The revised US open banking rule is likely to reach the Federal Register in the fourth quarter of 2026, most probably between late October and mid-December, with a public comment window that closes in the first quarter of 2027. That timing matters far beyond bank compliance teams: it means the 2026 holiday season, and on the prior precedent most of 2027, will run without an enforceable federal rule governing who may access consumer bank account data and on what commercial terms. For merchants who have been modelling pay-by-bank as a card-cost escape hatch, the practical read is that the escape hatch stays narrow and bilaterally negotiated for at least another year.
The prediction rests on three signals observed in the past four weeks, all of them from primary government sources rather than press reports. None of them is an announcement. Each is a procedural tell that the rulemaking is real, is close, and is nonetheless unlikely to clear before autumn ends.
In short
- The prediction: the CFPB’s revised Section 1033 proposal, catalogued as RIN 3170-AB39, is likely to publish as a notice of proposed rulemaking in Q4 2026 (base case late October to mid-December), with comments closing in Q1 2027 and no enforceable compliance obligation before 2028.
- Signal 1: the proposal, titled “Personal Financial Data Rights Reconsideration”, entered White House regulatory review on 4 August 2026 at the proposed-rule stage, flagged as economically significant and carrying no legal deadline.
- Signal 2: the CFPB’s regulatory agenda published in the Federal Register on 14 August 2026 confirms the reconsideration as a planned rulemaking, but its own data is current only as of 13 January 2026, and it describes a Bureau operating under interim leadership.
- Signal 3: a snapshot of the entire government-wide review docket taken on 31 August 2026 shows 140 rules pending, with roughly a third of them sitting longer than 60 days and one in six longer than 90 days.
- What it means for commerce: the cost and legality of bank-data access stay governed by private contracts through the holiday peak, so pay-by-bank likely stays concentrated in high-ticket and recurring baskets rather than displacing cards at general checkout.
Why this matters now
Section 1033 of the Dodd-Frank Act gives consumers a right to their own financial data and a right to authorise third parties to receive it. It is the legal foundation on which every account aggregator, budgeting app, cash-flow underwriter and pay-by-bank provider in the United States operates. Until it is implemented by a rule that survives challenge, that foundation is contractual rather than statutory in practice.
The CFPB finalised a rule implementing Section 1033 in November 2024, with phased compliance beginning 1 April 2026 for the largest data providers. Bank trade groups sued in the Eastern District of Kentucky, and the court enjoined enforcement pending the Bureau’s reconsideration of the rule. The April 2026 compliance date therefore arrived without teeth. The Bureau opened a reconsideration through an advance notice in August 2025 and has been drafting a replacement since.
For retailers and platforms, the practical stake is not the constitutional argument. It is whether a data provider may charge a third party for an account data call, and if so on what basis. That single question sets the marginal cost of every pay-by-bank authorisation, every instant account verification at onboarding, and every cash-flow risk check that sits behind a buy-now-pay-later approval, a dependency that grows as BNPL lenders convert to deposit-funded banking.
The November 2024 rule answered that question one way, by broadly barring fees for covered data access. The reconsideration is widely expected to answer it differently. Until the proposal is public, nobody outside the drafting room knows how differently, and that uncertainty is itself the reason merchant payment roadmaps for 2027 keep slipping.
Signal 1: an economically significant proposal entered White House review on 4 August
Executive Order 12866 requires significant rules to pass through the Office of Information and Regulatory Affairs before publication. That queue is public. As of 31 August 2026, the pending-review docket lists the Consumer Financial Protection Bureau with a proposed rule under RIN 3170-AB39, titled “Personal Financial Data Rights Reconsideration”, received on 4 August 2026 and still pending.
Three attributes of that entry carry information. The stage is “Proposed Rule”, not pre-rule and not final rule, which confirms the Bureau has moved past the advance-notice phase and has produced actual regulatory text. The economic significance flag reads “Yes”, meaning the Bureau itself assesses an annual effect on the economy of $100 million or more. And the legal deadline field reads “None”.
The significance flag is the most consequential of the three, and it cuts against speed. An economically significant rule under Section 3(f)(1) must be accompanied by a regulatory impact analysis, and that analysis is precisely what reviewers, other agencies and the Office of Management and Budget interrogate during interagency review. Rules that touch a $100 million threshold rarely clear the queue in three weeks.
The empty legal deadline field matters just as much. Where a statute or a court order forces an agency to act by a date, OIRA review compresses accordingly. Here there is no such forcing function: the Kentucky injunction relieves pressure rather than creating it, because the current rule is already unenforceable. The Bureau can afford to get the replacement right rather than fast.
