Open banking regulation is in the works — finally.

The Consumer Financial Protection Bureau (CFPB) announced in October 2022 a plan to propose a rule in 2023 requiring financial institutions to share consumer data upon request by the consumer. One year later, on Oct. 19, 2023, the bureau unveiled its Personal Financial Data Rights proposal.

CFPB Director Rohit Chopra made it a top priority to pass an open banking regulation when he took the helm of the agency in 2018, a source familiar with the matter told Bank Automation News. The proposed rule has been much awaited by consumers and the financial services industry alike, and the bureau aimed to address every facet of the market before submitting the proposal, the source said.

“Banks were anticipating this,” Ameya Talwalkar, chief executive of API security company Cequence, told BAN. “The ruling is mainly focused around protecting consumer data and giving them more control over that data.”

The rule proposes that, through open banking, consumers would have a legal right to their data, free of junk fees, and could “break up with banks that provide bad service. … This would allow [consumers] to access competing products and services without worrying that their data might be collected, used, or retained to serve commercial interests over their own.”

According to a Nov. 8 Consumer Finance Insights report from global law firm Goodwin Law, open banking is the practice of sharing consumer banking and financial data with third-party vendors who can use it for other services, including bill payment, portfolio management, lender shopping and aggregating data.

With a CFPB proposal on the table, financial institutions are starting to determine how to approach open banking within their operations since the CFPB views the proposal as a way to kickstart competition and innovation within the industry.

While some financial institutions view the impending rule as a catalyst for innovation, others believe it could be a potential wrench in operations.

According to the October “Predictions 2024: Banking,” report from research and data consultancy Forrester four out of five United States banks will fail to deliver a single consumer-facing open banking solution.

Larger banks, for example, might view open banking as a threat, while smaller banks might not have the resources to invest in open banking solutions or the digital capabilities necessary to maintain a competitive edge, according to the report.

Ready or not, the open banking market is expected to reach $123.7 billion by 2031, up from $13.9 billion in 2020, according to a report on the state of the open banking market by Allied Market Research.

So, what does open banking regulation mean for U.S. financial institutions?

Prepping the tech stack

Banks should look internally to their tech stacks to prepare for open banking regulation, according to the Banking Stability and Innovation Study 2023 by consulting company CCG Catalyst. Financial institutions must have tech stacks that can support data-sharing and that’s where APIs come in, the report states.

Digital transactions require an API, even ordering an Uber, Cequence’s Talwalkar said. Financial institutions work the same way; they’re sharing consumer data through APIs so those APIs must be secure, he said.

The challenge is not only to ensure one’s own financial institution has secure APIs, but also to ensure the APIs of the financial institutions that data is shared with also have secure APIs, Talwalkar said. FIs must make sure “partners have the access to the right amount of data in the right ways to make sure they’re not abusing access,” he said.

APIs are a safe method for moving consumer data among separate entities, Paige Pidano Paridon, senior vice president and senior associate general counsel at Banking Policy Institute, told BAN.

In fact, Financial Data Exchange (FDX), a financial services consortium founded in 2018 by American Express, Bank of America, Capital One and Fiserv, among others, has standards in place about how consumer data should be shared via APIs to ensure security and authentication of how that data is shared, Paridon said.

Cequence, which follows FDX standards, has facilitated this type of API security for a decade, Talwalkar said. Cequence has $9 trillion in business value, secures 6 billion API calls daily and safeguards 2 billion user accounts, including American Express, according to its website.

Sparking innovation

As banks prepare their tech stacks for the CFPB regulation, they must view open banking as an opportunity for innovation, Jacob Morgan, principal analyst at Forrester, told BAN.

While open finance has existed in the U.S. for years, it has been allowed to grow organically, Morgan said, adding that the open banking proposal will force the hands of many institutions to innovate and keep up with evolving tech.

Open finance has “not really driven the level of competition or consumer-oriented solutions that the regulator would like to see,” which is the reason behind the open banking regulation, Morgan said.

The CFPB proposal would seek to increase competition by enabling comparison shopping, allowing consumers to more easily change providers, and encourage the development of new products and services that rely on consumer data, a source familiar with the proposal told BAN.

The regulation will encourage “banks to adopt new technology, adopt new services and new offerings,” Karla Booe, chief compliance officer at card-issuing fintech Zeta, told BAN. If banks don’t lean into open banking, they risk losing clients — a chance most banks aren’t willing to take.

For example, as consumers find it easier to move their financial data and accounts, institutions that have these seamless capabilities will move to the top of the list, Booe said.

As the ease of moving account information to third-party vendors grows, including data about auto payments, credit limits and payment history, competition within the industry will tick up, Booe said.

The CFPB wants “to create competition in the financial industry,” she said. “They’re wanting new consumers to have a better experience, have more options [and] have [institutions] fighting for their business.”

“Fundamentally, the American consumer is the person that is most likely to benefit from this,” Forrester’s Morgan said. “Anything that drives innovation for consumers and forces the banks to raise their game in order to compete against nimble, innovative fintechs can only be positive.”

