As part of Invela's broader effort to encourage greater collaboration among regulators to align open finance and risk management, Invela submitted a formal comment letter responding to the NCUA's proposed updates to its Guidelines for Safeguarding Member Information and its Guidance on Response Programs for Unauthorized Access. The proposals acknowledge something practitioners have known for years: the line between regulatory obligations and non-binding guidance has become blurred – and that blur has consequences.
Third-party risk management (TPRM) is essential to a safe financial system. But when TPRM frameworks designed for vendor relationships are applied wholesale to open finance data access, the result is predictable: confusion, friction, and unnecessary barriers to innovation.
We've seen this firsthand. Invela's team has spent decades building fintechs, navigating supervisory expectations, and helping institutions unlock consumer-permissioned data. The mismatch between TPRM and open finance is persistent – and avoidable.
The NCUA rightly notes that guidance is not regulation. That distinction matters, especially when statutory obligations like Section 1033 of the Dodd-Frank Act require institutions to enable consumer-directed data access.
To avoid conflicting interpretations, prudential regulators and the CFPB should issue a unified interagency statement clarifying: that TPRM guidance does not override statutory obligations; that open finance risk management is distinct from TPRM; and that institutions can confidently support consumer-permissioned data access without fear of misapplied supervisory expectations.
The OCC's 2020-10 FAQs – particularly FAQ 4 – offer a strong foundation. The 2019 Interagency Statement on Alternative Data shows how coordinated guidance can unlock innovation. It's time for a similar moment for open finance.
Open finance is accelerating. Institutions want clarity. Consumers expect access. And regulators have an opportunity to modernize the supervisory framework in a way that supports innovation while maintaining safety and soundness.
Invela welcomes the NCUA's leadership and looks forward to continued engagement as the agency considers next steps.
-p-2000.jpg)
