The Consumer Financial Protection Bureau has submitted a revised open-banking rule to the White House's Office of Information and Regulatory Affairs, and a public release is expected within weeks, if not days. The headline change is a reversal of the single most contested feature of the Biden-era version: where the original 2024 rule barred banks from charging for access to consumer financial data, the new proposal is expected to let banks charge fintechs and other third parties for it. Fintech groups are framing this as an assault on a consumer right, insisting that people's financial data belongs to them and should flow, fee-free, to the apps they choose. Banks counter that providing that access costs real money and carries real risk.
The dispute is almost always narrated as a fight over who owns your financial data. That framing is misleading, because it is a question both sides can largely agree on. The consumer owns the data; even the banks do not seriously contest that. The actual disagreement lies one step further down, in a question the ownership language obscures: who should bear the cost of making that data portable, and does whoever bears it get to charge for it? Once you see the fight as a cost-allocation problem rather than an ownership problem, almost everything about it, including who really pays and why it keeps ending up in court, comes into focus.
How the fight got here
Section 1033 of the Dodd-Frank Act rests on a clean principle: financial data belongs to consumers, not to the institutions that hold it, and consumers can direct that it be shared. The CFPB turned that principle into a detailed rule in October 2024, requiring banks above about $850 million in assets, and certain nonbanks, to make account data available electronically and free of charge to consumers and their authorized third parties, on a phased timeline running into 2026.
Banks and banking groups sued almost immediately, a federal court in Kentucky enjoined the rule, and the appeal was stayed. Under the current administration, the CFPB withdrew its attempt to have the rule vacated and instead reopened the rulemaking, announcing it would replace the prior version with one more suited to market realities. That reconsideration has now produced the proposal sitting at OIRA, and the market realities it is most suited to, on the available reporting, are the banks'.
Why it looks like a fight about ownership
The two sides talk past each other because each is answering a different question while sounding as if they are answering the same one. The fintech and consumer-advocacy camp, represented by groups like the Financial Data and Technology Association, argues from ownership: since the data is the consumer's, charging to release it is like a warehouse billing you to retrieve goods you already own, and a right you must pay to exercise is a diminished right. On this view, fee-free, secure access is the whole point of open banking, the thing that lets new entrants challenge incumbents.
The banks argue from infrastructure and liability. They may not own the data, but they own the pipes, the secure interfaces that make the data accessible, and they bear the cost of building and maintaining them, the burden of handling enormous request volumes, and the risk of being blamed when data leaks through a third party. From that vantage, a fee is not a charge for the data but for the access service wrapped around it, and being forced to provide that service for free is a taking of their resources, not a protection of the consumer's rights. Both positions can be held while fully conceding that the consumer owns the data, which is the tell that ownership is not really what divides them.
Why it is really a fight about cost
Strip away the ownership language and the durable disagreement is about an unavoidable cost. Making financial data portable is not free; it requires infrastructure, maintenance, security, and liability-bearing, and that cost exists no matter what the rule says. The 2024 rule did not make access free. It assigned the cost to the banks, which had to build the access and provide it without charging. The forthcoming rule does not create a cost either. It reassigns the same cost to the fintechs, which will have to pay for access. In both versions the cost is identical; only the party holding the bill changes.
And here is the part that both sides' rhetoric conveniently omits: in both versions, the cost ultimately lands on consumers, just through different channels and on different consumers. When banks bear it under free access, they recover it the way banks always recover costs, through the pricing of their products, spread across their entire customer base in slightly worse rates or fees, a socialized and nearly invisible charge paid by everyone who banks there. When fintechs bear it under paid access, they recover it through the pricing of their apps and services, charged to the specific consumers who use those data-dependent products. So the choice between free and paid access is not a choice between consumers paying and not paying. It is a choice about which consumers pay, all bank customers diffusely or fintech users directly, and how visible the charge is. Neither option is free; the entire fight is over the incidence of a cost that will be paid regardless.
Why it is also a competitive weapon
Cost allocation would be a dry accounting matter if it were not also the main lever in the war between incumbent banks and the fintechs trying to unbundle them, which is exactly what it is. Free access forces banks to subsidize their own disruptors, compelling them to build and maintain the very infrastructure that lets competitors reach in and peel away their customers, at the banks' expense. That is a real grievance, and stated plainly it has force: why should an incumbent be legally required to hand rivals the data they need to compete against it, for free?
Paid access flips the lever the other way, letting incumbents tax their disruptors. Raising fintechs' cost of accessing data weakens the challengers who depend on it, and the largest banks are positioned to set the price. JPMorgan Chase reportedly reached data-access fee agreements during the period of regulatory uncertainty, which fintechs read as a giant setting a market floor high enough to squeeze smaller competitors. The uncomfortable truth is that there is no neutral setting here, because the cost allocation is the competitive lever. Whichever way the rule tilts, it is putting a thumb on the scale of the bank-versus-fintech contest, and calling one option "protecting consumer rights" and the other "market realities" mostly disguises which competitor each choice favors.
