2026 Open Banking Regulation: Federal Uncertainty and State-Level Proposals

In Washington, D.C., there are indications that the CFPB’s Acting Director aims to finalize revisions to the Section 1033 rules before his term limits, possibly publishing updated rules by early July. However, there is doubt about whether these revisions will appease various stakeholders and resolve ongoing litigation. In the meantime, several states are contemplating initiatives to establish their own open banking regulations.

Open banking fundamentally consists of two components: data access rights and payment initiation. Under Section 1033, consumers can request electronic information about financial products. While the CFPB's final rule requires that data providers facilitate access for third parties to execute payments, it has limited data sharing obligations to consumer credit cards and Regulation E accounts, citing these as key areas for consumer transactions.

In recent developments, the CFPB has issued an Advance Notice of Proposed Rulemaking seeking public input on issues such as who can access data, potential fees for data access, and security concerns. Among potential changes, the CFPB is considering allowing fees from data providers after a certain number of free requests.

Meanwhile, at the state level, New York is advancing legislative measures aimed at open banking through Assembly Bill 10640 and Senate Bill 9483, both introduced in March 2026 and currently in committee. If passed, these bills would require financial institutions to establish a developer interface for data access, prohibit fees for such access, and mandate express consumer consent for third-party data access. Notably, the New York proposal includes provisions extending access to small business accounts, unlike the federal rules which apply only to consumer accounts.

While the New York bills align with key aspects of federal rules, they expand on their scope, allowing broader access to various financial products and imposing stricter penalties for violations. However, the proposals also leave many regulatory details undefined, which could create challenges for implementation.

States considering similar regulations will also face legal questions regarding preemption, as any state law limiting banks’ ability to charge fees could conflict with federal banking laws. State attorneys general are examining their powers to enforce consumer protection laws amid rising consumer privacy expectations, ensuring that a less active CFPB does not result in weakened enforcement.

Additionally, federal legislative efforts such as the GUARD Financial Data Act aim to modernize the Gramm-Leach-Bliley Act, potentially enhancing data sharing frameworks and regulating practices like screen scraping. This act would allow consumers greater control over their shared data and necessitate transparency regarding AI use in data processing.

Despite federal uncertainties, market dynamics continue to drive evolution in open banking. Financial institutions, lenders, and fintechs are increasingly forming data-sharing agreements, addressing liability, security issues, and customer experience concerns.

In conclusion, the landscape of open banking regulation in the U.S. is complicated, marked by federal inaction and proactive state initiatives. Should New York’s legislation advance, it may lead to a fragmented system of state-level regulations. Additionally, potential federal reforms on data privacy and open banking infrastructure are under consideration, prompting stakeholders to enhance technological frameworks and adapt to rapidly changing regulatory conditions.