Open Banking Explained in The US

Data Sharing, Benefits and Privacy Risks

1. Open banking in one minute

Open banking is a system that lets you instruct a bank, credit-card issuer, payment provider, or other financial company to share selected account data with another service. In everyday life, it is what makes it possible to connect a checking account to a budgeting app, verify income for a loan, view several accounts in one dashboard, or move money using an account-to-account payment service.

The important word is permission. Open banking does not mean that everyone can see your bank account. It means data can move through a consumer-authorized connection, ideally using a secure application programming interface (API) rather than by giving an app your online-banking username and password.

2. What open banking means in the United States

Open banking is consumer-directed financial data sharing. A consumer asks one financial provider, called the data provider, to make certain information available to another company, often called a third party, data recipient, fintech, or data aggregator. The receiving service uses that data for a purpose the consumer requested, such as budgeting, payment initiation, account verification, underwriting, or financial advice.

Unlike the United Kingdom and European Union, the United States did not begin with a single nationwide open-banking mandate and standardized implementation timetable. U.S. data sharing developed mainly through private agreements among banks, aggregators, payment networks, and fintech companies. Section 1033 of the Dodd-Frank Act created a federal statutory right to access certain financial information, and the CFPB issued a detailed rule in 2024. That rule is now under reconsideration and subject to a court injunction, so the practical system remains a mixture of market standards, contracts, existing privacy and security law, and an unsettled federal rulemaking process.[1][2][3]

2.1 Open banking, open finance, and banking-as-a-service

2.2 What open banking is not

• It is not public access to your account.
• It does not automatically authorize a company to move money; data access and payment authority are separate permissions.
• It is not the same as selling your financial data, although privacy terms may permit broader uses unless law or contract restricts them.
• It does not guarantee that every bank, product, or data field can connect to every app.
• It does not eliminate the need to review the third party’s privacy, security, dispute, and deletion practices.

3. How open banking works

A modern open-banking connection usually involves four parties: you, your financial institution, the app or service you want to use, and sometimes a data aggregator that handles the technical connection. The aggregator may connect thousands of financial institutions to many apps, reducing the need for each app to build a separate connection to every bank.

3.1 Typical step-by-step process

1. You choose “Link bank,” “Connect account,” or a similar option inside an app.
2. The app identifies your bank and sends you to a bank-controlled login or authorization screen, or opens a secure bank window.
3. You authenticate with the bank. Multi-factor authentication may be required.
4. The authorization screen explains which accounts and data categories will be shared, why they are needed, and how long access may continue.
5. You approve the connection. The bank or aggregator issues a token or other credential so the app does not need to store your banking password.
6. The app retrieves permitted data through an API. Depending on the service, data may refresh periodically or on demand.
7. You can later review or revoke access through the app, your bank’s security or privacy dashboard, or both.

3.2 What is an API?

An application programming interface, or API, is a controlled digital doorway that lets software systems exchange specific information in a defined format. A well-designed financial API can limit which data is available, verify the receiving party, log activity, and revoke access without changing the consumer’s password.

3.3 Tokens, consent, and refresh access

A token is a digital credential that represents an approved connection. It can be narrower than a password because it may allow only certain data or actions. Some tokens expire quickly; others can refresh so the app can continue updating information. Long-lived access is convenient but increases exposure if the third party is compromised or the consumer forgets the connection exists.

4. What financial data may be shared

The exact data depends on the product, bank, API, agreement, and applicable law. Common categories include account identifiers, balances, transaction history, payment information, fees, interest rates, rewards, and account terms. Data may reveal far more than a balance: transaction descriptions can indicate where a person shops, travels, worships, receives medical care, donates, or works.

5. Benefits of open banking

5.1 Benefits for consumers

• One financial view: Combine checking, savings, credit cards, loans, and investments in one dashboard.
• Better budgeting: Automatically categorize spending, monitor cash flow, and identify recurring subscriptions.
• Easier account switching: Transfer information to a competing provider without rebuilding financial history manually.
• Faster verification: Confirm account ownership, income, assets, or cash flow for loans, rentals, and other applications.
• More tailored products: Lenders or financial tools may evaluate real cash flow rather than relying only on traditional credit data.
• Lower-cost payments: Account-to-account payments may reduce dependence on card networks in some settings.
• Fraud detection: Aggregated views can help consumers spot unfamiliar transactions across multiple accounts.
• Automated savings and cash management: Apps can analyze balances and move permitted amounts according to rules the user chooses.

