Open Banking Without Forced Subsidies

The Issue

Consumers should be able to compare loans, move to a better-paying deposit account, and authorize software to manage their finances. Delivering those services requires infrastructure that someone must finance. Washington cannot establish that open banking is affordable simply by prohibiting one business from charging another. A zero-price mandate transfers the bill; it does not eliminate it.

Section 1033 requires a covered person, such as a bank, to make account information available to a consumer upon request in a usable electronic form, and directs the Consumer Financial Protection Bureau (CFPB) to promote standardized formats while respecting technological neutrality. The statute gives consumers a right to their data. A commercial firm does not become a consumer by requesting that data, and nothing in the statute says delivery to such firms must be free. The CFPB’s own 2024 rule defines a consumer as a natural person and treats apps and aggregators as third parties acting with a consumer’s authorization.

The 2024 rule prohibited charges for required interfaces and data requests. Its compliance dates were stayed on October 29, 2025, and the Bureau’s reconsideration reopened representative status, fees, and security. A rewrite is now under review at the White House budget office; its details have not been released. The policy choice is whether a replacement repeats that price control. SPPI’s research calls for voluntary contracts and accountability across the data-sharing chain. Its subsequent commentary distinguishes control of personal information from commercial use of bank infrastructure. Calls to repeal the rule rest on the same concern about compulsory subsidies.

Application programming interfaces (APIs) let software communicate directly. An aggregator such as Plaid connects financial institutions with apps a consumer authorizes. The service entails authentication, permissions, capacity, maintenance, and incident response. The rule’s 99.5% monthly proper-response requirement, excluding scheduled downtime, illustrates the ongoing obligation. Keeping account records for a bank’s own business does not pay for every external delivery service. Nor should banks attribute all preexisting technology spending to the mandate.

The CFPB’s sample of large depository providers reported annual developer-interface costs of $2 million to $47 million, with a $21 million median. Some could not cleanly separate these costs from other systems. These are reported interface costs, not the marginal cost of a request or the rule’s incremental burden. They establish neither an appropriate tariff nor costless infrastructure. The Bureau asked separately about fixed, marginal, and authorization costs when reopening the rule.

Even if the next transmission costs very little, maintenance and future investment still require financing. Banks also benefit from secure interfaces, which can be reflected in negotiated prices. Subscriptions, volume commitments, and service levels can distinguish frequent polling from a one-time verification. A federal price of zero prevents that bargaining over compensation. It is a regulatory choice, not a finding that the service has no economic cost.

Ronald Coase supplies no rule that the party already holding the records must absorb every expense. His analysis examines bargaining under clearly defined rights and, when transactions are costly, compares the actual costs of alternative institutional arrangements. Choosing who can perform a task efficiently is different from deciding who pays that provider. It is possible for a bank to operate the interface at least cost and for an intermediary to compensate it. Neither unrestricted gatekeeping nor compulsory free service follows automatically from Coase.

Fintech charges may reach app users; unrecovered bank costs may reach depositors or borrowers, including people who never use an app. The CFPB recognized possible pass-through through account fees, deposit rates, and credit prices, without quantifying its extent. Neither channel is inevitable or necessarily dollar-for-dollar. The analogy to payment-card interchange cuts against selective accounting: changing which business receives the bill does not establish which households ultimately pay it.

Negotiated pricing and continued access can coexist. In September 2025, JPMorganChase and Plaid announced a renewed agreement containing a pricing structure and no change to Plaid’s current customer agreements and pricing. Dave separately confirmed no change to its existing Plaid access or fees. The disclosed outcome was a negotiated pricing arrangement, not abandonment of commercial pricing. These announcements do not prove permanently unchanged prices, but they contradict claims that an aggregator charge necessarily becomes an immediate consumer surcharge. They do not establish that regulatory pressure alone produced the agreement.

Secure access already operates at scale. Financial Data Exchange (FDX) reported roughly 114 million connections through aligned APIs in April 2025, up from 76 million a year earlier. Figure 1 shows that expansion before the earliest scheduled compliance deadline. These North American connections are not unique consumers and cannot be added to Plaid’s account totals. Nor do they isolate voluntary adoption from anticipation of regulation. They do establish that the alternative to free mandated access is not universal password sharing. Existing standards and contracts provide a foundation for further progress.

