“Akoya was founded to give consumers more control over their data and protect their sensitive financial information. We have built a data network, the right way, from the ground up, never asking a consumer to share their username or password with anyone outside their bank or financial services provider. 100% of our transactions are completed through secure APIs and not risky practices like screen scraping.
We partner with financial institutions and financial technology companies of all sizes to help them provide safe, transparent data access while meeting regulatory requirements, including compliance with the CFPB's Section 1033 rule. Our solutions allow consumers to more confidently use financial apps, knowing exactly what data is being shared and with whom, and with the ability to revoke that access at any time, safeguarding their privacy and security.”
- Paul LaRusso, CEO, Akoya
Last week, the Consumer Financial Protection Bureau (CFPB) issued its final Personal Financial Data Rights rule, and we’re prepared to help covered entities comply with this new regulation.
Akoya was created in 2018 to solve a problem: helping consumers and financial institutions manage data sharing safely, via APIs. We build technology that protects consumers, allowing them to keep their data secure and under their control.
Consumer Control & Privacy
When consumers share their financial data with third parties for a specific purpose, they do not intend for that information to be used without restriction. The CFPB has limited secondary use to narrow circumstances–only where the consumer has provided their express authorization–and the consumer can withdraw consent at any time.
Additionally, Akoya believes consumers shouldn’t have to worry about their sensitive information being compromised through risky practices like screen scraping when there are better ways to share personal, permissioned data than through screen scraping. Though Akoya called for the Bureau to go further to protect consumers by fully banning harmful practices like screen scraping, the final rule provides an opportunity for industry progress toward more inclusive, secure, and consumer-permissioned data access.
Consumer Choice & Transferability
Consumers should have options when it comes to the financial institutions and third-party apps that they use, and it should be easy to move between them. Akoya urged the CFPB to take steps to promote choice for consumers’ authorized third parties, requiring data aggregators and service providers to adhere to qualified industry standards that enable portability.
The CFPB’s rule creates an institutional safe harbor for compliance with qualified industry standards and adhering to a unified standard for data sharing, which is a good step toward increasing consumer choice. The safe harbor makes it easier for every player in the ecosystem to move into the future of open banking.
Summary of Key Provisions
- Compliance timeline: The first wave of financial institution compliance begins in April 2026.
- Data access: The final rule requires that data access end immediately when a consumer revokes permission.
- Record retention: Data providers must retain records that show their actions in response third-party and consumer access requests for at least three years.
- Secondary use: The final rule prohibits third parties from using consumer data for unrelated business reasons that are not “reasonably necessary.” This includes a ban on targeted advertising, cross-selling of other products or services, or the sale of covered data.
- Data formats: The final rule requires data to be in a standardized and machine-readable format.
- Fees: The final rule prohibits fees or charges for consumer or third-party data access.
- Developer interface access and security: Data providers can deny third party access if granting access would be inconsistent with safety and soundness standards established by a prudential regulator. Denials must be reasonable.
- Prohibition on evasion: Data providers can’t take any action to intentionally evade the requirements of the final rule.
- Standard setting body: The CFPB has not yet designated a standard setting body.
For more detailed information, consult the Consumer Financial Protection Bureau’s final rule.
Learn more about Akoya's end-to-end 1033 Compliance Solution for financial institutions.
About Akoya
Akoya is transforming how consumers share their banking data, using API technology to enhance data privacy and security. We’re committed to a financial system that provides more transparency, accessibility, and choice. Through Akoya’s data access network and open banking solutions, we serve financial institutions, authorized third parties, and data aggregators, offering products that are purpose-built for safe and secure data access.
