CFPB Opens Gate for Banks to Charge Open Banking Fees

The Consumer Financial Protection Bureau may be about to turn America's budding open banking system into a toll road. According to a new rulemaking submission, the agency is reconsidering its decisive ban on data-access fees, teeing up a direct fight over who pays to make your financial data portable. The proposal could allow banks to charge fintechs for account data after a threshold of free requests, rewriting the economics of financial innovation according to PYMNTS.

This isn't a minor technical tweak. It's a fundamental renegotiation of whether consumers truly own their financial history or whether banks can monetize the right to share it. The decision will dictate whether the U.S. builds an open, competitive ecosystem or one quietly gated by new fees.

The Fee Nudge: How CFPB's Quiet Rewrite Threatens to Besiege Open Banking

The core conflict is stark. Section 1033 of the Dodd-Frank Act was created to empower consumers with their data. The CFPB’s 2024 final rule operationalized that right, requiring banks to share transaction data with authorized apps for free. That rule is now frozen by a court injunction, and the agency is reconsidering nearly everything, with the fee prohibition at the top of the list.

Allowing banks to charge third parties would recalibrate the entire system. Data portability ceases to be an inalienable right and becomes a metered service. The natural endpoint is a landscape where data flows not freely, but along the cheapest or most negotiated paths. The stakes are high precisely because the change is subtle. No one is advocating to kill open banking outright. Instead, the besieging force wants to tax the traffic.

Ballard Spahr's analysis, which first flagged the potential fee shift, represents the canary in this coal mine. It reported the CFPB is considering "eliminating the 2024 rule’s blanket prohibition on data-access fees and instead allowing data providers to charge after fulfilling a certain number of requests without charge." That fee-after-threshold model is the compromise on the table. It acknowledges the banks' cost-recovery argument while preserving some level of free access, likely aimed at small-scale use cases, a pattern seen in other sectors like the bank-led push into Earned Wage Access.

The fee issue could prove particularly contentious. Banks… have argued that Section 1033 itself does not prohibit reasonable cost recovery and that building and maintaining secure application programming interfaces and related infrastructure imposes substantial continuing expenses.

This XOOMAR analysis concludes the central question is no longer whether consumers can share data, but who profits from its movement. The pivot from a free-access mandate to a monetized framework would redefine "open" as a commercial term rather than a consumer right, creating subtle obstacles for fintech innovation before a single line of code is written.

From Fort Knox to Marketplace: Section 1033’s Original Vision Versus the New Reality

Dodd-Frank’s Section 1033 was born from a simple idea: a consumer has a right to their own financial information in a usable, electronic format. For over a decade, the statute sat dormant, while the market filled the vacuum with private, often fragile data-sharing agreements. The CFPB’s 2024 rule aimed to codify market practices into enforceable rights, starting with free, secure API-based access for credit and deposit accounts.

The industry backlash was immediate. A coalition of bank groups filed suit the same day the 2024 rule was finalized. Their core grievance is in the open banking tracker: they argued the rule forced them to bear significant costs building and maintaining APIs while being barred from charging the third parties benefiting from them. After a change in administration, the CFPB itself switched sides in court, agreeing the rule was legally flawed and announcing a full-scale rewrite.

The agency’s August 2025 Advanced Notice of Proposed Rulemaking (ANPRM) formally reopened the rulebook. It sought comment on four major issues, with nearly 14,000 responses. The questions are:

1. Who qualifies as an authorized third party?
2. Can data providers charge fees?
3. How should privacy and cybersecurity be balanced?
4. How heavy are the compliance burdens?

Fees landed as the most contentious point because they flip the property-rights model on its head. The original vision treats personal financial data as an asset belonging to the individual, with the bank merely a custodian. Introducing fees reframes data access as a service the bank provides, transforming a consumer's right into a corporate commodity.

The legal quagmire has real-world consequences. The first compliance date of April 1, 2026, for the largest institutions came and went with no effect due to the injunction. This regulatory vacuum has pushed states like New York to introduce their own open banking bills, potentially creating a fragmented national landscape where data-sharing rights depend on your zip code.

The Permitted Toll Road: A Stakeholder Map of Winners and Losers

If the CFPB permits data-access fees, the immediate impact is financial. This creates a clear stakeholder map dominated by balance sheet size.

Potential Winners: Incumbents and Infrastructure Giants

• Large Banks & Credit Unions: They gain a potential new revenue stream. They have long argued that API infrastructure is costly and creates liability; fees would offset that. It also changes their competitive position relative to fintechs, potentially raising their rivals' cost of doing business.
• Core Banking Processors: Entities like FIS, Fiserv, or Jack Henry would be tasked with implementing and managing the fee-charging infrastructure. As we saw in the recent Fiserv Core Banking Revenue Plunges 10% in Crisis, legacy tech giants are under pressure. A new, complex fee-billing mandate could drive expensive service engagements, turning regulatory change into a revenue opportunity for their professional services arms.