Considering security, responsibility

With innovation in mind, financial institutions must not lose sight of security and responsibility when handling sensitive consumer information.

When a consumer shares their data with a third-party service provider, some methods go outside of API connections. Screen scraping is one such tactic.

Screen scraping is the automated collection of data used by some third-party vendors who mirror a consumer’s screen and collect consumers’ credentials in order to log into their accounts, Morgan said.

“This can be dangerous because third-party vendors don’t implement the security standards that banks do and those credentials can be vulnerable for being accessed by fraudsters,” Banking Policy Institute’s Paridon told BAN.

CFPB should ban screen scraping, BPI believes, but its proposal will not accomplish that, she said.

“That’s one element that we’re concerned about because consumers would certainly benefit by a ban on screen scraping or more stringent requirements,” Paridon said.

The CFPB also must provide clear guidelines about the liability shift for consumer data breaches to give consumers more confidence in using open banking services, she said.

“If the consumer’s data is stolen or accessed and misused after it has left the support walls of the bank and gone to an aggregator or third-party fintech, [the banks] need to bear the responsibility for any consumer harm. … And currently that’s not the case,” Paridon said.

Avoiding screen scraping can push innovation, she said, noting that the BPI is urging CFPB to instill strong data security safeguards for any entity dealing with sensitive customer information.

Mastercard, for example, is developing APIs that can both protect data and offer a seamless flow of information, Jess Turner, executive vice president and head of global open banking and API at Mastercard, told BAN.

“We talk a lot about open banking and connecting to banks’ APIs because that is the most secure way to move data,” Turner said. “We put a lot of energy into digital identification, a lot of energy into fraud reduction.”

The CFPB is not looking to ban screen scraping, but rather is urging companies to use developer interface solutions like APIs to transact consumer data, a source familiar with the matter told BAN.

What banks are saying

While big banks are staying quiet regarding the open banking proposal, smaller banks are telling the CFPB that compliance with the proposal will be costly and ultimately detrimental.

For example, Spencer Kunze, vice president and IT manager at $95 million State Bank of Table Rock of Nebraska, submitted a comment to the CFPB on Nov. 6, stating, “I understand the intent behind these rules is to protect consumers’ access to their financial data. I believe that the implementation of these rules may create unintended burdens for small financial institutions.”

The costs affiliated with the proposal — including the need to hire more staff, invest in new tech and take on more work with already limited resources — would create “a unique set of challenges,” Kunze states in the comment.

Other comments filed from The American Fintech Council, American Bankers Association and Clearing House Association request an extension of the comment period of 90 days from the day the proposal was published in order to submit comments until Jan. 17, 2024.

Some of the biggest U.S. banks refuse to say anything about the proposed regulation. The following banks declined BAN’s requests to discuss open banking:

• $1.9 trillion BNY Mellon;
• $1.7 trillion Citigroup; and
• $190 billion KeyBank.

Open banking today

Open banking is a growing market, but banks have been waiting for regulation to dive into strategy, according to the CCG Catalyst study, which showed that 9% of the 108 C-level bank executives surveyed were waiting for regulation to be published before creating an open banking strategy.

Since the proposal has been announced, FIs must now develop open banking strategies and put them into place, if they haven’t already.

JPMorgan Chase, for one, is already thinking about open banking.

The $3.7 trillion bank’s latest open banking initiative was announced in October, when it teamed up with Mastercard to provide customers with a pay-by-bank option. The platform taps into Mastercard’s existing open banking technology, allowing consumers and businesses to share and transfer data across institutions, a Mastercard spokesperson told BAN.

Tech providers, too, are teaming up with financial institutions to facilitate open banking.

For example, in the third quarter, Fiserv signed a deal with Plaid “for API access to bank data, allowing the company to move further away from screen scraping,” Fiserv Chief Executive Frank Bisignano said during the tech provider’s October earnings call.

Similarly, BNY Mellon launched an open banking payment platform, BankifySM, in September and Platinum Federal Credit Union selected Jack Henry’s Symitar for its open banking configurability in May.

Regulation timeline

Open banking is already implemented in other parts of the world, including the United Kingdom, Europe and Asia, and now “it’s playing out here in the U.S.,” Shanker Ramamurthy, global managing partner for banking and financial markets at IBM Consulting, told BAN.

The CFPB will accept comments and submissions regarding the proposal until Dec. 29, according to its website.

The bureau is expected to finalize the rule by next fall, and then be phased in, Ramamurthy said. Compliance will be required first of financial institutions with assets over $500 billion, he said. Then, over the next four years, even the smallest depository institutions will have to comply, he added.

Open banking “is going to open up the financial services landscape … beyond financial institutions,” Ramamurthy said. “Open banking is increasing competition, and it’s reducing the barriers for non-financial services players to get access to financial information.”

Get ready for the Bank Automation Summit U.S. 2024 in Nashville on March 18-19! Discover the latest advancements in AI and automation in banking. Register now.