5.2 Potential benefits for small businesses

• Automated bookkeeping and bank reconciliation.
• Faster cash-flow forecasting and invoice matching.
• Simpler verification of revenue and account ownership.
• Access to financing based on transaction data, subject to underwriting and fair-lending requirements.
• Less manual data entry and fewer file uploads.

5.3 Potential economic benefits

At a market level, data portability can reduce switching costs and make it harder for an incumbent provider to retain customers merely because moving information is difficult. It can also help new firms offer products without operating a full banking infrastructure. The benefits depend on interoperability, reliable data, security, liability rules, and the ability of consumers to understand and control consent.

6. Privacy, security, and fraud risks

6.1 Risk 1: Consent that is broader than expected

Consumers often click through permission screens quickly. A request framed as necessary for one feature may include more accounts, more years of history, more frequent refreshes, or more uses than the consumer expects. The safest design uses data minimization: collect only what is necessary, use it only for the stated purpose, and retain it only as long as needed.

6.2 Risk 2: Secondary use, profiling, and monetization

A company may use financial data to personalize services, train models, market products, create risk scores, or share information with affiliates and service providers. Whether a particular use is allowed depends on the company, consent, contracts, and law. Consumers should distinguish between data needed to provide the requested service and optional uses for advertising, cross-selling, analytics, or model development.

6.3 Risk 3: Cybersecurity and concentration

Open banking can reduce password sharing, but it also creates valuable data stores and connection hubs. Aggregators and multipurpose financial apps may become attractive targets because one breach can affect many institutions or reveal a consumer’s entire financial life. The FTC Safeguards Rule requires covered nonbank financial institutions to maintain a written security program with administrative, technical, and physical protections; its requirements include risk assessment, access controls, encryption, multi-factor authentication, testing, service-provider oversight, incident response, and certain breach notifications.[4][5]

6.4 Risk 4: Screen-scraping credentials

Some connections still rely on screen scraping, in which a service logs into the consumer’s account and reads information from web pages. This can require the consumer to provide banking credentials to an intermediary. It may also collect more information than necessary, break when a bank changes its website, or trigger fraud controls. Tokenized API access is generally preferable when available.

6.5 Risk 5: Fraud and social engineering

Criminals may impersonate a bank, aggregator, lender, or support representative and ask the consumer to “reconnect” an account. A legitimate connection should not require sending a password, one-time code, or remote-access permission through email, text, chat, or phone. Fraudsters may also trick consumers into authorizing payments, which can complicate reimbursement if the transaction appears technically authorized.

6.6 Risk 6: Inaccurate, stale, or miscategorized data

APIs and aggregators may show pending transactions, duplicate items, missing merchants, or incorrect categories. A lender or financial tool may draw a poor conclusion from incomplete history. Consumers should review important data before relying on it for credit, taxes, budgeting, or business decisions and should preserve supporting records.

6.7 Risk 7: Difficult revocation and deletion

Stopping future access does not necessarily delete data already collected. Revocation, account disconnection, account closure, and data deletion are distinct actions. A consumer may need to revoke access at the bank, disconnect the account in the app, and separately submit a deletion request to the third party. Legal retention obligations may allow some records to remain.

6.8 Risk 8: Unclear liability

When a problem involves a bank, app, aggregator, and payment provider, each party may point to another. The answer can depend on whether the issue is unauthorized access, an electronic fund transfer, identity theft, inaccurate underwriting data, breach of contract, or a privacy violation. Save screenshots, authorization records, notices, and communications, and report problems promptly.

7. U.S. laws and regulatory status

The United States has no single comprehensive federal consumer privacy law covering every open-banking participant and use. Instead, multiple laws and regulators may apply depending on the entity, product, data, state, and activity. This creates overlap as well as gaps.

