard setter.

After considering these comments, the CFPB is making several changes to §§ 1033.131 and 1033.141 relating to both standard setters and the standards they issue. First, this final rule replaces the term “qualified industry standard” with “consensus standard,” and adds a definition of “recognized standard setter,” a term not defined in the proposed rule. These editorial changes are intended to better organize the structure of these key terms, enhance readability of the final rule, and adopt terminology that more clearly describes the defined terms.

The definition of “consensus standard” in final § 1033.131 provides additional specificity regarding when a ( print page 49086) given standard is a consensus standard. Final § 1033.131 provides that to be a “consensus standard” the standard must be one that is adopted by a recognized standard setter, and that continues to be maintained by that recognized standard setter. Regarding the commenters' concern about market uncertainty, the CFPB expects revocation of recognition for a standard setter to be a rare occurrence, and in that event the CFPB would issue guidance to help manage a transition.

The CFPB has determined that it is appropriate to require a recognized standard setter to seek renewal of its recognition on a periodic basis. However, in § 1033.141(a), this final rule extends the maximum duration of the CFPB's recognition of a standard-setting body from the proposed duration of three years to five years. Periodic review and re-recognition mitigate the risk of outdated standards, which the CFPB's approach to industry standards was intended in part to avoid. Additionally, periodic review by the CFPB will ensure standard setters carefully mind their governance and procedures and keep them in conformance with the attributes. However, extending the maximum recognition period to five years in this final rule is warranted, for two main reasons. First, a five-year recognition period will mean that, should one or more standard-setting body receive early recognition from the CFPB, such recognition—and by extension their standards' status as consensus standards—would last further into the period during which industry is initially coming into compliance with the forthcoming Personal Financial Data Rights rule, providing additional certainty to smaller data providers covered by the rule. Additionally, the CFPB expects that reducing the frequency of periodic review and re-recognition by the CFPB will encourage standard-setting bodies to obtain recognition because their standards will retain consensus status for a longer period without the burden of seeking re-recognition.

The CFPB's Authority To Recognize Standard-Setting Bodies

Several industry commenters disputed the Bureau's legal authority to recognize standard-setting bodies that would then issue consensus standards for purposes of facilitating implementation of a final Personal Financial Data Rights rule. In response, the CFPB notes that, as discussed above in this final rule, establishing a framework for standard setting is authorized by CFPA section 1033(a) and (d) and the CFPB's authority to issue rules under CFPA section 1022(b)(1). The CFPB expects that individual recognition decisions will be authorized by this final rule, by the CFPB's authority to issue orders under CFPA section 1022(b)(1), and additionally by the CFPB's authority to issue declaratory orders to “to terminate a controversy or remove uncertainty” under section 554(e) of the Administrative Procedure Act.^[11]

Attributes of Standard-Setting Bodies

Openness

The CFPB proposed to include “openness” as a necessary attribute for CFPB recognition, and that a standard-setting body's openness would be evaluated by reviewing whether the standard-setting body's sources, procedures, and processes are open to all interested parties, and whether those interested parties can meaningfully participate in standards development on a non-discriminatory basis.

A few commenters addressed the proposed openness attribute. Consumer advocate commenters supported the explicit inclusion of consumer groups as an interested party for an open standard-setting body. A small number of commenters recommended alterations to the attribute. One industry trade group called for the CFPB to clarify that only the members of the standard-setting body would need to meaningfully participate in the standards development. Additionally, some third-party industry commenters asked the CFPB to clarify that a standard-setting body that is “open” for purposes of the attribute includes all types of financial institutions, including financial technology companies. In support of this consideration, one commenter highlighted what it described as the undue influence of banks in another country's standard-setting body due to the other country's exclusion of financial technology voices in the standard-setting body.

