How banks are getting their data ready for open banking

Anyone who has attempted to import multiple sets of data into a spreadsheet knows how important it is for shared datasets to have common formatting standards. What's true for Microsoft Excel is even more true for bank account information.

The Consumer Financial Protection Bureau had finalized an open banking rule that would mandate the sharing of consumer financial information across different apps. This rule is now likely to be vacated by the new administration, which last week filed an update to a pending lawsuit regarding the CFPB rule stating that the agency's "leadership has determined that the rule is unlawful and should be set aside."

The CFPB rule is known widely as 1033, after Section 1033 of the 2010 Dodd-Frank Act, which gave the agency the authority to enact a rule governing consumer data rights. The actual rule-writing did not begin until Biden appointee Rohit Chopra took over the agency in 2021, and it was finalized and released in October 2024.

The future of the CFPB's rule, and by extension the regulation of open banking more broadly, is currently uncertain in the face of multiple pending lawsuits and the possible vacating of the rule itself by the current administration.

Despite this, many banks are looking to expand their open banking capabilities in anticipation of future competition and consumer demand.

"Even if something changes when it comes to Section 1033, open banking in the U.S. isn't going anywhere," Eyal Sivan, general manager of North America for Ozone API, told American Banker. "The consumer demand to share their financial data across the ecosystem will continue — the genie is out of the bottle, so to speak."

Sivan believes that regardless of how the courts handle various Section 1033 lawsuits, banks will continue to use the CFPB's rule as a regulatory guideline for building their open banking tech stacks.

"What exactly is going to happen to the rule does remain somewhat up in the air," Sivan said. "However, the activity we're seeing from the market is that interest in moving towards open banking continues. Interest in adopting open, shared standards continues. Ultimately, I think that's because the U.S. financial ecosystem recognizes that the consumer demand for this is real and will continue to grow."

Currently, some banks authorize third-party platforms to obtain financial data through screen scraping. This involves users handing their login and password information to these platforms, which then use code to log in as the user and pull data off the page. Screen scraping universally is considered less secure and more brittle than sharing data through application programming interfaces, or APIs. That's why a cohort of banks, including JPMorganChase, have moved away from it. 

Using APIs lets banks narrowly define what data is shared. Larger banks often build their own APIs in house. Smaller banks, such as Alabama-based Regions Bank, are partnering with third-party API providers to acquire the same tech capabilities and move away from screen scraping.

"The API that we're using is actually based on the FDX 6.0 API standard, which is really becoming the industry standard," Regions Bank emerging and digital payments group manager Tim Mills told American Banker. "The FDX API serves as a gateway into our deposit core, which is where we maintain the data related to transactions and balances for covered accounts."

How standards get designed and adopted

In order for open banking to work most effectively, the consumer data shared between financial institutions — such as between banks and fintechs — needs to share a formatting standard. As an industry standards body FDX, or the Financial Data Exchange, is seeking to help banks and other financial firms format their data.

"Data format comprises things like the structures for API calls to be requested and responded to, the communication language protocols that technology systems use to communicate with each other, and how the fields are structured and the requests are sent," FDX CEO Kevin Feltes told American Banker.

FDX is a nonprofit industry standards body composed of some 200 members across financial services in the U.S. and Canada. Upon FDX's official launch in 2018, the Financial Services Information Sharing and Analysis Center assigned FDX its Durable Data API (built in 2015) and renamed it to FDX API.

In June 2024, the CFPB finalized a separate rule outlining the qualifications for an organization to become a standard-setting body, which can issue consensus standards that companies can then use to update their data formatting.

"The CFPB created this legal framework and process around recognizing standard-setting bodies," Feltes said. "When they did so in June of last year, FDX decided internally that we wanted to put ourselves forward to play that role in the marketplace. We applied last fall and were officially recognized by the CFPB in January of this year."

A move to APIs

As of press time, the CFPB has two applications posted on its website: one from FDX and the other from the Digital Governance Standards Institute. FDX's application is so far the only one officially approved as a standard-setting body for the open banking rule.

"We already have very strong and broad adoption of FDX API standards in the marketplace," Feltes said. "There's over 96 million customer connections flowing through APIs that align to the FDX standard already today. In many ways we're serving as a standards body for the industry already, but the recognition does help to bring some additional relevance to compliance obligations."

Other standard-setting bodies exist in the financial services space but have not submitted an application to the CFPB, although they've been around for decades. One example is Nacha's Afinis API, which uses the Interactive Financial Exchange, or IFX, model introduced in 1997 to provide a common XML format for financial institutions to exchange data and power online banking features. Nacha is the organization that manages and develops the Automated Clearing House, or ACH, network in the United States.

Building on IFX, the Open Financial Exchange, or OFX, was also launched in 1997 as an open standard for advanced financial data functions like bill pay. OFX then joined FDX in June 2019 "as an independent working group with the goal of aligning all users to a single interoperable standard," according to FDX's website. "All existing implementations of OFX will continue to be supported, and users of OFX will have assistance to migrate to the FDX API standard at an appropriate juncture, such as during a technology refresh."

FDX has updated its API standard and data formatting guidelines for the organization's members several times since its 2018 launch.

"The most recent published version is 6.3, which was published in the latter half of last year," Feltes said. "At FDX, one of the benefits of having an industry-driven standard is that we have a lot of devoted members who are committed to adapting it over time, and so we've had many different versions that have evolved and built upon prior versions over the last seven years." 

Consumer demand for data-sharing

As consumers get more comfortable with the idea of letting other companies and apps into their bank data, they are likely to demand increasing levels of integration from their banks. 

"Open banking, as an idea, fundamentally is about letting people share their financial data between institutions with their consent based on common standards," Sivan said. "When Section 1033 was finalized at the end of last year, that really was the regulator coming to meet market activity that was already taking place. And that's great, because for open banking to work, you need a little bit of market and a little bit of regulation, and the two have to compliment each other."

The need to compete will continue to drive banks' data-sharing efforts, even if the 1033 rule lays by the wayside for the next four years, experts said.

"There are more and more financial institutions building or expanding upon digital experiences that depend on permissioned data-sharing from held-away accounts due to the rapid adoption by consumers of use cases that depend on open banking," Feltes said. "It's driven in part by the success of many fintech companies building compelling experiences and a desire by banks to compete in all of these use cases, whether it's budgeting, wealth planning, easier verification of account for payments, cash flow underwriting or account onboarding."

For reprint and licensing requests for this article, click here.
Open banking Technology Magazine Issue Year 2025 Regulation and compliance
MORE FROM AMERICAN BANKER