The entry can be checked directly on the OIRA pending review docket, which updates as items are received and concluded. Readers tracking this prediction should watch for the status flipping from “Pending Review” to a concluded action, which typically precedes Federal Register publication by one to three weeks.
| Field | Value as of 31 August 2026 | What it implies |
|---|---|---|
| RIN | 3170-AB39 | A distinct rulemaking, separate from the 2024 rule’s RIN |
| Title | Personal Financial Data Rights Reconsideration | Replacement rather than repeal-only; “reconsideration” language matches the agenda |
| Stage | Proposed Rule | Regulatory text exists; the drafting phase is over |
| Economically significant | Yes | Requires impact analysis; historically correlates with longer review |
| Received | 4 August 2026 | 27 days elapsed at the time of writing |
| Legal deadline | None | No statutory or court-ordered forcing date |
Signal 2: the 14 August agenda is a January snapshot of a Bureau in transition
On 14 August 2026 the CFPB published its contribution to the Unified Agenda of Federal Regulatory and Deregulatory Actions in the Federal Register, at volume 91, number 156. The document states that the Bureau anticipates the listed matters being under consideration between January 2026 and November 2026. It explicitly names, among three planned rulemakings, “a rulemaking to reconsider certain aspects of the Bureau’s November 2024 personal financial data rights rule”.
That is useful confirmation, but the more informative detail is buried in the dates line. The agenda states that its information is current as of 13 January 2026. A document published in mid-August describing an agency’s intentions as of mid-January is a seven-month-old snapshot, which is normal for the Unified Agenda cycle and a poor guide to near-term timing.
The practical consequence is that the agenda should be read as confirmation of direction, not of schedule. The OIRA docket entry from 4 August is seven months fresher and therefore carries the timing information the agenda does not. Analysts who anchor on the agenda’s November 2026 horizon are likely reading a stale document as a forecast.
A second detail in the agenda is worth weighing. The document says plainly that “the Bureau is under interim leadership pending the confirmation of a permanent director” and that it is “carefully considering various sources in setting its future priorities”. Agencies without a confirmed principal tend to move deliberately on economically significant rules, because a successor can reopen anything a caretaker signs.
The agenda’s structure reinforces the point. Only one item appears in the final-rule stage, the Section 1071 small business lending data reconsideration under RIN 3170-AB40. A regulatory pipeline that thin is consistent with an agency conserving capacity, not one racing several major proposals to the printer at once.
Signal 3: the review queue is running long, and the Bureau’s own smaller item proves it
The third signal is not a document but a measurement. A count of the government-wide OIRA pending-review docket taken on 31 August 2026 returns 140 rules under active review. The median item has been pending 34 days, the mean is roughly 62 days, and the oldest has been sitting for 409 days.
The distribution is the useful part. Roughly 34% of pending items have been in review longer than 60 days, and about 16% longer than 90 days, which is the nominal cap under Executive Order 12866 before an extension is required. Among the 36 economically significant items in the queue, the median pending age rises to 42 days. Narrowing further to the 21 economically significant proposed rules, the median pending age is also 42 days.
One methodological caution belongs here. A pending-age snapshot is a censored statistic: it describes how long unfinished reviews have been running, not how long finished reviews took. It systematically over-weights slow items, because fast ones have already left the queue. It is a floor on typical duration for hard rules, not a mean.
Even read conservatively, the snapshot is hard to reconcile with a September publication. RIN 3170-AB39 was 27 days old on 31 August, below the median for its own cohort of economically significant proposed rules, and that cohort’s median is a censored floor rather than an expected completion time.
The Bureau supplies its own control case. RIN 3170-ZA54, a request for information on credit card late fees, entered the queue on 6 July 2026 at the pre-rule stage and is flagged not economically significant. It had been pending 56 days on 31 August. When an agency’s lowest-stakes possible action takes eight weeks to clear, its economically significant proposed rule is unlikely to clear in four.
| Measure (OIRA docket, 31 August 2026) | Value | Read |
|---|---|---|
| Rules pending review, all agencies | 140 | A working queue, not a backlog crisis |
| Median pending age | 34 days | Half the queue is under five weeks old |
| Mean pending age | ~62 days | A long tail pulls the mean well above the median |
| Share pending over 60 days | 34.3% | Multi-month reviews are routine, not exceptional |
| Share pending over 90 days | 16.4% | The nominal EO 12866 cap is regularly exceeded |
| Economically significant items pending | 36 (median age 42 days) | Significance correlates with duration |
| Economically significant proposed rules pending | 21 (median age 42 days) | The closest peer group to RIN 3170-AB39 |
| CFPB RIN 3170-ZA54 (pre-rule RFI) | Pending 56 days | Agency-specific throughput control case |
What the pattern suggests
Put the three signals together and a fairly narrow timing window emerges. The proposal exists in text, sits in a review queue whose peer-group durations run well past four weeks, faces no deadline, and belongs to an agency operating under interim leadership with a deliberately thin pipeline. Each factor points the same direction, which is why the signals reinforce rather than merely repeat one another.
