1033 Goes Into the Wilderness
For a while, it looked as though Section 1033 of the Dodd-Frank Act might disappear into the regulatory wilderness.
The CFPB finalized its Personal Financial Data Rights rule in late 2024, only for the incoming administration to dramatically scale back the Bureau and reconsider much of the work it had inherited. Open Banking appeared to be one of the casualties, something many of the larger US banks seemed happy with at the time.
But the underlying problem never went away. And now 1033 is coming back, with a new rulemaking making its way through Washington.
The Real Argument Was About Control
However, having sat in some of the rooms where the original issues were debated, one thing was striking: there was far less disagreement over whether consumers should be able to share their financial data than there was over who should control the infrastructure through which that sharing happened.
Banks were understandably uncomfortable with the position occupied by aggregators such as Plaid, MX and Yodlee. The banks own the customer relationship, operate the underlying systems and carry much of the regulatory responsibility. Yet aggregators have built substantial businesses around providing access to those customers. The original rule effectively prevented banks from charging for the underlying data access they were being required to provide.
That tension was never really resolved by arguing about whether APIs were a good or bad idea.
Open Banking Is More Than an API
There was another problem: the original regulatory discussion did not always distinguish clearly enough between the different technical layers involved.
An API is not the same thing as a data model. An API schema is not a security model. Authentication is not consent. And none of those things tells you whether an API that worked when it was certified is still working properly six months later.
These layers have to work together, but they solve different problems. More importantly, they need to be independently testable and measurable if anyone is going to determine whether an implementation actually complies.
That distinction matters even more today than it did when the original rule was developed.
Then Along Came AI
At the end of 2024, most of the Open Banking debate still assumed that the machine consuming financial data would be an application operated by a fintech or aggregator.
Now we have to consider agents.
Consumers increasingly expect software to act on their behalf: examining accounts across multiple institutions, identifying subscriptions, optimizing cash balances, comparing products, and eventually initiating permitted actions.
Those agents need reliable machine-to-machine access to financial systems.
Agents Need Secure Machine Access
We've known for a while that screen scraping is an increasingly absurd way to provide that access. Giving an AI agent somebody's online banking credentials would be much worse. Modern web login systems are also increasingly designed to prevent credential sharing and automated access in ways they simply weren't two or three years ago.
The alternative is secure, standardized and properly governed machine interfaces — built on conformance to agreed standards.
That means strong identity, delegated authority, well-defined consent that is easy to revoke, common data structures, and APIs that can demonstrate that they conform to the standards they claim to implement.
It also means measuring whether they actually work.
Someone Has to Measure Whether It Actually Works
That is one lesson other Open Banking markets have already learned.
An API can return HTTP 200 and still provide the wrong data. It can be technically available but functionally unusable. Two institutions can both claim 99.9% availability while measuring entirely different things.
Once access becomes commercially important, the ability to measure it independently becomes important too. Banks, aggregators and fintechs all have their own telemetry and their own interests. None should have to simply accept another participant's assertion about what happened.
1033: A Second Chance to Get This Right
The next version of 1033 therefore has an opportunity to move the discussion forward.
The question should not simply be whether a financial institution provides APIs. It should be whether an authorized machine can use those APIs securely; whether the implementation conforms to an agreed standard; whether the data returned aligns to what the standard says it means, and whether the interface continues to perform reliably in production.
Open Banking has always been built on systems talking to systems. With AI, those systems will increasingly be acting directly on behalf of people. That makes the foundations — standards, access controls, conformance and reliability — more important than ever.