---
kind: "section"
citation: "12 C.F.R. § 1033.321"
title: "12"
number: "1033.321"
heading: "Interface access."
url: "https://uscodex.org/cfr/12/1033.321"
---

# §1033.321. Interface access.

- (a) **Denials related to risk management.** A data provider does not violate the general obligation in [§ 1033.201(a)(1)](/cfr/12/1033.201.md?p=a-1) by denying a consumer or third party access to all elements of the interface described in [§ 1033.301(a)](/cfr/12/1033.301.md?p=a) if:
  - (1) **Granting access would be inconsistent with policies and procedures reasonably designed to comply with—**
    - (i) Safety and soundness standards of a prudential regulator, as defined at [12 U.S.C. 5481(24)](/usc/12/5481.md?p=24), of the data provider;
    - (ii) Information security standards required by [section 501](/cfr/12/501.md) of the Gramm-Leach-Bliley Act, [15 U.S.C. 6801](/usc/15/6801.md); or
    - (iii) Other applicable laws and regulations regarding risk management; and
  - (2) **The denial is reasonable pursuant to paragraph (b) of this section.**
- (b) **Requirements for reasonable denials.** A denial is reasonable pursuant to [paragraph (a)(2)](#a-2) of this section if it is:
  - (1) Directly related to a specific risk of which the data provider is aware, such as a failure of a third party to maintain adequate data security; and
  - (2) **Applied in a consistent and non-discriminatory manner.**
- (c) **Indicia bearing on reasonable denials.** Indicia bearing on the reasonableness of a denial pursuant to [paragraph (b)](#b) of this section include:
  - (1) Whether the denial adheres to a consensus standard related to risk management;
  - (2) Whether the denial proceeds from standardized risk management criteria that are available to the third party upon request; and
  - (3) Whether the third party has a certification or other identification of fitness to access covered data that is issued or recognized by a recognized standard setter or the CFPB.
- (d) **Conditions sufficient to justify a denial.** Each of the following is a sufficient basis for denying access to a third party:
  - (1) The third party does not present any evidence that its information security practices are adequate to safeguard the covered data; or
  - (2) The third party does not make the following information available in both human-readable and machine-readable formats, and readily identifiable to members of the public, meaning the information must be at least as available as it would be on a public website:
    - (i) Its legal name and, if applicable, any assumed name it is using while doing business with the consumer;
    - (ii) A link to its website;
    - (iii) **Its Legal Entity Identifier (LEI) that is issued by—**
      - (A) A utility endorsed by the LEI Regulatory Oversight Committee, or
      - (B) A utility endorsed or otherwise governed by the Global LEI Foundation (or any successor thereof) after the Global LEI Foundation assumes operational governance of the global LEI system; and
    - (iv) Contact information a data provider can use to inquire about the third party's information security and compliance practices.

## Notes

### Authority

Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5533.

### Source

Source: 89 FR 90989, Nov. 18, 2024, unless otherwise noted.