Open Banking

Open banking expands consumer choice—but trust depends on clear consent, strong security, and shared accountability.

Section 1033 of the Dodd-Frank Act established consumers' right to access information about their financial accounts.

Since then, a broad data-sharing ecosystem has developed that lets people connect their financial information to apps and services they choose.

Consumers should not lose their safety nets simply because their information moves from one provider to another.

Once financial information moves across the open-banking ecosystem, consumers may not know who can access it, how long it is retained, or who is responsible if it is exposed or misused.
- Fewer than half of Americans say they're confident their personal data, including financial information, is private and not shared without their knowledge.
As more companies collect, transmit, and store sensitive financial data, the risks extend beyond cyberattacks to include fraud, unauthorized access, inappropriate data use, privacy violations, and gaps in accountability.
Consumers should have clear, meaningful control over what information they share, why it is needed, who receives it, and how to withdraw access.

Every company that touches consumers' financial data has a role in keeping it secure.

Roughly 100 million consumers have already authorized an app or service to access their financial account data—whether to view accounts in one place, automate savings, make payments, or apply for credit.
Nearly half of U.S. households now use a nonbank online payment service such as PayPal, Venmo, or Cash App.
These tools can give consumers more convenient ways to manage their financial lives and access the services that work best for them.
But those benefits depend on trust. Every company that accesses, transmits, or holds sensitive financial data should share responsibility for protecting it and responding when something goes wrong.
Any implementation of Section 1033 should pair consumer choice with consistent privacy and security standards, clear and meaningful consent, appropriate limits on data collection and use, and accountability across the full ecosystem.