4 ms·

CFPB finalizes personal financial data rights rule

138 points by hn_acker 2y ago

toomuchtodo 2y ago
CFPB Announcement: https://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-personal-financial-data-rights-rule-to-boost-competition-protect-privacy-and-give-families-more-choice-in-financial-services/ https://www.consumerfinance.gov/about-us/newsroom/cfpb-final... Rule: https://files.consumerfinance.gov/f/documents/cfpb_personal-financial-data-rights-final-rule_2024-10.pdf https://files.consumerfinance.gov/f/documents/cfpb_personal-...
hggigg 2y ago
Having seen how this shit works behind the scenes I’d rather do it manually.
- buffington 2y ago
  I'd love to hear what you saw that motivated this. Care to share?
  - hggigg 2y ago
    Account holder migration between two major international banks. Subcontracted out to the lowest bidding outsourcer who operate some major enterprise messaging bespoke piece of crap bought from IBM which is held together with sticky tape, string and smeared in dog shit and requires hand holding 24/7 due to the sheer amount of bugs in it. I found this out because the company I was contracting for was trying to get the open banking API working against one of the banks and we ended up having to speak to four parties over an simple encoding issue that no one at any org could understand. It was basically the spider man pointing meme. One set of outsourcers blaming another set of outsourcers while their local managers were doing the same. No one even understood or communicated the issues. When you do something at a bank and it takes longer than expected it’s that sort of shit happening.
  - Suppafly 2y ago
    >I'd love to hear what you saw that motivated this. Care to share? Working adjacent to medicine,banking, supply chain, and some other fields, I'd say that most people don't realize that everything is just csv files and sftp servers underneath. You'd assume these fields would be using realtime web services to communicate with each other, but even the ones that seem roughly realtime are often using scheduled file transfers of batched data. A lot of the integration is essentially bat files and shell scripts converting between one type of csv to another. It's bandaids and bailing wire all the way down.
arunabha 2y ago
And right on cue, wall street fights back! Expected, but still rankles as bit. 'JPMorgan CEO Jamie Dimon says 'it's time to fight back' on regulation' from https://www.reuters.com/business/finance/jpmorgan-ceo-says-its-time-fight-back-regulation-2024-10-28/ https://www.reuters.com/business/finance/jpmorgan-ceo-says-i... The comment from Dimon is the cherry on top. 'Dimon said he was not against open banking but noted that it could compromise consumer data and lead to fraudulent money transfers and he was set to fight it.' His bank is happy to accept fraudulent checks and ACH transfers all day long, but his primary opposition to open banking rules is his overwhelming concern for his customers. Riiiight.
- toomuchtodo 2y ago
  "It is difficult to get a man to understand something, when his salary depends on his not understanding it." You have an entire commercial banking industry that has been dependent on being able to capture inexpensive deposits from unsophisticated financial services consumers (they make the spread between the ~0% they offer on demand deposits and what they can lend at), as well as charging exorbitant fees to move value around, and that is all coming to an end with open banking and FedNow instant payments. Sad folks gonna sad. You're a utility, sorry to say. (obligatory credit union plug here)
  - SoftTalker 2y ago
    Credit Unions are typically better, but not always. Fees can still be high and interest rates low. You still have to comparison shop and do some due diligence.
    - toomuchtodo 2y ago
      Certainly, but they are not profit motivated in the same way a commercial bank is. Do your due diligence. https://mycreditunion.gov/about-credit-unions/find-join-start https://mycreditunion.gov/about-credit-unions/find-join-star...
      - 2y ago
teeray 2y ago
So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?
- ryandrake 2y ago
  Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.
  - hollerith 2y ago
    Of course it violates the terms of service written by your bank. Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.
    - dylan604 2y ago
      at the same time, the banks are happy they don't have to spend the money to develop those APIs themselves.
    - _boffin_ 2y ago
      Actually… not as much as you think. Go read Wells Fargo’s policies. The gist of it: if you give it to someone, that’s on you.
      - sjtgraham 2y ago
        It's not on you though. Banks have Reg E obligations that cannot be waived by contract.
        _boffin_ 2y ago
        I wasn't talking about Regulation E. My point was that banks like Wells Fargo have effectively "allowed" companies like Plaid and MX to log in using user credentials .
AshamedCaptain 2y ago
ah, you mean there are still more than two banks customer can choose from? and for how long?
- stronglikedan 2y ago
  Unless you have a very narrow use case, there has always been a plethora of banks to choose from.
  - bob1029 2y ago
    Banking with a more local institution can make all of the difference in the experience. It would probably blow your mind if you've never done it. Maybe try a mid-size bank that operates in a few states if you are concerned with going too small. If you are banking with Wells Fargo or BoA, you are getting exactly what you signed up for. A customer base so large that they have no choice but to treat you like a row in a database (i.e., a piece of shit).
    - mindslight 2y ago
