Here's everything you need to know about the proposed Open Banking Rule for the US 📚 What does the rule say? It defines four roles. 1. A data provider is any credit, debit, prepaid, or deposit account provider. 2. An authorized 3rd party is any app or service with consumer consent to use data held at a data provider (e.g., a Fintech wallet or Neobank) 3. A data aggregator who connects to multiple data providers through a single interface (e.g., Plaid, MX, Finicity) 4. A standards body sets technical standards for APIs and represents the views of all ecosystem participants (e.g., FDX). 🎯 The key responsibilities of data providers: 👉 Must make all transactions for the past 12 months available, including the most recent card authorization. 👉 Must include any fees (!!), yield, or rewards data available. 👉 Make account verification like name, email, and address available (but not date of birth). 👉 Must set up secure APIs with clear, standardized documentation 👉 Must guarantee 99.5% uptime and not improperly restrict access 👉Cannot charge fees for API access or API calls (!!) 🎯 Key responsibilities for authorized 3rd parties 👉 Make disclosures to consumers about how data is used and processed and their privacy (this is something the banks lobbied for) 👉 Use standardized APIs and security models and maintain written policies 👉Do not use data for targetted advertising, data re-sale, or cross-selling (although cross-selling can be done if implicitly opted in) 🎯 Key responsibilities for data aggregators are interestingly pushed to the authorized 3rd party and the data provider. The fact that data is being processed must be disclosed. The most interesting part for me was the standards body. 🎯 Responsibilities of the standards body 👉Balances decision-making power across all parties 👉Has an appeals process 👉The CFPB authorizes it. ⌚ b) When does it go live? The rule is at the proposal stage and is open for comment until December. There is no timeline for when it will go live. If I had to guess, I’d say before the election. The rule does say 👉Six months from publication, any institution with more than $500bn in assets (or more than $10bn in revenue) must comply. 👉12 months from publication, institutions with $50bn to $500bn in assets must comply 👉30 months from publication, institutions with $805m to $50bn in assets must comply 🙉 c) What does the rule NOT say? 👉Nothing about investments or brokerage. That could leave Fidelity unscathed by any new rule. But PNC? And those banks that play games with connectivity and latency? That should "just work." 👉Nothing about how standards work. But if you must offer an API and it must give free and equal access, two questions appear. 👉How should that API work? FDX is a standards body with momentum; will it have to change its governance or processes? 👉How will the CFPB's new rule be enforced? This is the big unknown. If Fintech companies report that one bank that always breaks connectivity, what happens next? 👉Nothing about payments. Open Banking initiated payments can be a “killer app” for open banking. It is possible without regulation. (For example, Plaid already works with Tesla to help consumers make car deposits.) 👀 d) What are the objectives of the rule? 👉Create competition. The release talks about empowering consumers to walk away from bad service. 👉Consumer data control. Trying to avoid any company misusing consumer data for advertising. 👉Avoid pricing and availability games. The CFPB suggested large banks could play games with availability, latency, or price. The press release positions this as a “junk fee,” which is very on-brand for the Biden administration. 👉Move to “fair industry standard setting.” Implies that the CFPB views the way standards are set today as unfair. 🤔 e) What are some implications? 👉The rule doesn’t let banks charge for API access so have to take the hit on cost? This will further reinforce the perception that open banking has zero upside for incumbents and all downside. (See lessons from the UK in next section) 👉It can’t be used for identity use cases. If the date of birth can’t be shared, then this isn’t an identity “rail.” It will work for account verification and payment initiation, however. 👉If PNC tried to copy Fidelity, it would breach this rule. The timing of the Fidelity and Akoya move probably wasn’t an accident. 🇬🇧 f) How does this differ from the UK market? 👉The UK doesn’t have open banking it has open checking. That means no brokerage, credit and lending product aggregation. 👉The UK required open access to the A2A (account to account) payments initiative via open banking. This is not included in the CFPB rule. 👉The UK required large banks to fund an independent body (open banking implementation entity) that defined the standards. The CFPB is leaving that to the market. Will it work? You'll have to read the full blog (link in bio) to find out