At Money20/20, I spoke with Steve Boms, Executive Director of the Financial Data and Technology Association (FDATA). FDATA represents financial technology companies whose products depend on access to financial data with the permission of consumers or businesses.
Why this matters
Steve makes a distinction between a market where data-sharing products are available and one where people have consistent rights to use them.
In the U.S., financial data connections often depend on arrangements between the institution holding the account and the third-party provider. Those arrangements can determine the data available, the way it can be accessed, and the conditions attached to access.
Steve argues that a consistent right to share data with an authorized provider would give customers more choice and reduce the importance of individual commercial agreements.
Open banking is not the same as open data
I challenged Steve on the name “open banking.” To a consumer, it can sound as though financial information is becoming public.
That is not how consumer-permissioned data sharing is intended to work. The idea is that you decide which provider can access specified information to perform a service you have chosen.
Steve also pushed back on my concern that users do not know what they share. He pointed to disclosures and consent flows created by data aggregators, even without a uniform U.S. open-banking rule. My question remains whether those practices are consistent enough across the market.
The useful distinction is between a provider’s current consent process and an enforceable, widely applicable right to access and share data.
What Section 1033 changes
The 2024 CFPB rule was designed to establish requirements for covered financial institutions and authorized third parties. Steve describes it as the foundation for clearer disclosure, consent, data protection, and API access expectations.
FDATA supported much of that framework and has been advocating for a new version that preserves its underlying consumer data-rights principles.
Canada provides a useful comparison. In March 2026, Canada enacted a new Consumer-Driven Banking Act to establish a legal framework for customer-directed data sharing. Enacting a framework does not mean every connection is already operational, but it offers a clearer statutory direction than the uncertain U.S. implementation path.
Agentic commerce raises the stakes
We also talked about the attention paid to agentic commerce at Money20/20.
A useful framework needs to establish what the customer authorized, what the agent can do, when new permission is required, and who is responsible when something goes wrong.
Steve’s position is that rules for consumer-directed data access are part of the foundation for this next generation of financial services.
What it means for your team
If you build financial products, use data aggregators, or consider adding pay-by-bank, treat data access as part of the product and operating model, not just an integration step.
Your product may work technically with the institutions in your test environment while customers at other banks experience different coverage or terms. Consent design, access revocation, failure handling, and customer support should be part of product discovery and provider selection.
For teams exploring AI agents, write down the boundary between reading information, giving recommendations, and initiating financial activity before designing the experience.
Resources
Related episodes
Open Banking and Pay-by-Bank with Anubhav Pradhan, ShiftMate — Open Banking and Pay-by-Bank with Anubhav Pradhan, ShiftMate.
Subscribe
PAYMENTS FM covers how payments work in practice for merchants, platforms, and product teams. Subscribe for conversations with people working on financial products and infrastructure.