7.1 Section 1033 and the CFPB rule

Section 1033 of the Consumer Financial Protection Act, part of the Dodd-Frank Act, provides that consumers may obtain certain information about financial products or services from covered persons, subject to CFPB rules. The CFPB’s 2024 final rule required covered data providers to make specified data available securely to consumers and authorized third parties and imposed authorization, use, retention, and other obligations on third parties.[1][2]

The final rule became effective January 17, 2025 and originally used phased compliance dates from 2026 through 2030. In 2025 the CFPB opened a reconsideration focused on who may act as a consumer representative, whether providers may charge fees, security, and privacy. A federal court later issued a preliminary injunction pausing compliance while reconsideration proceeds. As of August 1, 2026, consumers and businesses should not assume that the original compliance timetable is operative or that the 2024 rule will remain unchanged.[2][3]

7.3 Gramm-Leach-Bliley Act (GLBA)

GLBA governs financial privacy and information security for many financial institutions. The privacy framework generally addresses notices and certain sharing of nonpublic personal information, while the Safeguards Rule and bank-regulator standards require appropriate protection of customer information. Coverage and enforcement vary by entity. The FTC notes that GLBA applies beyond banks to many companies providing financial products or services.[4][5]

7.4 Electronic Fund Transfer Act and Regulation E

Regulation E provides important rights for many consumer electronic fund transfers, including error-resolution procedures and limits on liability for certain unauthorized transfers. Protection depends on the transaction and facts. A consumer who was deceived into initiating or authorizing a payment may face a different analysis from a transfer made after stolen credentials were used. Report suspected errors quickly and follow written notice procedures where appropriate.[6]

7.5 Fair Credit Reporting Act (FCRA)

If transaction or account data is assembled or used for consumer-reporting purposes, the FCRA may apply to the company or use. It can create rights involving permissible purpose, accuracy, adverse-action notices, file disclosure, and disputes. Not every budgeting app or data transfer is a consumer report, so the role and use matter.[2][7]

7.6 State privacy and data-security laws

State laws may provide rights involving access, deletion, correction, or opt-outs, but many contain exemptions for financial institutions or data regulated by GLBA. The scope of exemptions differs. State breach-notification laws, unfair-practices laws, biometric rules, and sector-specific requirements may also apply. Consumers should review state attorney general resources for local rights.

8. Open banking versus screen scraping

API access is not automatically safe. An app can still over-collect, retain data too long, suffer a breach, or make misleading disclosures. The security advantage comes from narrower permissions, strong authentication, tokenization, encryption, monitoring, and accountable governance—not from the word “API” alone.

9. How to evaluate an open-banking app or service

9.1 A practical decision framework

9.2 Questions to ask before connecting

• Does the service need transaction history, or would account verification alone be enough?
• Can I choose one account instead of every account at the institution?
• Is access one-time or continuous?
• Will the company use data for advertising, underwriting, model training, or sharing with affiliates?
• Can I use the core service without agreeing to optional data uses?
• Where is data stored, and is it encrypted in transit and at rest?
• How does the company authenticate users and employees?
• Can I export, correct, revoke, and delete data?
• What laws, regulator, and complaint process apply?
• What happens if the connection causes a payment error, incorrect decision, or account lockout?

10. How to connect and disconnect safely

10.1 Safe connection checklist

1. Download the app from an official store or use the company’s verified website.
2. Research the company, privacy policy, data-retention practices, and security history.
3. Use a unique password for the app and enable multi-factor authentication.
4. Prefer a bank-hosted authorization screen and avoid sending credentials or one-time codes to anyone.
5. Select the minimum number of accounts and data categories needed.
6. Read the authorization period and purpose before approving.
7. Save a screenshot or confirmation of what you authorized.
8. Review connected apps periodically in both the app and your bank account.
9. Turn on transaction and login alerts at your bank.
10. Disconnect services you no longer use and request deletion where appropriate.

10.2 How to disconnect thoroughly

1. Revoke access in your bank’s “connected apps,” “data sharing,” “security,” or “privacy” settings.
2. Disconnect or remove the financial institution inside the third-party app.
3. Cancel any separate payment mandate, automatic debit, or transfer authorization if applicable.
4. Request deletion of previously collected data, understanding that legal or fraud-prevention records may be retained.
5. Confirm the connection is no longer refreshing and monitor the account for unexpected activity.
6. Change your bank password if you shared credentials directly or suspect compromise.

