Open banking moves from buzzword to budget line: A practical playbook for credit unions

For years, open banking sat at the edge of strategy decks. Interesting, but not urgent. That window has closed. With the CFPB's Section 1033 rule setting a federal baseline for consumer-permissioned data access, and major aggregators moving away from screen scraping toward standardized APIs, the operating model for data sharing is changing. For executives and boards, the question is no longer whether to participate, but how to do it in a way that protects the institution, improves member experience, and creates options for future growth.

The promise is clear: secure, standardized connectivity that lets members control which apps can access their data and for what purpose. The reality is that getting from today's credential-sharing model to tomorrow's tokenized, auditable access is a multi-year program. Success requires equal parts technical execution, vendor strategy, and disciplined governance.

The emerging standard in the U.S. is the Financial Data Exchange (FDX) model: OAuth 2.0 and OpenID Connect (OIDC) for secure authentication flows; standardized data objects for members, accounts, transactions, and statements; and explicit consent management. Aligning to this stack is not a simple bolt-on. Most credit unions will need to:

In parallel, credit unions will be negotiating with aggregators (and, in some cases, fintechs) on connection methods, volumes, support, and liability. This is as much a vendor-management exercise as a technology build.

Delaying comes with hidden costs. Screen scraping persists because it works, but it also increases credential risk, generates support tickets when connections break, and degrades trust when members must share passwords with third parties. As aggregators phase out scraping in favor of APIs, late adopters will face a scramble: higher integration costs under tighter timelines, fragmented member experiences, and reduced leverage in commercial negotiations. Early movers, by contrast, can shape terms, rationalize partner lists, retire scraping in an orderly way, and demonstrate progress to regulators and boards.

For most credit unions, the most effective route is to partner with established aggregators to enable FDX APIs, while preparing internal systems for regulatory and operational requirements. Direct-to-fintech connections and one-off APIs may make sense in select cases, but they rarely scale. A concentrated aggregator model simplifies oversight, speeds time to value, and still covers many use cases: account verification, personal finance tools, loan underwriting, payments, and money movement.

Pricing is an evolving issue. As the 1033 regime matures, expect shifts in who pays for access and how much. Some FIs have publicly signaled plans to charge for API connections. Even if your credit union is not a net data exporter, you should pressure-test the economics in both directions—what you might pay for consumption and what policies you will set for third parties accessing your members' data. Then build these assumptions into your multi-year budget and vendor scorecards.

Open banking is ultimately a member relationship decision, not just a plumbing exercise. Institutions that lead with transparency and control will have an advantage. At minimum, plan for:

Done well, these features can reduce call center load, cut down on risky credential sharing, and raise satisfaction scores. These are all benefits that compound as more connections shift from scraping to APIs.

No matter which aggregator you choose first, the internal readiness work looks similar. Organize it as a structured program with measurable milestones:

Credit unions that prioritize this foundation can deliver a first production API connection in roughly two to three quarters, depending on core vendor readiness and aggregator certification queues. The second and third integrations proceed faster as the playbook hardens.

Executives can head off delays and cost overruns by watching for these failure modes:

Set program KPIs before launch and report them at the board level:

Early adopters often start with two aggregators that cover most traffic, integrate account and transaction endpoints first, and launch a consent dashboard at the same time. Within the first quarter after go-live, they see a meaningful shift of connections from scraping to APIs, faster account verification, and fewer broken-link support calls. Over time, they add statements and other FDX objects, broaden to additional aggregators as needed, and retire scraping in phases aligned with fintech partner readiness.

Open banking is becoming the default way that members connect their financial lives. Acting now, with a practical plan and the right partners, positions your credit union to control risk, improve member experience, and create flexibility for what comes next.

Section 1033 of the Dodd-Frank Act establishes the consumer's right to access their financial data. The CFPB has tasked this right to govern and implement, with the initial ruling taking place in late 2023 and setting the stage for more secure and regulated open banking in the U.S. 

In July 2025, however, the CFPB paused its implementation of Section 1033 in response to pushback and concerns, citing "recent events in the marketplace." While the full implications of this shift remain to be seen, these events open the door for new rulemaking that could further impact how open banking is governed—both from a regulatory and a commercial perspective.

For credit unions, this development leaves Section 1033 in a state of uncertainty—particularly around timelines for compliance, division of responsibilities, and whether banks can charge for API access. It's important to remain nimble in adjusting to any regulatory, commercial, or technical changes that may arise.