Whose data is it, anyway? That's quickly becoming the
As the Consumer Financial Protection Bureau has moved to vacate its
According to recent reporting, the CFPB has returned to the drawing board and is considering a fresh process, including new requests for public comment. Among the questions under review: whether banks can reasonably recover infrastructure costs incurred in servicing repeated API calls from fintechs and data aggregators and whether fintechs must obtain fresh customer consent for each data request. The agency is also reconsidering its own authority under Dodd-Frank to enforce a no-fee mandate. These are technical questions, yes, but the implications are enormous.
Lurking not very far behind the fintech v. bank fight are more existential questions: Is customer financial data the customer's to control or the bank's to monetize? Once given to the bank, can the bank charge for access to that data at the customer's request, and if so, how much?
These questions arise just as the competitive terrain between banks and fintechs is shifting. The administration and Congress are both working to create a freer, market-oriented regulatory environment for both banks and nonbanks. Nonbanks are already taking advantage of this shift, expanding into what amount to traditional banking services directly or by partnering with banking-as-a-service platforms. Some are going even further, seeking OCC charters of some variety, including full national bank charters.
If fairly and rigorously supervised, obtaining an OCC charter should help level the playing field for traditional banks. And if the playing field is not in fact leveled, banks should work vigorously to ensure it is. But charters also empower fintechs to achieve a level of legitimacy that, when coupled with new, more-agile technology stacks, could make them a greater competitive threat to legacy banks. This should be a clarion call — and one would hope at this stage traditional banks do not need one — to modernize internal systems and customer-facing processes and procedures and to develop competitive new products and services already being delivered by nonbanks and increasingly demanded by customers before legacy banks are outpaced.
At the same time, banks are moving to defend the strengths that come with their legacy positions, especially their deep customer relationships and the data those relationships generate. As noted, one such effort is the push to charge fintechs for access to that data. JPMorgan's move is a shot across the bow, signaling that the days of free access may be coming to an end.
If banks are ultimately allowed to levy such fees, it won't just be a technical rule change, it will mark a shift in leverage. Fintechs have long relied on consumer-permissioned access to deliver services, building business models on top of account data pulled from traditional institutions. But if that access becomes prohibitively expensive or more tightly controlled, the model of open finance could slow, stall or consolidate around only the largest players.
Bank trade groups have asked a federal court to halt enforcement and extend compliance dates for the Consumer Financial Protection Bureau's open banking rule that was enacted during the Biden administration. The move comes as the lobbying fight over how the rule will be rewritten intensifies.
Some fintech associations and industry leaders have already warned that data fees could "cripple" their businesses. According to one trade group, proposed changes from JPMorgan alone could eat up as much as 60% to 100% of a small firm's annual revenue. Others argue that such fees would suppress innovation and narrow customer choice, undermining the very goals of open banking.
This isn't just about infrastructure costs or API traffic — it's about control. Charging for access is one way for banks to reclaim the upper hand, reasserting themselves as the central node in the customer relationship.
But beneath the technical rulemaking and industry maneuvering lies the much deeper and still unresolved question I alluded to earlier: Who owns the customer data and under what conditions?
That question remains legally murky. While the customer may originate the data, once it is transferred to the bank, ownership becomes far less clear. Through contract terms, banks can secure broad rights to that data and limit how, or whether, it is shared with third parties like fintechs. Some customers will accept those terms; others won't. But it is certainly in the bank's interest to obtain as many rights to the data as possible and minimize its obligation to share that data with competitors.
In today's digital world, where nearly every interaction generates a data point, control of that data is power. It allows banks to not only protect their position but expand it — fueling personalization, pricing, risk management and strategic growth. If data is king, then controlling it becomes both shield and sword. This is a fight the banking industry will want to play to win.
And it's not the only one. The chartering push is another key front. If fintechs can obtain OCC charters and still operate with lighter supervision and regulation, lower costs and more-flexible technology, banks will face pressure not just on the margins but on relevance. Ensuring a level regulatory playing field — and demanding rigorous supervision — is critical. So is modernizing internal systems and improving customer experiences before new challengers do it better.
Ultimately, the outcomes of these conflicts will shape who owns the future of financial services. Whether that future is open or gated will depend not just on who holds the licenses but on who controls the data — and who the customers trust to use it.
