PLAID Open Banking Readiness Customer Guide User Guide
- June 13, 2024
- PLAID
Table of Contents
PLAID Open Banking Readiness Customer Guide
Information
Open banking regulation is coming to the U.S. (commonly known as the CFPB’s 1033 rule). It’s been in the works for a long time and is expected to be released this fall. The rule will ensure consumers have control over data about their financial lives, which is good for consumers and the financial ecosystem broadly. These protections will also introduce new compliance obligations for everyone in the ecosystem. As currently proposed by the CFPB, portions of the rule may become effective in as little as 60 days after it is finalized. Plaid’s 1033 readiness tool kit helps you meet your new obligations more easily and confidently. Review the guide below for key requirements and actions to take ahead of the anticipated compliance deadlines. This guide focuses on authorization-related requirements and will continue to be updated as the regulatory landscape evolves.
Note that the rule is not yet final, so while we’ve included actions that
we anticipate all customers will need to take, those may change as the final
rule is published later this year.)
Learn more about Section 1033 and your business’ obligations:Section 1033: What Companies Need to Know
REQUIREMENT
- 1033 PROPOSED REQUIREMENT: Capture consumer’s authorization for all data being collected to power their desired use case (e.g. lending).
- ACTION Enable and test Data Transparency Messaging (DTM).
- Check your client library version to ensure it supports additional consented products. See API docs.
- Determine which products and additional consented products to initialize with Link.
- Create a Link customization in the Dashboard.
- Review your pre-selected business use cases in the Dashboard and update them as needed.
- Turn on the toggle for Data Transparency. You will be automatically enabled once 1033 compliance begins.
- Pass through products and additional_consented_products when initializing the Link. Plaid will show the data types and use case to the user for authorization.
- 1033 PROPOSED REQUIREMENT Consumers must be able to view a record of their authorization and be able to revoke it at any time.
- NO ACTION The Plaid Portal already serves as one way for consumers to revoke their authorization, and we are continuing to enhance it ahead of the final rule.
- OPTIONAL ACTION Build additional channels for consumers to easily revoke authorization
- Direct users to the Plaid Portal to view and manage their connections.
- Create your own consumer permissions control portal within your existing app/website experience, powered by Plaid consent logs (coming soon).
- Offer consumer support team channels via email, phone, and/or chat.
- 1033 PROPOSED REQUIREMENT Authorization changes must be synced across the open banking ecosystem.
- ACTION If you offer a surface for consumers to unlink accounts within your app or website, integrate with ecosystem synchronization webhooks & endpoint
- Continue to notify Plaid when a consumer unlinks their financial account from your app or website via item/remove, so Plaid can update its system of record.
- Listen to ‘user permission revoked‘ and ‘user account revoked‘ webhooks from Plaid to be notified when a consumer has revoked their item or an account on either Plaid or the data provider’s surfaces.
- 1033 PROPOSED REQUIREMENT Capture consumer reauthorization of their account connections every 12 months to ensure that their chosen third parties can continue accessing their data.
- ACTION Integrate with Update Mode for annual reauthorization
- Review the reauthorization default setting in the Dashboard, and update settings if desired.
- For customers not already using Update Mode, complete the integration.
- [Optional] Listen to the PENDING EXPIRATION webhook to track when an Item’s access consent is expiring.