      > Maybe try a mid-size bank that operates in a few states if you are concerned with going too small I disagree with this. Medium/regional banks often have the same dynamic where the people in the branches have to call in to centralized help lines to get anything done, rather than employees being empowered to exercise judgement and act. But yet their systems can be way less polished than the megabanks. And from what I've seen their fees are often higher and less forgiving (not that you should be paying fees anywhere though, as an individual retail customer) My main combo is local bank/creditunion for cash/notary/medallion/safedepositbox/cashierschecks and then online-only large bank because it pays real interest and has a less janky UI. (although with the ever-ratcheting SMS login nags, I'm starting to question that last bit). Both refund third party ATM fees. On the larger topic, I'm disappointed to see this regulatory push has very little to do with making sure users can get frequent automated access to their own transaction data. Continually verifying the transactions on your account is basically the necessary and sufficient condition for preventing the bank making you responsible for their being defrauded.
0cf8612b2e1e 2y ago
I hate that I am so pessimistic, but I will hold my breath until the Supreme Court says why nobody has the authority to tell banks what to do.
- Molitor5901 2y ago
  Unfortunately it will still come down to the bank wanting to do business with you. I believe at the end of the day, if you don't agree to what the bank wants of you, and from you, they will debank you. There is no right, or even a law, that the bank has to give you an account. This is a good decision by the CFPB but it's a drop in the bucket.
- jerf 2y ago
  The Supreme Court did not say that no Federal agency can do anything, ever. You can tell by the way the Federal agencies are still, you know, there. Doing things.
skybrian 2y ago
Dismissing fraud as a problem makes it sound like there’s no tradeoff here. I think we all know that in real life, fraud actually is a pretty big problem? Though they’re self-interested, I expect that banks know it too. It doesn’t mean you shouldn’t be able to export your data, but this is a sensitive operation that maybe shouldn’t be too easy. People are definitely going to be tricked. The individualistic, libertarian assumption (that customers are responsible adults who know what they’re doing) is known to be false by anyone who has worked in a customer support role.
- throwaway48476 2y ago
  Fraud is only a problem for international transactions. The rest can be handled by lawyers.
  - Nifty3929 2y ago
    At great time and expense, while you have bills to pay and someone else has your money.
ilaksh 2y ago
If you don't like what banks do, then learn about the technologies that can replace them today.
- barumrho 2y ago
  Do you mean bitcoin/crypto or did you have something else in mind?
  - ilaksh 2y ago
    I think most people don't really know what those things are, or what the fundamental concepts are, so I recommend people research decentralized technologies that are related to money from scratch.
- politician 2y ago
  Banks are 95% law and maybe 5% technology.
- immibis 2y ago
  Although you're obviously talking about crypto, I support the message of learning how shit things work underneath and maybe someone will come up with a way to improve them.
renewiltord 2y ago
This seems impossible without Chevron Deference. I doubt one can exercise one’s rights under this.
- monocularvision 2y ago
  What does Chevron Deference have to do with this? Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so. This entirely fits within the current Supreme Court doctrine around regulatory agencies. Now, that’s not to say there might not be some other constitutional objection the the law itself…
  - sjtgraham 2y ago
    > Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so. Actually it didn't. S1033 of the CFPA states a financial institution will upon request of a consumer provide covered information about their financial accounts in a digital format usable by consumers. The rule relies on an expansive interpretation of the statutory definition of "consumer", which is a natural person or "an agent, trustee, or representative" thereof. The agency asserts that representative can be any third party and off of this says banks have to make a developer interface available for them to access, that ironically it does not mandate actual consumers, i.e. natural persons like you and I, can access. This expansive interpretation will not survive judicial review. The canons of statutory interpretation do not allow it, e.g. agent and trustee are fiduciary relationships, as they are mentioned before "representative" it limits the potential scope to other types of fiduciary relationship (ejusdem generis and noscitur a sociis). A fintech is not a fiduciary and has no obligation to act in your interest. It's a typical arms-length commercial transaction. Whether or not the agency's goal is noble is besides the point. It has plainly and obviously gone way beyond the statutory authority granted to it by Congress.
    - monocularvision 2y ago
daft_pink 2y ago
Does anyone else feel like Apple’s app store rules have more teeth than this? Lobbyists have already or will soon be gutting this for sure.
Snuupy 2y ago
Until this comes to fruition and banks actually implement it with software (like Actual Budget) supporting it, I will continue using SimpleFIN Bridge. Hopefully this becomes ubiquitous like GoCardless in the EU.
fowl2 2y ago
Wonder how this compares with the Consumer Data Right in Australia. The standards and discussions around them are right there on GitHub [1] - pretty surreal seeing accounts for the big banks. Of course it's mostly completely useless for anything DIY as semi-understandably access to any real data is gated behind certification requirements. [1] https://consumerdatastandardsaustralia.github.io/standards/#introduction https://consumerdatastandardsaustralia.github.io/standards/#...

