FinRegLab Responds to Comments on Proposed Third-Party Relationships Guidance

BY EMAIL

Chief Counsel’s Office

Attn: Comment Processing

Office of the Comptroller of the Currency

400 7th St. SW, Suite 3E-218

Washington, DC 20219

Mr. James P. Sheesley

Assistant Executive Secretary

Attn: Comments-RIN 3064-ZA24

Federal Deposit Insurance Corporation

550 17th St. NW

Washington, DC 20429

Ms. Ann E. Misback

Secretary

Board of Governors of the Federal Reserve System

20th Street and Constitution Ave. NW

Washington, DC 20551

RE: Proposed Interagency Guidance on Third-Party Relationships: Risk Management, Docket No. FRB OP-1752, FDIC RIN 3064-ZA26, OCC-2021-0011

FinRegLab is pleased to submit these comments in response to the agencies’ Proposed Interagency Guidance on Third-Party Relationships: Risk Management (“the Proposed Guidance”) as it potentially relates to customer-directed data transfers from depository institutions to other financial services providers. Such transfers, which facilitate the exercise of consumer rights under § 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act,¹ are fueling an increasing range of financial services in the U.S. and warrant careful attention by regulators. However, as detailed below, recent history has illustrated that there are substantial disadvantages to attempting to manage their potential risks through guidance that is primarily designed to address how depository institutions structure their relationships with companies from which they obtain products and services or through which they conduct their own business activities.

Harmonizing and clarifying the agencies’ risk management expectations for depository institutions with regard to customer-directed data transfers could be extremely helpful to the market, but we urge the regulators to consider the implications of relying so heavily on general third-party service provider frameworks for managing associated risks, to consult closely with the Consumer Financial Protection Bureau and Federal Trade Commission regarding their rulemakings on closely related topics,² and to seek additional input from stakeholders in finalizing such guidance. Coordinated action is critical between federal regulators to continue moving the growing ecosystem for customer-directed transfers toward adoption of safer technologies and practices without undermining consumers’ § 1033 rights or frustrating the law’s potential benefits for competition and innovation.

Background

Established in 2018, FinRegLab is an independent, nonpartisan innovation center that tests and monitors the use of new technologies and data to drive the financial services sector toward a responsible and inclusive marketplace. Through our research and policy discourse, we facilitate collaboration across the financial ecosystem to inform public policy and market practices.

FinRegLab has focused on issues concerning customer-directed data transfers since the launch of our first empirical project in 2018, which evaluated the use of cash-flow data from bank accounts and other sources in underwriting consumer and small business credit.³ We structured our work as a case study of the potential for customer-directed data transfers to spur greater competition and innovation in financial services, and concluded the project last year by publishing a policy analysis of how various stakeholders could help to strengthen financial inclusion and borrower protections in the broader ecosystem.⁴

In partnership with the Financial Health Network, Flourish, and Mitchell Sandler, we also published a report that describes existing U.S. federal law governing consumer financial data and highlights open issues, areas of ambiguity, and other emerging topics.⁵ We also partnered with the Federal Reserve Bank of San Francisco in 2019 to host a symposium on the Role of Consumers in the Data Ecosystem,⁶ and were invited to participate in the Consumer Financial Protection Bureau’s 2020 symposium on consumer data access issues⁷ and a recent hearing by the House Financial Service Committee’s Financial Technology Task Force on preserving customers’ rights to data access.⁸

Our prior publications contain substantial analyses of the technology, market, and regulatory context that is shaping customer-directed data transfers, and are incorporated by reference. We focus these comments on major themes and recent developments. FinRegLab is not an advocacy organization, but through our research and engagement we work to identify market and policy issues that will be particularly critical in determining the benefits, risks, and scale of adoption for specific data and technology uses.

Discussion

A. The potential benefits, risks, and scale of customer-directed data flows

The generation of customer financial data has accelerated exponentially in recent decades as the financial services industry has come to rely heavily on digital information sources, backoffice automation, and electronic service delivery. The increasingly sophisticated use of data and technology can produce significant benefits for consumers and small businesses, for instance by increasing the speed and convenience of financial services delivery, expanding access for historically underserved populations, supporting more individually tailored financial products and services, and giving customers more control over their financial lives. Congress decided that § 1033 of the Dodd-Frank Act would facilitate such innovation and competition benefits by granting consumers the right to access the data collected and generated by financial services providers with respect to consumers’ accounts for consumers’ own benefit.⁹

