Open Banking has been one of the biggest success stories in the modern UK financial landscape, and is constantly evolving to help lead a new way for businesses to perform payments and understand their customers.
But across the pond, the US has quietly also been developing its own Open Banking framework. To learn more how the US is differentiating itself from the UK and the rest of Europe in its approach, Eyal Sivan, North American General Manager for Ozone API analyses how recent US Open Banking regulations are setting a foundation for greater adoption.
Payment Expert: Firstly Eyal, could you give us a brief overview of how Open Banking has been handled in the US, from when it was first introduced to current day?
Eyal Sivan: Open Banking has existed in some form in the US for over 20 years, where early data sharing services like Yodlee introduced the technology in the late nineties, albeit using insecure methods such as screen-scraping.
As a result of this, the consumer behaviour of connecting financial service providers together is well-entrenched (sometimes referred to as ‘connected banking’), with US consumers sharing more financial data than any market in the world by far. However, this behaviour was largely based on proprietary, often insecure interfaces and bi-lateral agreements from a handful of dominant aggregators.
Then, in 2018, the Financial Data Exchange (FDX) was formed as a market-driven non-profit dedicated to aligning the industry around a common standard – essentially, market-driven open banking. Around the same time, the Consumer Financial Protection Bureau (CFPB) started indicating that it was considering regulating the space and requesting industry feedback.
Since then, the market-driven and regulatory-led approaches have advanced in parallel. On the market-driven side, the FDX API is now used to share consumer data from over 94 million accounts as of September 2024 (without any regulation). Meanwhile, on the regulatory-led side, the CFPB officially released the final version of their Section 1033 rulemaking, formally called Personal Financial Data Rights, on 22 October 2024.
However, we should keep in mind that the CFPB has not yet selected FDX as a recognised standard-setting body.
Payment Expert: How do the recent changes to Section 1033 of the Dodd-Frank Act differ from the original proposed rulemaking from October 19th, 2023?
Eyal Sivan: The final version of Section 1033 has significantly modified its approach to tiering and compliance dates since the original draft was published in October last year.
The draft rule had four tiers, with the first due to comply in six months and applied to all banks in the US by the time of the final tier. By contrast, the final rule has five tiers, with the first is due to comply by April 1st, 2026. More importantly, the updated rule does not apply to banks with less than $850m in assets, effectively removing 80% of financial institutions from the scope.
The language restricting the secondary use of data has also been strengthened, stating that data could only be used to fulfil an explicit customer request. An additional notable change on the technology side is the recognition that an open banking standard included both data standards and a secure communication protocol standard.
Payment Expert: To the best of your knowledge, how receptive have some of the major banks in the US been to Section 1033 of the Dodd-Frank Act?
Eyal Sivan: From my knowledge, almost all major banks in the US are members of FDX, and have been for years, with some sitting on the board. This indicates strong support for open banking in general, as they have been working to establish a common standard for the industry.
As a result, their reaction to Section 1033 has been generally supportive, at least at the technology level, where they view regulatory efforts as largely complementary to existing market efforts.
However, given that the Bank Policy Institute and Kentucky Bankers Association (where many of the same banks are members) issued a lawsuit against the CFPB based on Section 1033, there may be some resistance at more senior levels.
Payment Expert: How has Ozone API overseen and helped develop Open Banking adoption across the US?
Eyal Sivan: Ozone API has been a member of FDX for many years. As part of that membership, we participate in working groups and provide feedback on the standard where appropriate.
Additionally, we have participated in many conferences, events and webinars, and continuously publish thought leadership articles and resources, to help others learn from our experiences. We have also conducted a handful of North American pilot projects with banks and payments providers as well.
Payment Expert: How does the US Open Banking legislation draw similarities and differences to UK regulations?
Eyal Sivan: The most prominent difference is that UK Open Banking was driven by a competition order from the Competition and Markets Authority (CMA) with a lean towards payments.
By contrast, the Section 1033 regulation in the US was driven by the CFPB with a lean towards data rights. While both consider driving competition a major objective, these different origins led to different approaches. For example, Section 1033 does not have any payment initiation API (what the UK calls the ‘write’ API), instead including ‘all the information necessary to initiate a payment’ but no actual payment initiation.
Another difference is that the UK is quite centralised in its governance, with Open Banking Limited (OBL) acting as an oversight body and operating a central registry. Meanwhile, the CFPB has given no indication that it will oversee the operation of the ecosystem, nor is a registry mentioned in the regulation – these responsibilities may be inherited by the selected standards-body, such as FDX.
It’s also worth noting that the CMA9 were charged a hefty bill for the establishment of the system, where the CFPB has not asked US banks to pay for anything.
Payment Expert: Are there opportunities for US legislators to innovate and perform new capabilities when it comes to Open Banking payments?
Eyal Sivan: As above, payment initiation is not in the scope of Section 1033, instead being limited to ‘all the information necessary to initiate a payment’, putting significant payment innovation at arm’s length.
However, the final Section 1033 rulemaking did include stronger focus on the benefits of the ‘Pay By Bank’ use case and explicitly identified payments as an area for future expansion. Therefore, I would agree that there remain considerable opportunities for US legislators to innovate the regulation further when it comes to payments.
Payment Expert: In relation to Open Banking, have there been any other developing regulations, services, innovations, etc., when it pertains to open finance?
Eyal Sivan: The most significant development into open finance included in Section 1033 is the inclusion of digital wallets. In its scope the regulation includes any provider who can ‘facilitate a payment’ from or to a deposit account (Reg E) or credit card account (Reg Z) and calls out ‘digital wallets’ by name. This has led to much speculation about how Section 1033 will apply to big tech providers like Apple and Google.
Section 1033 also includes bill payments information (although read only) in scope, including bill details and frequency. However, the FDX standard includes many open finance data domains, such as payroll, investments and rewards, which are not covered by Section 1033
Payment Expert: Lastly, is it feasible in the coming years that the US can catch up and possibly overtake the UK when it comes to Open Banking?
Eyal Sivan: Absolutely. By certain measures, including the number of records shared and number of consents issued, the US is already far ahead of the UK.
By increasingly moving towards standardisation via FDX, and now introducing clear, ambitious regulation in the form of Section 1033, the US is poised to become a true global leader; despite their relatively late start. The UK better keep pushing ahead if they want to maintain their lead.
