On February 25, 2025, Judge Danny C. Reeves of the Eastern District of Kentucky granted a Joint Motion to Stay Proceedings in Forcht Bank, NA et al v. Consumer Financial Protection Bureau et al, temporarily staying litigation proceedings and tolling compliance deadlines under Section 1033 of the Dodd-Frank Act by 30 days. This order postpones the initial compliance dates for covered entities from April 1 to May 1 for each phase of the implementation period.
Background
Dodd-Frank Act Section 1033, colloquially known as the “Open Banking Rule,” provides that, subject to rules prescribed by the Consumer Financial Protection Bureau (CFPB), a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person, subject to certain exceptions. The information must be made available in an electronic form usable by consumers.
In October 2024, the CFPB finalized its rulemaking, subjecting various “data providers,” including banks, credit unions, digital wallet providers, and payment apps to the rule, while exempting small depository institutions with assets of $850 million or less. The rule mandates that covered data, such as transaction history, account balances, and payment information be made available in standardized, machine-readable formats.
Compliance deadlines
The CFPB’s rule implemented a phased compliance schedule, with deadlines ranging from April 1, 2026, to April 1, 2030, depending on the size of the data provider. The specific compliance deadlines are set forth in the table below.
|
Institution and size
|
Compliance deadline
|
|
Depository institutions holding at least $250B in total assets
|
April 1, 2026
|
|
Nondepository institutions generating at least $10B in total receipts (including affiliates) in either 2023 or 2024
|
April 1, 2026
|
|
Depository institutions holding between $10B and $250B in total assets
|
April 1, 2027
|
|
Nondepository institutions that did not generate $10B or more in total receipts in both 2023 and 2024
|
April 1, 2027
|
|
Depository institutions holding between $3B and $10B in total assets
|
April 1, 2028
|
|
Depository institutions holding between $1.5B and $3B in total assets
|
April 1, 2029
|
|
Depository institutions holding between $1.5B and $850M in total assets
|
April 1, 2030
|
Industry reaction and litigation
The CFPB’s final rule was met with mixed reactions from the industry. Fintech trade associations were generally supportive of the rule, citing the rule’s potential to boost consumer choice and drive innovation. However, they also raised concerns over provisions like annual reauthorization requirements and restrictions on secondary data use. Banking groups, on the other hand, were more critical, arguing that the rule exceeds the CFPB’s authority, imposes undue burdens on banks, and fails to adequately allocate liability for data privacy and security breaches.
On the day that the CFPB’s final rule was released, the Bank Policy Institute, the Kentucky Bankers Association, and Forcht Bank, N.A. filed suit against the CFPB challenging the rule in the Eastern District of Kentucky. Specifically, the lawsuit alleges that the CFPB exceeded their statutory authority and violated the Administrative Procedure Act by requiring banks to ensure the protection of sensitive customer information, increasing the likelihood of fraud and scams, failing to eliminate “unsafe” practices like screen scraping, failing to hold third parties accountable for data security, allowing third parties to profit from systems built and maintained by banks, and imposing unreasonable implementation timelines.
The joint motion and order
On February 25, 2025, both the plaintiffs and the defendants submitted a Joint Motion to Stay Proceedings requesting a 30-day stay in the litigation with amended briefing deadlines and a 30-day tolling of the compliance deadlines prescribed in 12 C.F.R. § 1033.121(b).
To support their request, the parties cited the administrative change at the CFPB. Effective as of January 31, 2025, Rohit Chopra was removed as director of the CFPB and was replaced by Acting Director Scott Bessent (subsequently followed in that role by Russell Vought). As a result, the CFPB’s new leadership requested “time to review and consider the CFPB’s position on various pending agency actions and recently finalized rules.”
The court agreed with the parties’ requests and ordered “a 30-day stay of these proceedings and a corresponding 30-day tolling of the obligations prescribed by the rule the plaintiffs are challenging.” This order extends the compliance deadline for each phase from April 1 to May 1.
What this means to you
Forcht Bank, NA et al v. Consumer Financial Protection Bureau et al is not the first case in which the CFPB has requested additional time to evaluate its position in light of the leadership change. In Texas Bankers Association v. Consumer Financial Protection Bureau, the Fifth Circuit granted a 90-day toll on the compliance deadlines for the CFPB’s Small Business Lending Rule, but only for plaintiffs and intervenors in the case. Similarly, in Cornerstone Credit Union League v. Consumer Financial Protection Bureau, the Eastern District of Texas granted a 90-day stay on the effective date of Regulation V.
The joint motion, and the court’s corresponding order, signifies the state of flux surrounding many of the previous administration’s recent rules and regulatory actions. The new administration will need to reassess its stance on various rules and pending litigation, potentially leading to drastic changes in the CFPB’s approach. As such, industry participants should keep a close eye on rules that affect them for further developments.
Contact us
If you have any questions about this study or other consumer financial issues, contact Chris Friedman, Jakob Seidler, or your local Husch Blackwell attorney.