Our personal financial data is one of our most valuable assets. Utahns treat it that way, and so do the responsible businesses that serve them. Yet under the previous administration, that information was placed at unnecessary risk. In a state where finance, technology, innovation and entrepreneurship continue to expand, safeguarding data isn’t optional; it is foundational to consumer confidence and to the companies that depend upon it.
The Consumer Financial Protection Bureau’s (CFPB’s) Section 1033 “open banking” rule was advertised by the Biden administration and many fintech players as a step toward modern financial services. It was anything but. The mandate required banks to provide consumers’ financial data to “data middlemen” free of charge and with no control over how often that information could be pulled or what it could be used for. That kind of compulsory data transfer ignored the risks facing consumers and imposed one-sided obligations on banks while insulating these middlemen from meaningful accountability.
These issues matter in Utah, where companies would never treat broad, repeated access to sensitive financial data as something to be handed out to entities that avoid the compliance obligations banks must meet.
Earlier this year, the Trump administration halted the rule and a federal judge agreed that implementation should be put on hold. Importantly, the court noted the CFPB failed to assess risks to data security or the consequences for consumers. For Utah families and for businesses relying on predictable regulatory frameworks, that decision restored a measure of clarity.
What happened next is telling. With the mandate off the table, banks and fintech companies began negotiating their own voluntary agreements — not because Washington required it, but because the market had an incentive to create workable, secure standards. These agreements conceivably define when consumer-authorized data can be shared, how often access can occur and what safeguards must be in place. They are demonstrating that a functioning market can produce solutions and that government-mandated price caps are unwise and unnecessary. Nevertheless, some fintech companies continue to argue that without the Biden-era mandate they can’t operate effectively.
The CFPB now faces a pivotal choice. It can recognize that the marketplace is developing its own standards and allow those agreements to evolve. Or it can attempt to revive a mandate that distorted incentives, exposed consumers to unnecessary risk and overlooked the legal responsibilities banks shoulder every day. Reimposing that rule would destabilize the progress already underway and reintroduce the very concerns the court identified.
These issues matter in Utah, where companies would never treat broad, repeated access to sensitive financial data as something to be handed out to entities that avoid the compliance obligations banks must meet. The Biden-era mandate gave data middlemen expansive access without holding them to comparable standards. That is not consumer protection. It is an uneven playing field that leaves consumers worse off. These are precisely the kinds of mandates I opposed as Utah Attorney General and I know many of my AG colleagues would have similar concerns.
During my decades working with business leaders as a lawyer, investor, operator and regulator, I’ve seen up close how innovation accelerates when government understands its limits. The right regulatory posture encourages investment, strengthens consumer trust and ensures companies can compete on the merits rather than receive preferential treatment from Washington.
Utah’s economy reflects that principle. Our success isn’t driven by federal mandates. It is driven by entrepreneurship, responsible stewardship and the discipline of the market. With the Section 1033 rule set aside, we are already seeing the benefits of a system that prioritizes private solutions over federal compulsion. The CFPB — under new leadership — should reinforce that direction by advancing a rule emphasizing data security, market-tested standards and accountability for all participants.
Protecting financial data ultimately comes down to trust. Consumers need assurance that their information is safe and businesses need the confidence of a stable, predictable regulatory environment. By favoring common-sense protections over sweeping mandates, we preserve both privacy and economic opportunity. That is the environment Utah’s business community deserves, and the one that best positions our state — and our nation — to continue leading in financial innovation.