Comments urging withdrawal of Chopra CFPB open banking mandate

Dear Acting Director Vought:

On behalf of the Competitive Enterprise Institute, I appreciate the opportunity to submit comments on RIN 3170-AB39, CFPB’s reconsideration of issues concerning the implementation of 12 U.S.C. § 5533, Section 1033 of the Dodd-Frank Act. The CFPB was correct to pause and reexamine the final rule issued regarding Section 1033 in late 2024, under the tenure of former director Rohit Chopra. That rule exceeds vastly the language of Section 1033, attempting to

mandate a European-style “open banking” regulatory regime that was never authorized by the statutory provision. The rule also disregards centuries of economic wisdom on the folly of price controls by mandating that banks and credit unions provide extensive data sets to fintech and other firms for free.

CEI favors withdrawing that rule – hereafter cited as the “Chopra rule” – and ensuring that any new rule adheres to the statutory language and refrains from market-distorting limits on the pricing mechanism for data.

About CEI

The Competitive Enterprise Institute (CEI) is a non-profit public interest organization committed to advancing the principles of free markets and limited government. CEI has a longstanding

interest in applying these principles to the rulemaking process and has frequently commented on issues related to oversight of rulemaking and the regulatory process.

Our mission is to advance the freedom to prosper for American consumers, entrepreneurs, and investors striving for a better life for themselves and their families. We also believe American adults should be allowed to make choices in the marketplace — weighing the costs and benefits

of these choices — without overreaching government bureaucracies limiting their options, even if justified as ostensibly “for their own good.”

CEI also pursues public-interest litigation on behalf of consumers and small businesses to ensure that federal agencies follow the requirements of the underlying laws and, when applicable, the Administrative Procedure Act, and to ensure that agencies act within the constraints of the U.S. Constitution. We are particularly concerned with what we call “regulation without representation” – the process of laws effectively being made by unelected regulatory agencies

instead of the people’s representatives in Congress in contravention of the intent of the Founders in writing the U.S. Constitution.

At CEI, we have long championed private-sector innovation that promotes financial inclusion and warned about government red tape that contributes to the problem of the unbanked. We are excited about the potential improvement in Americans’ financial well-being enabled by

innovations such as cryptocurrency, blockchain, and other forms of financial technology (fintech). We have called for the removal and relaxation of regulations inhibiting these

innovations. However, we also strongly oppose subsidies to this sector – as we oppose subsidies to any business sector – as well as regulations on one type of business with the intention of boosting another. We believe the Chopra rule fits into this latter category and thus should be withdrawn.

Chopra rule exceeds authority from Congress in attempt to mandate “open banking” regulatory regime

The prepared remarks of former director Chopra in October 2024 hail the rule as the beginning of “Open Banking in the U.S.” The former director stated in the remarks that “we have been working with players across the ecosystem to sketch out what open banking in the U.S. could

look like.” He added that the CFPB under this tenure was “continuing to be in constant communication with other financial regulators to advance open banking.”

Yet the phrase “open banking” is never mentioned in the statutory provision from which the Chopra rule purportedly derives its authority. Instead, the Dodd-Frank provision, which takes up only a few paragraphs of text, requires banks and credit unions and other “covered persons” to “make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person.” Nothing in this section requires data transfer to third parties.

Open banking goes far beyond this requirement to make information available to consumers upon request, and instead involves automatic sharing of consumer data among banks and credit unions and third-party fintech and payment services, as well as other apps and websites that receive payments from consumers. In various jurisdictions, open banking can be market-driven, mandated by government policy, or a combination of both. Yet in the main jurisdictions in which it is mandated, open banking policy emerged from debates in elected legislatures, rather than originating on the fly in regulatory agencies staffed by unelected bureaucrats. As has been noted in other comments when the Chopra rule was proposed, both the European Union and the United Kingdom only implemented open banking mandates after extensive parliamentary debates.

The contrast in the formulation of the Chopra rule through a regulatory agency with the creation of open banking policy through elected legislatures in the UK and EU could likely be one more proverbial nail in the coffin for this rule in the courts. In 2024, the Supreme Court changed significantly the legal landscape for agencies offering novel interpretations statutes to justify new authority. In Loper Bright v. Raimondo, 144 S. Ct. 2244, the Court jettisoned the “Chevron deference” precedent that largely defers to regulatory agencies’ interpretation of the powers granted to them by law. And it admonished lower courts to be skeptical of agencies’

interpretations of authority not expressly given to by Congress.

Also under West Virginia v. EPA, 142 S. Ct. 2587 (2022), the Chopra rule’s sweeping open banking mandate would almost certainly trigger the “major questions doctrine,” requiring clear congressional authorization for policy changes that would have a significant political or economic impact. The fact that Section 1033 contains no language authorizing the CFPB to restructure financial-data markets would make the Chopra rule subject to heavy scrutiny under the major questions doctrine from the courts.

Chopra rule also exceeds statutory authority in mandating free sharing of consumer info with third-party businesses

The Chopra rule also exceeds the statutory text in mandating that banks and credit unions share detailed customer data with fintech firms and other financial providers. As noted, the text of Section 1033 only requires that banks and credit unions make available information from customer accounts to the consumers whom they serve. It contains no language requiring the sharing of data with other parties that may serve these same consumers. And the provision certainly does not mandate that banks and credit unions compile and provide this valuable

information to other businesses for free.

Not only are these mandates of the Chopra Rule likely to face Loper Bright scrutiny for diverging from the law, they also – like all price controls – have destructive market-distorting effects. The great free-market economist Thomas Sowell has written that “in the competition of the marketplace, prices are signals that convey underlying realities about relative scarcities and relative costs of production.”

In the area of financial data, these realities include many threats to cybersecurity and privacy, and the costs include the extensive safeguarding necessary when sharing data with third parties to reduce harms by bad actors and system errors. The invaluable pricing mechanism created by the free market must be allowed to operate in this sector to exert market discipline in reducing

the number of frivolous data requests, discouraging fly-by-night financial providers from accessing consumer data, and making sure security costs are covered. As financial commentator John Tamny has written in Forbes: “Information is extraordinarily valuable. How dangerous to make it free.”

Conclusion: withdraw the rule

In light of the glaring defects of the Chopra rule in exceeding the Dodd-Frank statutory language and imposing mandates that could pose harm to data privacy and data security, we believe the CFPB must withdraw the Chopra rule. We also advise strongly that any new rule the CFPB undertakes pursuant to Section 1033 sticks closely to the language requiring data sharing with consumers and lets the market work out arrangements regarding data sharing between banks and credit unions and other financial providers.

Thank you for this opportunity to present the views of the Competitive Enterprise Institute on this important matter. If you have any questions, please feel free to contact me at [email protected].

Sincerely,

John Berlau

Director of Finance Policy & Senior Fellow Competitive Enterprise Institute