CFPB Section 1033 testing requirements
The CFPB Personal Financial Data Rights rule, 12 CFR Part 1033, requires banks, card issuers, and digital wallet providers to make consumer financial data available to consumers and authorised third parties. On 16 September 2026, its compliance dates are stayed by court order. Testing verifies developer interface performance, denials, authorisation, and revocation, and produces response rate recalculations and revocation logs.
- Jurisdiction
- US (federal, CFPB rule under section 1033 of the Consumer Financial Protection Act of 2010)
- Primary source
- ecfr.gov
- Status verified on
Engineering interpretation of testing requirements, not compliance advice.
What the Personal Financial Data Rights rule requires, and where it stands
The Consumer Financial Protection Bureau (CFPB) released the final rule on 22 October 2024. It was published in the Federal Register on 18 November 2024 as document 2024-25079 and took effect on 17 January 2025. Section numbers below follow the 12 CFR Part 1033 text on eCFR (checked on 2026-09-16), where the latest amendment date is 17 January 2025.
Status on 16 September 2026.
- Compliance dates as published. Section 1033.121(b) sets five tiers from 1 April 2026 to 1 April 2030. The first tier covers depository institutions with at least $250 billion in total assets and nondepository data providers with at least $10 billion in total receipts in 2023 or 2024. Third parties have no separate compliance dates.
- Court stay. The CFPB compliance page (last modified 6 January 2026) states that on 29 October 2025 the court in Forcht Bank, N.A., et al. v. CFPB, No. 5:24-cv-304-DCR (E.D. Ky.), stayed the compliance dates.
- Reconsideration. The advance notice of proposed rulemaking (ANPR) of 22 August 2025 took comments until 21 October 2025 on four issues: who counts as a "representative" of the consumer, the fee prohibition in 1033.301(c), data security, and data privacy. The ANPR also announced a proposed rule to extend the compliance dates, and its footnote 11 records that an earlier court order had moved the first compliance date to 30 June 2026.
- Agenda. The CFPB regulatory agenda published on 14 August 2026 (current as of 13 January 2026) lists a rulemaking to reconsider certain aspects of the rule. The Federal Register shows no proposed or final rule amending Part 1033 after the ANPR.
The published text sets these testable obligations for data providers and third parties, and their compliance dates are stayed.
- Covered data, 1033.201 and 1033.211. A data provider makes available the most recently updated data, including authorised but not settled transactions (1033.201(b)). At least 24 months of transaction history is deemed sufficient (1033.211(a)).
- Developer interface, 1033.311. Data comes in a standardised, machine-readable format (1033.311(b)). Proper responses divided by requests must reach at least 99.5 percent each calendar month, and scheduled downtime is excluded only with reasonable notice to third parties (1033.311(c)(1)). A third party cannot access the developer interface with consumer interface credentials (1033.311(e)(1)).
- Denials, 1033.321 and 1033.351(b). A denial is directly related to a specific risk and applied in a consistent and non-discriminatory manner (1033.321(b)). Missing evidence of adequate information security, or a missing legal name, website, Legal Entity Identifier (LEI), or security contact, is a sufficient basis for a denial (1033.321(d)). The data provider records the basis and sends the reason in a timely manner (1033.351(b)(2) and (b)(3)).
- Requests and revocation, 1033.331. A third party request needs the consumer's identity, the third party's identity, proof of authorisation, and the data scope (1033.331(b)). A data provider that offers a revocation method revokes access and notifies the third party in a timely manner (1033.331(e)).
- Disclosure, 1033.341(d). The monthly response rate is published as a percentage rounded to four decimal places, with a rolling 13 months.
- Authorisation, subpart D. The authorisation disclosure carries the content listed in 1033.411(b), including data categories and the one-year limit. Collection stops one year after the most recent authorisation without reauthorisation (1033.421(b)). Revocation is as easy as authorisation, and the third party notifies the data provider and any data aggregator (1033.421(h)).
- Accuracy, 1033.351(c) and 1033.421(d). Data providers and third parties keep written policies reasonably designed to make and receive covered data accurately.
