CFPB's open banking rule gets much right — but there's a piece missing

Samuel Corum/Bloomberg

Last month, a long-awaited open banking regulation proposal from the Consumer Financial Protection Bureau was unveiled — an important and welcome step forward for open banking in the U.S. As one commentator put it, "the fintech industry has been waiting for a 1033 rule to pass like kids wait for Christmas." 

The 299-page draft gets a lot right. For example, specifying that data should be made available by developer interfaces, preventing institutions from limiting access to APIs and making provisions to ensure clear authorization. These parameters will increase reliability of data sharing, encourage competition and ensure consistent standards across the industry.

But there's one big omission — the proposed rules do not consider the millions of small businesses that rely on banking data connectivity to keep their businesses running. 

Sharing banking data and transferring it between systems is fundamental to how businesses manage their day-to-day finances. For busy small-business owners, banking data connectivity enables them to reconcile and close their accounts, apply for funding, manage expenses and pay suppliers.

Let's consider just one small-business use case for open banking: accessing credit. In a recent YouGov and Codat survey of 490 U.S. small and medium-size businesses, 21% of respondents indicated they did not access credit in 2022, despite needing it — the equivalent of 6.8 million businesses. The most common causes — reported by 78% — were application-related problems (application costs being too high, the application process being too complex and it taking too long to get the money).

That figure is bolstered by a 2023 survey conducted by the National Small Business Association (NSBA) which found that more than one-third of small-business owners were not able to secure sufficient financing for their business. Sharing historical bank statements is a standard part of the credit application process that can be made significantly easier for businesses through open banking, reducing the numbers of businesses whose growth is stymied due to lack of access to funds.

Banking data connectivity isn't just beneficial for businesses — it's good for banks, too. Small and medium-size businesses (SMBs) have an average of four bank accounts, often with multiple providers. Access to banking data from customers' other accounts allows banks to have a clearer picture of a business' cash flow, enabling them to make more informed lending decisions and product recommendations.

Open banking can also mean a productivity boost for small businesses. U.S. businesses spend as much as 100 days each year on bookkeeping and administrative tasks, a large portion of which can be automated when transaction data flows directly into accounting and enterprise resource planning systems automatically, instead of relying on laborious manual reconciliation.

However, open banking for businesses is hard to get right, leading the industry to focus on consumers first. Businesses can have more complex financial profiles than consumers, often having multiple bank accounts and multiple user roles (accountant, controller, CFO, etc.). This can make it more difficult for banks and aggregators to enable access, as seen with Australia's implementation of CDR, which forced small businesses to print out forms and physically go to their bank branches to be able to connect their accounts digitally.

Regulation and compliance

Acting Comptroller Hsu weighs in on nonbank, fintech roles in banking

Michael Hsu is voicing concerns about the increasing disintermediation of accountability for banking services as more banks collaborate with nonbank entities. In an interview, he also addresses industry concerns about the Basel endgame proposal and notes banks' growing interest in tokenizing real-world assets.

By Ebrima Santos Sanneh

November 7

The CFPB's rulemaking proposal is currently focused on consumer accounts, which is inconsistent with regulations in the U.K., Europe and Australia, where SMB accounts are typically included.

Despite this narrow scope, 1033 rulemaking may still benefit SMBs. Microbusinesses and sole proprietors may be using consumer accounts to run their businesses, in which case they would be able to tap into the benefits of open banking directly. Some banks may decide to proactively include small-business banking units within their API coverage plans in order to account for small-business use cases, recognizing the market's direction of travel.  

But even if certain banks take this approach, business banking data connectivity is likely to remain inconsistent, resulting in spotty coverage and a dependence on screen scraping. There is a risk that financial institutions will focus resources solely on enabling connectivity for consumer accounts and at worst restrict access to small-business banking data.   

SMBs are as hungry for open banking as consumers, if not more so. In the U.K., small businesses have a higher adoption rate of open banking than consumers (16% vs 11%) and Codat's own research shows that 73% of U.S. SMBs are willing to share their data with lenders in exchange for better interest rates or an easier application process. To meet this demand, the CFPB should consider including small-business accounts in open banking rulemaking as soon as possible. Here are three considerations that should be part of an expanded scope to SMBs:

The agency should define "SMBs." Business financial accounts come in a range of different shapes and sizes. Defining the size of businesses and type of accounts that should be covered will be a key piece of guidance for financial institutions and will need to align to the existing phased rollout, suggested by 1033 rulemaking. For example, SMB and covered financial accounts are clearly defined in U.K. open banking regulations. 

Second, CFPB should enable multiple users. Regulation will need to enable the various user roles that help manage small businesses' finances. Business owners, accountants, CFOs, controllers, etc. will all need to be able to efficiently access and permission data sharing to enable business processes.

Finally, set consistent standards. Bringing SMBs in scope will require consistent standards and the feedback of market participants who support SMB use cases on a day-to-day basis. Those use cases should be considered with the formalization of a 1033 standards setting body, which could be extended to SMBs.

Extending the scope of the 1033 rulemaking to business accounts builds on all of the valuable work that the CFPB has already done to lay out the way forward for open banking in the U.S., and it stands to vastly amplify its benefits to financial institutions, businesses and the economy.