Open Banking

Quick Definition

Open banking is a financial services model in which banks share customer account data with third-party providers through secure application programming interfaces (APIs), with explicit customer consent. This enables consumers to use fintech apps, aggregators, and payment services that connect directly to their bank accounts without sharing passwords.

What It Means

Before open banking, your financial data was locked inside each bank's proprietary systems. Apps like Mint could only see your Wells Fargo data by having you hand over your Wells Fargo password, a practice known as "screen scraping" that was insecure and technically violated bank terms of service.

Open banking replaces this with standardized, API-based data sharing. You authorize specific apps to access specific data, and the bank provides it in a structured format without credential sharing. A nimble fintech can build better budgeting tools, loan comparison features, or payment experiences by accessing the same data the bank holds, with your permission.

How Open Banking Works

1. You open a fintech app (budgeting tool, loan application, payment service)
2. You authorize the app to access specific data from your bank (for example, 12 months of transactions)
3. The fintech sends a request to your bank's open banking API with your authorization token
4. Your bank returns the requested data in a standardized format
5. The fintech displays insights, makes recommendations, or initiates a payment
6. You can revoke access at any time through your bank's settings

The key principle: you control your data. Third parties only see what you authorize, for as long as you permit.

Open Banking Use Cases

Global Open Banking Regulation

Open banking has been mandated in some markets and is voluntary or market-driven in others:

The US Section 1033 Saga: 2026 Update

The US Consumer Financial Protection Bureau finalized the Personal Financial Data Rights rule implementing Section 1033 of the Dodd-Frank Act in October 2024. The rule required banks to share consumer financial data upon request with authorized third parties through secure APIs, with phased compliance deadlines from April 2026 to April 2030.

The rule never took effect. In 2025, the Bank Policy Institute, Kentucky Bankers Association, and Forcht Bank sued in the Eastern District of Kentucky. Following a change in CFPB leadership, the Bureau reversed course and told the court it now considered its own rule unlawful. The court granted a preliminary injunction in early 2026, barring the CFPB from enforcing the rule.

As of July 2026, the CFPB is undertaking a new rulemaking to "substantially revise" the framework. Key open issues include:

• Whether data providers may charge fees for data access (the original rule banned fees; JPMorgan and Plaid struck a paid data-access deal in September 2025)
• Who qualifies as an "authorized third party" and what obligations they face
• How data security and privacy are enforced
• Revised compliance timelines

The April 2026 Tier 1 compliance deadline (for depositories with $250B+ in assets) passed without becoming a binding enforcement trigger. The rule remains codified in the Code of Federal Regulations but is effectively unenforceable while the injunction is active.

Meanwhile, states are beginning to consider their own data-sharing frameworks to fill the federal void. The market is converging on the Financial Data Exchange (FDX) standard, and companies like Plaid are transitioning from screen scraping to direct API partnerships with banks.

Open Banking vs. Screen Scraping

Key Open Banking Data Types

The Open Banking Ecosystem: Who Benefits

Open Finance: The Next Evolution

Open banking (bank accounts) is evolving toward open finance (all financial data):

The UK and Australia are already moving toward open finance frameworks. The EU's FIDA regulation (proposed 2023) would extend data-sharing requirements to investment accounts and insurance products.

Key Points to Remember

• Open banking enables secure, API-based sharing of financial data with third-party apps, with customer consent
• It replaces insecure screen scraping (sharing bank passwords) with standardized token-based access
• The UK and EU mandated open banking through PSD2; the US CFPB Section 1033 rule is enjoined and under revision as of mid-2026
• The CFPB is rewriting the rule, with key disputes over whether banks can charge fees for data access
• States may step in with their own data-sharing frameworks if federal regulation remains stalled
• The market is converging on the FDX standard, with Plaid and similar aggregators transitioning to direct API partnerships
• Open banking is evolving toward open finance, encompassing all financial data

Common Mistakes to Avoid

• Granting data access to unverified apps: Open banking is only as safe as the apps you authorize. Always verify the fintech's reputation and read what data permissions you are granting before connecting your bank account.
• Assuming open banking means your data is public: Open banking requires your explicit consent for each data-sharing connection. No third party can access your account without your authorization.
• Forgetting to revoke access: Many consumers connect apps to their bank accounts and forget about them. Periodically review which apps have access through your bank's settings and revoke any you no longer use.
• Confusing open banking with open source: Open banking refers to standardized data access through APIs, not open-source software. Banks maintain proprietary systems; they simply expose data through secure interfaces when authorized.

Related Concepts

• Fintech: The broader technology sector driving open banking adoption
• API Banking: The technical infrastructure that enables open banking
• Digital Wallet: A common consumer application powered by open banking data
• ACH: The traditional payment rail that open banking payment initiation complements
• Robo-Advisor: A fintech category that benefits from open banking data access
• P2P Lending: Non-bank lending platforms that use open banking data for underwriting

Frequently Asked Questions

Q: Is open banking safe? A: Open banking is significantly safer than screen scraping because you never share your bank password with third parties. Access is granted through an authorization token with defined scope and expiration. Banks maintain security standards for their APIs, and consumers can revoke access instantly. The primary risk is consumer education: granting access to untrustworthy apps. Regulatory frameworks require strong consent flows and clear disclosure.

Q: Does open banking mean my bank can see what I do in other apps? A: No. Open banking is one-directional by default. It lets you share your bank data with third-party apps you choose. Your bank does not gain visibility into other apps through open banking. Banks do have visibility into transactions flowing through their own systems regardless of open banking.

Q: How is open banking different from Plaid? A: Plaid is a fintech infrastructure company that connects apps (like Venmo, Betterment, Chime) to bank accounts, providing an open banking layer before formal bank APIs existed. Plaid initially used screen scraping but has transitioned to direct API partnerships with banks. As formal open banking standards emerge, companies like Plaid become infrastructure providers that implement those standards. Plaid is a key intermediary in the open banking ecosystem, not an alternative to it.

Q: What is the status of US open banking regulation in 2026? A: The CFPB's Section 1033 rule (finalized October 2024) is currently enjoined by a federal court and under revision by the CFPB. The April 2026 compliance deadline for the largest banks passed without enforcement. The CFPB published an Advance Notice of Proposed Rulemaking in August 2025 reopening questions about fees, authorized third parties, and data security. Revised rules could be published in mid-2026, but the outcome remains uncertain. See the CFPB's Section 1033 page and Congress.gov's CRS report for updates.