Open Banking

Also called CFPB 1033, Section 1033, personal financial data rights, bank data sharing

The rules governing whether consumers can share their bank data with third parties. As of 2026 the US rule is enjoined and being rewritten.

What it is

Open banking is the principle that a consumer owns their financial data and can authorize third parties — budgeting apps, lenders, payment providers, accounting software — to access it. In the US, the legal foundation is Section 1033 of the Dodd-Frank Act, implemented through a CFPB rule on personal financial data rights. The status as of August 2026 is genuinely unsettled and merchants should not be told otherwise. The final rule was issued October 22, 2024, published November 18, 2024 and took effect January 17, 2025. A federal court in Kentucky then enjoined the CFPB from enforcing it, finding potential statutory authority violations, and the appeal remains stayed while the Bureau revises. The CFPB issued a Personal Financial Data Rights Reconsideration ANPR in August 2025 seeking input on the definition of "representative," fee assessment, and data security and privacy threat analysis. As of August 2026 the reconsideration proposal sits at the White House for review with language not public. The central fight is data-access fees: whether the 2024 rule's blanket prohibition on banks charging for data access survives, or whether banks may charge after some number of free requests. Reporting suggests the fundamental architecture of the 2024 framework could survive even if the fee prohibition doesn't.

Why it matters to your business

Open banking is the plumbing under pay by bank, cash-flow underwriting, instant account verification for ACH, and the automatic bank feeds in your accounting software. If the rules change, all of those get more expensive or more limited. The practical posture: use bank-connected tools where they save you money today, and don't sign a long agreement premised on those economics lasting. The honest sentence to a customer is "cheaper than cards today, and we'll re-price if the rules change."

Where it gets contested

This is a fight between banks and fintechs, with consumers and merchants as the stated beneficiaries of both positions. Banks argue they built and secure the data infrastructure, bear the fraud and liability risk when third parties mishandle credentials, and should be able to recover costs. Fintechs and aggregators argue that charging for data access converts a consumer right into a paid service and entrenches incumbents by pricing out smaller competitors. Both have real arguments. The security concern is not manufactured — screen-scraping and credential-sharing genuinely created risk, and the move to tokenized API access was driven by it. The competition concern is equally real: if access fees are set by the party with the least incentive to enable competition, the fees will be set high. For a merchant, the consequence is straightforward and worth stating plainly. If aggregators start paying banks for data, pay-by-bank's cost advantage over debit compresses. Anyone selling you a bank-payment product on the promise that it will always cost pennies is making a promise the regulatory record does not currently support.

How to check it yourself

If a provider is pitching you on bank payments or bank-data-driven underwriting, ask what happens to your pricing if data-access fees are permitted. If they haven't thought about it, they haven't read the regulatory record. If they promise the price can't change, get it in writing and watch them decline.

Receipts

Claims above that are checkable, with where to check them. Published so you do not have to take anyone's word for it.

The CFPB's personal financial data rights final rule was issued October 22, 2024, published November 18, 2024 and effective January 17, 2025
consumerfinance.gov ↗
A federal court in Kentucky enjoined the CFPB from enforcing the rule and the appeal remains stayed while the Bureau revises; as of August 2026 the reconsideration proposal is at the White House with language not public, and data-access fees are the central issue
pymnts.com ↗
The CFPB issued a Personal Financial Data Rights Reconsideration ANPR in August 2025 seeking input on the definition of representative, fee assessment, and data security and privacy threat analysis
consumerfinance.gov ↗