11. Costs, fees, credit, taxes, and consumer rights

11.1 Fees and hidden costs

Open-banking connections are often presented as free to consumers, but the business model still matters. An app may charge a subscription, earn referral fees, receive payment-processing revenue, cross-sell products, or use data to support other services. Banks, aggregators, and fintechs may also negotiate access or service fees. The CFPB’s reconsideration specifically raised the question of whether and how data providers may charge for responding to consumer-directed requests.[3]

• Monthly or annual app subscriptions.
• Expedited transfer or instant-payment fees.
• Foreign-exchange markups or payment fees.
• Overdraft, nonsufficient-funds, or late fees triggered by automated movements.
• Premium analytics or credit-monitoring charges.
• Opportunity cost from recommendations influenced by referral compensation.
• Costs of resolving fraud, errors, or identity theft even when direct monetary liability is limited.

11.2 Credit impact

Simply connecting a bank account to a budgeting app normally does not create a hard credit inquiry. However, a lender may use connected account data in underwriting, and a credit application may involve a credit report, inquiry, or adverse-action rights. Ask whether the service is only verifying data or is making a credit decision, and whether it will obtain a consumer report.

11.3 Tax implications

Sharing or aggregating financial data is not itself a taxable event. Tax consequences arise from the underlying transactions, income, gains, rewards, interest, business expenses, or payments. Automated categorization is not a substitute for tax records. Review imported data for duplicates, personal-versus-business classification, and missing transactions before using it for a return.

11.4 Consumer rights and complaint paths

• Contact the bank, app, aggregator, or payment provider promptly and keep a written record.
• For an electronic fund transfer error, follow the institution’s Regulation E dispute instructions and act quickly.[6]
• For identity theft, use the FTC’s IdentityTheft.gov recovery process and consider a fraud alert or credit freeze.[8]
• For a consumer-report issue, dispute with the reporting company and the source of the information.[7]
• File a complaint with the relevant regulator, such as the CFPB, FTC, bank regulator, state attorney general, or state financial regulator.
• Consider legal advice where losses are significant, deadlines are approaching, or responsibility is disputed.

12. Common mistakes and best practices

12.1 Expert best practices

• Use data minimization as your default: fewer accounts, fewer fields, shorter history, shorter duration.
• Prefer services that separate essential processing from optional advertising or analytics consent.
• Keep the bank as the place where you authenticate whenever possible.
• Enable alerts for new logins, linked apps, transfers, low balances, and profile changes.
• Treat financial-data permissions like recurring subscriptions: review them regularly and cancel unused access.
• Preserve records when data will affect a loan, rental, tax filing, insurance decision, or business report.
• Do not place your only emergency funds in an account controlled by unfamiliar automation.
• For business use, assign an owner for connected apps, access reviews, vendor risk, and offboarding.

13. The future of open banking in the United States

The long-term direction is toward more consumer-directed data portability, but implementation details remain contested. The largest policy questions are who qualifies to request data for a consumer, whether providers may charge access fees, which security standards should apply, how liability should be allocated, and how to prevent data from being reused or monetized beyond the consumer’s purpose.[3]

13.1 What to watch

• A revised or replacement CFPB rule and the outcome of litigation.
• Whether compliance dates are reset and which institutions are covered.
• Recognition or use of industry standards and certification programs.
• Rules on access fees, payment initiation, and liability.
• Greater use of tokenized APIs and reduced reliance on screen scraping.
• Expansion from bank accounts and cards into open finance, payroll, investments, and insurance.
• State privacy-law developments and treatment of GLBA-covered entities and data.
• Use of transaction data in AI-driven underwriting, fraud detection, personalization, and financial advice.

14. Frequently asked questions

14.1 What is open banking in simple terms?

Open banking lets you authorize one financial company to share selected account data with another service, usually through a secure digital connection.

14.2 Is open banking legal in the United States?

Yes, consumer-authorized data sharing is widely used and Section 1033 establishes a federal data-access right subject to CFPB rules. The detailed 2024 CFPB rule is currently enjoined and under reconsideration, so its long-term requirements remain unsettled.

14.3 Does open banking mean my bank data is public?

No. Data should be shared only with your authorization and for permitted purposes. The practical risk is that consent may be broader or longer-lasting than you realize.

14.4 Is open banking safe?

It can be safer than password-based screen scraping when it uses tokenized APIs, strong authentication, encryption, narrow permissions, monitoring, and accountable third parties. It is not risk-free.

14.5 What is screen scraping?

Screen scraping is automated login to a financial account to read information from web pages. It may require sharing credentials and can collect more data than necessary.

14.6 Can an open-banking app move my money?

Not merely because it can read data. Payment initiation requires separate authority. Some apps combine data access and payment features, so review each permission carefully.

14.7 Will linking my bank account hurt my credit score?

Usually not by itself. A lender may separately obtain a credit report or use cash-flow data in underwriting. Ask whether a hard inquiry will occur.

14.8 Can I revoke access?

Usually yes, through the app, bank, or both. Revoking future access does not automatically delete previously collected data or cancel autopay.

14.9 How long can an app keep my data?

It depends on law, consent, policy, and legitimate retention needs. Look for a clear retention period and a separate deletion process.

14.10 Can my data be sold?

Policies and legal restrictions vary. Review whether the company sells, licenses, shares, or uses data for advertising, analytics, model training, or affiliate marketing.

14.11 What should I do if I see an unauthorized transaction?

Contact the financial institution immediately, secure the account, and follow its error-dispute process. Speed matters because legal protections and liability can depend on notice timing.

14.12 Is Plaid or another aggregator the same as open banking?

An aggregator is one type of company that provides technical connections between financial institutions and apps. Open banking is the broader data-sharing system.

14.13 Are small banks required to provide APIs?

Coverage depends on the governing rule and current legal status. The 2024 CFPB rule exempted certain small institutions and phased duties by size, but the rule is enjoined and being reconsidered.

14.14 What data should I avoid sharing?

Avoid sharing accounts, history, or payment authority that the service does not need. Be especially cautious with payroll, medical, gambling, political, location-revealing, and business-sensitive transactions.

14.15 How often should I review connected apps?

Quarterly is a practical baseline, and immediately after changing banks, losing a device, noticing suspicious activity, or stopping use of a service.

14.16 Does deleting an app stop data sharing?

Not necessarily. Revoke the connection at your bank and in the app, then request deletion if appropriate.

14.17 Who is responsible for a breach?

Responsibility depends on where the breach occurred, contracts, applicable law, and the parties’ roles. Banks, fintechs, aggregators, and service providers may have different duties.

14.18 Can open banking help people without a credit history?

Potentially. Cash-flow data may show income and payment patterns not visible in a traditional credit file, but the quality, fairness, and transparency of underwriting still matter.

14.19 Are open-banking payments protected like credit cards?

Not always. Protections and chargeback rights vary by payment method. Confirm whether the transaction uses ACH, debit, wire, instant payment, or another rail.

14.20 What is the safest way to connect an account?

Use a verified app, bank-hosted authentication, multi-factor authentication, minimum permissions, clear retention terms, and regular access reviews.

15. Actionable takeaways

16. Conclusion

Open banking can make financial services more useful, portable, and competitive. It can help consumers understand spending, verify income, compare providers, automate money management, and access new payment or credit tools. The same connectivity can also expose a remarkably detailed record of a person’s life.

The best approach is neither to reject every connection nor to approve every permission. Use open banking deliberately: choose reputable services, share the minimum necessary data, prefer secure API authorization, monitor access, and revoke connections that no longer create value. Regulation will continue to evolve, but careful consent and sound security remain essential regardless of the final legal framework.

Reader Advice

This article is provided for educational and informational purposes only and is not personalized legal, tax, investment, financial, cybersecurity, or other professional advice or a recommendation to use any particular service. Open-banking rules, policies, technologies, consumer protections, and statistics can change over time and may vary by state, institution, provider, and transaction type. Before connecting an account, sharing financial data, authorizing a payment, or acting on this information, verify current requirements and terms through official sources and qualified professionals where appropriate. Carefully review permissions, privacy practices, fees, security controls, dispute procedures, and potential risks, and seek prompt professional assistance when significant money, fraud, legal rights, or deadlines are involved.