138 points by hn_acker 2y ago

CFPB Announcement: https://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-personal-financial-data-rights-rule-to-boost-competition-protect-privacy-and-give-families-more-choice-in-financial-services/ https://www.consumerfinance.gov/about-us/newsroom/cfpb-final... Rule: https://files.consumerfinance.gov/f/documents/cfpb_personal-financial-data-rights-final-rule_2024-10.pdf https://files.consumerfinance.gov/f/documents/cfpb_personal-...

hggigg 2y ago

Having seen how this shit works behind the scenes I’d rather do it manually.

buffington 2y ago
I'd love to hear what you saw that motivated this. Care to share?
- hggigg 2y ago
  Account holder migration between two major international banks. Subcontracted out to the lowest bidding outsourcer who operate some major enterprise messaging bespoke piece of crap bought from IBM which is held together with sticky tape, string and smeared in dog shit and requires hand holding 24/7 due to the sheer amount of bugs in it. I found this out because the company I was contracting for was trying to get the open banking API working against one of the banks and we ended up having to speak to four parties over an simple encoding issue that no one at any org could understand. It was basically the spider man pointing meme. One set of outsourcers blaming another set of outsourcers while their local managers were doing the same. No one even understood or communicated the issues. When you do something at a bank and it takes longer than expected it’s that sort of shit happening.
- Suppafly 2y ago
  >I'd love to hear what you saw that motivated this. Care to share? Working adjacent to medicine,banking, supply chain, and some other fields, I'd say that most people don't realize that everything is just csv files and sftp servers underneath. You'd assume these fields would be using realtime web services to communicate with each other, but even the ones that seem roughly realtime are often using scheduled file transfers of batched data. A lot of the integration is essentially bat files and shell scripts converting between one type of csv to another. It's bandaids and bailing wire all the way down.

