US banks are building application programming interfaces, or APIs, to hand customers control over their own financial data, and they are doing it with no legal deadline forcing them. A federal court stayed the compliance dates of the Consumer Financial Protection Bureau’s Section 1033 rule in October 2025, and the Bureau has been drafting a replacement ever since. An open banking API is the technical channel that work runs through, replacing older methods that relied on stored passwords.
That gap between a paused rule and an active build-out is the thing worth understanding. It shows what banks now think open banking is for, once compliance has stopped being the reason to do it.
What does an open banking API do in practice?
Open banking, at its simplest, is a customer’s right to let a third party pull their own account data directly from the bank, without handing over login credentials. A budgeting app, a lender or an AI assistant can request the connection, but only with the customer’s permission. Before APIs existed for this purpose, apps commonly used screen scraping: they logged in with the customer’s own password and read the account page the way a browser would. Screen scraping is fragile and hands the aggregator the customer’s credentials. An API instead gives the aggregator a defined, permissioned data feed that the bank controls and can revoke.
What the court did to the 1033 deadline?
The CFPB issued its Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act on 22 October 2024. It took effect on 17 January 2025, with compliance staggered by institution size. Fintechly has covered the rule’s rollout and the litigation challenging it in detail.
Forcht Bank, the Kentucky Bankers Association and the Bank Policy Institute challenged the rule in the Eastern District of Kentucky, arguing the Bureau had gone beyond what the statute allows and that it forced mass data sharing without adequate privacy safeguards. In June 2025 the CFPB agreed with them, telling the court in a summary judgment motion that its own rule exceeded its authority.
On 29 October 2025, Judge Danny Reeves granted a preliminary injunction barring the Bureau from enforcing the rule and stayed its compliance dates. The CFPB’s own compliance page carries the notice, naming the order in Forcht Bank, N.A., et al. v. Consumer Financial Protection Bureau, et al., No. 5:24-cv-304-DCR. The original deadlines are not running.
The Bureau opened its reconsideration with an advance notice of proposed rulemaking on 22 August 2025, asking for comment on who counts as a consumer’s authorised representative, whether a bank can charge a fee to cover the cost of responding to a data request, and how security and privacy obligations apply. PYMNTS reported on 5 August 2026 that the Bureau’s position is that data aggregators should pay those fees. The replacement proposal reached the Office of Information and Regulatory Affairs on 4 August 2026 and was still under review at the time of writing, so the fee question banks and aggregators are building around is still open.
For a bank, that leaves the work with a business case and no enforcement date behind it.
Who is building the pipes?
Three aggregators dominate the US market for open banking connections: Plaid, Akoya and MX. Each occupies a slightly different position. Plaid connects consumer accounts to thousands of apps and, more recently, to AI tools. Jelena McWilliams, Plaid’s president of corporate, legal and external affairs, wrote in July 2026 that consumers are now extending permissioned data access to AI assistants that build personal financial agents, and argued that consumer protections need to travel with the data wherever it goes.
Akoya runs a bank owned network built specifically around API access rather than screen scraping, with Wells Fargo, U.S. Bank, JPMorganChase and Jack Henry, which joined as the first core provider in May 2021, among the institutions connected to it. MX, the third major aggregator, describes itself as a leader in open finance and announced an open banking integration with Lumin Digital on 10 September 2026, giving banks and credit unions on Lumin’s platform a standards-based way to connect customers to third-party applications. Lumin is a digital banking platform rather than a core processor, so the integration sits in front of the core rather than doing away with that work. Bank side integration work is still expanding well over a year after the rule took effect, and now with no deadline behind it.
A bank’s own move: JPMorgan Chase and Akoya
The clearest evidence of where the fee debate is heading sits in a real contract. On 18 November 2025, Akoya and JPMorganChase renewed their data access agreement with what the companies described as an updated pricing structure. Akoya’s chief executive, Paul LaRusso, said the company was created “to give consumers greater control over their financial data, safely and securely.” JPMorganChase’s head of consumer payments, Melissa Feldsher, said the bank remained “committed to advancing the open banking ecosystem” through the partnership.
The renewal predates the CFPB’s fee reconsideration by nine months, which suggests banks and aggregators are not waiting for the regulator to settle the question before negotiating pricing directly with each other.
What this mean for banks still on the sidelines?
Smaller banks without a direct aggregator relationship are exposed on two fronts. They remain liable under Section 1033 for making data available even without an API of their own, and they typically rely on a core provider or a middleware partner to build the connection for them, the same role Lumin Digital plays for MX. Compliance teams evaluating a vendor in this space benefit from the same due diligence they would apply to any regtech purchase. Fintechly’s guide to regtech versus compliance tech sets out how to separate genuine automation from a relabelled manual process, a distinction that matters as much for data sharing APIs as for transaction monitoring.
A fuller list of infrastructure providers building this layer, including the aggregators named above, is on Fintechly’s infrastructure sector directory.
Frequently asked questions
What is open banking, and does Section 1033 force banks to offer it for free?
Open banking is a customer’s right to let a third party pull their account data directly from the bank instead of scraping it with a password. Section 1033 does not settle whether a bank can charge for that access, and its compliance dates have been stayed by a federal court since 29 October 2025. The CFPB opened the fee question for comment in August 2025 and has not issued a final answer.
Is screen scraping now banned under the CFPB’s rule?
No, and in any case the CFPB is currently enjoined from enforcing the 2024 rule. Section 1033 does not outlaw screen scraping outright, but it pushes the market toward API based access, and the banks and aggregators building that access are doing so commercially rather than under an enforcement deadline. Akoya has publicly called on the CFPB to phase out screen scraping and restrict how aggregators reuse the data they collect.
How does a smaller bank know if its core provider already supports a 1033 compliant API?
The fastest check is to ask the core provider directly which aggregator networks it already connects to. Jack Henry, for example, joined Akoya’s network in May 2021, the first core provider to do so, so banks running on that core may already have the plumbing in place without having built anything themselves.
Who is liable if a fintech misuses data it pulled through a bank’s open banking API?
Liability runs through the permission and the contract, not just the API connection. Banks, aggregators and the fintechs they onboard each carry obligations under Section 1033 and their own data sharing agreements, and the CFPB’s pending rulemaking on the representative definition is partly aimed at tightening who can request data on a consumer’s behalf.
Correction, 18 September 2026: An earlier version of this article said the Section 1033 rule remained in effect and described its compliance timeline as one banks are working against. A federal court stayed the compliance dates on 29 October 2025 and enjoined the CFPB from enforcing the rule. The article has been updated.
