What Is Open Banking and How Does It Affect Your Accounts?

You link your checking account to a budgeting app, a payment app or a loan application, and a few seconds later the app knows your balance and your last 90 days of spending. That is open banking at work. It is convenient, and it is also one of the least understood ways your financial data moves around.

This guide explains how the connection works, what the federal rule on financial data rights says, where that rule stands as of October 2026, and how to see and cut off every app that can read your accounts.

Open banking in plain English

Open banking is the idea that your financial data belongs to you, and that you can direct your bank to share it with another company you trust. The bank keeps holding your money. The app only gets the data, or permission to start a payment, that you approve.

Common uses include:

• Budgeting and net worth apps that pull balances and transactions from several banks into one view (see our guide on how to build a budget with an app)
• Payment apps that verify your account before you send money
• Lenders that check income and cash flow from your bank history instead of relying only on a credit report
• Tax and accounting tools that import transactions automatically
• Account switching when you move direct deposits and bill pay to a new bank (our bank switching checklist covers that process)

Open banking is part of the wider move toward embedded finance, where financial features show up inside apps that are not banks.

How apps actually connect to your bank

Most consumer apps do not connect to your bank directly. They use a data aggregator, a company that maintains connections to thousands of banks and credit unions. Plaid, MX, Finicity (owned by Mastercard) and Akoya are well-known examples. When an app shows a “connect your bank” pop-up, it is often an aggregator’s screen.

There are 2 main connection methods:

Large banks have moved many connections to APIs, often built on the Financial Data Exchange (FDX) standard. In January 2025, the CFPB recognized FDX as the first standard-setting body under its data rights rule. Some smaller institutions still rely on credential-based access, so you may see both methods depending on where you bank.

Key takeaway: If an app asks for your bank password on its own screen instead of sending you to your bank’s login page, you are probably using screen scraping. It may work fine, but it gives a third party more power than an API connection does.

The CFPB data rights rule (Section 1033)

Section 1033 of the Dodd-Frank Act gives consumers a right to access their own financial data. On October 22, 2024, the Consumer Financial Protection Bureau released its final Personal Financial Data Rights rule to put that right into practice. According to the CFPB’s announcement, the rule:

• Requires covered banks, card issuers and other providers to make data such as transactions, balances, upcoming bills and basic account details available to consumers and the third parties they authorize
• Bars providers from charging fees for that access
• Limits third parties to collecting and using data only for the product the consumer asked for, ruling out uses such as targeted advertising
• Caps authorizations at 1 year unless the consumer reauthorizes
• Requires that access ends immediately when a consumer revokes it, with deletion as the default
• Pushes the industry away from screen scraping toward safer interfaces

Compliance dates were staggered by institution size, starting April 1, 2026 for the largest providers and running to April 1, 2030 for the smallest covered ones. Certain small banks and credit unions are exempt.

Where the rule stands in 2026

The rule has not taken effect as planned. Here is the sequence, based on CFPB and court records:

1. Lawsuit: Banking groups sued in federal court in the Eastern District of Kentucky (Forcht Bank v. CFPB) shortly after the rule was finalized.
2. Reconsideration: In 2025, the CFPB said it would reexamine the rule. On August 22, 2025, it published an advance notice of proposed rulemaking asking for comment on 4 issues: who can act on a consumer’s behalf, whether fees can be charged, data security and data privacy.
3. Court order: On October 29, 2025, the court stayed the compliance dates and blocked enforcement until the CFPB finishes its reconsideration.
4. Missed date: The April 1, 2026 compliance date passed without becoming enforceable.

So the rule exists on paper, but banks are not currently required to follow it, and the final version may look different, especially on fees. Watch the CFPB’s personal financial data rights page and the Federal Register for a new proposed rule. This is not legal advice.

