The US Financial Services Regulatory Agenda: Where Boards Should Be Paying Attention

Three regulatory strands are converging on US financial services at the same time, and boards should treat them as one agenda rather than three separate compliance projects. The Basel III endgame proposal, the CFPB's Section 1033 personal financial data rights rule finalized in October 2024, and the federal payment-stablecoin framework that emerged from the 2025 legislative cycle do not, individually, look like the same problem. Together, they redraw the boundary between banks, non-banks, and the plumbing that connects them.

The Basel III endgame reproposal, in the shape it has taken through 2025 and into 2026, raises capital requirements for large banks and, more importantly, changes the relative economics of loan categories the largest US banks previously treated as commodity balance-sheet trades. Whether the final rule lands closer to the original proposal or the reproposed version, the direction of travel is clear: capital-intensive lending to less-well-rated corporate borrowers becomes more expensive to hold on a large bank's balance sheet. That capacity does not disappear; it moves. Private credit funds and regional banks are the two most obvious beneficiaries, and boards at large banks should already be asking what their long-run competitive position looks like in a market where they are structurally the more expensive lender for certain segments.

Section 1033 is the more understated story but arguably the more structural one. By requiring banks to make consumer financial data available to authorized third parties in a standardized way, the CFPB has given fintechs and non-bank aggregators a durable right that used to depend on the goodwill of screen-scraping arrangements. The implementation timelines run through the second half of the decade and vary by institution size, but the effect on retail banking is the same everywhere: switching costs fall, and the value of being the primary account of record erodes. Retail banking strategies still built on account inertia are being quietly overtaken by strategies built on being the best interface, wherever the underlying accounts happen to live.

The payment-stablecoin framework introduces a third dimension. For the first time, there is federal-level regulatory clarity about which entities can issue dollar-denominated payment stablecoins, what they must hold in reserve, and how they interact with the traditional banking system. The near-term commercial implication is a real payments channel that settles faster and cheaper than card rails for a subset of merchant and B2B use cases. The medium-term implication is that treasury and corporate-payments strategies designed around the ACH-plus-card duopoly need a new option on the drawing board.

For a bank general counsel or CFO, the useful synthesis is that these three rules together move value away from balance-sheet scale and toward data access, interface quality, and payment optionality. Institutions that treat each as a discrete compliance obligation will comply and lose ground. Institutions that treat them as a strategic re-pricing of what a bank is for will make different investment choices. The question we would put to a board audit committee is whether the current three-year plan can be defended in a world where Basel III endgame is fully implemented, 1033 has made data portable, and stablecoin rails are handling a meaningful share of B2B payments. If it cannot, the plan is optimistic about the past.