How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for data access, the CFPB’s August 2025 notice shifted open banking terms from regulation into contracts. Large banks could set prices, smaller institutions would inherit them through vendors, and data users would have to redesign around them.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 22, 2025, the Consumer Financial Protection Bureau published an advance notice of proposed rulemaking to reconsider its personal financial data rights rule under Section 1033 of the Dodd-Frank Act. The rule, finalized in October 2024, required many banks, credit unions and other providers to make consumer data available to consumers and authorized third parties through interfaces, and barred fees for that access. Bank groups had sued the day it was finalized, and in 2025 the bureau told the court it considered the rule unlawful before announcing a new rulemaking in late July. The notice asked four questions: who may act as a consumer’s representative, whether providers may charge fees, and whether data security and privacy protections were adequate. Comments were due October 21. Weeks earlier, news reports had said JPMorgan Chase planned to charge data aggregators for access.
Earlier in this series we looked at the 1033 rule as a consent experience banks would have to design, and as an architecture that would replace screen scraping whatever the courts decided. The August 2025 notice raised a different question: who pays. That question changes where the rules of open banking get written. A no-fee regulation sets terms for everyone. Once fees are possible, terms are set in bilateral contracts, and the contract, with its price, rate limits, data scopes and liability clauses, becomes the working rulebook.
Institutions meet that shift from one of three positions. Some providers have the scale to set a price. Most providers will inherit a price through the vendors that run their interfaces. And the companies that use the data will pay it and have to redesign around it. Each position calls for different preparation.
Providers that can set a price
Only the largest banks have direct interfaces, heavy aggregator traffic and the bargaining power to price access unilaterally. JPMorgan Chase’s reported plan to charge aggregators pointed to the heavy volume of automated data requests its systems handled, much of it, the bank argued, automated refreshes rather than requests a customer had initiated.
A per-call price changes behavior on both sides. It gives aggregators a reason to stop polling every account several times a day and to request data only when a customer action needs it. That can cut load and fraud exposure for the bank. A bank that sets a price takes on obligations, too. Paying customers will expect uptime commitments, response-time targets and dispute processes that look like any other commercial service.
The terms that come with a price often matter more than the price. Contracts can specify which data elements are shared, how long tokens last, what security standards the recipient must meet and who absorbs fraud losses. Those clauses decide many of the questions the 2024 rule tried to settle by regulation. Pricing too aggressively carries its own risk: political scrutiny, complaints when popular apps break, and arguments that the fees entrench incumbents. Banks in this position should know their actual cost per call and be able to defend any price against it. They should also watch the measures that show whether pricing works: request volumes by aggregator, the share of calls tied to customer sessions, and complaint rates when access is throttled.
Providers that will inherit a price
Most community banks and credit unions do not run their own data interfaces. Their customers’ data reaches third parties through core processors and digital banking vendors, or through aggregators connecting to those platforms. The 2024 rule exempted the smallest depository institutions altogether, but many of them still face aggregator traffic.
For these institutions, a fee regime is mainly a vendor contract question. If access becomes chargeable, the vendor might bill the aggregator, bill the institution, or both. It might keep the revenue or share it. It might set access policies on the institution’s behalf. Few existing core contracts anticipated any of this, because the market assumed either scraping or a no-fee mandate.
Institutions should read their core and digital banking agreements now for clauses on third-party data access, API pricing, data use by the vendor and the institution’s right to set its own access policies. Contract renewals are the moment to secure those rights. An institution that leaves the question open may find its data priced, and its customers’ apps throttled, by decisions it did not make.
Pricing also interacts with screen scraping. If an interface becomes expensive or slow to arrive, some third parties will keep logging in with customers’ credentials, which is the risk the 2024 rule aimed to end. An institution cannot simply block scraping until a workable interface exists, or it will break apps its customers rely on. The practical sequence is to secure an interface through the vendor, publish how third parties should connect, and then restrict credential-based access with notice. Each step needs a date and an owner.
Data users that will pay a price
Fintechs, lenders and aggregators sit on the other side of the rate card. A per-call fee turns data access from a fixed engineering cost into a variable cost that scales with customers and refresh frequency. Products built on constant balance refreshes, such as overdraft alerts or round-up savings, feel that most. Lenders using bank data in underwriting pay per application, which is easier to absorb.
The engineering response is familiar from any metered service. Cache what can be cached. Refresh on events, not on a timer. Request only the data elements a feature needs. Price products to reflect the full cost of the data they consume. Some costs will pass to consumers, and those that are absorbed will squeeze thinner margins first.
The notice’s representative question matters here too. If a future rule limits who counts as a consumer’s representative, some business models may lose a regulatory right to access and depend entirely on negotiated contracts. Data users should know which of their products rely on the rule and which already rest on bilateral agreements. They should also track the litigation and any revised compliance dates with counsel, because the answer to that question decides their bargaining position.
With hindsight
The rate card arrived before the rule. In mid-September 2025, JPMorgan Chase and Plaid announced a renewed data access agreement that included a pricing structure, the clearest sign that access was becoming a negotiated commercial term. On October 29, 2025, a federal court in Kentucky preliminarily enjoined the CFPB from enforcing the 2024 rule while the bureau reconsidered it. The court expressed doubt about the rule’s treatment of third parties and its fee ban.
By this point in 2026, the original compliance dates have passed without taking binding effect, and we have not seen a final revised rule. Institutions should confirm the current status with counsel. The positions described here held up. Large banks priced access through contracts. Smaller institutions found their exposure written into vendor agreements. Data users that had already moved to event-driven, scoped requests had lower costs and stronger negotiating positions than those still polling.