In early August 2026 the Consumer Financial Protection Bureau sent a proposed rule titled "Personal Financial Data Rights Reconsideration" to the White House Office of Information and Regulatory Affairs for review, usually one of the last steps before publication[1]. It reconsiders the open banking rule finalised in late 2024, which gave consumers the right to share their financial data with third parties through banks' systems.
The text is not yet public. The direction is visible from the CFPB's advance notice of 22 August 2025, which asked about four issues: who can act as a consumer's representative, whether and how banks may charge fees for responding to data requests, and the data security and privacy risks of compliance[2].
The fight is about fees
The positions are well established. Banks argue that Section 1033 was meant to give information to consumers, not to commercial third parties such as fintechs and aggregators; fintechs and open banking advocates see the rule as a pro-competition consumer right[3]. The 2024 rule has also faced legal challenges, including from the Bank Policy Institute and the Kentucky Bankers Association.
If the new proposal allows banks to recover the costs of data access, US open banking changes character. It stops being a free mandate that banks comply with reluctantly and becomes a service that banks provide, at a price, to other businesses.
A price makes open banking a product. Price it to recover cost and fund reliability, not to keep competitors out.
How banks should think about pricing
Fees are not good or bad in themselves. They are good if they fund reliable, secure, well-documented access; they are bad if they are set to make competitors' products unviable. Regulators and courts will be able to tell the difference. Four principles I would build a pricing model on:
- Tie price to cost. Publish the basis for the fee and the costs it covers: infrastructure, security, support. Unexplained prices will be challenged.
- Price for service levels. If a third party pays, it should get uptime, response-time and data-quality commitments in return. A priced API with poor reliability is the worst of both worlds.
- Keep the consumer free. Consumers accessing their own data, and low-volume use, should stay free. Fees belong in the commercial relationship between the bank and the business using the data.
- Treat access as a business. A data-access API with customers, a price list and a service level needs a product owner, a roadmap and a P&L, not just a compliance sponsor.
What most commentary misses
The debate is framed as banks versus fintechs. In practice, many banks are also heavy users of data from other institutions, for lending, onboarding and financial wellness tools. A pricing regime that feels defensive today will be paid by the same banks tomorrow when they are the ones requesting data. The banks that design fair, transparent pricing will be setting terms they can live with on both sides.
What to do now
Before the proposal is published, banks should estimate their true cost of serving data requests, measure their current API reliability honestly, and decide who inside the bank owns data access as a product. Fintechs and aggregators should model their unit economics under a range of fee levels, and decide which data they genuinely need. The final rule will set the boundaries. How well the market works inside them will depend on the choices made now.