The base case is publication in the Federal Register between late October and mid-December 2026, implying an OIRA review of roughly 80 to 130 days. Comment periods on economically significant CFPB proposals have typically run 60 to 90 days, which would place the close of comments in January to March 2027. A final rule would then plausibly arrive in late 2027 at the earliest, with phased compliance dates beyond that.
The commercially important corollary is that the interim regime persists. Between now and a final rule, the terms on which a payment provider or aggregator obtains bank account data will continue to be set by bilateral commercial contracts rather than by regulation. That is already the observed reality: the largest US bank began charging aggregators for data access in 2025 and reached a paid access agreement with the largest aggregator later that year.
Merchants tracking regulatory risk should treat this as one of the slower-moving items on the 2026 retail policy agenda, not one of the imminent ones. The pattern here is closer to a multi-year rewrite than to a compliance sprint. Planning assumptions built on a 2027 open banking regime are likely to need pushing out.
| Scenario | NPRM publication | Rough likelihood | What merchants should assume |
|---|---|---|---|
| Fast clear | September to mid-October 2026 | Lower | Comments close in Q4 2026; a final rule becomes conceivable in mid-2027 |
| Base case | Late October to mid-December 2026 | Most likely | Comments close Q1 2027; no enforceable obligation before 2028 |
| Slip | Q1 2027 or later | Material | The interim contractual regime runs through the whole of 2027 |
| Withdrawal | No NPRM; different vehicle | Low but non-zero | Congress or the courts, not the Bureau, set the terms |
Wider context: price, pre-emption and a patchwork forming
The fee question nobody has settled
The substantive fight underneath the procedural signals is about price. The November 2024 rule effectively established free access as the default, barring data providers from charging consumers or their authorised third parties for covered data. Banks argued that serving billions of automated data calls is a genuine infrastructure and security cost that they were being compelled to absorb.
The scale figures cited during that argument are worth holding in mind. One large US bank disclosed receiving roughly 1.89 billion aggregator data requests in a single month of 2025, and estimated that only around 13% corresponded to something a customer was doing in the moment. The rest were background refreshes and recurring pulls. Whether that ratio justifies a per-call price is exactly what the reconsideration is expected to address.
The commercial consequence for merchants is not abstract. If data providers may charge per call, the marginal cost of a pay-by-bank authorisation stops being effectively zero, and the economics start to resemble a small fixed fee rather than a pure interchange escape. On a $30 basket, a per-call data cost is a rounding error against card fees; on a $300 basket it is negligible; on a $8 basket with multiple refresh calls it can invert the comparison.
That is a different shape of cost from card acceptance, and it argues for a different deployment pattern. Where interchange scales with ticket size, a per-call data fee is roughly flat, so the savings case strengthens as average order value rises. Merchants who have been weighing acceptance costs alongside options such as card surcharging under state law are likely to find pay-by-bank most defensible at the high-ticket end of the catalogue.
It also matters that aggregators have so far absorbed rather than passed through the bank fees they have agreed to pay. That absorption is a commercial choice made under competitive pressure, not a structural feature, and it is unlikely to survive indefinitely if per-call pricing becomes the codified norm across many data providers rather than a bilateral arrangement with one.
Congress and the states are running on a different clock
The Bureau is not the only actor drafting rules for financial data. In April 2026 the House Financial Services Committee and the House Energy and Commerce Committee announced a joint effort to advance two data privacy bills, including the GUARD Financial Data Act, introduced as H.R. 8398 on 21 April 2026. The stated aim includes creating a uniform national framework, which is legislative shorthand for pre-empting state law.
The GUARD bill approaches the problem from the Gramm-Leach-Bliley Act rather than from Section 1033, modernising privacy obligations rather than mandating data portability. Among its provisions are disclosure requirements around screen scraping and consumer opt-out rights. If it advanced, it would sit alongside rather than replace a Section 1033 rule, which is part of why the two tracks have not converged.
