ST. PETERSBURG, Fla.—In a move stirring quiet but critical debate across the financial sector, the potential rollback of CFPB Rule 1033 may not spell disaster—or deliver salvation—for financial institutions.
While the open banking rule was designed to accelerate open banking, industry insiders say financial institutions no longer need regulatory permission to innovate: Many are already forging ahead with open API strategies on their own terms.
“The potential rescission of CFPB Rule 1033 is not inherently good or bad for financial institutions,” said Angelina Renaldo, innovation strategist at Velera. “The reality is financial institutions don’t need the rule in place to move forward with an open banking API strategy.”
Many FIs already support consumer-permissioned data sharing through APIs that include strong information security and data minimization standards – practices adopted today among many large banks, fintechs and aggregators—for example Finicity, a Mastercard company; Plaid, MX, etc.— Renaldo explained.
“That said, if the rule remains in place, financial institutions can deny access to third parties that don’t meet minimum safety and soundness requirements,” she said. “This includes cases where a third party cannot demonstrate that its data security practices are sufficient to safeguard consumer information.”
While Rule 1033 does not prescribe a specific process for how a financial institution should deny access, it does require that institutions retain records when such access is denied, Renaldo said.
“If the rule is rescinded, financial institutions should still move forward with implementing open banking APIs, blocking screen scraping and incorporating risk management and allocation into their broader data-sharing strategy,” she said.
500 Million Consumers
While over 500 million consumers are connecting accounts, screen scraping still accounts for 30%–50% of data sharing, according to insights shared at the 2025 FDX Summit, Renaldo pointed out.
“For institutions without open banking APIs, that means zero visibility into who is accessing data, what is being accessed or how it is being stored,” she said. “By contrast, APIs enable secure, controlled data sharing and allow institutions to enforce data minimization based on the specific use case. If a financial institution has an API in place, it can require third parties to use that API instead of relying on screen scraping. Whether the rule moves forward or is rescinded, the financial ecosystem needs to align on ensuring all consumer-permissioned data is shared securely and kept safe.”
Another consideration with Rule 1033 is its restriction on data providers charging third parties for data access.
“On the surface, this appears unreasonable given open banking infrastructure comes with both initial and ongoing costs,” Renaldo said. “But there are broader implications. If large financial institutions can charge data recipients for access, what will it mean for smaller institutions or credit unions seeking to power use cases like personal financial management, cash flow underwriting or account opening? What will the cost of access be for the long tail of the industry?”
When thinking about open banking, CUs must expand their lens beyond just compliance, Renaldo said.
“It is about enabling secure, consumer-permissioned data sharing within a broader connected ecosystem,” she said. “That includes managing both data out and data in, preparing for the growing role of AI, and aligning strategies with the rise of real-time payments – all of which reinforces the need for trusted, secure infrastructure.”
CU Preparedness
Were CUs ready for this rule phasing in by 2026?
“When it comes to something as significant as credit union data being shared with third parties – and often fourth parties via aggregators—having more time for due diligence and strategic planning is never a bad thing,” Renaldo said. “For many credit unions, the first step is simply building a foundational understanding of open banking—what it means, how to secure members’ sensitive financial data, how to apply analytics and insights from API traffic, and how to benefit from consumer-permissioned data on the receiving end.”
Renaldo pointed out the CFPB estimates 90% of checking, savings and credit card accounts in the U.S. are covered by Rule 1033.
“The other 10% includes more than 4,300 credit unions, many of which may not have prioritized open banking due to not being directly subject to the rule,” she said. “Others that do fall under the rule may have delayed planning due to regulatory uncertainty. Either way, many institutions still lack a full understanding of how much data sharing is occurring today through screen scraping and the risks associated with it. Likewise, the benefits of joining a connected, standards-based ecosystem may not yet be fully appreciated.”
Consumer education is another critical piece, insisted Renaldo.
“While most consumers know how to read bank statements or use their debit cards, data sharing is unfamiliar territory,” she explained. “At the FDX Summit, a representative from MIT’s Computer Science and AI Lab said it well: ‘Most people want to assume they’re being respected—until something goes wrong.’ As an industry, we must focus on helping consumers avoid bad actors, ensure only the necessary data is shared, and build the trust needed to support innovation and adoption.”
Whether or not the rule moves forward, credit unions should see this CFPB decision as a catalyst to deepen their understanding of open banking, build a strategy, and educate both staff and members, Renaldo said.
“The time to prepare is now,” she said.
Privacy Concerns
As CUToday.info reported, the open banking rule brought with it data privacy concerns, with banks and credit unions being required to share account data with largely unregulated fintechs.
“The reality is that screen scraping presents far greater privacy and fraud risks than anything introduced by Rule 1033,” Renaldo said. “That point hasn’t been loudly voiced, mainly because larger institutions already operate in an API-driven model and are less impacted by screen scraping.”
While the financial services industry has made great progress on open banking without regulation, it has not collectively addressed risk management to the extent needed through regulation or market action, Renaldo said.
“Whether Rule 1033 moves forward or is rescinded, that gap remains,” she said. “Strong governance will require industry-wide collaboration. If the rule is rescinded, it only heightens the urgency for greater awareness and action to move away from screen scraping and toward secure, API-based data sharing—supported by clear standards for governance, risk and accountability.”
For credit unions, the impact will depend less on the rule itself and more on how they respond to the broader reality: Members are already actively sharing their financial data with third parties, Renaldo said.
“Members trust their credit union to keep their data safe and support their financial decisions, even if those involve products or services offered outside the credit union,” she said. “That trust is an asset credit unions can continue to build on, especially as consumers explore new tools and technologies in the broader financial ecosystem. This is a valuable opportunity for credit unions to deepen their role in members’ lives by participating in a more connected future.”
Long-Term View
Renaldo emphasized that credit unions and banks must adopt a long-term view and understand that a world where consumers are openly sharing their data to improve their lives is not far off.
“Startups like Deck are already building infrastructure for user-permissioned data access across the entire Internet,” she said. “Its browser-based agents can extract data from any website—with full user permission—and transform it into structured, actionable insights. That’s where things are headed.”
Credit unions that don’t build an open banking strategy won’t just fall behind—they will miss out on entirely new data sets members are already consenting to share, Renaldo asserted.
“They will also miss opportunities to support the next generation of financial tools and technologies,” she said. “Take AI, for example. AI agents are only as effective as the data on which they are trained. In the near future, we will see personalized AI agents that help consumers improve their financial lives. These tools can only function well if they have access to the full picture of a person’s financial situation.”
Visa and Mastercard, Renaldo pointed out, have already partnered with AI platforms to introduce AI agents that help consumers find and purchase products based on preferences, with the consumer’s consent.
“This is just the beginning,” she said. “As consumers share more data in exchange for better outcomes, we need to ensure open data and new technologies work together to promote financial well-being. Credit unions have an opportunity to lead, not just in protecting members’ data but in helping them use it to build better futures. An open banking strategy is key to sustaining trust, living the people-helping-people mission and building sustainability for the future.”