Part 1033 requirements that testing verifies
Rows marked "ANPR topic" sit in an area the August 2025 ANPR names for reconsideration. Every row follows the published text, whose compliance dates are stayed on 16 September 2026.
| Requirement | What we test | Evidence produced |
|---|---|---|
| 1033.201(b) Authorised but not settled transactions made available | Pending card authorisations and settled postings requested through the developer interface and compared with the core ledger. | Pending transaction field comparison per test account |
| 1033.211(a) 24 months of transaction history | History requests on synthetic accounts with 25 months of postings, including closed statement cycles. | History depth test result per account type |
| 1033.311(b) Standardised machine-readable format | Developer interface responses validated against the published schema of the chosen consensus standard. | Schema validation log per developer interface endpoint |
| 1033.311(c)(1) Response rate of at least 99.5 percent per month | Response rate recalculated from gateway logs, with timeouts and unexplained errors counted as improper responses. | Monthly response rate recalculation with excluded downtime windows |
| 1033.311(e)(1) No developer interface access with consumer credentials (ANPR topic) | Developer interface calls that present a consumer interface username and password. | Credential rejection test log per authentication endpoint |
| 1033.321(d) and 1033.351(b)(2) Denial basis and reason (ANPR topic) | Access requests from test third parties without an LEI, without a security contact, or without security evidence. | Denial record and reason message per test third party |
| 1033.331(b) Consumer, third party, authorisation, and scope checks | Data requests with an expired consumer token, a wrong client certificate, or a scope wider than the authorisation. | Negative request test matrix with the response per case |
| 1033.331(e) Revocation at the data provider | Revocation in the consumer interface followed by third party data requests and notification delivery checks. | Revocation propagation log with timestamps |
| 1033.341(d) Monthly response rate disclosure | Published disclosure file compared with the recalculated rate, the four-decimal rounding, and the 13-month window. | Disclosure reconciliation report per month |
| 1033.421(b) One-year authorisation limit and reauthorisation (ANPR topic) | Data collection jobs run before and after the authorisation anniversary, with and without reauthorisation. | Authorisation lifecycle test record per test consumer |
Records an examiner or partner bank can request
Part 1033 lists records that data providers (1033.351(d)) and third parties (1033.441(e)) retain for at least three years. A CFPB examiner or a sponsor bank can ask for:
- records of developer interface access requests, actions taken, and denial reasons (1033.351(d)(2)(i));
- records of fulfilled and unfulfilled data requests with reasons (1033.351(d)(2)(ii));
- records that each third party followed the 1033.401 authorisation procedures (1033.351(d)(2)(iii));
- records of actions a consumer and the data provider took to revoke third party access (1033.351(d)(2)(iv));
- response rate, downtime, notice, and response time records (1033.351(d)(2)(v), referring to 1033.311(c)(2)(ii));
- the record of data fields and the data withheld under a 1033.221 exception, with reasons (1033.351(b)(1));
- developer interface documentation with metadata for every covered data field (1033.341(c));
- signed authorisation disclosures with signature dates and data aggregator certifications (1033.441(e)).
Common findings against the published text
- Unannounced maintenance excluded from the rate. A deployment window with no notice to third parties is removed from the monthly denominator. The calculation departs from 1033.311(c)(1)(ii), which excludes downtime only after reasonable notice.
- Timeouts counted as proper responses. A gateway returns HTTP 504 with no explanation, and the metric counts the call as answered. The count breaks 1033.311(c)(1)(iv)(A).
- Pending transactions missing. The developer interface reads a settled-postings table only, so card authorisations appear a day later. The gap breaks 1033.201(b).
- Generic denial. A third party without an LEI receives HTTP 403 with no reason, and no record of the basis exists. The defect breaks 1033.351(b)(2).
- Revocation without notice. A consumer revokes a connection in the banking app, the token stops working, and the third party gets no notification. The defect breaks the notice duty in 1033.331(e).
- Collection after the anniversary. A scheduled refresh keeps pulling transactions 13 months after the last authorisation. The job breaks 1033.421(b)(2) and (b)(3).
- Aggregator missing from the disclosure. The authorisation screen names the app but omits the data aggregator that connects to the bank. The screen breaks 1033.431(b).
- Disclosure rounded to one decimal. The public performance page shows "99.7%" for the previous month. The format breaks the four-decimal rule in 1033.341(d).
How we cover Section 1033
Our engineers test against the published Part 1033 text and retest after a new CFPB final rule. Each evidence pack records its status date.
The open banking API testing service delivers API conformance test results for the developer interface rows above and the consent and reauthorisation flow test suite for subpart D authorisation, revocation, and the one-year limit. Its data normalisation accuracy checks compare balances and transactions between the data provider and the third party, which supports the accuracy policies in 1033.351(c) and 1033.421(d). The consent and token refresh guide shows the requests.
We test Part 1033 flows for open banking aggregators as third parties and for neobanks as data providers. The EU and UK interface rules are on the open banking standards page, and the security program that 1033.311(e)(2) and 1033.421(e) point to is on the GLBA and money transmitter page. Test runs use synthetic account data and never live consumer connections.
Related
Services
Segments
Adjacent standards
Questions
What is section 1033 of the Dodd Frank Act?
What is the CFPB 1033 rule?
What is 1033 compliance?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing