The section 1033 rule is the CFPB's 2024 open banking regulation. It requires banks and other data providers to share a consumer's account data, including transaction history, with third parties the consumer authorizes, and it limits how those third parties collect, use and keep the data. A federal court has enjoined its enforcement while the CFPB reconsiders it.
What does the section 1033 rule require of banks and data users?
The section 1033 rule puts duties on two groups. Data providers, such as banks, must make covered account data available electronically to the consumer and to third parties the consumer authorizes. Authorized third parties, such as a lender pulling data to underwrite a loan, must limit what they collect, how they use it and how long they keep it.
The rule takes its name from section 1033 of the Dodd-Frank Act, which gave consumers a right to access their own financial account information. The CFPB adopted the Personal Financial Data Rights rule in 2024 to put that right into practice, and banks and trade groups sued the day it was finalized.
For a lender, the important role is the third party. A lender does not become a data provider by making loans. It becomes an authorized third party when it asks a consumer's bank, directly or through a data aggregator, for that consumer's account data. The duties in subpart D of the rule then follow the lender for as long as it collects.
The rule draws a firm line around purpose. Under section 1033.421 of the rule, a third party must limit collection, use and retention to what is "reasonably necessary to provide the consumer's requested product or service." The rule spells out three uses that never meet that test: targeted advertising, cross-selling other products and selling the data.
Permitted uses are narrower than many lenders expect. The rule lists uses required by law, fraud prevention, servicing the requested product and improving it. Using a loan applicant's account data to market a credit card to them later is outside the lines.
Covered data under the section 1033 rule
Covered data under the section 1033 rule is the account information a data provider must share. It includes transaction history, balances, payment initiation details, account terms, upcoming bills and basic verification facts such as name and address. Transaction history must reach back at least 24 months.
Section 1033.211 lists six categories:
- Transaction information, including historical transactions, with at least 24 months made available.
- Account balance information.
- Information to initiate a payment to or from a Regulation E account, such as account and routing numbers.
- Terms and conditions, meaning the agreement data that sets out the consumer's obligations, including pricing.
- Upcoming bill information, such as scheduled bill payments and amounts owed to the provider.
- Basic account verification information: name, address, email and phone number, plus a truncated account number for certain accounts.
Two of these matter most to underwriting. Twenty-four months of transactions is more history than most lenders ask for on statements, so a lender would have enough to cover a 12-month or 24-month deposit lookback. Verification fields let a lender confirm that the account belongs to the applicant, which a PDF statement shows only in its header.
What the list leaves out matters too. Covered data is raw account data, not analysis. A data feed tells a lender that a deposit arrived. It does not decide whether the deposit was a transfer, a loan advance or income. That analysis still happens on the lender's side.
Section 1033 consent and the one-year authorization limit
Section 1033 consent is the authorization a consumer gives a third party before it can collect their account data. Under the rule, that authorization lasts at most one year. To keep collecting after that, the third party must get a new authorization no later than the anniversary of the most recent one.
The one-year limit is in section 1033.421(b). A lender that pulls data once at application never meets it. A lender that keeps a data connection open to monitor a borrower after funding does, and must plan for reauthorization or stop collecting.
Revocation has its own rules. The third party must offer a way to revoke that is as easy to reach and use as the way the consumer authorized, with no cost or penalty. When the consumer revokes, or fails to reauthorize, the third party must stop collecting under that authorization. It must also stop using or keeping data it already collected, unless using or keeping it is still reasonably necessary to provide the product the consumer asked for.
That retention rule meets the lender's other duties. A lender keeps a loan file for years because other laws and investors require it. Data that supported an approved loan is part of that file. The guide to loan file retention requirements covers how long lenders keep each record, which is the starting point for deciding what stays after a consumer revokes.
The authorization has its own form requirements, including a certification by the third party, which the court order discussed below summarizes as the rule's "authorization and certification requirements." What a broader borrower consent form covers is in the borrower authorization form guide.
Where does the section 1033 rule stand in 2026?
The section 1033 rule is not being enforced. On October 29, 2025, the federal district court in Kentucky enjoined the CFPB from enforcing the rule until the CFPB completes its reconsideration of it. The court also stayed the rule under the Administrative Procedure Act pending that reconsideration.
The order came in Forcht Bank v. CFPB, a suit brought by banks and trade groups. The district court's October 29, 2025 order in Forcht Bank v. CFPB states that the CFPB "is ENJOINED from enforcing the Personal Financial Data Rights Rule until it has completed its reconsideration of the Rule." The court described its approach as temporarily staying the rule and postponing its effective date pending final rulemaking.
The reconsideration started with an advance notice of proposed rulemaking published on August 22, 2025. As the order describes it, the notice asked how to read the word "representative" in the statute, whether the rule protects the security of consumer data, whether the costs of data access should be shared, and whether the compliance dates were appropriate.
The original rule set staggered compliance deadlines, with some providers facing dates as late as 2029 or 2030, as the court's order notes. Those dates are now on hold. A lender should not treat the 2024 text as settled. The fee question in particular could change what lenders pay for data, and the representative question could change how aggregators fit in.
For planning, three points hold regardless of outcome:
- Consumer-permissioned data access existed before the rule and continues while it is enjoined, under contracts between banks, aggregators and data users.
- The data-use limits in the 2024 text show where the CFPB was heading, and many contracts already contain similar limits.
- State privacy laws and federal safeguards duties still apply to account data a lender holds.
How section 1033 data access changes bank statement collection
Section 1033 data access replaces the document, not the analysis. Instead of asking a borrower for PDF statements, a lender with consent receives transaction records straight from the bank. That removes editing risk and missing pages, but the lender still has to classify deposits, exclude transfers and decide what counts as income.
The table below compares the two methods. It reflects the 2024 rule text; any revised rule may change the right-hand column.
| Point of comparison | PDF bank statements | Section 1033 data access |
|---|---|---|
| Source | Borrower uploads or emails files | Data provider sends records to the authorized third party |
| History | Whatever months the borrower supplies | At least 24 months of transactions available |
| Tampering risk | Files can be edited before upload | Records come from the bank |
| Consent | Borrower chooses to hand over documents | Signed authorization disclosure, renewed yearly to keep collecting |
| Use limits | Lender's privacy notice and other law | Reasonably necessary for the requested product; no targeted ads, cross-selling or sale |
| After revocation | Lender keeps the file under its own policy | Stop collecting; stop using or keeping data unless still reasonably necessary |
| Analysis | Lender or software reads the PDF | Lender or software reads the data feed |
The last row is the one that stays the same. A lender still needs a way to turn transactions into monthly deposit totals, recurring income and flags. Teams planning that work can use the guide to implementing bank statement analysis software, which covers the steps between receiving data and producing an underwriting figure.
TrueBankFlow works from uploaded US checking and savings statements, digital or scanned. It reads the statement layout and flags any statement that fails a balance check instead of averaging it, which addresses part of the tampering risk that a direct data feed would avoid.
When section 1033 data will not replace bank statements in a loan file
Section 1033 data will not replace bank statements in every file. The rule is about consumers' personal financial data, so business accounts, commercial products and banks without a working data connection still leave the lender with statements. Investor and agency rules may also name statements as the document they require.
Several situations keep the PDF in play:
- Business borrowers. The rule is framed around consumers' personal financial data. A merchant cash advance funder or small business lender reading company accounts will keep asking for statements, along with whatever state disclosures apply under commercial financing disclosure laws.
- Banks without a data connection. A borrower whose bank offers no data interface, or whose aggregator does not support it, has nothing to authorize.
- Investor documentation. A loan sold to an investor must meet that investor's document list. If the guide calls for statements, a data feed alone may not be accepted.
- Borrowers who decline. Data access depends on consent. A borrower who will not connect an account can still apply with documents.
- Historical gaps. An account closed or opened recently may not give the history the lender needs.
Most lenders will run both paths for years. The practical goal is a process where either a statement or a data feed lands in the same analysis, with the same exclusions and the same report.
TrueBankFlow is onboarding lending teams in small groups for that statement path.