By Roy Urrico
On Oct. 22, 2024, the Consumer Financial Protection Bureau (CFPB) finalized a rule requiring credit unions and other financial service providers to unlock an individual’s personal financial data and transfer it to another provider at the consumer’s request for free. Under this rule, credit unions must take steps to make covered data readily available to membership.
Brad Blumberg, co-founder of Aster Key, an app empowering consumers to anonymize, organize, and encrypt their financial data on their mobile phones, discussed with Finopotamus how credit unions can make compliance with the CFPB rule easier and allow members to control their financial data while fostering trust.
By providing tools such as Aster Key that help customers manage their financial data more easily, credit unions and community banks can strengthen customer loyalty, according to Blumberg. He explained offering integration with third-party apps — such as budgeting tools or investment platforms — will keep accountholders engaged within the institution’s ecosystem, reducing churn.
Getting a Leg Up on the Rule
“I'm confident that the general movement is to let consumers empower their data more and get some control over who sees it, where it goes, how it can be used,” explained Blumberg. “If I have a Citibank, Capital One or Chase account, I can tell the large organizations to send my data wherever I want it to go. If I want to send it to something like what I am building on Aster Key, the rule is saying that the lender has to send your data, wherever you want and cannot put a bunch of barriers or fees in front of that. What that does, for me as a consumer, is it lets me control my data.”
When it comes to the new CFPB rule, assuming the incoming administration goes ahead with it as planned, the earliest credit unions need to comply would be by April 2026 for those with at least $250 billion in assets. The rest of the credit union compliance dates are staggered with those at least $10 billion but less than $250 billion set for April 2027; at least $3 billion but less than $10 billion set for April 1, 2028; at least $1.5 billion but less than $3 billion, set for April 2029; and more than $850 million but less than $1.5 billion, set for April 2030. Financial depository institutions with less than $850 million in assets are exempt from the final rule.
“While the new rule imposes additional responsibilities on credit unions and community banks, it also creates significant opportunities to enhance customer experience, offer personalized services, and remain competitive in an evolving financial landscape,” Blumberg told Finopotamus. “With the right tools and strategies in place, these institutions can leverage consumer data to foster deeper relationships, improve security, and drive growth.”
Credit unions that quickly adapt to this rule can gain a competitive edge; Blumberg added. Financial institutions that offer seamless data sharing with third-party services will stand out in a crowded market, attracting tech-savvy consumers and fintech partnerships that can expand their accountholder base.
“They do not have to give (the data) out yet, but they can certainly use tools that let (the data) get aggregated in a product that is secure and create products. I see it is a good innovation thing,” suggested Blumberg.
For lenders, such as credit unions, Aster Key, according to Blumberg, provides a better member experience, which leads to less online drop-offs. Members/consumers also feel secure sharing financial details since trust, security, and privacy become a competitive advantage.
Protecting the Data
“The processes of a financial system are so complicated. That is why everyone is getting hacked,” said Blumberg. He noted that in many cases, transactions such as loans pass personal and financial data through multiple systems. “Think about a mortgage application going into a loan origination system, going to marketers, going to title companies, going to servicers, going to (Fannie Mae or Freddie Mac). It is going to many places. And nobody can tell you where your data is or where it sits. This (CFPB) reg kind of starts memorializing that. We are going to start letting people control their data if they ask for it.”
The Aster Key product is the first attempt to empower consumers, suggested Blumberg. “I decided that one big problem was everybody commingles your personal and your financial data, meaning your name, your social, your email, your PII (personally identifiable information) right next to your income, assets, debt. And they put it in a database, these gigantic databases. It is like a honeypot for hackers.”
The goal of the Aster Key product, Blumberg added, is the freeing of personal and financial information from those large databases. “Where could we put it? And the safest device everybody has is their phone. Use this open banking data, take the personal (data), separate and encrypt, take the financial (data), encrypt it somewhere else, and get it on your phone. And I could secure your phone,” said Blumberg. “The next trick is convincing lenders to create a channel where they can use that data, start their loan anonymously, maybe send some financials without sending their name.”
Aster Key started by lining up just pure lenders, not banks or credit unions. “I started last year with Independent Mortgage Bankers (IMB) lenders, where people could come and just make a pure financial statement, with verified or unverified data. And I had like 10,000 people do that,” Blumberg said, adding that he is the early stages of pitching Aster Key to credit unions.
From Real Estate to Aster Key
Blumberg co-founded Aster Key in 2022 as a way for consumers to create an ultra-secure financial statement, generate a proof of funds letter, or anonymously initiate a loan with participating lenders.
Blumberg and his brother Eric founded Smarter Agent, a mobile app which gained widespread adoption in the real estate space. The real estate brokerage franchisor Keller Williams acquired Smarter Agent in 2018.
Blumberg’s light bulb moment for Aster Key came after numerous letters from various institutions informing him of compromises to his financial data. “I was just curious. Why can no one hold onto my data?”
Blumberg said he realized the obvious, “We are all renters of our own financial personas. We do not necessarily own that when it is packaged. The credit bureaus own your financial persona. Data brokers sell your financial persona. So, when I see this (CFPB) rule, now I start to see regulation coming down saying, ‘Okay, Brad can have a little more control over his data, can at least as a baby step, get it to where I wanted to go.’ There are lots of startups like mine where we can take that data in, we can secure it for you, and we can start letting you permission it where you want it to go.”
Getting Started
While not a lender, Aster Key enables consumers to start loans, such as mortgages, anonymously. It is simple to get started, explained Blumberg. First, a member or consumer generates their financial statement. This takes a few minutes as verified data from existing banking and payroll accounts. When an individual wants a loan they can share the data with participating lenders directly, bypassing the initial online application.
Importantly, Aster Key does not store the consumer’s financial data on its servers; rather, the data resides solely on the consumer’s mobile device.
Aster Key allows participating lenders to approve loans and services based on receiving anonymous financial profiles via the Aster Key application programming interface (API). In some instances, this data can be sent into a loan origination system (LOS) encrypted. In a future release of the product, Blumberg explained loan applicants can get pre-approved anonymously. Then they can share their real-world identities with the lender, through the app, to complete the transaction.