What this means for you: data sharing keeps working because banks and aggregators already have contracts in place. The specific protections the rule promised, such as the 1-year reauthorization cap and default deletion, are not guaranteed by federal rule today. Your protection depends on each company’s own terms, privacy policy and state privacy laws.

What is shared, and what is not

When you connect an app, the permission screen should list what it can see. Typical categories:

• Account and routing numbers (needed to move money)
• Balances
• Transaction history, sometimes going back 1 to 2 years
• Account owner name, address and contact details
• Investment holdings or loan balances, for some account types

What generally stays out of reach: your login credentials on an API connection, and the ability to move money unless you separately authorize a payment. With screen scraping, the third party technically has whatever access your login gives.

Read the permission screen before you click “Continue.” If a cash-back app wants 2 years of transactions and your full contact details, ask whether that is really needed for what it does.

Risks worth knowing

Open banking is generally safe when you use reputable apps, but a few risks are real:

• Data reuse. Without the federal rule in force, an app’s privacy policy decides whether it can analyze or share your spending data. Check for language about sharing with “partners” or using data for marketing.
• Forgotten connections. Apps you stopped using years ago may still have live access.
• Credential exposure. Scraped connections store your login somewhere outside your bank.
• Fraud liability questions. If a third party with your password causes a loss, your bank may question whether the transaction was authorized. Turning on strong banking app security settings, such as alerts and multifactor login, helps you spot problems fast.
• Fintech failure. Data access and money storage are separate issues. If an app also holds your money, read our explainer on whether your money is FDIC insured in a fintech app.

How to review and revoke app access, step by step

Set aside 15 minutes once or twice a year for this audit.

1. Check your bank’s connected apps page. Many large banks have a section called something like “Connected apps,” “Data sharing” or “Third-party access” under security or privacy settings. You can usually turn off access app by app.
2. Check the aggregator’s portal. Plaid offers Plaid Portal at my.plaid.com, where you can see which apps you have connected through Plaid and choose “Disconnect app.” Plaid notes that the list is matched to your phone number and email, so it may not be complete. Other aggregators have their own privacy request processes; check their websites.
3. Disconnect inside the app itself. Most budgeting and payment apps have a “linked accounts” setting.
4. Ask for deletion. Disconnecting stops new data from flowing, but the app may keep what it already collected. Use the app’s privacy request form or support channel to ask for deletion.
5. Change your bank password if you ever used screen scraping with an app you no longer trust, and turn on multifactor authentication. Passkeys, where your bank supports them, are even stronger (see how passkeys work).
6. Delete the app from your phone after revoking access.

Where to start

If you have never checked who can see your accounts, start with your main checking account. Open its security settings, find the list of connected apps and remove anything you do not recognize or no longer use. Then visit Plaid Portal, since Plaid connects a large share of US consumer apps. Finally, set a calendar reminder to repeat the check every 6 months.

For unfamiliar terms like aggregator, API or tokenization, our glossary has short definitions.

The bottom line

Open banking is what lets your favorite money apps work. It can save you hours of manual tracking and make it easier to switch banks or qualify for credit. The federal rule meant to standardize protections is on hold, so for now you are the main line of defense: connect only apps you trust, prefer connections that send you to your bank’s own login, and revoke access you no longer need.

Sources

• CFPB: Required rulemaking on personal financial data rights — rule timeline, October 22, 2024 final rule, August 2025 reconsideration notice
• CFPB: Final personal financial data rights rule announcement — no-fee access, data use limits, 1-year authorization, revocation, compliance dates
• Federal Register: Personal Financial Data Rights Reconsideration — the 4 issues under reconsideration
• U.S. District Court, E.D. Ky.: Order in Forcht Bank v. CFPB (Oct. 29, 2025) — stay of compliance dates and injunction pending reconsideration
• Financial Data Exchange: FDX recognized by CFPB as a standard-setting body — API standard recognition in January 2025
• Plaid support: How do I disconnect my financial accounts from an app? — Plaid Portal disconnect steps and data retention note