Bank data & compliance
Section 1033: Definition & Example
Also called: Personal Financial Data Rights rule, CFPB 1033
What Is Section 1033?
Section 1033 of the Dodd-Frank Act gives consumers a right to access their own financial account data. The CFPB’s rule implementing it sets requirements for sharing that data with authorized third parties.
What does Section 1033 mean?
Section 1033 has been law since 2010, but it had no detailed implementing rule until the CFPB finalized its Personal Financial Data Rights rule in October 2024. The rule would require covered banks and card issuers to make account data available, free of charge, to consumers and to third parties they authorize, through secure interfaces instead of screen scraping.
For authorized third parties, the rule sets conditions such as limiting data use to what is reasonably necessary for the product the consumer requested, limiting how long access lasts without reauthorization, and letting consumers revoke access.
The rule was challenged in court soon after it was finalized, and in 2025 the CFPB moved to reconsider it. Compliance dates and specific requirements have been in flux, so check the CFPB’s current guidance before relying on any detail.
Section 1033 example
Under the 2024 rule as written, a consumer who wants to share bank data with a budgeting app could authorize access through the bank’s developer interface. The app could use the data only to provide the budgeting service and would need to seek reauthorization after a set period to keep access.
Related terms
- Open BankingOpen banking is the practice of letting consumers securely share their bank account data, such as balances and transactions, with third-party apps and services they choose, usually through APIs.
- Consumer-Permissioned DataConsumer-permissioned data is financial information a consumer actively authorizes a third party to access, such as bank transactions shared through an open banking connection.
- Gramm-Leach-Bliley ActThe Gramm-Leach-Bliley Act (GLBA) is a 1999 federal law that requires financial institutions to explain how they share customers’ nonpublic personal information and to safeguard that information.
- Access TokenAn access token is a credential an app receives after a user grants permission, letting it call an API on the user’s behalf, such as reading bank data, without ever handling the user’s password.
- Fair Credit Reporting ActThe Fair Credit Reporting Act (FCRA) is a federal law that regulates how consumer reporting agencies collect and share consumer information and how others use consumer reports.