The banks' security concern is real, even if convenient
It would be too cynical to treat the banks' position as pure rent-seeking, because embedded in it is a legitimate worry. Forcing an institution to open its customers' data to a wide range of third parties, fintechs, aggregators, and increasingly crypto firms, that it did not choose and cannot fully vet does enlarge the attack surface, and it raises a genuinely hard question about who is liable when sensitive data is breached somewhere down the chain of third parties the bank was required to share with. Fees, along with proposals to narrow which entities qualify to receive data, are partly a way for banks to limit and be compensated for that exposure.
The honest reading holds two things at once. The security and liability concern is real and would exist even if no bank had a competitive motive. And it also happens to align neatly with the banks' commercial interest in slowing fintech competition, which makes it difficult to tell, from the outside, how much of the banks' stance is prudence and how much is protectionism. Both are present, and the presence of the genuine concern does not neutralize the competitive one, nor the reverse.
The quieter fight over who counts as "you"
Running alongside the fee battle is a subtler one over the definition of a consumer's "representative," meaning who is allowed to access data on someone's behalf, whether only fiduciaries like agents and trustees, or any third-party service a consumer authorizes. This sounds technical, but it increasingly governs the future of AI-mediated finance. An AI agent that accesses your accounts to manage your money, move it, or shop for better terms is precisely the kind of authorized third party the definition covers, and a narrow reading could constrain whether such agents may act for you at all, while a broad one would clear the way for them. The rule that looks like a squabble over data-access fees is also, quietly, helping decide whether the next generation of automated financial tools can reach the accounts they would operate on.
The politics scramble, and the litigation never ends
Two final features are worth noting. The politics do not run along familiar lines: the current White House has close ties to the crypto industry, yet crypto firms are among the fintechs that would have to pay banks for data under the new rule, so a crypto-friendly administration is advancing a framework that disadvantages crypto's data access. The bank-versus-fintech divide simply does not map onto the usual deregulatory-versus-regulatory axis, because here two industries sit on opposite sides and someone's ox gets gored whatever the "pro-business" choice turns out to be.
And the instability looks permanent. The fee-ban rule was sued by banks; the fee-allowing rule, experts expect, will be sued by fintechs and consumer advocates. Neither version delivers the stable open-banking framework that everyone claims to want, because the cost-allocation question underneath has no answer both sides will accept, and the losing side of any given rulemaking has every incentive to litigate. That is why this has dragged on for years across two administrations and will likely drag on further: the disagreement is structural, not a matter of better drafting.
Which returns to the framing worth carrying out of all this. Open banking was sold as a simple consumer right, your data, freely yours to move, but the simplicity dissolves the instant you ask who builds and pays for the pipes. Underneath sits an unavoidable cost that someone must bear and that reaches consumers in the end no matter who is billed, and a competitive struggle in which "free" and "paid" are both weapons rather than neutral ground. The forthcoming rule will shift the cost from banks to fintechs, and with it from all bank customers to fintech users, tilt the field toward incumbents, and land in court. The accurate way to read the news that banks may soon charge for your financial data is not as a repeal of your ownership of it, which is not really in dispute, but as a decision about who pays to move what you own, and, increasingly, about whether the tools of the next decade will be allowed to move it for you.
Primary sources
- American Banker (reporting by Kate Berry) for the submission of a revised Section 1033 proposal to OIRA, the expectation that banks will be allowed to charge fintechs and third parties for data access, the reported JPMorgan Chase data-access fee agreements, the expectation of prolonged litigation if fintechs must pay, the Trump White House's crypto ties and the fact that crypto firms are among the fintechs that would have to pay, and the Financial Data and Technology Association's Steve Boms calling for fee-free, secure data access.
- The Congressional Research Service, via Congress.gov, for the Section 1033 framework, the October 2024 final rule, the roughly $850 million asset threshold, the categories of covered data, and the litigation and reconsideration history.
- Consumer Finance Monitor and Mitchell Sandler for the August 2025 Advance Notice of Proposed Rulemaking, the CFPB's stated aim of a rule "more suited to market realities," the reopened questions on fees, security, privacy, and the definitions of "consumer" and "representative," and the fiduciary-versus-authorized-third-party debate.
- Holland & Knight for the compliance-timeline questions and the June 30, 2026 deadline context.
- PYMNTS for the framing of open banking shifting "from access to economics" and the centrality of the fee prohibition.
- The Financial Technology Association for the consumer-rights and pro-competition case for fee-free access.