JPMorgan Chase announced this week that financial middlemen are increasingly taking advantage of a loophole that President Donald Trump’s administration has deemed “unlawful” to access consumers’ private data, teeing up a potential conflict as the Consumer Financial Protection Bureau plans to reform the sector.

Fintechs — companies that transfer financial data between checking accounts and finance apps — access private bank information multiple times per day, usually without being initiated by consumers for transactions, CNBC reported. Middlemen can still access the data even when apps are not in use or are deleted.

These middlemen are allowed to access this data because of a Biden-era “open banking” rule. Companies ostensibly use the data to improve products and prevent fraud, but also harvest it for sale. Consumers agree to this kind of data disclosure, but the details are buried in the “Terms and Conditions” of app agreements, CNBC said.

A group of banks filed suit against the CFPB in October 2024, saying it overstepped its authority and the new rule would increase the risk of fraud.

Now, the CFPB plans to substantially reform the rule. Initially, the agency agreed with the lawsuit, but it changed course after JPMorgan announced plans to charge middlemen for accessing consumer data, Bloomberg reported.

The CFPB petitioned Tuesday to stay the lawsuit, drawing praise from fintechs and criticism from the banking industry.

“In light of recent events in the marketplace, the Bureau has now decided to initiate a new rulemaking to reconsider the Rule with a view to substantially revising it and providing a robust justification,” the CFPB said in the filing. “The Bureau seeks to comprehensively reexamine this matter alongside stakeholders and the broader public to come up with a well-reasoned approach to these complex issues that aligns with the policy preferences of new leadership and addresses the defects in the initial Rule.”

The CFPB had initially said “the Rule is unlawful and should be set aside,” agreeing with banks that the original rule overstepped the bureau’s authority. Concerns from fintechs over JPMorgan’s announcement convinced the bureau to rework the rule instead.

JPMorgan said charging fintechs for accessing data would offset the costs of “unnecessary data requests.” The revenue would help the bank maintain data request infrastructure and deal with increased fraud claims.

The proposal drew criticism from fintechs, which say it could shut down tech companies. One fintech company, Plaid, could incur costs of $300 million per year based on current fee proposals. In June, Plaid made 1.08 billion requests for data from JPMorgan, only 6% of which were initiated by customers, CNBC said.

JPMorgan received 1.89 billion total data requests in the same month, with a total of 13% requested by customers.

Both White AI and crypto czar David Sacks and Donald Trump Jr. criticized JPMorgan’s plan on social media. Sacks called the rule “concerning.” A CFPB official also said the fees should be reviewed, Bloomberg reported.

The CFPB has not said what its new rule will look like, but the agency will release an advanced notice of proposed rulemaking within three weeks, the filing said. The notice will serve as a starting point for further changes.