arunabha 2y ago

And right on cue, wall street fights back! Expected, but still rankles as bit. 'JPMorgan CEO Jamie Dimon says 'it's time to fight back' on regulation' from https://www.reuters.com/business/finance/jpmorgan-ceo-says-its-time-fight-back-regulation-2024-10-28/ https://www.reuters.com/business/finance/jpmorgan-ceo-says-i... The comment from Dimon is the cherry on top. 'Dimon said he was not against open banking but noted that it could compromise consumer data and lead to fraudulent money transfers and he was set to fight it.' His bank is happy to accept fraudulent checks and ACH transfers all day long, but his primary opposition to open banking rules is his overwhelming concern for his customers. Riiiight.

toomuchtodo 2y ago
"It is difficult to get a man to understand something, when his salary depends on his not understanding it." You have an entire commercial banking industry that has been dependent on being able to capture inexpensive deposits from unsophisticated financial services consumers (they make the spread between the ~0% they offer on demand deposits and what they can lend at), as well as charging exorbitant fees to move value around, and that is all coming to an end with open banking and FedNow instant payments. Sad folks gonna sad. You're a utility, sorry to say. (obligatory credit union plug here)
- SoftTalker 2y ago
  Credit Unions are typically better, but not always. Fees can still be high and interest rates low. You still have to comparison shop and do some due diligence.
  - toomuchtodo 2y ago
    Certainly, but they are not profit motivated in the same way a commercial bank is. Do your due diligence. https://mycreditunion.gov/about-credit-unions/find-join-start https://mycreditunion.gov/about-credit-unions/find-join-star...
    - 2y ago

teeray 2y ago

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

ryandrake 2y ago
Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.
- hollerith 2y ago
  Of course it violates the terms of service written by your bank. Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.
  - dylan604 2y ago
    at the same time, the banks are happy they don't have to spend the money to develop those APIs themselves.
  - _boffin_ 2y ago
    Actually… not as much as you think. Go read Wells Fargo’s policies. The gist of it: if you give it to someone, that’s on you.
    - sjtgraham 2y ago
      It's not on you though. Banks have Reg E obligations that cannot be waived by contract.
      - _boffin_ 2y ago
        I wasn't talking about Regulation E. My point was that banks like Wells Fargo have effectively "allowed" companies like Plaid and MX to log in using user credentials .

AshamedCaptain 2y ago

ah, you mean there are still more than two banks customer can choose from? and for how long?

stronglikedan 2y ago
Unless you have a very narrow use case, there has always been a plethora of banks to choose from.
- bob1029 2y ago
  Banking with a more local institution can make all of the difference in the experience. It would probably blow your mind if you've never done it. Maybe try a mid-size bank that operates in a few states if you are concerned with going too small. If you are banking with Wells Fargo or BoA, you are getting exactly what you signed up for. A customer base so large that they have no choice but to treat you like a row in a database (i.e., a piece of shit).
  - mindslight 2y ago
    > Maybe try a mid-size bank that operates in a few states if you are concerned with going too small I disagree with this. Medium/regional banks often have the same dynamic where the people in the branches have to call in to centralized help lines to get anything done, rather than employees being empowered to exercise judgement and act. But yet their systems can be way less polished than the megabanks. And from what I've seen their fees are often higher and less forgiving (not that you should be paying fees anywhere though, as an individual retail customer) My main combo is local bank/creditunion for cash/notary/medallion/safedepositbox/cashierschecks and then online-only large bank because it pays real interest and has a less janky UI. (although with the ever-ratcheting SMS login nags, I'm starting to question that last bit). Both refund third party ATM fees. On the larger topic, I'm disappointed to see this regulatory push has very little to do with making sure users can get frequent automated access to their own transaction data. Continually verifying the transactions on your account is basically the necessary and sufficient condition for preventing the bank making you responsible for their being defrauded.

0cf8612b2e1e 2y ago

I hate that I am so pessimistic, but I will hold my breath until the Supreme Court says why nobody has the authority to tell banks what to do.