The states are moving in the opposite direction on the price question. A New York bill introduced in March 2026 as S9483, with an Assembly companion, would have created a state financial data rights regime and explicitly prohibited financial institutions from charging fees for data transfers. It did not advance out of committee, but the drafting choice is the signal: state legislators are anchoring on free access precisely as the federal reconsideration is expected to move the other way.
For merchants this is the familiar pattern of a patchwork forming before a federal standard lands, much as it has around checkout design and dark patterns enforcement. The practical exposure differs, though. Data access rules bind banks and aggregators rather than retailers directly, so merchants feel the divergence through vendor pricing and coverage rather than through their own compliance obligations.
One institutional detail is worth noting for anyone modelling the endgame. The Bureau recognised the Financial Data Exchange as a standard-setting body under the 2024 rule in January 2025, for a five-year term. That recognition has not been withdrawn, so the technical standards layer has continued to develop even while the legal layer stalled, which is one reason a replacement rule could move faster from proposal to final than the 2024 process did.
Implications for merchants, platforms and payment providers
The first implication is budgetary. Finance teams building FY2027 payment cost plans should not book savings that depend on a general-purpose, low-cost pay-by-bank rail being available at scale in the US next year. The signals point to the enabling regulation still being in comment or final-rule drafting through most of that period.
The second implication is about where to deploy. Account-to-account payment remains genuinely attractive where ticket sizes are large, where the customer relationship is recurring, or where funds finality matters more than rewards. Bill pay, subscription renewals, marketplace seller payouts, high-value electronics and furniture, and account top-ups all fit that profile better than impulse-driven low-value baskets.
The third implication concerns rail choice. Pay-by-bank has two separable legs: moving the money and checking the account. Only the second leg is governed by Section 1033. Implementations that move funds over real-time rails while minimising data-refresh calls are structurally less exposed to whatever the fee provision turns out to say.
The European contrast is instructive here, because the sequencing ran the other way. Regulation arrived first, the technical standards followed, and the commercial question of who bears the cost was largely settled before merchants had to choose. The result has been slower initial adoption but far more predictable unit economics, a dynamic visible in the way European account-to-account schemes are consolidating around a small number of rails.
The fourth implication is contractual. Merchants signing multi-year payment processing or aggregation agreements in the next two quarters are signing them into regulatory uncertainty, and should price that. A repricing clause tied to a change in data-access cost, or a shorter initial term with a renewal option, is cheaper to negotiate now than to retrofit after the proposal is public.
| Use case | Typical ticket | Sensitivity to a per-call data fee | Likely status through 2027 |
|---|---|---|---|
| Impulse and low-value retail baskets | Under $25 | High | Cards and wallets likely remain the default |
| General merchandise checkout | $25–$150 | Moderate | Pilots continue; broad rollout likely waits |
| High-ticket goods | $300+ | Low | The clearest near-term savings case |
| Subscriptions and bill pay | Recurring | Low to moderate | Fewest data calls per dollar; likely continued growth |
| Marketplace seller payouts | Variable, high | Low | Largely outside the consumer checkout debate |
| BNPL underwriting inputs | Not applicable | High | Cost per decision rises if data calls are priced |
Caveats: what could go wrong with this prediction
The most obvious way this call fails is on the upside of speed. OIRA review duration is substantially a political variable, and a rule that an administration wants published can clear in days rather than months. If the reconsideration is a priority deliverable rather than a routine rewrite, a September or early October publication is entirely possible and would falsify the base case timing while leaving the direction intact.
A second and more interesting failure mode is that the fee premise turns out to be wrong. The reconsideration could retain a fee prohibition, or adopt a cost-recovery safe harbour set low enough to be economically equivalent to free. The reconsideration was driven substantially by arguments about the Bureau’s statutory authority and about data security rather than exclusively about pricing, and it is possible pricing is not where the drafters spent their effort.
Third, the commerce consequence may simply not depend on the rule. Real-time account-to-account payments running over established rails do not necessarily require third-party aggregator data access at all, because a bank-direct implementation can authenticate and authorise inside the bank’s own channel. If large merchants pursue that architecture, pay-by-bank adoption could grow through 2027 regardless of what the fee provision says.
Fourth, private ordering may have already substituted for the rule. Bilateral data access agreements between major banks and major aggregators have established a de facto pricing regime covering a large share of US deposit accounts. A rule that arrives in 2028 into a market that settled the question commercially in 2025 and 2026 would be ratifying an outcome rather than determining one.
