12 CFR § 1033.401 - Third party authorization; general.
---
identifier: "/us/cfr/t12/s1033.401"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "12 CFR § 1033.401 - Third party authorization; general."
title_number: 12
title_name: "Banks and Banking"
section_number: "1033.401"
section_name: "Third party authorization; general."
chapter_name: "CONSUMER FINANCIAL PROTECTION BUREAU"
part_number: "1033"
part_name: "PERSONAL FINANCIAL DATA RIGHTS"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5533."
regulatory_source: "89 FR 90989, Nov. 18, 2024, unless otherwise noted."
cfr_part: "1033"
---
# 1033.401 Third party authorization; general.
To become an authorized third party, the third party must seek access to covered data from a data provider on behalf of a consumer to provide a product or service the consumer requested and:
(a) Provide the consumer with an authorization disclosure as described in § 1033.411;
(b) Provide a statement to the consumer in the authorization disclosure, as provided in § 1033.411(b)(5), certifying that the third party agrees to the obligations described in § 1033.421; and
(c) Obtain the consumer's express informed consent to access covered data on behalf of the consumer by obtaining an authorization disclosure that is signed by the consumer electronically or in writing.