What open banking means for your financial data

"Open banking" is a term that gets used loosely to describe a collection of policies and technologies that give consumers more control over their own financial data. In the U.S., it's been taking shape for years through a combination of regulatory rulemaking and market adoption. The rules matter for understanding what happens when you connect a bank account to any financial app.

The core idea

Your transaction history, balances, and account information are your data. Not the bank's data. Yours.

The bank is the custodian of that data: they store it, process it, and have obligations around its security. But the right to share it, access it, and port it to other services belongs to you.

This sounds obvious. For most of the history of consumer banking, it wasn't functionally true. Banks controlled their data behind closed doors, and the only way to get your transaction history into a spreadsheet was to download a CSV from a portal, if the bank even offered that.

Screen-scraping vs. APIs

The first generation of bank data aggregation was screen-scraping: you gave a third-party service your bank username and password, and they logged in as you to harvest your data.

Screen-scraping is fragile (banks changed their interfaces), a security risk (you'd handed your credentials to a third party), and legally murky (banks argued it violated their terms of service).

Plaid, Yodlee, MX, and similar aggregators built the connective tissue of an API ecosystem. Rather than logging in as you, they use authentication flows where you verify your identity directly with your bank, and the bank issues a token that gives the third-party read-only access to specific data.

This is the model most financial apps use today: OAuth-style authentication, read-only access tokens, no credential exposure. Your bank password doesn't leave your bank.

CFPB Section 1033

The Consumer Financial Protection Bureau finalized its Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act in October 2024. The rule requires covered financial institutions (banks, credit card issuers, credit unions, digital wallets) to make consumer financial data available to authorized third parties at the consumer's request.

Key provisions:

• Data portability: Consumers can authorize third-party apps to access their account data via standardized API
• Consumer control: You can revoke access at any time
• Data minimization: Third parties can only use data for the purpose you authorized: not sell it, not use it for advertising without separate consent
• Provider obligations: Financial institutions must provide data access without unnecessary barriers or fees

The rule was finalized but faced legal challenges and implementation questions through 2025. Its practical effect is to accelerate the transition from screen-scraping to API-based data access and establish clearer rules around what third parties can do with data they receive.

What this means for Sheetful and similar tools

The regulatory direction is toward a more structured, consumer-controlled data ecosystem. Tools that use Plaid (which is already operating in the API-based model the CFPB rule favors) are better positioned than tools still relying on credential-based scraping.

For Sheetful, the Plaid connection is the practical implementation of open banking: you authorize the connection, we receive read-only transaction data, you can revoke access at any time through your bank's third-party authorization portal.

The data that flows into your spreadsheet is your data, and the architecture is designed around you controlling who has access to it.

Why this matters beyond policy

The shift from credential-sharing to API tokens has a practical security implication: if your Sheetful access is compromised, an attacker gets a read-only token to your transaction data, not your bank password. The blast radius is contained.

The shift from broad data access to purposeful authorization means that when you authorize a financial app, you're specifically authorizing transaction data, not giving blanket access to your account.

Open banking as policy is still evolving. As infrastructure, it's already here, and it's meaningfully better than what existed before.