Fifth, an institutional reset is plausible. The Bureau’s own agenda describes interim leadership pending confirmation of a permanent director. A confirmed director could reprioritise, withdraw the proposal, or restart it, and the withdrawal scenario in the table above exists precisely because that path is available at any point during review.
Sixth, the courts remain live. The Kentucky litigation is stayed pending the rulemaking rather than resolved, and a court that concludes the stay has run too long could act independently of the Bureau’s timetable. That would change the sequence without necessarily changing the destination.
Taken together, these caveats do not undermine the central claim so much as bound it. The high-confidence element is that no enforceable federal open banking obligation binds US merchants or their payment vendors during the 2026 holiday season. The lower-confidence elements are the precise publication month and the content of the fee provision.
How to check whether this prediction was right
A falsifiable prediction should come with its own scoring rubric. The primary check is whether RIN 3170-AB39 appears in the Federal Register as a notice of proposed rulemaking with a publication date on or before 31 December 2026. That is a binary, publicly verifiable outcome requiring no interpretation.
Three secondary checks refine the score. Does the proposal permit data providers to charge third parties for covered data access, in any form including cost-recovery caps? Does the comment period close within Q1 2027? And does the proposal contemplate any compliance date earlier than 2028?
A useful intermediate marker arrives before publication. The OIRA docket entry will flip from “Pending Review” to a concluded status, typically recorded as consistent with change, consistent without change, or withdrawn. That transition normally precedes Federal Register publication by one to three weeks and is the earliest reliable public confirmation that a proposal is imminent.
Readers who want a single number to watch should track the elapsed review days. If RIN 3170-AB39 passes 90 days on roughly 2 November 2026 while still pending, the nominal EO 12866 clock has run and an extension has been taken, which would shift weight from the base case toward the slip scenario.
Frequently asked questions
What exactly is the CFPB open banking rule?
It is the regulation implementing Section 1033 of the Dodd-Frank Act, formally titled the Personal Financial Data Rights rule. It sets out when a bank or other data provider must make a consumer’s account data available, to whom, in what format, and on what terms. The version finalised in November 2024 is currently enjoined and under reconsideration.
Is any US open banking rule in force right now?
Not in an enforceable sense. A federal court in the Eastern District of Kentucky enjoined enforcement of the 2024 rule pending the Bureau’s reconsideration, and the phased compliance date of 1 April 2026 passed without becoming a binding trigger. Data access today operates under bilateral commercial agreements and existing privacy law rather than under an active Section 1033 regime.
Why predict Q4 2026 rather than September?
Because the proposal is flagged economically significant, carries no legal deadline, and sits in a review queue where roughly a third of items run past 60 days. The Bureau’s own much smaller pre-rule item had been pending 56 days at the end of August. A September clearance would be unusually fast for this combination of attributes, though it is not impossible.
Could the prediction be wrong because the rule publishes much later instead?
Yes, and that is arguably the more likely error. Review can extend past 90 days with an extension, agencies can withdraw and resubmit, and leadership transitions can pause everything. A slip into Q1 2027 would falsify the stated window while strengthening rather than weakening the practical conclusion that no rule binds merchants in the near term.
Does this actually change anything for a retailer that only accepts cards?
Directly, very little in the next twelve months. Indirectly it affects the pricing and availability of account verification, cash-flow underwriting and pay-by-bank options that vendors offer, and it affects how credible any 2027 pitch for card-cost reduction through account-to-account payment should be considered.
If banks can charge for data, does pay-by-bank stop making sense?
No, but its shape likely changes. A per-call data fee is roughly flat while card interchange scales with ticket size, so the savings case concentrates at higher average order values and in recurring payments rather than across the whole catalogue. The pattern suggests selective deployment rather than a general checkout default.
Are aggregator fees already being passed through to merchants?
Largely not yet. The major aggregator that agreed to pay a large bank for data access has said publicly that it would absorb the cost rather than pass it to its clients. That is a competitive decision rather than a structural one, and it would be harder to sustain if per-call pricing were codified and adopted broadly across data providers.
What is the strongest argument against this whole analysis?
That it over-indexes on procedural signals and under-weights political will. Regulatory queues are not physics, and a determined agency with White House backing can move an economically significant rule quickly when it chooses to. The counter is that nothing observable in the past four weeks suggests this particular rule is being treated as urgent.
What should a merchant actually do this quarter?
Three things, none of them expensive. Do not book FY2027 savings that assume a functioning US open banking regime; add a repricing clause tied to data-access cost changes in any payment contract signed in the next two quarters; and if piloting pay-by-bank, start where average order values are highest rather than where transaction counts are highest.