Implement a Section 1033-aligned open-banking data access workflow for credit underwriting (monitoring regulatory status)

Steps

1. Review the current status of CFPB Section 1033 rulemaking: as of mid-2026 the October 2024 final rule is enjoined by a federal court and under reconsideration; do not assume any specific compliance deadline is in force
2. Build your consumer-permissioned data access flow on an established aggregator (Plaid, Mastercard Open Banking/Finicity, MX) that uses OAuth-based tokenized consent rather than credential sharing, regardless of 1033 status
3. Implement a consumer-facing authorization screen that clearly describes what data will be accessed, for what purpose, and the duration of access; capture and store the consent record with a timestamp
4. Call the aggregator's data endpoint to retrieve account and transaction data under the consumer's authorization token; do not retain raw credentials
5. Apply your underwriting logic to the retrieved data; if using data from a CRA-regulated source, follow FCRA adverse action rules; if using non-CRA aggregated data, track CFPB interpretive guidance closely as the rule evolves
6. Build a revocation mechanism: if the consumer withdraws consent, cease data access and delete retained data per your data-use agreement with the aggregator