Final and already in court: sorting open banking work by how much you would regret it

The week

On October 22, 2024, the Consumer Financial Protection Bureau finalized its personal financial data rights rule under Section 1033 of the Dodd-Frank Act. The rule covered banks, credit unions, card issuers and certain payment providers. It required them to make specified account and transaction data available to consumers and authorized third parties through a developer interface, without charging fees. It set interface performance standards, limited third parties’ use of data to what the consumer requested, required annual reauthorization and aimed to end screen scraping. Compliance dates were staggered by size, from April 2026 for the largest institutions to April 2030 for smaller ones. Depository institutions with assets of $850 million or less were exempt from the interface requirements. The same day, the Bank Policy Institute, the Kentucky Bankers Association and a Kentucky bank sued to block the rule in federal court in Kentucky.

Earlier articles in this series covered what the 2022 outline and the 2023 proposal asked of banks: an interface with performance targets, consent and revocation, and unresolved liability. By October 2024 those questions were settled on paper. A new one replaced them. A final rule was in force and also in court on its first day, with a presidential election two weeks away. The first compliance dates were eighteen months out for the largest banks and further for everyone else.

Waiting for the courts carried risk if the rule survived. Building exactly to the text carried risk if it changed. The sound approach was to divide the program by how much each piece would be regretted if the rule fell. Every task in a Section 1033 program falls into one of three groups: work worth doing with or without the rule, work that only this rule requires, and work whose shape depends on the terms under legal attack. Each group warranted a different funding decision.

No-regret work: worth doing whatever the courts decide

Retiring screen scraping was in banks’ own interest. Aggregators logging in with customers’ online banking credentials create load on digital channels, blur fraud signals and leave the bank unable to tell a customer which apps hold their data. A tokenized interface fixes all three.

The no-regret list follows from that. Build or buy an interface on a widely used industry standard. Issue access tokens instead of accepting shared credentials. Give customers a dashboard showing which third parties have access, with a working revoke button. Detect and throttle scraping traffic once an interface alternative exists. Put third-party access under the existing vendor risk program, with criteria for granting and suspending access. None of this depends on the rule, and all of it reduces fraud and support cost.

For most mid-sized banks and credit unions, the interface would come from the core processor or digital banking provider. That made the no-regret task partly a vendor-management task: confirm what the provider would deliver, on what standard and on what timeline, and whether it would meet the institution’s own availability and monitoring expectations.

Rule-specific work: required only if the text survives

Some obligations existed only because of the rule. These included the specific performance metric for interface response, the published disclosures about the interface, the exact data elements, the record retention and policy requirements, and the duty to make data available without charge. Building them early had little cost for the largest banks, whose dates came first. Smaller institutions with dates in 2028 or later could reasonably sequence them last.

The way to keep this group cheap was to make it configurable. A data-element list driven by configuration can be extended or trimmed without code. Performance reporting can come from monitoring the bank already runs. Disclosures can be drafted but held unpublished. Each can be switched on quickly if the rule holds and set aside if it does not. Institutions under the $850 million threshold could skip this group entirely, though not the no-regret work, because their customers’ data was being scraped regardless.

One caution applies. Configurable is not the same as unbuilt. Suppose the rule survived with its dates intact. An institution that had deferred everything in this group would then face a compressed build in its final year, competing with every other bank for the same core-processor release slots. A sensible middle path was to design the rule-specific features now, build the ones that are cheap, and secure a written delivery commitment from the vendor for the rest.

Contested-term work: decisions to hold open

The third group covered terms the litigation and the coming change of administration put in doubt. The most consequential was the ban on fees for data access. Close behind were the scope of liability when shared data led to fraud, the grounds on which a bank could deny access, and which entities could act as a consumer’s representative.

For these, the right move was to prepare options, not commit. A bank could model the cost of serving third-party traffic so it would be ready to price access if fees became permissible, and ready to absorb the cost if not. It could draft access-denial criteria grounded in safety and soundness, which would be defensible under any version of the rule. It could review how Regulation E error-resolution duties would apply to payments initiated through third parties, with counsel. Long-term contracts with aggregators that locked in pricing or liability terms were the commitments most worth deferring.

Sorting the work this way also gave boards a clear answer to the question they asked: how much are we spending on a rule that may not survive? For most institutions, the honest answer was that the largest share sat in the no-regret group, and only a modest share was at risk.

With hindsight

The sorting proved useful because the contested terms were the ones that moved. In January 2025 the CFPB recognized the Financial Data Exchange as a standard-setting body under the rule, which helped the no-regret work. Under new leadership, the Bureau told the court in 2025 that it would reconsider the rule. In August 2025 it issued an advance notice asking, among other things, whether banks could charge for access, after large banks had begun seeking fees from aggregators. In late October 2025 the Kentucky court barred enforcement of the rule until the Bureau finished its reconsideration, so the April 2026 date passed without becoming an enforcement trigger. Meanwhile interface-based access kept displacing screen scraping through bilateral agreements and industry standards. Banks that had built the no-regret pieces kept their value; work tied to the no-fee regime was the work most exposed.