Updates on CFPB 1071 and 1033 for community financial institutions

The CFPB 1071 regulation has sparked plenty of debate and concern among financial institutions. Since our last 107 1 episode in March, there have been some key developments, including the Supreme Court's decision to uphold the CFPB’s funding structure and the new administration's 60-day pause on the rule. We’ll discuss how community financial institutions are responding—whether with resignation, adaptation, or continued hesitancy—and the practical steps they’re taking to comply.

Up next is an overview of CFPB 1033, the open banking rule, and what it means for community banks as they face new requirements for consumer data access and sharing. Learn how financial institutions can prepare, the role of technology in compliance, and how community banks can maintain their high-touch customer relationships while adapting to these changes. We'll also touch on what deregulation could mean for small business lending in 2025 and how banks can position themselves for growth.

Our guest is Paula King, CPA, Principal Consultant for Abrigo Advisory Services. King assists financial institutions with CECL, credit processes, model validations, and more. A former banker and bank co-founder, she has held executive positions (CFO, Chief Risk Officer, and Chief Compliance Officer) and has more than 25 years of experience across all aspects of banking, including financial and asset/liability management, credit, services and product development, and director responsibilities.

Helpful links:

Webinar: Understanding the impact of CFPB 1071 on small business lending

Blog: The CFPB section 1071 effective date

Software: Small Business Loan Origination Software

Transcript

This transcript was created with the assistance of ChatGPT and reviewed by Abrigo staff

Kate Randazzo:
Thank you so much for joining us, Paula. Since we last spoke on this subject—back in March—there have been some new developments, a little more drama around CFPB 1071. My first question for you is, do you feel there’s been a shift in how community financial institutions are feeling about the rule? Is there less hesitancy, more hesitancy—just resignation? What’s the sentiment right now?

Paula King:
Great question, Kate. Yes, you're right—there has been a lot of drama over the last year and a half. Just to revisit a bit, in May 2024, the Supreme Court upheld the constitutionality of CFPB’s funding, so the rule was a go. Then, when the new administration came in on January 20th, they put a 60-day pause on 1071, which is pretty typical when new administrations take over.

However, experts I speak with say that if this rule were to go to Congress, there are about 60 votes short of repealing or even amending it. So, at this point, I think it’s a go.

Paula King:
Obviously, financial institutions were hoping for some relief, and most aren’t thrilled about moving forward, but I think they’ve resigned themselves to the fact that compliance is necessary. Many of my clients are already preparing, moving forward with software solutions, and adapting. It’s just another regulation that they have to comply with, and they’re making the best of the situation.

Kate Randazzo:
Definitely. And hopefully, they’re able to get help from experts like you. Can you elaborate on some of the biggest challenges small banks, in particular, will face when it comes to collecting, storing, and reporting this data?

Paula King:
Absolutely. One of the biggest challenges is timing. A lot of my clients conduct pre-flights or pre-screenings that are very similar to loan applications, where financial institutions make initial determinations. The rule requires demographic information to be collected very early in the process—before any decisions are made—which is a big adjustment for many institutions.

The challenge is maintaining the high-touch, consultative approach that community banks are known for while ensuring they collect that demographic data at the right stage. The good news is that most financial institutions are in the same boat, so they aren’t alone in this.

Another major challenge is automation. If a bank doesn’t already have an automated system, they’ll need one to comply with the rule. There are just too many data points to collect, and trying to do this manually would be extremely difficult.

Kate Randazzo:
That makes sense. And hopefully, that high-touch service can help reassure applicants who may not expect to provide all this information so early in the process.

What can banks do to ensure that this sensitive data remains secure while still meeting compliance requirements?

Paula King:
That’s another area where software solutions are essential. The rule includes a firewall provision stating that anyone making loan decisions should not have access to demographic information. Most software vendors have built-in permission settings to handle this, ensuring compliance.

For institutions without an automated system, they’ll need to significantly revamp their processes to ensure decision-makers don’t see this data. The rule does allow for an exception to the firewall, but in that case, banks must disclose upfront to applicants that their demographic information will be visible to decision-makers. That’s a tricky conversation to have with applicants.

