It’s about to get harder for banks to hold onto unsatisfied customers — and their money.
It has long been a challenge for people to ditch the banks where they keep their checking accounts. Blame tricky data transfer processes, lengthy and time-consuming requests, and other hurdles. But the first so-called open banking rules in the U.S. aims to change that.
New rules finalized by the Consumer Financial Protection Bureau (CFPB) on Tuesday will require banks to simplify how customers transfer their data from one bank to another without losing their transaction and bill history.
The aim of the regulations, formally known as 1033, is to empower consumers by giving them unprecedented control over their financial data, including who to share it with and when. As a result, customers will be able to direct their bank to move their account to a competing one with ease and use third-party applications with just the click of a button — all without paying a fee.
“Imagine being able to switch banks as easily as switching streaming services,” said James McCarthy, a founding member of the CFPB who is now chairman of financial services solutions firm McCarthy Hatch. “That’s what it’s really going to be like.”
Open banking allows people to share data from their financial accounts — like account details, payment history, and other transaction information — with third parties including merchants, financial tech companies, and even rival banks. (If you’ve ever been prompted to give another app access to your bank, then you’ve already used open banking.)
The new rules mean that banks, for the first time ever, will have to meaningfully compete for customers — a fact that could force financial institutions to innovate and improve their offerings. Those could include what’s known as cash flow underwriting, stronger fraud protection, “pay-by-bank” (making online purchases directly through a bank account without the need for debit or credit cards), and more personalized financial services, according to the Financial Technology Association, a trade group representing fintechs.
CFPB Director Rohit Chopra said the rules “will give people more power to get better rates and service on bank accounts, credit cards, and more.” That means customers can “fire fintechs and banks that provide lousy service,” the agency said.
“That last anchor that banks had to hold customers in their institutions is going to be gone,” McCarthy said. “Now you have the opportunity to shop around, so when a customer sees a product or service that is attractive to them in another bank, it will be effortless to switch there.”
While it might seem like a minor adjustment to the way people bank, the rules will impact vast swaths of data and transactions. The CFPB estimates that more than 100 million consumers have given thousands of third parties access to their financial data from thousands of providers. In 2022 alone, the agency estimates, there were between 50 billion and 100 billion total authorized attempts to access consumer data.
It could take a while for consumers to catch on to the benefits of the new rules, but it will give them “absolute control” over their banking, McCarthy said.
Despite the growing pains banks will face to both comply with the new rules and remain competitive, they also stand to benefit from open banking.
Cash flow cash cow
One area that could see the greatest transformation under the new rules is underwriting — specifically cash flow underwriting, a process by which a bank evaluates a potential borrower’s banking data to determine how likely they will be to repay loans.
That’s in contrast to traditional underwriting, which only looks at credit-based metrics such as card utilization and credit checks, as well as payment history.
Open banking could help drive the use of cash flow underwriting, said Misha Esipov, CEO and co-founder of the credit infrastructure and analytics firm Nova Credit. These new rules could transform the adoption of this relatively new practice “from an innovation into a necessity for financial institutions,” he said.
The CFPB, citing industry research, said that cash flow can be predictive of delinquency, like not paying off overdue credit card balances. By using wider banking data, including income and expenses, lenders will be able to better distinguish between the repayment risks of consumers with similar traditional credit profiles, the agency said.
Banks will also be able to identify and reach more consumers with low repayment risk, which in turn could lead to an increase in profits, according to the CFPB.
This could also expand the accessibility of loans and other financial services for people with shorter or nonexistent credit histories, such as immigrants or lower-income households, according to Esipov.
“For many years, we’ve seen people denied access to financial products because they are misunderstood by traditional credit bureaus because they have a thin file, just arrived from another country, etc.,” Esipov said. “More Americans have bank accounts than have a credit score, and if banks can leverage the data within those accounts, they can approve more people, gaining them more customers while expanding financial access.”
Setting the standard
The new rules also seek to level the playing field for data providers more generally, including banks and other third-party lenders. A key part of that is standardizing how they collect and share data.
In June, the CFPB announced new guidelines for standard-setting bodies, firms that will help mold the open banking framework and expectations for companies. The agency opened applications for standards-setting bodies last month. Financial Data Exchange, or FDX, was the first to apply for recognition as a standard-setting body to define an industry standard “data format.”
FDX, a nonprofit industry standards body, created the FDX Application Programming Interface (API) that became a technical standard for sharing financial data that’s used by more than 94 million consumer accounts in North America.
APIs allow two separate systems to communicate with each other, without gaining full access to a customer’s devices or other data. This won out over a practice from the early days of digital banking known as screen scraping, which is seen as more intrusive and less secure because it includes using consumer credentials to log into accounts to retrieve data.
Under the new rules, third parties are not allowed to use screen scraping to access data. The CFPB said the practice “became a significant point of contention between third parties and data providers, in part due to its inherent risks, such as the proliferation of shared consumer credentials and overcollection of data.”
An even more open future
It’s up to banks and their fintech partners to ensure that customers are not only aware of the new rules, but feel comfortable with their newfound control over their data, said Tom Delaney, a lawyer who specializes in financial services and regulation.
“I think consumers, on the one hand, they want to have a great deal of access, and they want to be able to access a full menu of potential products and services,” said Delaney, a partner at the law firm Norton Rose Fulbright. “On the other hand, they read stories about cyberattacks and other data intrusions, and they’re worried about, ‘Well, where is my data really going?’”
“In order to accomplish objectives that the parties involved want, whether they’re third parties or even the banks, they are going to have to, first and foremost, ensure the consumers that their information is safe,” Delaney said.
That involves not only strengthening safeguards around information, he said, but also helping consumers see the day-to-day benefits and flexibility that open banking is supposed to provide.
And there’s still room to grow. In their current iteration, the new rules only cover account and transaction data. The next frontier is expanding the data rules to include other offerings from financial institutions, Delaney said.
“The long-range picture is that you will have open finance,” he said. “You will be able to go through in a more digital environment, the ability to pick and choose different types of products that will go beyond loans, and presumably will include different kinds of investment options that will include different types, even insurance and insurance products.”
That’s the direction Europe is already headed in with its Financial Data Access (FiDA) framework, a set of regulations put forward by the European Commission last year. Those rules will require financial institutions to share a broad set of customer data with authorized third parties. The European Union has led the charge in open banking, having adopted the Payment Services Directive (PSD2) in 2015, which established rules for all retail payments in the E.U..
When it comes to the CFPB’s open banking rules, the largest U.S.-based financial institutions will have to comply by April 1, 2026, while smaller firms will have a few more years. Once that’s complete, only then can the U.S. start thinking about open finance — but it will be a long road, Delaney said.
“It may take us longer to get there than it will in other jurisdictions,” Delaney said, “because the U.S. just moves a little more slowly and tries to be a little more cautious in the way it implements this.”