Bank fees for data access threaten the foundations of open banking

Adobe Stock

JPMorganChase’s stunning move to force fintechs to pay for accessing customer data has roiled the open banking landscape. PNC, another major bank, is reportedly considering a similar approach. If those two banks get their way, rest assured more banks will follow suit, and that could spell the end of open banking in the U.S.

What does this mean for consumers and small businesses? It means Venmo could charge you just to pay your nanny or split a meal with friends. It means Coinbase might put your newly registered account on hold while they manually verify your bank account. It means Quickbooks users may be hit with a fee every time their bank transactions are refreshed. It means you may incur more overdraft fees as your favorite budgeting app has stopped working properly. In short, the fundamental benefits we take for granted in digital finance — low cost, speed and convenience — would be at risk of disappearing.

How did we get here? A quick overview of the history of open banking may help shed some light.

Open banking in the U.S. traces its roots to 1999 when Yodlee, the first data aggregator, was founded in Sunnyvale California. The core idea behind open banking is simple yet powerful: Consumers should own and control their own data. To make that possible, data aggregators built banking connections using a technique called screen scraping.

For more than a decade, the industry largely remained dormant. That changed in the early 2010s with the proliferation of smart phones and the rise of digital financial services. Powered by open banking solutions, fintechs encroached on banks’ turf by offering better products and services. Threatened by the competition and concerned with cyber security and privacy risk, a number of large banks, including JPMorganChase, attempted to “throttle” data access in 2015. 

Unable to rein in the aggregators and fintechs, those large banks were forced to negotiate direct data access agreements with aggregators. The outcome was a compromise accepted by all parties involved. Customer data access was ensured via secure APIs and fintechs agreed to stop screen scraping. 

Charging exorbitant fees for data access was never part of the deal for two reasons.

First, screen scraping posed security and fraud risk for banks. The benefits of establishing and maintaining secure API data access far outweigh the cost of guarding against fraudsters impersonating bank customers and preventing potential data breaches. 

It is worth noting that most fintechs were reluctant to “hand over the keys to the bank.” Giving up screen scraping meant ceding control to financial institutions that might later restrict access or impose fees. In Europe, this concern was so strong that a group of fintechs published a manifesto opposing a EU proposal to force fintechs to access customer data via bank APIs.

Second, the CFPB was watching. The agency’s pro-open banking stance had been extremely consistent across the last three administrations. After a long delay, the agency kicked off the Section 1033 rulemaking process during the first Trump administration and finalized the rule toward the end of the Biden administration. Despite enjoying bipartisan support, the rule faced immediate legal challenge from the banking lobby the moment it was released. 

The banking lobby and its allies have attacked the rule as “central planning” and “regulatory overreach” and insisted that “a better path is to let the market lead.” They also argue that banks are entitled to charge for data access as banks “have invested billions of dollars in building systems to protect consumers’ data and information.”

Earlier this year, the current Trump administration bought into those flawed and uninformed arguments and decided to kill the rule. Unfettered and emboldened, the nation’s largest banks finally seized the opportunity to exact revenge and reclaim control over consumer data.

The 1033 rule is far from being perfect. However, it largely codifies the best industry practices over the last decade. It even defers to the industry to set technical standards, hardly the hallmark for “central planning.” That’s why the rule has strong support from the fintech and crypto industries which are largely composed of “little tech” rather than “big tech.” Without the proper regulatory guardrails, which the 1033 rule aims to set up, or the threat of regulatory interventions, this “well-functioning ecosystem that was thriving under private industry initiatives” is quickly falling apart. Now JPMorganChase is indeed leading the market but in the wrong direction that stifles innovation and crushes competition. 

The rationale for charging excessive fees simply doesn’t hold water.

First, protecting and securing customer data is not only expected by consumers, but also mandated by law. This is the most fundamental obligation for all financial service providers, bank or nonbank. No one has ever seen a “data security surcharge” on their bank or credit card statement.

Second, as noted earlier, moving from screen scraping to APIs is tremendously beneficial for banks. If the cost were truly that high, banks would have pushed aggressively for fee negotiations a long time ago.

Open banking is now at a critical juncture. It is encouraging that the CFPB recently reversed its earlier position and decided to revisit the rule. The CFPB must unequivocally state that consumers own their financial data and prohibit financial institutions from monetizing access to it. No one, not even the biggest bank in the country, should dictate with whom consumers can share their data.

Financial innovation has long stood as the crown jewel of American capitalism and entrepreneurship, driving economic growth and fostering competition. But without open banking, financial innovation is like a tree without roots, destined to wither. The choice before us is simple: Nourish those roots or watch the crown jewel of our economy lose its luster.