CFPB Revisits Section 1033: Banks Push for Data Access Fees, Fintechs Face New Competitive Threats

The Consumer Financial Protection Bureau’s final PFDR rule (October 2024) represents the most definitive US legal framework to date for open banking, requiring eligible data providers (banks, credit unions, card issuers, and non-bank providers) to supply consumers and their authorized third parties with covered financial data in machine-readable format, with no fees for the consumer or third party and strong limits on secondary usage. However, it exempts institutions with less than US$850 million in assets and provides staggered compliance dates through April 2026-2030 depending on size. [5][6]

Financial institutions—most notably major banks such as JPMorgan—and banking trade associations have mounted challenges. Key points of contention are the breadth of “authorized third parties” (including whether data aggregators qualify), potential data security and liability risks, the prohibition of cost recovery via fees, and the rule allegedly exceeding CFPB’s statutory authority. In response, in May 2025 the CFPB itself stated it would seek to vacate the rule, calling it “unlawful,” and subsequently released an Advance Notice of Proposed Rulemaking in August 2025 to reconsider components like fee logic, scope of representation, security, and liability. [3][4]

Corporate strategy actions have emerged in parallel. In July 2025, JPMorgan informed fintech‐aggregators it would begin charging them for accessing customer data through APIs, particularly targeting those making many background/pull requests, citing infrastructure cost and fraud risk. Agreements with Plaid, Yodlee and others formalised fee structures in late 2025. [2][4][7]

From a fintech perspective, fees—especially high or frequent ones—could undermine business models that depend on continuous account access for product features. Meanwhile, banks argue fees are legitimate cost recovery, positioning themselves as overinvested infrastructure owners who deserve compensation. One financial institution defended the fees as necessary to maintain secure, reliable infrastructure amid non-customer or non-transactional data pulls. [7][2]

Strategic implications are substantial: who owns access to customers’ financial data controls parts of the fintech/AI/data ecosystem. Chargeable access could shift power back toward large incumbent banks. For fintechs and startups, this may raise barriers to entry. Regulatory uncertainty adds risk: compliance deadlines, legal challenges, and CFPB’s likely revisions means investment, legal, and product roadmaps are at risk.

Open questions include: What constitutes “reasonable” fees under law? Will the CFPB reimpose fee prohibitions or allow banks to charge aggregators under tighter conditions? How will liability and data security obligations be enforced? What business and pricing changes will small fintechs or aggregators make? And will consumer rights over aggregate behavior data (used for AI, analytics) be preserved?