CFPB Open Banking Rule Faces April Compliance Date With Docket Unresolved

The CFPB's open banking rule reaches its first compliance date on April 1, 2026, for depositories with at least $250 billion in assets, per the final rule published November 18, 2024. As of January 31, 2026, the Federal Register shows no final action on the Bureau's reconsideration, leaving the largest banks carrying the original timetable.

Nuv Media publishes information, not financial advice.

What Does the Rule Require, and by When?

It obliges covered data providers, including banks and credit unions, to release consumer account data to consumers and authorized third parties in a secure, reliable manner, per the rule at 89 FR 90838. The rule took effect January 17, 2025, and subparts B and C carry five tiered compliance dates from April 1, 2026 through April 1, 2030.

The first tier is the narrow one. Depository institutions holding at least $250 billion in total assets, plus nondepository data providers that generated at least $10 billion in total receipts in either 2023 or 2024, must comply by April 1, 2026. The second tier, depositories between $10 billion and $250 billion in assets, follows on April 1, 2027, with smaller institutions phased through 2030.

What Has the CFPB Done Since Finalizing the Rule?

It moved to unwind its own work. In June 2025 the Bureau asked the Eastern District of Kentucky to vacate the rule, arguing it was unlawful, per Holland & Knight's litigation tracker, June 2025. Then, on August 22, 2025, it published a formal reconsideration docket at 90 FR 40986.

The reconsideration seeks comment on four implementation issues: who counts as a representative requesting data on a consumer's behalf, whether covered persons may charge fees to defray response costs, the data-security threat picture, and the data-privacy threat picture. The comment window closed October 21, 2025, per the Federal Register.

Since that closing date, the docket has produced no final rule, correction or delay notice through January 31, 2026, according to the Federal Register's document index. Whatever the Bureau intends, it has not yet been reduced to a binding amendment.

Where Does the Litigation Stand?

The Bank Policy Institute and the Kentucky Bankers Association sued within days of the October 2024 finalization, arguing the Bureau exceeded its statutory authority and imposed weak oversight of third-party data recipients, per BPI's November 2024 announcement. In February 2025 the district court paused the compliance deadline for 30 days to consider summary judgment motions, per Orrick's InfoBytes, February 2025.

The Bureau's June 2025 request that the court vacate the rule flipped the case's posture, and the court has since held the rule in check while the Bureau pursues a rewrite, per Cooley's FinSights tracker, 2025. That leaves April 1, 2026 nominally in force on paper and practically in suspense.

What Should Covered Institutions Do Now?

Treat the published rule as the operative one until a court or a final Federal Register action changes it. Tier-one institutions in particular have no filed extension to rely on, and the reconsideration docket's questions about representatives and fees do not themselves delay subpart B and C obligations.

Practical exposure concentrates in three areas: qualifying third parties under the rule's authorization and revocation flow, maintaining developer interfaces that meet performance and availability expectations, and documenting screening of authorized third parties. A later rescission would moot that build; a court refusal to vacate would strand anyone who waited.

What Happens Next on the Docket?

Nothing is scheduled that binds the Bureau publicly. The next visible step would be either a proposed revised rule or a final rescission published in the Federal Register, or a district court ruling on the pending vacatur request. Until one arrives, the April 1, 2026 date stands as written, and the five-tier calendar through 2030 remains the default planning baseline for every covered data provider.