This final rule adopts § 1033.141(a)(1) mostly as proposed, with some additional clarifying text. In response to commenter concern that certain financial technology sectors might be excluded if not explicitly mentioned, the CFPB has added explicit reference to “data recipients” as an interested party in this final rule. The inclusion of data recipients also helps ensure that data providers and recipients are not forever compelled to rely on intermediaries with commercial interests that may not consistently align with the advancement of open banking standards. This final rule does not adopt commenters' request to limit “openness” to only members of the standard-setting body. As stated in this final rule, the sources of the standard-setting body must be available to all interested parties. This language reiterates that the CFPB expects an “open” standard-setting body to utilize open-source materials that interested parties can reference. Such open-source materials would not truly be open unless they were made available outside the standard-setting body's membership.

Balance

The CFPB proposed to include “balance” as a necessary attribute for CFPB recognition. The CFPB proposed that a standard-setting body's balance would be evaluated by the CFPB reviewing whether the standard-setting body's decision-making power is balanced across all interested parties at all levels of the standard-setting body. Further, the proposed attribute clarifies that balance could be impacted by entities playing multiple roles, such as data provider and third party. Additionally, the CFPB proposed that it could consider the ownership of an entity when reviewing a standard setter's balance. Finally, the CFPB proposed that balance would include meaningful representation of small and large commercial entities.

A number of commenters addressed this attribute. One consumer advocate commenter expressed their support for the proposed rule's inclusion of consumer advocates as interested parties in an open standard-setting body. Another consumer advocate commenter noted that some current standards bodies do not provide the same voting rights across categories of membership. A few commenters asked for clarification as to what the CFPB will consider “meaningful representation,” noting the importance of including small entity voices in the decision-making processes. Additionally, one consumer advocate commenter and one industry commenter recommended that a final rule extend balanced representation considerations to any committee or sub-committee involved in the standard setters decision-making processes.

After considering these comments, the CFPB is finalizing the requirement in § 1033.141(a)(2) largely as proposed, with some modifications. To address commenters' concerns about representation at the committee and sub-committee level, the CFPB has revised this final rule to state that balanced representation must be reflected at all levels of the standard- ( print page 49087) setting body. The additional “reflected” language provides a standard-setting body with some flexibility to arrange adequate committee and sub-committee representation, while also mitigating the possibility that a particular committee or sub-committee's representation become so unbalanced that it hinders the overall decision-making of the standard-setting body. This final rule does not further define “meaningful representation” because after consideration the CFPB concludes that the additional language reading “[n]o single interest or set of interests dominates decision-making” sufficiently describes the scope of meaningful representation. Finally, to address concerns about weighting of voting rights, this final rule clarifies that if a participant plays multiple roles, the weight of that participant's role will be factored into the balance consideration. As such, if a participant has a vote as a data provider but their primary business is as a third party, this could suggest that the standard-setting body is not balanced. Similarly, the CFPB can look at the ownership of a participant to determine to what degree the role and form of that entity's participation in the standard-setting body furthers or hinders the body's balance.

Due Process and Appeals

The CFPB proposed to include “due process” and “appeals” as necessary attributes for CFPB recognition. The proposed due process attribute would consider whether a standard-setting body uses documented and publicly available policies and procedures and provides a fair and impartial process for resolving conflicting views. The proposed appeals attribute would consider whether the standard-setting body provides an appeals process for the impartial handling of appeals.

A small number of commenters addressed these attributes. A few industry trade groups recommended that a final due process attribute should protect the anonymity of participant dialogue to encourage open dialogue among the members of the standard-setting body. One consumer advocate commenter recommended that a final appeals attribute focus on the process of creating standards, rather than on the standards themselves.

The CFPB is finalizing the proposed due process and appeals attributes with minimal change and a non-substantive structural modification. The structural modification is to combine the appeals and due process attributes into one attribute (now at § 1033.141(a)(3)), because both address similar issues of procedural fairness. Additionally, the CFPB is finalizing a modification to the appeals attribute that clarifies that the appeals process is available for the impartial handling of procedural appeals. The CFPB is finalizing the remainder of the attribute as proposed. Specifically, this final rule does not add requested language about anonymity within the standard-setting body. While anonymity may in some circ*mstances help create open dialogue, the CFPB is not including in this final rule the explicit availability of participant viewpoint anonymity because such protection is already provided by this final rule. Standard-setting bodies are not precluded from making viewpoints anonymous, so long as such anonymity policies do not have the potential to undermine a final openness, transparency, or due process attribute.

