S T A T E O F N E W Y O R K
________________________________________________________________________
10640
I N A S S E M B L Y
March 13, 2026
___________
Introduced by M. of A. VANEL -- read once and referred to the Committee
on Banks
AN ACT to amend the banking law, in relation to the accessibility of
consumer financial data and the prohibition of fees for the transfer
of such data to authorized parties
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Short title. This act shall be known and may be cited as
the "New York financial data rights act".
§ 2. The banking law is amended by adding a new article 14-C to read
as follows:
ARTICLE 14-C
CONSUMER AND SMALL BUSINESS FINANCIAL DATA RIGHTS
SECTION 800. DEFINITIONS.
801. CONSUMER AND SMALL BUSINESS RIGHT TO DATA PORTABILITY.
802. PROHIBITION OF FEES FOR DATA ACCESS.
803. AUTHORIZED REPRESENTATIVE OBLIGATIONS.
804. SECURITY STANDARDS.
805. ENFORCEMENT AND PENALTIES.
§ 800. DEFINITIONS. AS USED IN THIS ARTICLE, THE FOLLOWING TERMS SHALL
HAVE THE FOLLOWING MEANINGS:
1."AUTHORIZED REPRESENTATIVE" MEANS ANY PERSON OR ENTITY, OTHER THAN
THE FINANCIAL INSTITUTION HOLDING THE DATA, THAT SEEKS TO ACCESS COVERED
DATA WITH THE CONSUMER'S OR SMALL BUSINESS'S CONSENT PURSUANT TO SECTION
EIGHT HUNDRED THREE OF THIS ARTICLE.
2. "CONSUMER" MEANS AN INDIVIDUAL WHO RESIDES IN THE STATE OF NEW
YORK.
3. "FINANCIAL INSTITUTION" MEANS:
(A) A BANKING ORGANIZATION AS DEFINED IN SUBDIVISION ELEVEN OF SECTION
TWO OF THIS CHAPTER;
(B) ANY OUT-OF-STATE STATE BANK AS DEFINED IN SUBDIVISION TWO OF
SECTION TWO HUNDRED TWENTY-TWO OF THIS CHAPTER THAT MAINTAINS A FINAN-
CIAL PRODUCT OR SERVICE FOR A RESIDENT IN THIS STATE;
(C) ANY PERSON OR ENTITY ACTING AS A CUSTODIAN FOR FINANCIAL ASSETS AS
DESCRIBED IN SECTION 11-1.9 OF THE ESTATES, POWERS AND TRUSTS LAW; AND
(D) ANY OTHER DATA PROVIDER REGULATED BY THE DEPARTMENT THAT MAINTAINS
A FINANCIAL PRODUCT OR SERVICE FOR A RESIDENT OF THIS STATE.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD15201-02-6
A. 10640 2
4."COVERED DATA" MEANS THE FOLLOWING INFORMATION RELATING TO A CONSUM-
ER OR SMALL BUSINESS IN THE CONTROL OR POSSESSION OF A FINANCIAL INSTI-
TUTION:
(A) TRANSACTION INFORMATION, INCLUDING AMOUNTS, DATES, PAYMENT TYPES,
PENDING OR AUTHORIZED STATUS, AND PAYEE OR MERCHANT NAMES, FOR AT LEAST
TWENTY-FOUR MONTHS PRECEDING THE REQUEST;
(B) ACCOUNT BALANCE INFORMATION;
(C) INFORMATION TO INITIATE PAYMENT TO OR FROM A COVERED ACCOUNT,
INCLUDING ACCOUNT NUMBERS;
(D) TERMS AND CONDITIONS OF THE CONSUMER OR SMALL BUSINESS, FINANCIAL
PRODUCT OR SERVICE, INCLUDING INTEREST RATES, CREDIT LIMITS, OVERDRAFT
COVERAGE, REWARDS, AND FEE SCHEDULES;
(E) UPCOMING BILL INFORMATION, INCLUDING AMOUNTS AND DUE DATES; AND
(F) ACCOUNT AND IDENTITY VERIFICATION INFORMATION, INCLUDING NAME,
ADDRESS, AND CONTACT INFORMATION.
