The Consumer Financial Protection Bureau's open banking rule under Section 1033 of Dodd-Frank takes legal effect June 1, with the largest banks (those above $500 billion in assets) required to provide consumer-authorized data sharing via standardized APIs by October 1, 2026. Smaller institutions face compliance deadlines extending through 2028.
The rule requires banks to make transaction history, account balances, payment initiation data, and account verification information available to third-party apps that consumers authorize — at no charge to the consumer or the third party. Banks cannot use data sharing agreements to restrict competition.