The Consumer Financial Protection Bureau plans to take a closer look at "the challenges consumers face in accessing, using, and securely sharing their financial records," asking for information about how much choice consumers are being given about the use of their records, how secure it is for them to share their records, and to what extent consumers have control over their records.

What happened

Are consumers facing challenges in accessing, using, and securely sharing their financial records? The Consumer Financial Protection Bureau (CFPB) wants to find out, releasing a Request for Information (RFI) about the issue.

"Consumers should be able to use their financial records and account information and securely share access in an electronic format," Bureau Director Richard Cordray said in a statement about the inquiry. "Technology provides opportunities to use these records to create new consumer tools that help improve financial lives. To realize that potential, we are launching a public inquiry into how much control consumers have over their records and how easy and secure it is for them to share their records with third parties."

Historically, banks and credit unions kept paper records of consumers' financial account activity. As records have shifted into digital account histories, consumers are typically able to view their information by logging in to their online accounts. This data is sought by third parties, often data aggregators, who process the information and provide it to companies offering various products and services, the Bureau explained.

Digital financial records can be leveraged to make it easier, cheaper, or more efficient for consumers to manage their financial lives, the CFPB added, with new products and services ranging from tax help to budgeting advice to underwriting new lines of credit.

Consumers have the right to access their financial records and account-related information, the CFPB said, with rulemaking authority in this area granted to the Bureau by the Dodd-Frank Wall Street Reform and Consumer Protection Act. In light of the burgeoning use of digital financial records, the CFPB released the RFI "to understand the full range of issues associated with how consumers access their financial records and how that information can be used."

The Bureau focused its inquiry on three topics: consumer choice, security, and consumer control. Under the heading of consumer choice, the CFPB expressed concern that financial institutions "may make it difficult or impossible" for consumers to allow others to access and use their digital financial records. Blocking access to digital financial records can prevent new companies from offering innovative products, the Bureau said, and reduce incentives for financial institutions to compete with new entrants.

"Consumers should be able to access their financial records and have the choice to use that information for their own benefit," the CFPB emphasized. So the agency asked for more information about the business burdens that must be addressed to facilitate access and use of financial records, as well as whether consumers are being given appropriate opportunities to access and allow others to securely access their personal financial records.

Security poses a challenge for financial institutions when providing third-party companies with access to consumers' financial records, with banks unwilling to compromise consumer privacy or put consumers' funds and account relationships at risk. What options do financial institutions have to ensure that financial records are securely obtained, stored, and used? the Bureau wondered in the RFI.

Finally, the CFPB requested comment on consumer control over their financial records. Questions include what information consumers are given about how their records will be accessed and used and to what extent consumers are able to control how the information will be used by third parties—can consumers limit the frequency and purpose of companies' access to their records, for example, or request deletion of the records?

The CFPB will accept comments for 90 days.

To read the CFPB's RFI, click here.

Why it matters

"The CFPB wants to foster an environment where competing providers can securely obtain, with the consumer's permission, the information needed to deliver innovative products and services that will benefit consumers," the Bureau said, expressing its hopes for the future of data sharing. But the issue creates a divide between traditional financial institutions and fintechs, with banks and credit unions concerned about the risks of allowing consumers to share their digital records, from privacy to cybersecurity to liability in the case of a data breach. Banks should keep an eye on the RFI, which noted that comments will be used "to evaluate whether any guidance or other action by the Bureau is called for, including future rulemaking."