5. "EXEMPT DATA" MEANS INFORMATION THAT A FINANCIAL INSTITUTION IS NOT
REQUIRED TO MAKE AVAILABLE, SUBJECT TO THE REQUIREMENTS IN SUBDIVISION
TWO OF SECTION EIGHT HUNDRED ONE OF THIS ARTICLE, CONSISTING OF:
(A) ANY CONFIDENTIAL COMMERCIAL INFORMATION, INCLUDING PROPRIETARY
ALGORITHMS USED TO DERIVE CREDIT OR RISK SCORES;
(B) INFORMATION COLLECTED SOLELY FOR THE PURPOSE OF PREVENTING FRAUD
OR MONEY LAUNDERING;
(C) INFORMATION REQUIRED TO BE KEPT CONFIDENTIAL BY ANY OTHER
PROVISION OF LAW; AND
(D) ANY INFORMATION THE FINANCIAL INSTITUTION CANNOT RETRIEVE IN THE
ORDINARY COURSE OF BUSINESS.
§ 801. CONSUMER AND SMALL BUSINESS RIGHT TO DATA PORTABILITY. 1. UPON
THE REQUEST OF A CONSUMER, SMALL BUSINESS, OR THEIR AUTHORIZED REPRESEN-
TATIVE, A FINANCIAL INSTITUTION SHALL MAKE AVAILABLE ALL COVERED DATA
THEY HAVE REQUESTED IN A SECURE, ELECTRONIC, AND MACHINE-READABLE FORMAT
BY WHICH THE CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE CAN
RETRIEVE, RETAIN, AND TRANSFER SUCH DATA FOR PROCESSING INTO A SEPARATE
INFORMATION SYSTEM.
2. FINANCIAL INSTITUTIONS SHALL MAINTAIN A DEVELOPER INTERFACE, SUCH
AS A STANDARDIZED APPLICATION PROGRAMMING INTERFACE, TO RECEIVE AND
RESPOND TO REQUESTS FOR ACCESS TO COVERED DATA AS SET FORTH IN SUBDIVI-
SION ONE OF THIS SECTION.
3.(A) A FINANCIAL INSTITUTION SHALL NOT ENGAGE IN OR BE A PARTY TO ANY
UNREASONABLE DENIAL OR IMPAIRMENT OF ACCESS BY A CONSUMER, A SMALL BUSI-
NESS, OR AUTHORIZED REPRESENTATIVE, INCLUDING WITHOUT LIMITATION ANY
DENIAL OR IMPAIRMENT RELATED TO RISK OR SECURITY STANDARDS.
(B) UNREASONABLE DENIAL OR IMPAIRMENT UNDER PARAGRAPH (A) OF THIS
SUBDIVISION INCLUDES CONDUCT THAT:
(I) IS LIKELY TO EVADE OR UNREASONABLY DELAY COMPLIANCE WITH, OR
INTERFERE WITH, PREVENT, OR MATERIALLY DISCOURAGE ACCESS OF COVERED DATA
BY A CONSUMER, A SMALL BUSINESS, OR AN AUTHORIZED REPRESENTATIVE;
(II) DEGRADES, IMPAIRS, OR CREATES BARRIERS THAT WOULD RESTRICT OR
SYSTEMATICALLY IMPEDE ACCESS TO COVERED DATA BY A CONSUMER, A SMALL
BUSINESS OR AUTHORIZED REPRESENTATIVE; OR
(III) IS APPLIED TO A CONSUMER, A SMALL BUSINESS, OR AUTHORIZED REPRE-
SENTATIVE IN A DISCRIMINATORY MANNER.
(C) A FINANCIAL INSTITUTION IS NOT ENGAGED IN OR A PARTY TO AN UNREA-
SONABLE DENIAL OF ACCESS BY AN AUTHORIZED REPRESENTATIVE BY DENYING
ACCESS IF THE DENIAL:
(I) IS NECESSARY TO ENSURE COMPLIANCE WITH SPECIFIC SAFETY AND SOUND-
NESS OBLIGATIONS OF THE FINANCIAL INSTITUTION'S PRUDENTIAL REGULATOR,
A. 10640 3
AND IS BASED ON STANDARDIZED SAFETY AND SOUNDNESS CRITERIA AVAILABLE TO
AUTHORIZED REPRESENTATIVES UPON REQUEST; OR
(II) TO COMPLY WITH APPLICABLE LAW.
(D) A FINANCIAL INSTITUTION SHALL BEAR THE BURDEN OF DEMONSTRATING
THAT A DENIAL OF ACCESS UNDER PARAGRAPH (C) OF THIS SUBDIVISION IS
REASONABLE BASED ON A SPECIFIC, KNOWN RISK LIKELY TO CAUSE SUBSTANTIAL
INJURY TO CONSUMERS OR SMALL BUSINESSES, AND THAT SUCH DENIAL IS APPLIED
CONSISTENTLY TO AUTHORIZED REPRESENTATIVES FACING THE SAME OR MATERIALLY
SIMILAR RISK.