Molitor5901 2y ago
Unfortunately it will still come down to the bank wanting to do business with you. I believe at the end of the day, if you don't agree to what the bank wants of you, and from you, they will debank you. There is no right, or even a law, that the bank has to give you an account. This is a good decision by the CFPB but it's a drop in the bucket.
jerf 2y ago
The Supreme Court did not say that no Federal agency can do anything, ever. You can tell by the way the Federal agencies are still, you know, there. Doing things.

skybrian 2y ago

Dismissing fraud as a problem makes it sound like there’s no tradeoff here. I think we all know that in real life, fraud actually is a pretty big problem? Though they’re self-interested, I expect that banks know it too. It doesn’t mean you shouldn’t be able to export your data, but this is a sensitive operation that maybe shouldn’t be too easy. People are definitely going to be tricked. The individualistic, libertarian assumption (that customers are responsible adults who know what they’re doing) is known to be false by anyone who has worked in a customer support role.

throwaway48476 2y ago
Fraud is only a problem for international transactions. The rest can be handled by lawyers.
- Nifty3929 2y ago
  At great time and expense, while you have bills to pay and someone else has your money.

ilaksh 2y ago

If you don't like what banks do, then learn about the technologies that can replace them today.

barumrho 2y ago
Do you mean bitcoin/crypto or did you have something else in mind?
- ilaksh 2y ago
  I think most people don't really know what those things are, or what the fundamental concepts are, so I recommend people research decentralized technologies that are related to money from scratch.
politician 2y ago
Banks are 95% law and maybe 5% technology.
immibis 2y ago
Although you're obviously talking about crypto, I support the message of learning how shit things work underneath and maybe someone will come up with a way to improve them.

renewiltord 2y ago

This seems impossible without Chevron Deference. I doubt one can exercise one’s rights under this.

monocularvision 2y ago
What does Chevron Deference have to do with this? Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so. This entirely fits within the current Supreme Court doctrine around regulatory agencies. Now, that’s not to say there might not be some other constitutional objection the the law itself…
- sjtgraham 2y ago
  > Congress passed an explicit law saying financial companies have to offer the ability outlined in this rule. They state the CFPB needs to make rules to enable it and now they are doing so. Actually it didn't. S1033 of the CFPA states a financial institution will upon request of a consumer provide covered information about their financial accounts in a digital format usable by consumers. The rule relies on an expansive interpretation of the statutory definition of "consumer", which is a natural person or "an agent, trustee, or representative" thereof. The agency asserts that representative can be any third party and off of this says banks have to make a developer interface available for them to access, that ironically it does not mandate actual consumers, i.e. natural persons like you and I, can access. This expansive interpretation will not survive judicial review. The canons of statutory interpretation do not allow it, e.g. agent and trustee are fiduciary relationships, as they are mentioned before "representative" it limits the potential scope to other types of fiduciary relationship (ejusdem generis and noscitur a sociis). A fintech is not a fiduciary and has no obligation to act in your interest. It's a typical arms-length commercial transaction. Whether or not the agency's goal is noble is besides the point. It has plainly and obviously gone way beyond the statutory authority granted to it by Congress.
  - monocularvision 2y ago

daft_pink 2y ago

Does anyone else feel like Apple’s app store rules have more teeth than this? Lobbyists have already or will soon be gutting this for sure.

Snuupy 2y ago

Until this comes to fruition and banks actually implement it with software (like Actual Budget) supporting it, I will continue using SimpleFIN Bridge. Hopefully this becomes ubiquitous like GoCardless in the EU.

fowl2 2y ago

Wonder how this compares with the Consumer Data Right in Australia. The standards and discussions around them are right there on GitHub [1] - pretty surreal seeing accounts for the big banks. Of course it's mostly completely useless for anything DIY as semi-understandably access to any real data is gated behind certification requirements. [1] https://consumerdatastandardsaustralia.github.io/standards/#introduction https://consumerdatastandardsaustralia.github.io/standards/#...