Kate Randazzo:
Yeah, I would definitely have questions if I saw that disclosure and didn’t know what it meant.

Paula King:
Exactly. But the upside is that all financial institutions have to comply with the same rule, so there’s a level playing field.

Kate Randazzo:
That’s good to know. One last question on this topic—how should community banks start preparing now? I know implementation deadlines have shifted quite a bit. Hopefully, most are already working on solutions, but what should they be doing now? And how can Abrigo help?

Paula King:
At this point, banks should already have a plan in place and be well into implementation, because deadlines are quickly approaching. If they haven’t started yet, they need to determine what their pre-flight application process will look like under 1071 and how they will comply with the firewall provision.

For context:

• Tier 1 institutions must comply by July 2024, so they should already be testing their systems and processes to ensure compliance.
• Tier 2 institutions have a compliance deadline of January 2026—they should be making final decisions about application processes and firewalls and start testing soon.
• Tier 3 institutions have until October 2026, but by now, they should have established their 1071 compliance team and begun making key process decisions.

At Abrigo, we have a fully compliant 1071 solution available today. We also offer advisory services to guide financial institutions through major decisions, like best practices for applications, firewalls, and policy development. Our team consists of former bankers and regulators, so we have firsthand insights into industry best practices and what early adopters are doing to comply.

Kate Randazzo:
That peer data is so valuable. I’ve heard great things about Abrigo’s advisory and change management services, so I’ll link to those in the show notes.

Before we switch topics, is there anything else you want to add about 1071?

Paula King:
I think it’s here to stay. It reminds me of CECL—early on, people thought CECL would be repealed, but it wasn’t. So I would advise banks to proceed as if there will be no changes. Maybe something unexpected happens, but for now, institutions should be fully preparing for compliance.

Kate Randazzo:
That makes sense. Let’s switch gears to CFPB 1033. This rule redefines consumer control over their financial data. Can you explain what that means and what the implications are for small banks?

Paula King:
Sure. CFPB 1033, finalized in October 2024, is also known as the open banking rule. It applies primarily to financial institutions offering credit cards and deposit accounts, including checking and savings accounts.

The rule gives consumers greater access to their financial data and makes it easier to switch providers. That’s great for consumers but adds complexity for banks, which will need to adjust their systems and processes to comply.

One big requirement is that third parties accessing consumer data must obtain explicit permission from the consumer. The CFPB recently appointed FDX as the organization responsible for developing a standardized format for data sharing, but that format hasn’t been finalized yet.

Kate Randazzo:
So how does this impact smaller banks that may not have extensive tech resources but need to provide large amounts of data efficiently?

Paula King:
It will be a challenge, but smaller institutions do have more time.

• Banks under $10 billion in assets don’t have to comply until 2028.
• Depending on asset size, deadlines range from 2027 to 2030.
• Banks under $850 million in assets are exempt from the rule.

The biggest technological challenge will be ensuring data is shared in a machine-readable, standardized format. This may require banks to upgrade systems, integrate new solutions, or adopt third-party software to meet compliance requirements. Smaller institutions should monitor developments closely, especially as the FDX standard is finalized.

Kate Randazzo:
With fintechs also required to comply, do you see opportunities for small banks to compete?

Paula King:
Yes, but fintechs already have a head start on technology. Banks, however, excel in relationship banking—that’s their competitive advantage. To compete, banks need strong technology partners and well-defined processes to ensure a smooth customer experience.

Kate Randazzo:
That’s great advice. Finally, any predictions for banking regulation under the new administration?

Paula King:
There’s a lot of excitement about potential deregulation, particularly among small businesses and financial institutions. While 1071 and 1033 are finalized, the overall regulatory landscape might become more pro-business.

I also expect small business lending to ramp up in 2025. With less regulatory pressure, banks will have more flexibility to support small business growth. At Abrigo, we recently launched a small business lending platform, which could be a game changer for institutions looking to streamline and grow their lending portfolios.

Kate Randazzo:
That’s exciting! I’ll link to that in the show notes as well. Paula, thank you so much for your time and insights today.

This version removes filler words and redundancies while maintaining the natural flow of the conversation. Let me know if you need any refinements!