Fintech Intelligence Showcase Demo #9 — CFPB §1033 Financial Data Rights Mapper

T165 Institution Classifier ↗ T166 Data Rights Scoper ↗ T167 TPPP Mapper ↗

Open Banking · RegTech T165 + T166 + T167 CFPB §1033 AP2 v1.0 Zero PII

CFPB §1033 Financial Data Rights Mapper

The CFPB's Personal Financial Data Rights rule (12 CFR Part 1033) mandates that covered financial institutions give consumers and authorised third parties machine-readable access to their financial data. Map your institution's obligations, scope the seven data categories you must expose, navigate the four-wave compliance calendar from April 2026 through April 2030, and generate an AP2 mandate for your open-banking programme.

Rule Published

Oct 2024

CFPB Final Rule

First Deadline

Apr 2026

Tier 1 institutions

Covered Entities

~4,000+

Banks, CUs, fintechs, TPPPs

Data Categories

Mandated access types

Standard

FDX API

Screen-scraping sunset

Quick Scenarios

Step 1 — Institution Classification

Institution Type Based on total domestic assets or CFPB-defined covered entity classification.

Step 2 — Covered Products & Accounts

Checking / Demand Deposit Account

Core DDA — always covered for Tier 1–4

Savings / Money Market Account

MMDA and savings products in scope

Credit Card (TILA-covered)

Open-end credit cards; transaction data required

Prepaid Account (Reg E)

GPR prepaid, payroll cards covered

Digital Wallet / BNPL Account

Non-bank BNPL providers may fall under TPPP classification

Closed-End Loan (HMDA / CRA)

Mortgage, auto, personal loans — limited scope

Step 3 — Data Access Role

Primary Role under §1033

Step 4 — Technical Readiness

FDX API implemented / in roadmap

Financial Data Exchange v6.0+ API standard

OAuth 2.0 / PKCE authorization

Token-based third-party authorization flows

Screen-scraping sunset plan in place

§1033 displaces screen-scraping by compliance date

Third-party registry / vetting process

Provider must vet authorised data recipients

Consumer authorization & revocation UI

Consent dashboard, access logs, one-click revocation

Rate limiting / availability SLA defined

§1033 requires reasonable availability; no discriminatory limits

Readiness Snapshot

§1033 Compliance Calendar

Data Category Obligations

Data Category	Description	Scope for You	Format Required

Consumer Authorization Workflow Requirements

CFPB §1033 Final Rule

Published October 2024 under Dodd-Frank §1033, this rule creates a US open banking framework requiring covered institutions to give consumers API-accessible data — displacing screen-scraping and legacy credential-sharing.

📅 First deadline: Apr 2026 (Tier 1)

📅 Final wave: Apr 2030 (TPPPs)

Financial Data Exchange (FDX) API is the industry-consensus technical standard. CFPB has not mandated FDX specifically, but rule-makers expect providers to use recognised standards for machine-readable delivery.

🔒 OAuth 2.0 + PKCE required for auth

🚫 Screen-scraping sunset at compliance date

Non-compliance risk: CFPB can bring enforcement under Dodd-Frank UDAAP authority — potential for 7-figure civil money penalties and consent orders.

⚠️ UDAAP enforcement risk post-deadline

Sources: CFPB 12 CFR Part 1033 (Oct 2024); FDX API v6.0; Dodd-Frank §1033 (12 U.S.C. § 5533).

RegTech

Turning a compliance clock into an operating plan?

We help institutions operationalize obligations like DORA, MiCA, the EU AI Act, CFPB §1033 and AML — past the checklist and into production. Tell us what's on your enforcement calendar.

Talk to our team →

Post Oak Labs · production deployments in the Caribbean & South Asia · works with a limited number of institutions at a time