Competition concerns deserve a remedy. A bank that competes with an app may have an incentive to obstruct it; dominant aggregators may also disadvantage entrants. Secure access should not be undermined by exclusionary fees, discriminatory delays, or forced manual downloads. Yet telephone portability does not establish a zero-price principle: FCC guidance permits porting charges while prohibiting refusal to port because of an unpaid balance. Access obligations and cost recovery can coexist. Enforcement should address unlawful exclusion, not assume every charge is exclusionary.

Security requires more than changing the access technology. The 2024 rule limited data use, required periodic reauthorization, and imposed Gramm–Leach–Bliley Act safeguards or the Federal Trade Commission’s security-program requirements; aggregators had certification obligations. It nevertheless declined to establish a comprehensive commercial liability-allocation regime. Responsibility should follow control of data, with verifiable safeguards and credible financial recourse. Existing protections for consumers should remain distinct from how firms allocate losses among themselves.

AI agents raise the stakes. Software that logs in and acts for a customer can request data far more often than any person, and a compromised or rogue agent can be hard to tell apart from an authorized one. JPMorgan Chase’s chief executive warned on the bank’s October earnings call about “rogue agents” and urged customers not to give their bank passwords to Meta, which runs a popular AI agent. Bank lobbyists say the rewrite now under White House review could become the vehicle for regulating those agents. Defending against them takes stronger authentication, anomaly monitoring, rate limits, and fast revocation, and those costs grow as the threats change. A rule that bars banks from charging for access leaves those costs with banks and their other customers, while the firms deploying agents pay nothing toward the security load they create at the bank. Negotiated access terms let the price reflect that load, and the cost of building the interfaces in the first place.

SPPI’s earlier rent-payment analysis highlights why accountability matters to households. Reliable account verification and rent-payment services depend on clear duties among banks, aggregators, and vendors. Section 1033 governs data access, which must be distinguished from the movement of rent funds. Policymakers should evaluate service interruptions, misuse, and financial recourse alongside access charges. A tenant needs a dependable service, not merely a connection whose wholesale price has been set to zero.

Mortgage verification, monitoring designed to protect older adults, and AI assistants may create substantial value. Their usefulness does not prove that uncompensated access is necessary for their survival. A housing-affordability claim must identify the requests charged, negotiated prices, pass-through, and offsetting savings. Listing potential charges at each mortgage stage does not measure a borrower’s total cost. Promising applications justify dependable infrastructure; they do not establish its proper price.

International adoption likewise does not settle American law or cost allocation. The United Kingdom’s mandate followed a competition investigation and a specific 2017 order. That framework requires evaluation on its results, not imitation by analogy. A poll favoring free access cannot reveal who should finance it unless respondents confront the tradeoffs. Objections to account closures and support for children’s savings programs do not establish that every commercial data connection should be uncompensated. Those goals must be evaluated separately from the subsidy.

What We Recommend

1. Remove the zero-price mandate. The CFPB should repeal § 1033.301(c)’s ban on compensation and avoid recreating it in a replacement. Preserve usable consumer access and permit negotiated payment for commercial delivery. Any broader compulsory regime should require clear congressional authorization.
2. Protect competition through access and contracting. Enforce existing prohibitions on unlawful exclusion. Support interoperable industry standards and reusable agreements that smaller banks and new entrants can use. A price should not become a disguised denial of authorized access.
3. Make responsibility follow control. Preserve consumer remedies and require verifiable security and meaningful financial accountability from each data handler. The transition away from credential-based scraping should close gaps in responsibility, with consistent safeguards across institutions of different sizes.
4. Test affordability across the entire market. Evaluate incremental costs, benefits, and likely pass-through for banks, intermediaries, app users, and nonusers. Claims of consumer savings should account for investment, reliability, and fraud costs as well as access charges.

Consumers should direct their information. Firms should negotiate the service that moves it. An affordability policy should reduce total costs, not hide them behind a mandated price of zero.

Read the full paper at southwestpolicy.com/sppi08