Due diligence checklist, United States
CFPB Section 1033: what to ask a vendor
Personal Financial Data Rights rule (Dodd-Frank Act section 1033). CFPB. Data providers make consumer data available through developer interfaces, and third parties use it with consent.
What it is
Data providers make consumer data available through developer interfaces, and third parties use it with consent.
Who it applies to
Applies to every financial institution in the United States, when procuring open banking and cdr, digital banking, payments.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Developer interfaces aligned with a recognised standard such as FDX | Conformance test results or a written statement of conformance against the standard, with the version supported. |
| 2 | Consent, data use limits and no screen scraping where an interface exists | A description of the consent and authentication flows with screenshots or a demonstration, and the standard they follow. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have