(E) A FINANCIAL INSTITUTION SHALL PROVIDE PROMPT NOTICE OF ANY DENIAL
OF ACCESS TO A CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE.
§ 802. PROHIBITION OF FEES FOR DATA ACCESS. NO FINANCIAL INSTITUTION
SHALL DIRECTLY OR INDIRECTLY IMPOSE A FEE, ASSESSMENT, OR ANY OTHER
CHARGE TO A CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE IN
CONNECTION WITH RECEIVING REQUESTS FOR OR MAKING AVAILABLE COVERED DATA
AS REQUIRED BY SECTION EIGHT HUNDRED ONE OF THIS ARTICLE. THIS PROHIBI-
TION APPLIES TO THE ESTABLISHMENT, MAINTENANCE, AND USAGE OF THE DEVEL-
OPER INTERFACE.
§ 803. AUTHORIZED REPRESENTATIVE OBLIGATIONS. 1. AN AUTHORIZED REPRE-
SENTATIVE MUST OBTAIN EXPRESS, INFORMED CONSENT FROM A CONSUMER OR SMALL
BUSINESS IN ORDER TO REQUEST ACCESS TO COVERED DATA ON THE CONSUMER'S OR
SMALL BUSINESS'S BEHALF.
2. AUTHORIZED REPRESENTATIVES SHALL PROVIDE A SIMPLE AND TRANSPARENT
MECHANISM FOR A CONSUMER OR SMALL BUSINESS TO VIEW AND REVOKE ANY
AUTHORIZATIONS FOR DATA SHARING AT ANY TIME.
3. AN AUTHORIZED REPRESENTATIVE MUST LIMIT ITS COLLECTION, USE, AND
RETENTION OF COVERED DATA TO WHAT IS REASONABLY NECESSARY TO PROVIDE THE
CONSUMER'S OR SMALL BUSINESS'S REQUESTED PRODUCT OR SERVICE.
4. AN AUTHORIZED REPRESENTATIVE MUST APPLY TO ITS SYSTEMS FOR THE
COLLECTION, USE, AND RETENTION OF COVERED DATA AN INFORMATION SECURITY
PROGRAM THAT SATISFIES THE APPLICABLE RULES ISSUED PURSUANT TO SECTION
FIVE HUNDRED ONE OF THE GRAMM-LEACH-BLILEY ACT (15 U.S.C. 6801) OR, IF
THE AUTHORIZED REPRESENTATIVE IS NOT SUBJECT TO SECTION FIVE HUNDRED ONE
OF THE GRAMM-LEACH-BLILEY ACT, THE THIRD PARTY SHALL APPLY TO ITS
SYSTEMS FOR THE COLLECTION, USE, AND RETENTION OF COVERED DATA THE
INFORMATION SECURITY PROGRAM REQUIRED BY THE FEDERAL TRADE COMMISSION'S
STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION, 16 CFR PART 314.
§ 804. SECURITY STANDARDS. FOR THE PURPOSE OF AUTHENTICATING A CONSUM-
ER'S OR SMALL BUSINESS'S REQUEST PURSUANT TO SUBDIVISION ONE OF SECTION
EIGHT HUNDRED ONE OF THIS ARTICLE, FINANCIAL INSTITUTIONS SHALL USE, AT
A MINIMUM, THE SAME PROCESSES AND INFORMATION THAT THEY RELY UPON TO
AUTHENTICATE A CONSUMER OR SMALL BUSINESS FOR THEIR ONLINE BANKING
PORTALS.
§ 805. ENFORCEMENT AND PENALTIES. 1. THE SUPERINTENDENT OF FINANCIAL
SERVICES SHALL HAVE THE POWER TO ENFORCE THE PROVISIONS OF THIS ARTICLE.
2. ANY FINANCIAL INSTITUTION FOUND TO BE IN VIOLATION OF THIS ARTICLE,
INCLUDING THE IMPROPER CHARGING OF FEES OR THE RESTRICTIONS SET FORTH IN
SUBDIVISION THREE OF SECTION EIGHT HUNDRED ONE OF THIS ARTICLE, SHALL BE
SUBJECT TO A CIVIL PENALTY OF NOT MORE THAN TEN THOUSAND DOLLARS PER
VIOLATION.
§ 3. This act shall take effect on the sixtieth day after it shall
have become a law.