Potential Losers: The Fintech Innovation Layer

• Early-Stage Fintechs & Startups: These companies often operate on thin margins and rely on free data access to bootstrap. A per-API-call fee, even after a threshold, adds a variable cost that can kill unit economics. Their growth, often measured in user and data-connection volume, becomes financially punitive.
• Personal Financial Management (PFM) Apps: Services that aggregate data across many accounts to provide holistic views are high-volume, low-margin use cases. They would be hit hardest by usage-based fees. Consumers might see these services introduce paywalls, reduce update frequency, or drop support for smaller banks.
• Comparison & Underwriting Services: Tools that scan transaction data to find better loan rates or personalized insurance quotes rely on frequent data refreshes. Fees could make this model prohibitively expensive, reducing market transparency and competition.

The Consumer Question For end-users, the effect is indirect but real. Fintechs facing new costs have three choices: absorb the hit and compress margins, pass costs through via higher subscription fees or new paywalls, or stop supporting certain bank connections altogether. The risk is a consolidation of innovation where only well-funded giants like Chime or SoFi can afford comprehensive data access, narrowing consumer choice. The promise of easier account-switching and better product discovery, the core of open banking, fades if the data diet is rationed by cost. For a perspective on a startup navigating this complex landscape, see our coverage of Erebor Quadruples Deposits In 100 Days For $8B Valuation.

Beyond Consumer Choice: The Financial Health and Security Implications

The CFPB’s mandate includes protecting consumers from unfair practices and promoting financial health. Allowing data-access fees could run counter to both goals in unintended ways.

First, it could drive consumers back to less secure methods. If fintechs respond to fees by limiting API calls or dropping bank connections, users desperate for aggregation might revert to manual uploads or, worse, share their banking login credentials with apps using screen-scraping. The 2024 rule was designed to kill this insecure practice; a fee regime could inadvertently resurrect it.

Second, financial-health tools targeting underbanked or low-income consumers are often the most margin-sensitive. The very applications designed to help people improve credit, avoid overdrafts, or automate savings could be systematically disadvantaged by new, per-use costs. The CFPB’s own research shows these tools have value. Enabling fees could paradoxically reduce access to them, harming the financial health of vulnerable populations.

Finally, there's a competition paradox. By allowing data providers to charge, the CFPB might believe it's creating a fairer market. In practice, it could do the opposite. Fees create a new barrier to entry, protecting incumbents and cementing the dominance of large, established players. True financial health stems from choice, competition, and transparency, elements that a pay-to-play data ecosystem directly undermines.

The Global Inflection Point: Will US Financial Innovation Fall Behind?

The U.S. is late to formal open banking. The UK and EU, under PSD2, established frameworks years ago with a clear principle: data access for third-party providers (TPPs) is free. The goal was to spur competition, lower prices, and fuel innovation by treating data portability as a right, not a revenue line. It has created a vibrant, if regulated, fintech sector.

If the U.S. legitimizes data-access fees, it chooses a divergent path. The American model would signal that the infrastructure for data sharing is a privatized utility, open to congestion pricing. The risk is that the U.S. becomes a more expensive, less dynamic market for building global fintech products. Why develop a budgeting app that must factor in unpredictable U.S. data costs when the European market offers a predictable, free-access baseline?

This divergence could also fragment global fintech services. A multinational app might offer richer features in markets with free data access and a stripped-down version in the U.S. where every API call carries a cost. The long-term strategic question is whether the U.S., by prioritizing bank compensation, willingly cedes leadership in the next wave of consumer financial innovation to regions with more open, predictable rules.

Navigating the New Rules: The Pragmatic Future for Fintechs Under a Fee Regime

The CFPB’s specific proposal remains under wraps at the White House Office of Information and Regulatory Affairs (OIRA). Its review typically takes up to 90 days, but given the CFPB’s stated priority, it could be just weeks. The shape of the rule will determine the fintech industry's next moves.

Here is the key commercial relationship that will be tested under a fee regime:

Practical outcomes to watch for:

• Consolidation: Smaller fintechs may be acquired or fold. Others might merge to achieve negotiating scale with banks on fees.
• Specialization: Apps may stop trying to be all-in-one finance hubs. Instead, they'll focus on high-value, low-data-use niches where margins can absorb fees.
• Rise of Toll-Paying Aggregators: Companies like Plaid could evolve further, negotiating bulk data-access agreements with banks and reselling access to smaller developers, adding a new layer to the data supply chain.
• Bank-Branded Apps Flourish: Incumbents might double down on their own PFM tools, leveraging their "free" internal data access as a competitive advantage over third-party apps they now charge.

The ultimate signal lies in the fee structure details. A high free-tier threshold could neuter the impact for most apps. A low threshold or high per-call cost would be transformative. The CFPB’s decision on this single issue will define whether "open banking" becomes a new, competitive marketplace or a closed ecosystem of financial gatekeepers. Watch the OIRA docket. When the "Personal Financial Data Rights Reconsideration" proposal drops, the fee section will be the first page everyone reads.

Disclaimer: This XOOMAR analysis is for informational and educational purposes only. It is not financial, investment, legal, tax, or professional advice. It does not provide buy, sell, hold, price-target, portfolio, or personalized recommendations. Verify information independently and consult qualified professionals before making decisions.

Impact Analysis

• It could fundamentally shift who pays for data portability, potentially imposing new costs on fintechs and consumers.
• It renegotiates whether consumers truly own their financial data or if banks can monetize access to it.
• The decision will shape whether the U.S. builds an open, competitive financial ecosystem or one gated by fees.