By Ray Birch
TAMPA--As open banking expands across the United States, credit unions should pause before rushing into strategy decisions and instead examine the broader data-sharing ecosystem that is rapidly reshaping financial services — including risks and opportunities that go well beyond simply replacing screen scraping with APIs.
That’s the message from Velera Senior Innovation Strategist Angelina Renaldo, who argues that understanding the full landscape — from data governance to consumer consent — will determine whether credit unions can compete with fintechs while protecting member trust.
“Let’s zoom out and look at the broader open banking ecosystem to put key questions into context — questions credit unions should be asking before they develop an open banking strategy,” Renaldo wrote in a recent blog for Velera. “Asking these questions will help evaluate the paths available to support open banking.”
Renaldo told CUToday.info that some credit unions may assume they can simply opt into open banking enablement through a digital banking provider and consider the job done once their data is no longer being screen scraped. But she said that “check-the-box” approach can leave significant value on the table if institutions fail to think strategically about member journeys, downstream data-sharing relationships and what consumer-permissioned data reveals about why members are seeking products and services elsewhere.
Renaldo said the answers credit unions develop will shape outcomes such as member engagement, digital experience and long-term competitiveness with fintech firms and other data-sharing organizations.
A Rapidly Expanding Ecosystem
The scale of consumer-permissioned data sharing in the U.S. is already significant. According to the Financial Data Exchange, the open-banking ecosystem now includes more than 4,000 financial institutions and more than 10,000 fintech companies.
FDX reports that 114 million consumers have linked their financial accounts, generating roughly nine billion API calls every month.
That growth is helping position open banking as a major new channel for improving financial experiences, Renaldo said, but it is also increasing scrutiny around privacy, security and operational risk.
A Fundamental Shift In Data Control
Historically, financial institutions acted as the primary custodians of consumer financial data and shared it with third parties only through structured business-to-business relationships. Those arrangements typically included formal vendor reviews, contractual safeguards and periodic oversight.
Open banking flips that model. Consumers now initiate the connection between their financial accounts and third-party applications, often by providing digital banking credentials that trigger business-to-consumer data sharing.
In many cases, multiple parties are involved — including aggregators, data platforms and downstream service providers. When something goes wrong anywhere along that chain, Renaldo noted, the financial institution often bears the reputational impact and responsibility for resolving member issues.
Screen Scraping Still A Reality
Even as APIs become the preferred mechanism for secure data sharing, credential-based screen scraping remains widespread.
In comments to the Consumer Financial Protection Bureau’s Rule 1033 advance notice of proposed rulemaking, the Financial Data Exchange said roughly one-third of consumer-permissioned data sharing still relies on screen scraping.
That figure highlights how much work remains as the industry transitions to more secure API-based systems, Renaldo said. Meanwhile, financial institutions must continue meeting obligations under laws such as the Gramm-Leach-Bliley Act and the Dodd-Frank Act to safeguard consumer data.
Managing Third-Party Risk
One of the most pressing challenges in the open-banking ecosystem is third-party and downstream risk management. While APIs standardize how data moves, the industry has yet to standardize how institutions evaluate trust, liability and security across thousands of potential data recipients.
Research cited by Renaldo from American Banker’s 2026 State of Open Finance Adoption Report found that 34% of financial institutions see third-party risk management as a significant challenge and another 43% view it as a moderate one.
For credit unions, she said, protecting member data requires clear answers to critical questions — including how third parties are validated, whether monitoring is continuous and how consumer consent is obtained, stored and audited.
Renaldo said credit unions should also push prospective partners for visibility into who is actually on the receiving end of data portability, how those downstream recipients were initially vetted, and what ongoing assessments are in place. She added that institutions should expect clarity around what open-banking API traffic looks like and whether unusual spikes or changes in that traffic are being flagged as possible warning signs requiring deeper review.
“Perhaps the most critical question,” Renaldo said, “is how long these practices have been in place,” noting that the answer can reveal whether a partner’s strategy truly aligns with a credit union’s priorities around transparency and governance.
The Consent Challenge
Consumer consent is another key factor shaping the open-banking experience. Many consumers understand how to stop a recurring payment or dispute a card charge, Renaldo noted, but far fewer know how to track or revoke access to their financial data once accounts are linked.
Consumers currently connect their accounts for a range of purposes — from aggregating financial data to opening accounts and enabling digital payments. As artificial intelligence and large-language-model applications expand these capabilities, the complexity of managing data permissions is likely to increase.
Trust remains a major advantage for credit unions. Surveys consistently show that 93% of members say they trust their credit union, including to protect them from fraud or unintended data exposure.
Why Visibility Matters
Renaldo also pointed to the importance of understanding how members interact with third-party financial services once data sharing begins.
She cited an example shared by one credit union involving a member caught in a payday-loan cycle. Because lenders misinterpreted consumer-permissioned transaction data, multiple payday lenders began debiting the member’s account before payroll deposits arrived, generating more than $3,000 in NSF fees before the credit union intervened.
The credit union now uses ACH reporting to detect similar patterns, but Renaldo said deeper visibility into API activity could have allowed earlier intervention and prevented the damage.
A Strategic Moment For Credit Unions
For credit unions, developing an open banking strategy cannot wait, Renaldo said — even as regulatory timelines remain fluid.
“Your members’ trust and their ability to continuing having a seamless, connected experience with your credit union — instead of other fintechs or programs where they are already sharing their data — are at stake,” she wrote.
Renaldo told CUToday.info that while many institutions are waiting for more certainty around the CFPB’s Section 1033 rulemaking, that process is likely to remain a multi-year journey, with implementation expectations potentially stretching well into 2027. But she argued that financial technology has historically moved faster than regulation, pointing to mobile remote deposit capture as one example of a service that saw widespread adoption years before Regulation CC was updated to more directly address the risks.
In today’s market — with neobanks, fintech specialists, super apps and embedded-finance platforms competing for the primary financial relationship — she said credit unions risk falling behind if they wait for perfect regulatory clarity before building an open-banking strategy.
Instead, she said, credit unions should use existing industry tools such as Financial Data Exchange standards and work with partners to build a long-term approach that addresses consent, governance, vendor oversight and member experience.
Ultimately, Renaldo argued that open banking and open finance offer credit unions a broader view of how members engage with financial services beyond their institutions.
That insight, she said, can strengthen engagement, improve outcomes and fuel innovation — but only if credit unions approach the opportunity with careful governance and a clear understanding of the evolving ecosystem.