Open banking is a system that lets you give other companies, with your permission, access to your own bank account data so they can offer you a service, from a budgeting app that reads your transactions to a lender that verifies your income in seconds. Instead of handing over your bank username and password, you grant a secure, revocable connection that you can switch off at any time. The idea is that your financial data belongs to you, and you should be able to take it with you.

What open banking means

At its simplest, open banking means your bank has to share your data with a third party when you tell it to. That covers your transaction history, your balances, and the details needed to set up a payment or verify an account. The promise is competition: if a rival bank or a fintech app can see your real spending, it can offer you a better deal, and switching becomes easier because your financial history travels with you.

How it works: connections, not passwords

The old way of connecting a finance app to your bank was screen scraping: you gave the app your login, and it signed in as you to read your data. That is fragile and risky, because the app holds your actual credentials. Open banking replaces it with a direct, permission-based link, usually through an application programming interface (API), authorized by a token rather than your password. You approve exactly what the app can see, and for how long, and you can revoke it. Under the US rule, access must end when you withdraw permission, deletion of your data is the default, and access cannot run longer than a year without you reauthorizing it.

The US rule: the CFPB's Section 1033

In the United States, open banking rests on Section 1033 of the Dodd-Frank Act, a provision Congress passed in 2010 that sat unused for over a decade. The Consumer Financial Protection Bureau finally activated it: on October 22, 2024, the CFPB finalized its Personal Financial Data Rights rule. It requires banks, credit card issuers and other covered providers to make a consumer's data available, and to transfer it to another provider at the consumer's request, at no charge. Third parties may use the data only to deliver the product the consumer asked for. Compliance was phased by size, with the largest institutions due to comply by April 1, 2026 and the smallest covered firms by April 1, 2030.

Why it is in limbo now

That is the rule on paper. In practice, US open banking is stalled. Banking trade groups sued, arguing the CFPB had overstepped and that free data sharing raised security and liability concerns. On October 29, 2025, a federal court in Kentucky (Forcht Bank v. CFPB) enjoined the CFPB from enforcing the rule until it finishes reconsidering it, according to client alerts from the law firms Cozen O'Connor and Cooley. The CFPB itself had already moved to reopen the rulemaking: in August 2025 it published an advance notice seeking comment on four questions, who counts as a consumer's representative, whether data access can carry fees, data security, and privacy.

The upshot is that the first compliance date, April 1, 2026, passed without the rule being enforceable, and as of late October 2026 no revised rule had been published. Open banking is a legal right in the US text, but not yet an enforced one. The debate over whether banks can charge fees for data access is the piece to watch, because a fee would reshape the economics for the fintech apps that depend on free access.

What it changes for consumers

Even in limbo, data sharing happens every day through existing connections. If you use a budgeting app, a neobank that pulls in your outside accounts, or a service that checks your cash flow to approve a loan, you are already using something like open banking. A settled rule would make those connections safer and more standardized, make it easier to move your accounts, and in principle give you a clear right to cut off access. It would also let smaller players compete with big banks on more even terms, because they could see the same picture of your finances that your bank does.

Open banking around the world

The US is a latecomer. The United Kingdom launched open banking in 2018, requiring its largest banks to share data through standardized APIs, and the European Union built data sharing into its revised Payment Services Directive (PSD2). Several other markets, from Australia to Brazil, have their own regimes. Those systems are further along, which is why US fintech companies have watched the Section 1033 fight so closely: it determines whether America's version will look like the open, standardized models abroad or something more limited.

The risks to weigh

Data sharing cuts both ways. The more apps can read your account, the more places your financial life is exposed if one of them is breached or misuses the access. That is exactly why the CFPB's rewrite is focused on data security and privacy, and why the rule limits third parties to using your data only for the service you asked for. The consumer's defense is simple: grant the minimum access an app needs, review the connections you have authorized, and revoke anything you no longer use.

What to watch

Three things over the coming months: whether the CFPB publishes a revised rule and what it says about fees, whether the court injunction is lifted or extended, and how states move, since some are writing their own data-sharing rules in the federal gap. For now, treat any app that connects to your bank the way you would any access to your money: grant only what is needed, check what you have authorized, and switch off anything you no longer use.