Open Banking in the US: How It Works, the CFPB 1033 Rule, and How to Revoke Access

What is open banking in the US?

Open banking in the US means a third-party app can read your bank data or start a payment after you approve it, usually through a data aggregator such as Plaid, MX, or Finicity. There is no single federal open banking law in force today, so the system runs on bank agreements, industry standards, and older consumer rules.

If you have ever used Venmo to link a checking account, let a budgeting app pull transactions, or verified a bank for a brokerage transfer, you used it. The part most people never see is the middleman. You click “connect your bank,” pick a name from a list, and a screen from an aggregator walks you through the login. The app you wanted never touches the bank directly.

My read after going through the CFPB’s materials and the trade coverage: the technology works well, and the legal footing under it is the shaky part. That matters to you as a user because “who is responsible when something goes wrong” has a less tidy answer here than it does for a debit card.

How does open banking work behind the scenes?

Think of three parties and one permission slip.

1. You approve a specific app to see specific data, or to start a specific payment.
2. The app (a budgeting tool, a payments app, a lender) asks an aggregator to fetch it.
3. The aggregator connects to your bank, pulls the data, and passes it on.

The older method was screen scraping: the aggregator logged in as you with your username and password and read the pages. It worked everywhere and it was fragile and risky. The newer method uses a login page hosted by the bank itself, and the aggregator receives a token, a limited key that can be switched off without changing your password. Industry groups such as the Financial Data Exchange publish a common data format so banks and apps speak the same language.

Connection style	What the aggregator holds	Main risk	Your control
Credential-based (scraping)	Your username and password	Credential exposure, bank may block logins	Change password to cut it off
Token-based (bank-hosted login)	An access token	A forgotten token keeps working	Revoke token at bank or portal
Direct API agreement	Token under a bilateral deal	Bank may restrict fields or add fees	Same as token-based

What the screen can show also varies. Some connections are read-only (balances, transactions). Others include “payment initiation,” which lets the app pull money from your account. Always read which one you are granting, because the second kind carries the larger downside.

Who are the main players, and what do they actually do?

The names you will see most often are Plaid, MX, Finicity (owned by Mastercard), and Yodlee. They are infrastructure companies, not apps you download. Consumer apps built on top of them include payment apps, budgeting tools, brokerage funding flows, and loan underwriting checks.

For the lender side, the value is concrete: a lender can verify income and balances from bank data in minutes instead of waiting on PDF statements. For you, the value is fewer typos, faster account verification, and one dashboard. The tradeoff is that your data now sits in more places than your bank.

If you use these tools to track spending, two earlier guides on this site compare options: the best budgeting apps and a longer budget app review. Both are worth reading before you decide how many connections you really want.

What is the CFPB Section 1033 rule status in 2026?

The short answer as of October 2026: the rule exists on paper, a federal court has blocked the CFPB from enforcing it, and the agency is rewriting it. I am hedging because the sources I could reach were law-firm alerts, industry trackers, and trade press, not a fresh CFPB notice. Check the CFPB’s rule page for the authoritative dates.

Here is the timeline as I could piece it together.

Date	What happened	Confidence
2010	Dodd-Frank Section 1033 requires consumer data access, leaves rulemaking to the CFPB	Statute
Oct 2024	CFPB issues the Personal Financial Data Rights final rule, with compliance dates phased from April 1, 2026 for the largest institutions	Widely reported
Aug 22, 2025	CFPB publishes an advance notice to reconsider the rule, reopening issues including fees for data access	Reported by multiple sources
Oct 29, 2025	A federal court in Kentucky preliminarily enjoins enforcement while reconsideration proceeds	Reported by multiple sources, see ABA Banking Journal
2026	Original first compliance date passes without an enforceable trigger; sources disagree on tolled dates	Unsettled
Aug 2026	A revised proposal was reported to have gone to the White House regulatory review office; I found one source and no confirmation	Unverified

Two takeaways. First, the injunction blocks enforcement; it does not erase the statute, and Section 1033 still exists in law. The Congressional Research Service overview is a clean neutral read on how the statute and rule fit together. Second, the fight is mostly about who pays and who sets the terms: whether banks can charge aggregators for access, and how much control banks keep over third parties. Large banks and the fintech side have opposite instincts there.

What this means for you today: do not assume a federal right to portable data is being enforced. Assume the current system, with its patchwork of bank agreements and a few state privacy laws, is the one you are living in.

Which consumer protections apply right now?