The ecosystem for facilitating such transfers has grown substantially over time, with data aggregators at its hub acting on behalf of consumers to transfer information between providers. Aggregators have historically operated by obtaining consumers’ bank log in credentials and collecting data through a process called screen scraping. Executing transfers through such means allows consumers to direct the data to the financial services provider of their choice, though it can have significant disadvantages for data sources, data users, and customers relative to more modern technologies that are now gradually being adopted pursuant to bilateral contracts between large aggregators and data sources.¹⁰ After substantial growth during the COVID-19 pandemic, roughly 50% of U.S. consumers are estimated to have signed up for financial services that frequently rely on aggregators to effectuate transfers.¹¹

Many of the initial financial services that were facilitated by this system involved financial advisory and account management offerings for relatively wealthy and/or technologically sophisticated consumers, often provided by banks and other traditional market participants.¹² But over time customer-directed transfers have come to support an increasingly diverse range of financial services—including various personal financial management (PFM) platforms, payment services, and credit products that rely on automated verification services and/or new data sources for underwriting—by an increasingly broad range of providers to an increasingly broad range of customers.¹³ Our research suggests that customer-directed transfers could be particularly important for addressing concerns about the fairness, inclusion, and general predictiveness of credit underwriting models by providing more holistic, real-time information about both consumers and small businesses. These concerns have substantially increased in recent months due to both to economic damage from the COVID-19 pandemic and greater awareness of the effect that racial disparities in credit information systems and underwriting have on wealth gaps and broader economic participation.¹⁴

Yet while the scale and significance of customer-directed data transfers continues to increase, the regulatory frameworks that govern such transfers have not kept pace with technology and market changes. For instance, data sharing and usage practices have evolved significantly over the past two decades, but information security requirements for non-banks have not been updated since the initial implementation of the Gramm-Leach-Bliley Act in the early 2000s.¹⁵ The CFPB also has not yet implemented § 1033 or clarified the application of various existing protections to customer-directed data flows, such as whether banks may initially have to absorb certain costs for unauthorized transactions in the event that a consumer’s log-in credentials are misused in connection with a data transfer.¹⁶ The CFPB also has not yet taken steps necessary to begin examining larger data aggregators and other certain other non-bank data users for compliance with various federal laws.¹⁷

B. The role of third-party guidance in shaping the current market

In light of this broader context, it is understandable that prudential regulators have come to view the increasing volume of customer-directed transfers as a source of potential source of risk for both depository institutions and their customers, and have begun emphasizing the need for better monitoring processes and substantive standards in recent years.¹⁸ The Office of the Comptroller of the Currency has specifically relied on its third-party guidance to manage such risks, for instance by issuing 2020 FAQs stating both that data-sharing contracts or other “business arrangements” between banks and aggregators increase the banks’ monitoring obligations and that banks have certain due diligence obligations even in the absence of such business arrangements.¹⁹ However, other differences in the three agencies’ written guidance and variations in oral feedback from individual examination teams may also have contributed to uncertainty about when and how third-party principles and processes should be applied to data aggregators²⁰ and/or their downstream customers.²¹

The effect of the guidance on the current market is difficult to quantify but is frequently cited by large national banks as they have been negotiating bilateral agreements to govern data sharing and the move to technologies such as read-only tokenized access and application program interfaces (APIs). Some banks have gone so far as announcing that they have or are preparing to block any screen scraping by aggregators who have not already signed data sharing agreements,²² and two large aggregators have indicated that 75% to 80% of their data transfers will be pursuant to such contracts by the end of 2021.²³ While contractually governed data flows may still be effectuated via credential sharing and/or screen scraping as the parties work to implement new technologies, they have served as the first step toward enhancing information security and privacy protections as well as increasing the accuracy and efficiency of data transfers.²⁴

Yet while the market is gradually moving toward more secure technologies, recent experience has also revealed substantial disadvantages of relying on bespoke agreements, technologies, and monitoring programs to manage the broader ecosystem. Where each bank has its own interpretation of third-party obligations and list of demands, negotiations take substantial time and resources and implementation becomes more complex for aggregators and end users. In addition, there are concerns that business incentives and unequal bargaining power are skewing both the terms of the contracts and the ways that they are executed in practice. For instance, banks have strong competitive reasons to want to limit data flows to rival financial services providers beyond concerns about information security, privacy, and liability, and may not be strongly motivated to structure or maintain technical systems in ways that reduce process frictions. At the same time, as the contracts place increasing responsibility on data aggregators, it is unclear whether they have either the incentives or clout necessary to monitor end users consistently on all potentially relevant issues, especially since the end users are the aggregators’ customers. And efforts to develop common standards and platforms have been substantially complicated by competitive tensions and coordination challenges among different market actors.²⁵

In addition, smaller institutions face particular challenges in contracting with and monitoring the activities of other actors in the ecosystem. Smaller banks’ practical ability to facilitate data access is often limited due to dependence on core processors and other vendors to implement technical solutions, limited technology and compliance staffing, and the fact that their small scale affects their degree of contracting and monitoring leverage relative to larger counterparties. The more intense due diligence and monitoring expectations become under third-party guidance frameworks, the more that some banks may be inclined to refrain from attempting to negotiate data sharing agreements or simply to shut off access altogether, notwithstanding the rights created by § 1033.²⁶ Particularly to the extent that smaller institutions may tend to focus on historically underserved populations, this pattern also may affect financial inclusion and the accrual of benefits and risks from authorized data access to different groups of consumers.

