The financial services industry asked a federal court to clarify whether institutions can ignore the Consumer Financial Protection Bureau’s (CFPB) final rule implementing data privacy standards described in Sec. 1033 of the Dodd-Frank Act while waiting for the agency to issue a revised version of the regulation.
The U.S. District Court for the Eastern District of Kentucky granted the CFPB’s request to stay litigation proceedings challenging the rule on July 29 in light of the agency’s stated intention to initiate a new rulemaking process. Upon granting the stay, Judge Danny Reeves ordered the CFPB to provide the court with status updates every 45 days.
Although the financial services industry welcomed the bureau’s plans to revise the rule, the situation has put covered institutions in a state of limbo in terms of compliance because the order did not address compliance expectations with respect to the existing rule.
To clear up this regulatory uncertainty, the Bank Policy Institute (BPI), Kentucky Bankers Association (KBA) and Forcht Bank filed a motion requesting the court to issue a formal determination on the matter.
“Unless the court acts, banks will be forced to begin investing time and resources to build systems to comply with a regulation that will soon be replaced,” BPI Co-Head of Regulatory Affairs Paige Pidano Paridon said in a statement. “This is a straightforward and common-sense procedural matter, and we are asking the court to act to avoid unnecessary cost and confusion.”
The three entities are the same ones who challenged the legality of the CFPB’s data privacy rule in October 2024, contending that its provisions exceeded the bureau’s statutory authority and put sensitive consumer financial data at risk.
The motion requests the court to stay the existing rule’s compliance deadlines and enjoin the enforcement of the rule for one year following the conclusion of the stayed litigation proceedings. Without court intervention, some banks will be required to comply with the existing Sec. 1033 rule beginning in summer 2026.
For more Dodd Frank Update coverage of matters related to data privacy and the CFPB’s efforts to implement Sec. 1033 of the Dodd-Frank Act, visit the “Data Privacy Vault” – a resource library holding all of our coverage of every volley in the ping-pong match between the finance industry and regulators over how to be protect consumers’ sensitive data in the rapidly evolving virtual financial marketplace.