Even without an enforceable 1033 rule, you are not unprotected. Several older rules still do real work:

• Regulation E covers electronic fund transfers from your bank account, including unauthorized transfers initiated through an app. The CFPB’s Regulation E text lays out the notice rules.
• Gramm-Leach-Bliley Act requires financial institutions to protect customer data and disclose how it is shared.
• State privacy laws such as California’s give residents rights to see and delete data held by businesses, including some aggregators. Coverage varies by state.
• FTC authority over unfair or deceptive practices reaches apps and aggregators that mislead you about what they collect.

If this happens	Rule that usually applies	What to do first
App pulls money you never approved	Regulation E	Tell your bank right away, then confirm in writing
Data shared beyond what you agreed to	State privacy law, FTC authority	Revoke, then submit a deletion request
Aggregator is breached	State breach laws, class actions	Follow the notice, freeze credit if SSN exposed

Regulation E’s clock matters more than anything else. If you report an unauthorized transfer within two business days of learning about it, your liability is generally capped at $50. After that it can rise to $500, and waiting more than 60 days after the statement that shows the transfer can leave you more exposed. Those thresholds come from the regulation, but your bank’s own policy may be more generous, so ask.

Data breaches at companies that hold financial data are a separate problem with their own remedies. If one touches you, see how data breach class action settlements work.

How do I revoke access to my bank account?

Revoking has three layers, and the mistake most people make is stopping at the first.

1. In the app. Go to settings, find linked accounts, and disconnect the bank. This stops the app from asking for new data.
2. In the aggregator’s portal. Plaid, for example, offers a consumer portal where you can see which apps hold a connection and remove them. Look for Plaid’s portal, currently at my.plaid.com, and check that the address is the official one before logging in. Other aggregators have similar privacy pages; search the aggregator’s name plus “privacy portal.”
3. At your bank. Many banks list connected apps or third-party access in security or profile settings. Names differ by bank, so use the search box inside your online banking. Removing the app here is what ends the token on the bank side.

After that, do two more things: request deletion of the data already collected, and change your online banking password if the connection was ever credential-based.

A quick audit routine that takes about ten minutes:

• Open your bank’s connected-apps page and list every app you see.
• Cross off anything you use monthly or more.
• Revoke the rest, then open the aggregator portal and confirm they are gone.
• Set a calendar reminder for six months out.

If you are tightening your overall security at the same time, the cybersecurity solution comparison covers password managers and monitoring tools worth considering.

A failure case: why did my payment bounce after I revoked access?

This is a composite, not one person’s story, but it happens constantly. Someone clears out old bank connections after reading a scary headline and disconnects everything at the bank in one afternoon. Two days later a utility autopay fails, a subscription lapses, and a transfer to a brokerage account is rejected. One of the “old” connections was actually the funding link for those payments.

The lesson is boring and useful. Before you revoke, check which connections are tied to recurring payments or account funding. Those usually show up as ACH debits on your statement with the company’s name. Revoke the dead ones, and for the live ones, decide whether you would rather keep the connection or switch to a manual payment method.

Also note the opposite failure: disconnecting inside the app but never at the bank. In that case the app looks disconnected while a token may still be valid. That is the quieter risk, and it is why the three-layer revoke above is worth the extra minutes.

Is open banking worth using, and how many connections is too many?

My own rule of thumb, which is an opinion and not a regulation: keep one connection per job. One app for budgeting, one for payments, one for investing funding. If two apps do the same thing, retire one.

Use case	Worth connecting?	Safer alternative
Daily budgeting across several accounts	Yes, if you check it weekly	Monthly CSV export
Brokerage funding	Yes, for one-time verification	Micro-deposit verification
Loan applications	Often required	Upload statements, if the lender allows
Apps you tried once	No	Revoke now

Credit-related tools are worth a thought here too. If you are connecting accounts to improve credit visibility, the credit score improvement guide explains which factors actually move a score, so you can judge whether another connected app earns its permission.

The bigger picture is that US open banking is in an in-between state. Banks, aggregators, and regulators are still negotiating who controls the data pipe and who pays for it. Whatever the final rule looks like, the habits that protect you do not change: share the minimum, prefer token-based logins, review connections twice a year, and act fast on anything you did not approve.

What should I watch for next?

Watch three things. First, whether the CFPB publishes a new proposed rule for comment, which would restart the clock on any compliance dates. Second, whether courts change the injunction, either through an appeal or a final judgment. Third, whether big banks and aggregators keep signing private data-access agreements, because those deals set the real rules in the meantime.

Do not rely on a blog post, including this one, for dates in a fast-moving rulemaking. The CFPB’s rule page and the federal docket are the places to confirm what is current before you make a business decision.

This article is general information as of October 2026 and is not legal, financial, or tax advice. Rule status, deadlines, fees, and bank or aggregator menus change often, so confirm details with the CFPB, your bank, and the service you are using.