If you’ve ever connected your checking account to a budgeting app, a payment app, or a tax tool, you’ve used open banking. You probably clicked a button, picked your bank from a list, logged in, and that was it. The app could suddenly see your balance and your last few months of transactions.
What happens behind that button is a fight that’s been running in Washington and in bank boardrooms for years. The central question is simple to state and hard to settle: when you tell your bank to share your own account data with an app, can the bank charge for that? The answer is about to be rewritten, and it could affect which apps you use and what they cost.
What Happens When You Link an Account
Most apps don’t talk to your bank directly. They go through a data aggregator, a company whose whole business is connecting to thousands of banks and passing account data to apps. Plaid, MX, Finicity, and Yodlee are the big names. When a budgeting app shows you that Plaid login screen, Plaid is the one fetching your data and handing it over.
For a long time, aggregators did this through screen scraping. You gave the aggregator your actual bank username and password, and its software logged in as you, read the pages, and pulled out the numbers. It worked, but banks hated it. Your credentials were sitting with a company you’d never heard of, and the bank had no clean way to tell an automated login from a criminal one.
The industry has been moving toward a better method: secure APIs. Instead of handing over your password, you log in on the bank’s own page and grant permission. The bank then sends the data through a controlled connection with tokens that can be limited or revoked. You never share your password with the app, and the bank can see exactly who is asking for what.
What Section 1033 Was Supposed to Do
The legal hook here is Section 1033 of the Dodd-Frank Act, a short passage from 2010 saying consumers have a right to access their own financial data. It sat mostly unused until October 2024, when the Consumer Financial Protection Bureau finalized its Personal Financial Data Rights rule to put that right into practice.
The 2024 rule required banks and card issuers to make your data available, in a standard electronic format, to you and to third parties you authorize. It pushed the industry toward those secure API connections and away from screen scraping. And it said something banks did not like at all: data providers generally couldn’t charge fees for this access. According to Open Banking Tracker’s timeline, compliance was supposed to phase in starting April 1, 2026 for the biggest banks (those with $250 billion or more in assets), with smaller institutions following each April through 2030.
That first deadline came and went, and no bank had to do a thing.
How the Rule Got Stuck
The Bank Policy Institute, the Kentucky Bankers Association, and Forcht Bank sued in federal court in the Eastern District of Kentucky. In 2025, under new leadership, the CFPB changed sides and agreed with the banks that the rule should be revisited. In August 2025, the Bureau published an advance notice reopening four questions: who counts as an authorized third party, data security, data privacy, and whether banks may charge fees.
On October 29, 2025, the court stayed the compliance deadlines and blocked the CFPB from enforcing the rule while it reconsiders. The rule is still technically on the books, but nobody has to follow it right now.
Then, in August 2026, the CFPB sent a new proposed rule, titled “Personal Financial Data Rights Reconsideration,” to the White House Office of Information and Regulatory Affairs for review, as Ballard Spahr’s Consumer Finance Monitor reported. Those reviews ordinarily take up to 90 days, which put the rough target in early November. As of mid-November 2026 the text hasn’t been published, so nobody outside the government knows exactly what it says. Once it appears in the Federal Register, the public gets a comment period before anything becomes final.
Why the Fee Question Matters So Much
The fee question isn’t hypothetical anymore. Banks started charging on their own while the rule was frozen.
In mid-2025, JPMorgan Chase said it would start charging aggregators for data access. It argued that answering automated requests at scale is a real cost. The numbers it put out are striking: in June 2025 alone, the bank said it received 1.89 billion data requests from aggregators, and only about 13% were tied to a customer actually doing something in an app. The rest were background refreshes. In September 2025, JPMorgan and Plaid reached a paid data access deal. People familiar with it described the fees as fractions of a cent per data pull, and Plaid said it wouldn’t pass the cost on to its roughly 7,000 app clients.
Other firms have followed. Fidelity and Schwab have reportedly pressed fintechs to pay for data too.
Now the rewrite may make fees officially allowed. PYMNTS reported that the Bureau has been weighing dropping the 2024 rule’s blanket ban, with one option letting banks charge after a set number of free requests. That idea has been described as a compromise between your right to your data and the bank’s cost of serving it.
What This Could Mean for You
I have mixed feelings about this one, and I think most people should.
The banks have a point. Billions of background requests aren’t free to handle, and a bank that’s on the hook when your data leaks has a fair interest in knowing who’s pulling it and how often. A world where every app connects through secure, permissioned channels is safer than one where your password is floating around in a scraper’s database.
But fees change incentives. Even a fraction of a cent per request adds up for an app that refreshes millions of accounts several times a day. Big aggregators can absorb that. Small startups, the ones that tend to build the scrappy free tools, may not. Over time, that could mean fewer free budgeting apps, more subscription fees, or apps that refresh your balance less often. Some analysts expect a slow squeeze rather than a sudden shock, which sounds about right to me.
There’s also a competition angle. A bank that can price access to your data has some say over which outside apps you can easily use, including apps that might help you move your money to a competitor with a better savings rate.
What You Can Do Now
None of this requires panic, but a little housekeeping is smart. Start by checking which apps you’ve connected over the years. Many banks now have a “connected apps” or “data sharing” page in their security settings where you can see and revoke access. Old apps you no longer use are still pulling data until you cut them off.
When you link a new app, prefer connections that send you to your bank’s own login page instead of asking you to type your bank password into the app’s screen. That’s the API route, and it’s the one you want.
Finally, keep an eye out for the CFPB’s proposal. When it’s published, there will be a public comment period, and regular account holders are allowed to weigh in. The question of whether you should pay, directly or indirectly, to use your own transaction history is one where your opinion counts as much as a bank lobbyist’s, at least on paper.
