Congress moves to restore CFPB data-security rule for financial firms
S.J.Res. 164 — A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information". · Filed by Jacky Rosen (D-NV) · Introduced Apr 13, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This resolution uses the Congressional Review Act to block a CFPB action that withdrew a 2022 data-protection rule. If passed, it would restore the 2022 rule requiring financial companies to maintain adequate data security and protect sensitive consumer information from breaches.
Why we flagged it
The bill's sole function is to invoke the Congressional Review Act to disapprove a CFPB withdrawal, thereby restoring a 2022 rule mandating data-security standards for financial institutions. It is a procedural consumer-protection measure, not a substantive new rule.
What the text implies
- If passed, this resolution would require financial institutions to comply with the 2022 CFPB circular's data-security standards, potentially increasing compliance costs for banks and fintech companies.
- The resolution does not create new law; it merely prevents the CFPB from withdrawing an existing rule. Its fate depends on whether it reaches a floor vote and survives a presidential veto.
- The 2022 circular (87 Fed. Reg. 54346) and the CFPB's withdrawal notice (90 Fed. Reg. 20084, May 12, 2025) are the operative documents; this resolution's effect is entirely dependent on their content, which is not reproduced in this text.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Restoring the 2022 data-protection rule strengthens consumer safeguards against data breaches and inadequate security practices by financial institutions. Ordinary people gain enforceable protections requiring companies to maintain reasonable security standards for sensitive financial information.
Named in the bill
Bureau of Consumer Financial Protection (CFPB), U.S. Senate, Senator Jacky Rosen (sponsor), Committee on Banking, Housing, and Urban Affairs
Where it stands
- Apr 13, 2026 — Introduced · Congress.gov: “Introduced in Senate”
- Apr 13, 2026 — Referred to Senate Committee on Banking, Housing, and Urban Affairs · Congress.gov: “Read twice and referred to the Committee on Banking, Housing, and Urban Affairs”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,498 characters) on Apr 16, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Congress moves to restore CFPB data-security rule for financial firms” QuorumCivic. https://share.quorumcivic.app/bill/119/sjres164 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.