For all of these reasons, there are practical and conceptual disadvantages to managing risks associated with customer-directed data flows through the frameworks that the agencies developed primarily under the Bank Service Company Act to address how depository institutions structure their relationships with companies from which they obtain products and services and through which they conduct their own business activities.²⁷ Banks when dealing with vendors and business partners (and, in turn, those companies in dealing with their own subcontractors or business partners) have certain contractual, financial, and process tools for requiring and monitoring compliance that do not apply in situations involving a data aggregator that is acting at the direction of a consumer to transfer data to a competing financial services provider. While extremely large institutions may have enough scale to impose a proximation of this structure through data sharing contracts, it is difficult to create consistent standards for the entire ecosystem through such mechanisms. Indeed, stakeholders have voiced concerns that application of third-party frameworks may have actually slowed and complicated the adoption of data sharing agreements to implement safer technologies in individual cases, particularly by medium and smaller depository institutions.

C. The importance of moving to more direct, coordinated standards going forward

The rulemakings by the FTC and the CFPB have the potential to substantially improve the current state of the market by strengthening direct regulation and supervision of the broader customer-directed transfer ecosystem. For instance, the FTC is in the process of modernizing information security requirements for all non-bank financial institutions that handle customer directed data flows, including both data aggregators and their customers. The CFPB has also begun a rulemaking to implement § 1033 data access rights and clarify the obligations of entities that act on behalf of consumers in effectuating such transfers. The Bureau potentially could also use the proceedings both to clarify the application of various other federal consumer protection laws and to initiate supervision of larger data aggregators and additional non-bank financial services providers.

The FTC and CFPB rulemakings could narrow the focus and strengthen the incentives for industry standardization initiatives as well as providing a more efficient and effective alternative to relying primarily on duplicative and overlapping contractual monitoring mechanisms to manage risks in the market. We believe these effects could be further strengthened if prudential regulators consider providing guidance that is more specific to customer-directed data transfers instead of relying heavily on general third-party frameworks, coordinate closely with the FTC and CFPB on the substance of such guidance, and seek additional comment from stakeholders. Moving the ecosystem toward safer technologies and practices is potentially beneficial for all ecosystem participants, but the process must be carefully calibrated to avoid creating unintended consequences for smaller depository institutions, undermining consumers’ § 1033 rights, or frustrating that law’s potential broader benefits in stimulating competition and innovation.

For instance, rather than relying on individual institutions and examiners to adapt vendor management principles and frameworks to data transfers between competitors, the agencies could consider articulating more specific, tailored guidance concerning their expectations for banks in (1) handling customer-directed data transfers by entities that have not specifically identified themselves as data aggregators; (2) dealing with known data aggregators; and (3) negotiating and executing data sharing agreements with aggregators or direct data users, separately from situations in which aggregators are transferring data on behalf of depository institutions themselves in a traditional vendor posture. Such an approach would provide an opportunity to account for differences in resources and leverage between small and large depository institutions, the differences in the postures of both banks and aggregators outside of a traditional vendor relationship, and the effects of the FTC and CFPB rulemakings on market conditions. Similarly, such an approach could take into account the competing interests that may be at play in this ecosystem.

We recognize that timing considerations may complicate coordination efforts given that the FTC and CFPB have recently come under new leadership and are still evaluating the pace and scope of these rulemakings relative to other priorities. However, there may be ways for the agencies to continue to encourage better risk mitigation while other essential building blocks are being put in place. For example, while U.S. financial institutions have often chosen to implement tokenized access at or near the same time that they implement APIs, encouraging tokenization or other authentication initiatives that do not require consumers to provide their bank platform log-in credentials to aggregators could be a helpful intermediate step in its own right. While technical details are important for smooth, consistent execution, such options could help to reduce concerns about liability for unauthorized transactions without requiring smaller institutions to develop and implement APIs while questions about the accessibility of particular data elements are being resolved under § 1033.²⁸

Given the importance of these issues, the risk of unintended consequences for both smaller banks and consumers and small businesses, and the fact that the agencies’ request for comment on the Proposed Guidance did not ask any specific questions concerning customer-directed data transfers to independent financial services providers, we urge the agencies to seek additional comment before finalizing guidance that would apply to such transfers.²⁹ Thank you for the opportunity to comment on these important topics.

Download Pdf

Endnotes