Consensus

The CFPB proposed to include “consensus” as a necessary attribute for CFPB recognition. Specifically, the proposed attribute looks at whether the standards development processes would proceed by consensus, defined as general agreement but not unanimity.

The CFPB received little commenter input concerning the consensus attribute. One third-party trade group recommended that a final rule consider consensus to be when there is consensus within a particular sector. The commenter suggested that if all third parties or all data providers oppose a standard, then that standard should not be adopted. Additionally, one data provider commenter recommended that a final rule consider that the majority of the standards proposed in the Personal Financial Data Rights rulemaking are obligations on data providers, and, as such, consensus should require data providers to be in agreement with a particular decision-making process of the standard-setting body.

The CFPB is finalizing the attribute largely as proposed, and adding language stating that consensus does not necessarily require unanimity. This modification is to clarify that general agreement can include unanimous decisions by the members of the standard-setting body. This final rule does not include language stating that a single class of standard-setting group members (like data providers or third parties) could have unilateral power in a standard-setting body. While consensus is important, privileging one group of members would inappropriately give that group unwarranted influence. The provision is also renumbered to § 1033.141(a)(4) to reflect organizational changes.

Transparency

The CFPB proposed to include “transparency” as an attribute for CFPB recognition consideration. Specifically, the proposed attribute would look at whether the procedures or processes for participating in standards development and for developing standards are transparent to participants and publicly available.

Several industry trade groups recommended that a final transparency attribute protect the anonymity of participant dialogue to encourage open dialogue among the participants in the setting of consensus standards. As stated above in the discussion of the proposed due process provision, standard-setting bodies are not precluded from making viewpoints anonymous, so long as such anonymity policies do not have the potential to undermine a final openness, transparency, or due process attribute. Accordingly, for the reasons discussed in the proposal, the CFPB is finalizing the transparency attribute as proposed. The provision is also renumbered to § 1033.141(a)(5) to reflect organizational changes.

Additional Attributes

In response to the CFPB's request for comment on whether it should include additional attributes when evaluating a standard setter for recognition, at least one commenter suggested that a final rule should adjust the attribute list to account for the relevance of standards that a standard-setting body adopts.

This final rule does not include an additional “relevance” attribute. However, demonstrating the attributes in this final rule is the minimum requirement for recognition; accordingly, the CFPB may consider other information when reviewing an application for recognition, including whether the standard-setting body will adopt and maintain standards relevant to open banking.

C. Procedures for CFPB Recognition of Standard-Setting Bodies

High-Level Comment Summary

A number of commenters on the proposed rule encouraged the CFPB to establish a process for recognizing standard setters as soon as possible. Their comments generally focused on seeking clarity and transparency from the CFPB about this process. Some industry commenters requested that the CFPB publish its recognition procedures for comment.

In response to comments that the CFPB quickly establish a process for recognizing standard-setting bodies, the ( print page 49088) CFPB is publishing the procedures included at appendix A. These constitute a rule of agency organization, procedure, or practice, and thus do not require notice and comment under the Administrative Procedure Act.^[12] As published, these procedures take account of comments received on the proposed rule regarding procedures for recognizing standard-setting bodies. The CFPB may publish amendments to the procedures from time-to-time as it develops experience with this recognition process and receives stakeholder feedback on them.

Discussion of Procedures for Recognition

The CFPB is providing a plain language guide for how standard setters should apply for recognition, how the CFPB evaluates applications, and what standard setters can expect once recognized. When submitting a request for recognition, the applicant should provide information sufficient to enable a determination by the CFPB of whether the applicant satisfies the requirements for recognition articulated in § 1033.141(a)(1) through (5). Other information provided, such as a description of how the applicant's current and/or anticipated standards relate to open banking, will help the CFPB understand the relevance of the standard setter to open banking.

