§1033.321. Interface access.
12 C.F.R. § 1033.321
Denials related to risk management. A data provider does not violate the general obligation in § 1033.201(a)(1) by denying a consumer or third party access to all elements of the interface described in § 1033.301(a) if:
Granting access would be inconsistent with policies and procedures reasonably designed to comply with—
Safety and soundness standards of a prudential regulator, as defined at 12 U.S.C. 5481(24), of the data provider;
Information security standards required by section 501 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801; or
Other applicable laws and regulations regarding risk management; and
The denial is reasonable pursuant to paragraph (b) of this section.
Requirements for reasonable denials. A denial is reasonable pursuant to paragraph (a)(2) of this section if it is:
Directly related to a specific risk of which the data provider is aware, such as a failure of a third party to maintain adequate data security; and
Applied in a consistent and non-discriminatory manner.
Indicia bearing on reasonable denials. Indicia bearing on the reasonableness of a denial pursuant to paragraph (b) of this section include:
Whether the denial adheres to a consensus standard related to risk management;
Whether the denial proceeds from standardized risk management criteria that are available to the third party upon request; and
Whether the third party has a certification or other identification of fitness to access covered data that is issued or recognized by a recognized standard setter or the CFPB.
Conditions sufficient to justify a denial. Each of the following is a sufficient basis for denying access to a third party:
The third party does not present any evidence that its information security practices are adequate to safeguard the covered data; or
The third party does not make the following information available in both human-readable and machine-readable formats, and readily identifiable to members of the public, meaning the information must be at least as available as it would be on a public website:
Its legal name and, if applicable, any assumed name it is using while doing business with the consumer;
A link to its website;
Its Legal Entity Identifier (LEI) that is issued by—
A utility endorsed by the LEI Regulatory Oversight Committee, or
A utility endorsed or otherwise governed by the Global LEI Foundation (or any successor thereof) after the Global LEI Foundation assumes operational governance of the global LEI system; and
Contact information a data provider can use to inquire about the third party's information security and compliance practices.
Notes, amendments, and revision history
Authority
Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5533.
Source
Source: 89 FR 90989, Nov. 18, 2024, unless otherwise noted.