Wednesday, the Consumer Financial Protection Bureau (CFPB or Bureau) announced it has finalized a rule outlining the qualifications to become a recognized industry Standard Setter body (Standard Setter Rule). These bodies will be instrumental in issuing standards that assist companies in complying with the forthcoming Personal Financial Data Rights Rule under Section 1033 of the Consumer Financial Protection Act (Section 1033 Rule). The Standard Setter Rule outlines the attributes that these bodies must exhibit to gain recognition from the CFPB. It also provides a comprehensive guide detailing the application process for recognition and the CFPB’s evaluation methodology.

Background

As the CFPB continues the process of finalizing its proposed rule under Section 1033, discussed here and here, CFPB Director Rohit Chopra recently issued remarks at the Financial Data Exchange Global Summit emphasizing the importance of Standard Setter organizations in the transition to open banking in the United States.

Standard Setter Rule

Wednesday, final rule identifies the attributes that standard setters must demonstrate to be recognized by the CFPB, including:

• Openness: The process will be open to all interested parties, including public interest groups, app developers, and financial firms with a stake in open banking.
• Transparency: Procedures will be transparent and publicly available.
• Balanced decision-making: The power to set standards will be balanced and include consumer and other public interest groups. The rule also provides for meaningful representation of both large and small commercial entities.
• Consensus: The rule provides that standards development must proceed by consensus. Comments and objections must be considered under a fair and impartial process.
• Due process and appeals: The standard setting body must use documented and publicly available policies and procedures, provide adequate notice of meetings, sufficient time to review drafts and prepare objections, access to comments and objections of other participants, and a fair and impartial process for resolving conflicts. An appeals process will also be available.

There is also a mechanism for the CFPB to revoke the recognition of standard setters. Any CFPB recognition will have a maximum duration of five years, after which recognized standard setters will have to apply for re-recognition.

The rule also includes a step-by-step guide to help interested parties to apply for recognition. The five steps in the application and recognition process include:

• Written request for recognition: This includes key contact information, evidence of the organization’s policies and practices, and an explanation of how the organization satisfies each of the required attributes.
• Additional information and public comment: After reviewing the submission, the Bureau may request additional information, publish the submission, and seek public input.
• CFPB review: The CFPB will consider whether the organization’s policies and practices meet all the requirements for recognition and whether the application is accurate and complete.
• Decision: Recognition will be publicly disclosed on the CFPB’s website, along with the applicable terms and conditions. If the CFPB declines the application, the organization will be notified. An application may be withdrawn at any time.
• Recognition: As a recognized standard setter, the CFPB may monitor the organization and request information. Also, within 10 days, an organization must submit a written explanation of any material change to information that was submitted with the application or during recognition, as well as any reason the organization may no longer meet the underlying requirements. The Bureau reserves the right to modify or revoke recognition.

The Standard Setter Rule will become effective 30 days after publication in the Federal Register.

Our Take

The Standard Setter Rule is a significant step towards the implementation of the Section 1033 Rule. It provides clarity on the qualifications for standard-setting bodies and the process for recognition by the CFPB.

Standard-setting bodies that wish to be recognized by the CFPB should review the final rule and the step-by-step guide to understand the requirements and the application process. They should also be prepared to demonstrate their adherence to the attributes codified by the CFPB.

It is also important for companies that will become subject to the Section 1033 Rule to be aware of the standards issued by any recognized standard-setting bodies, as these standards may help demonstrate compliance with the upcoming Section 1033 Rule.

However, some items that companies should keep in mind as the Section 1033 Rule is finalized and harmonized with the Standard Setter Rule, include:

• Utilizing a standard established by a standard setter may not confer a safe harbor from potential compliance violations as the CFPB states, “The CFPB will discuss and address all other substantive comments when it finalizes the remainder of the Personal Financial Data Rights rule, including the many comments received concerning the role that adherence to a consensus standard should or should not play in evaluating compliance with the particular underlying provisions of the final rule.”
• The CFPB plans to publicly disclose applications, recognitions, contingent recognitions, and denials on its website.
• The CFPB is not establishing any formal appeals process for its determinations about recognition or revocation.
• By agreeing to be a standard setter, an organization must agree to monitoring by the CFPB as well as responding to CFPB information requests.