The procedures also allow for a pre-filing meeting with the CFPB prior to submission of an application, so that the Bureau can provide information about the application process and assist organizations with submitting a complete application. During its review and discussions with the applicant, the CFPB may request additional information from the applicant necessary for the submission to be complete. Once it receives a complete application, the CFPB may publish the application, so as to enable stakeholders who believe the application is deficient to bring the CFPB's attention to any evidence that might substantiate such claims of deficiency.^[13] In this event, the CFPB expects to ask the applicant to provide written responses to any such claims, which the CFPB can then consider as part of its review and assessment of the application. This procedure addresses comments requesting greater public participation in the recognition process.

The CFPB will consider the complete application, including any adverse evidence provided to the CFPB, to evaluate whether the applicant satisfies the recognition requirements articulated in § 1033.141(a)(1) through (5). The CFPB will also evaluate whether the information provided in the application is accurate and complete, including regarding the applicant's policies and actual practices.

As part of its evaluation of an application, the CFPB will consider how granting a recognition request might support its own role in open banking pursuant to its CFPA section 1033 authority. However, the CFPB is not adopting the recommendation of one trade association commenter that a standard-setting body should not be eligible for CFPB recognition unless it had already promulgated standards central to the safe and efficient operation of open banking. Rather, the CFPB is retaining the flexibility suggested by other commenters that will enable the CFPB to recognize an organization at earlier stages of standards development in a given area. The CFPB emphasizes, however, that a recognition request from an entity that has not adopted, and does not intend to adopt, standards relevant to the CFPB's statutorily-authorized objectives for open banking is unlikely to be prioritized and may not be approved.

In acting on an application, in addition to either recognizing or not recognizing an applicant, the CFPB may provide contingent recognition to an applicant that has presented a satisfactory written plan specifying how and when it will address contingencies that the CFPB has identified. Once the applicant presents sufficient evidence that it has addressed such contingencies, the CFPB may recognize the applicant. The CFPB expects to use contingent recognition, which is not formal recognition under 12 CFR 1033.131, when it determines that an applicant is close to realizing, but has not yet realized, recognition requirements. The availability of contingent recognition responds to a trade association comment on the proposed rule that advocated for a phased approach to recognition, during which the CFPB would—before granting full recognition—offer feedback on steps to full recognition and support standard setters with garnering necessary stakeholder participation for recognition.

Consistent with trade association comments requesting that the CFPB publish a list of standard setters it recognizes, the CFPB will publicly disclose on its website each recognition and contingent recognition, along with the applicable terms and conditions of each. Some terms and conditions may be tailored to the circ*mstances of the applicant. For example, if the CFPB grants recognition based on the intention of a standard setter to develop and publish a consensus standard on a given subject matter, the CFPB may condition recognition on good faith efforts to develop a consensus standard in the given area.

Some commenters requested that the CFPB publish denials and include in its procedures a process to appeal such denials. The CFPB will publish denials as required by law, but applicants may also withdraw a pending application at any time for any reason. The CFPB is not providing a specialized appeals process. Consistent with the suggestion of one industry trade association, the CFPB may permit consultation with agency officials to help remedy issues after a submitted application is denied—although the agency intends pre-decisional consultation to minimize recourse to this option.

Next, the procedures describe the interaction between the CFPB and a standard setter once it is recognized. As noted above, each recognized standard setter must agree to a set of applicable terms and conditions. The procedures highlight terms and conditions related to CFPB observation or participation in standard-setting activities, notification requirements on the part of the standard setter, and monitoring of the standard setter by the CFPB. They also explain how a standard setter may request re-recognition.

In view of a trade association comment noting the need for market participants to have adequate time to transition from a consensus standard if the associated standard setter's recognition expires, the procedures state that recognized standard setters intending to apply for re-recognition should do so at least 180 days before their recognition expires. The CFPB may temporarily extend a recognition while a re-recognition application is pending. Both provisions related to re-recognition are intended to reduce the likelihood that a consensus standard loses its status due to a recognition expiring before re-recognition is granted.

Finally, the procedures describe the circ*mstances under which the CFPB may modify or revoke recognition. One advocacy organization indicated that the CFPB should revoke recognition when requirements of recognition are no longer met. Other industry commenters stated that the CFPB should clarify the circ*mstances under which recognition may be revoked, and also allow for the standard setter to cure deficiencies. ( print page 49089)

The CFPB expects to base a modification or revocation decision, which it would publish on its website, on whether the standard-setting body has failed to comply with applicable terms and conditions, otherwise no longer meets the required attributes, or otherwise no longer warrants recognition. The CFPB also expects to inform the standard setter of reasons for modification or revocation, and to provide the standard setter with an opportunity to address concerns.

V. Effective Date

The CFPB is adopting an effective date of 30 days after the publication of this final rule in the Federal Register , consistent with section 553(d) of the Administrative Procedure Act.^[14] No later effective date is necessary because this final rule does not impose any obligations on any party other than an applicant for recognition, which can choose when to submit its own application. Separately, the CFPB notes that an applicant may request that a pre-filing meeting, consistent with appendix A, be held before the effective date.

VI. CFPA Section 1022(b) Analysis

In developing this final rule, the CFPB has considered the potential benefits, costs, and impacts as required by section 1022(b)(2)(A) of the CFPA. Specifically, section 1022(b)(2)(A) of the CFPA requires the CFPB to consider the potential benefits and costs of a regulation to consumers and covered persons, including the potential reduction of access by consumers to consumer financial products or services, the impact on depository institutions and credit unions with $10 billion or less in total assets as described in section 1026 of the CFPA, and the impact on consumers in rural areas. The Bureau consulted with appropriate prudential regulators and other Federal agencies regarding the consistency of this final rule with prudential, market, or systemic objectives administered by such agencies as required by section 1022(b)(2)(B) of the CFPA.^[15]

This final rule creates an application and recognition process for industry standard setters but does not impose any compliance requirements based on the standards set by recognized standard setters. There are also no existing laws or rules that reference such standards. The CFPB anticipates finalizing the proposed rule of which this current rule was a part. If such a future rule were to reference industry standards set by recognized standard setters in connection with compliance requirements, the impacts of such requirements would be attributed to and assessed as part of that rule. Absent such a future rule, the CFPB does not anticipate changes in industry standards attributable to this final rule. As a result, relative to the baseline of current law used for this analysis, this final rule does not have impacts on consumers or industry participants other than standard setters that choose to apply for recognition.

In response to the proposal, one industry commenter stated that additional guidelines for recognized standard setters should be published, including a full cost-benefit analysis. The analysis in this part reflects the full consideration of benefits and costs attributable to this final rule. As noted, only a limited number of provisions from the proposal are being finalized in this rule, none of which impose substantive compliance requirements. As a result, any analysis of the benefits and costs of substantive compliance requirements based on industry standards prior to the finalization of such requirements would be speculative and would not be accurate absent a future rule finalizing those provisions.

Impacts on Consumers

The CFPB does not anticipate changes in industry standards attributable to this final rule and, thus, no benefits or costs to consumers. The CFPB is finalizing this rule to ease compliance with potential future rulemakings.

Impacts on Covered Persons ^[16]

This final rule will impact standard setters that choose to apply for recognition. The CFPB expects such standard setters may incur costs associated with assembling and submitting application materials and responding to any follow up requests or clarifications in the application process. The submitted materials and follow up requests would differ across applicants, so the cost estimates in this analysis reflect an estimated average.

Standard setters may have members that are covered persons and members that are not covered persons. The CFPB expects any costs incurred by standard setters would be spread across their membership.

Based on industry outreach and responses to the CFPB's proposed rule, few standard setters exist that maintain standards directly relevant to the Personal Financial Data Rights rule. As a result, the CFPB expects nine or fewer standard setters to apply for recognition.

Those standard setters that apply may incur an estimated $10,604 in labor costs, on average. This estimate assumes 120 staff labor hours at an average total hourly compensation of $88.37. This total hourly compensation reflects an average of May 2023 wages from the Bureau of Labor Statistics for compliance officers ($38.55), lawyers ($84.84), and general and operations managers ($62.18), adjusted for non-wage compensation (30 percent of all compensation for private industry workers).^[17] If nine standard setters apply, the estimated total costs to industry would be $95,436.

Consideration of Alternatives

The CFPB considered potential alternatives to this rule, including waiting to finalize provisions related to standard setter recognition until such time as substantive compliance requirements such as those in the full proposed rule were finalized.

In comments on the proposal related to standard setting, industry commenters generally noted that a lack of clarity on industry standards would make compliance with the proposal more costly and difficult. The comments indicated that having a standard setter recognized early relative to the compliance date for the proposal's substantive requirements could reduce industry costs. Based on these comments, the CFPB expects that the alternative of waiting to finalize the provisions in this final rule would have increased costs to industry of complying with any substantive compliance requirements finalized in a potential future rulemaking.

Potential Impacts on Depository Institutions and Credit Unions With $10 Billion or Less in Total Assets, as Described in Section 1026

The only impacts attributable to this final rule on depository institutions and credit unions with $10 billion or less in total assets would be through their roles ( print page 49090) as members of standard setters that choose to apply for recognition. The CFPB expects these costs would be the same as the costs faced by any members of such standard setters, as described earlier in this part.

Potential Impacts on Consumers in Rural Areas, as Described in Section 1026

The CFPB does not anticipate changes in industry standards attributable to this final rule and, thus, no impacts on consumers in rural areas.

VII. Regulatory Flexibility Act Analysis

The Regulatory Flexibility Act (RFA), as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, requires each agency to consider the potential impact of its regulations on small entities, including small businesses, small governmental units, and small not-for-profit organizations. The RFA defines a “small business” as a business that meets the size standard developed by the Small Business Administration pursuant to the Small Business Act.

The RFA generally requires an agency to conduct an initial regulatory flexibility analysis (IRFA) and a final regulatory flexibility analysis (FRFA) of any rule subject to notice-and-comment rulemaking requirements, unless the agency certifies that the rule would not have a significant economic impact on a substantial number of small entities. The Bureau also is subject to certain additional procedures under the RFA involving the convening of a panel to consult with small business representatives before proposing a rule for which an IRFA is required.

The CFPB convened a panel of small business representatives and conducted an IRFA as part of the proposal. However, this final rule includes only a limited number of provisions from that proposal, and none of the provisions being finalized impose significant compliance costs on small entities. As a result, the CFPB is not conducting a FRFA as part of this final rule. The CFPB would satisfy the requirements of the RFA by conducting a FRFA when it finalizes any provisions imposing significant compliance costs on small entities.

Some standard setters may be small entities, or may have members that are small entities. However, the CFPB expects nine or fewer standard setters to apply for recognition, which is not a substantial number of entities relative to all industry standard setters.

From a cost perspective, the CFPB expects any costs incurred by standard setters to be spread across all members, including both small entities and larger entities. This implies per-member costs substantially lower than the $10,604 in per-standard setter costs estimated above. Such costs will not be a significant economic impact on small entity members of standard setters.

Accordingly, the Director certifies that this final rule will not have a significant economic impact on a substantial number of small entities.

VIII. Paperwork Reduction Act

Under the Paperwork Reduction Act of 1995 (PRA), Federal agencies are generally required to seek, prior to implementation, approval from the Office of Management and Budget (OMB) for information collection requirements. Under the PRA, the Bureau may not conduct or sponsor, and, notwithstanding any other provision of law, a person is not required to respond to, an information collection unless the information collection displays a valid control number assigned by OMB.

The Bureau has determined that this final rule does not contain any new or substantively revised information collection requirements.

IX. Congressional Review Act

Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the CFPB will submit a report containing this rule and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States prior to the rule taking effect. The Office of Information and Regulatory Affairs has designated this rule as not a “major rule” as defined by 5 U.S.C. 804(2).

X. Severability

If any provision in §§ 1033.101, 1033.131, 1033.141, or appendix A, or any application of a provision, is stayed or determined to be invalid, the remaining provisions or applications are severable and shall continue in effect.

Authority and Issuance

For the reasons set forth in the preamble, the CFPB adds 12 CFR part 1033, as follows: