CFPB Guidance on Open Banking Data Access Fees: A Strategic Guide for US Merchants

The landscape of American financial services is undergoing a fundamental shift as the Consumer Financial Protection Bureau (CFPB) moves to activate a long-dormant section of the Dodd-Frank Wall Street Reform and Consumer Protection Act. Section 1033, which grants consumers the legal right to access and share their personal financial data, is the cornerstone of what is commonly known as "Open Banking" in the United States. For US merchants, particularly those exploring alternative payment methods (APMs) like "Pay-by-Bank," the regulatory tug-of-war over data access fees will have significant implications for transaction costs and customer experience.

Understanding Section 1033 and the Open Banking Mandate

Section 1033 of the Dodd-Frank Act was enacted in 2010, but it remained largely inactive for over a decade. In October 2024, the CFPB finalized the Personal Financial Data Rights rule, which requires financial institutions to make consumer-authorized data available to third parties—such as payment aggregators and fintech apps—without charging fees.

The scope of this rule is broad, covering checking accounts, prepaid cards, credit cards, and even mobile wallets and payment apps like Apple Pay, PayPal, and Venmo. By mandating that banks share transaction information and account balances through secure APIs, the CFPB aims to move the industry away from "screen scraping"—a less secure method where third parties use consumer credentials to log into accounts—toward a standardized, secure data-sharing ecosystem.

The Evolution of Data Access Fees: From Free to Fee-Bearing?

Historically, data access in the US was largely free, albeit unregulated. However, as the volume of data requests has surged—with JPMorgan Chase receiving nearly 1.9 billion requests in a single month in 2025—banks have argued that the infrastructure costs of maintaining these APIs are substantial.

While the 2024 final rule explicitly prohibited covered data providers from charging fees for providing required data access, the regulatory environment shifted in 2025. In August 2025, the CFPB issued an Advance Notice of Proposed Rulemaking (ANPR) that explicitly reopened the question of whether banks should be permitted to charge fees to third parties to defray the costs of responding to data requests. This reconsideration has created a period of uncertainty for the industry, as the rule that would have made such fees illegal is currently being rewritten and is subject to litigation.

The JPMorgan Precedent and the 2025 Regulatory Shift

The debate over fees moved from theoretical to practical in September 2025, when JPMorgan Chase began charging data aggregators like Plaid for data access. These fees, often described as "fractions of a cent" per pull, represent a significant shift in the economics of open banking. While aggregators like Plaid have stated they will not immediately pass these costs on to their thousands of clients, the precedent suggests that data access is transitioning from a free utility to a priced commodity.

For merchants, this is a critical development. If aggregators eventually pass these costs down the chain, the unit economics of "Pay-by-Bank" solutions—which rely on real-time account verification and balance checks—could be impacted. Merchants who adopted these methods to avoid high credit card interchange fees may find their expected savings slightly eroded by these new data-access tolls.

Impact on Alternative Payment Methods (APMs)

The CFPB's guidance and the ongoing fee debate directly impact how merchants offer alternative payment methods.

1. Pay-by-Bank Costs: These services allow consumers to pay directly from their bank accounts, bypassing traditional card networks. If the CFPB ultimately allows banks to charge for the data access required to initiate these payments, the cost of providing Pay-by-Bank could rise.
2. Third-Party Budgeting and Loyalty Tools: Many merchants integrate with third-party apps that help consumers manage their finances or earn rewards. These tools rely on the same Section 1033 data. Excessive fees could limit the availability or increase the cost of these integrations.
3. Shift to Secure APIs: Regardless of the fee outcome, the industry is moving toward secure API standards (like those managed by the Financial Data Exchange, or FDX). This shift generally improves security and reduces the risk of data breaches compared to legacy screen-scraping methods.

What Merchants Should Do

As the CFPB continues to refine the Section 1033 rules, US merchants should take proactive steps to protect their payment strategies:

• Audit Your Payment Mix: Evaluate the current cost-benefit ratio of your Pay-by-Bank and other API-dependent payment methods. Understand how much of your volume relies on third-party aggregators who may be subject to new bank fees.
• Review Aggregator Contracts: Engage with your payment aggregators and fintech partners to understand their long-term pricing stability. Ask specifically how they plan to handle potential "pass-through" fees from major banks like JPMorgan Chase.
• Monitor Regulatory Updates: The CFPB is expected to issue an interim final rule soon. Stay informed on whether the "no-fee" mandate is upheld or if a "reasonable and proportional" fee structure is adopted.
• Optimize Data Usage: Encourage your technical teams to adopt efficient data-pulling practices. As banks begin to measure and price "wasteful" background polling, efficient API usage will become a competitive advantage.

ONKORE Perspective

At ONKORE, we view the CFPB’s Section 1033 rulemaking as a double-edged sword for the merchant community. On one hand, the formalization of open banking rights is a massive win for competition, potentially breaking the stranglehold of traditional card networks and lowering overall transaction costs. On the other hand, the shift from a "free utility" model to a "priced commodity" model for financial data introduces new variables into the merchant's cost equation. We believe the most successful merchants will be those who diversify their payment acceptance strategies and maintain close communication with their fintech providers to navigate these shifting economic tides. The goal remains clear: a more transparent, secure, and competitive payments ecosystem that benefits both the merchant and the consumer.

The CFPB is reconsidering Section 1033 rules regarding data access fees, a move that could reshape the costs of Pay-by-Bank and alternative payment methods.