News & Insights

Section 1033 focuses exclusively on ‘read-only’ access to data on financial accounts, which makes its scope more similar to the proposed Financial Data Access (FiDA) regulation. In contrast, PSD2 (which is being updated with PSD3 and the Payment Services Regulation, PSR) also covers ‘write’ access via payment initiation services, enabling new options for customers in ecommerce payments, bill payments and business-to-business (B2B) payments. Payment use cases in the US are currently largely limited to individual banks pursuing API-based business models by offering premium treasury management solutions (i.e. submit payments to vendors and suppliers).

In addition, PSD2 and PSR use more stringent rules on the use of Strong Customer Authentication (SCA), which mandates the use of two or more authentication factors across banking operations to reduce fraud. FiDA brings along the requirement for mandatory schemes – which are to be developed by market actors within strict deadlines – to set all relevant rules and mechanisms to ensure secure financial data access.

Meanwhile, Section 1033 does not detail the exact requirements on how to share data. While approaches like screen scraping are not forbidden under the new rules, the CFPB is fostering a standardised way to share data by stimulating banks to follow data standards issued through certified standard setting bodies. At the time of writing, the only entity that has been approved by the CFPB as a standard setting body is Financial Data Exchange (FDX), but it is expected that more will emerge as the implementation of Section 1033 nears. 

Section 1033 also differs from PSD2 due to its staggered implementation deadlines. Depository institutions will have different compliance deadlines based on their size (measured in total assets), having been categorised into five separate tiers (see Figure 2). The largest banks are required to offer the full range of functionalities by as early as April 2026, while the smallest banks will have until April 2030 to do so. 

This contrasts with the regulatory deadline for PSD2, which didn’t differentiate between size of financial institutions. In this regard, Section 1033 grants smaller banks more time to build up their technical capabilities and learn from the implementation processes of larger banks. Many of the largest banks in the United States, such as Bank of America, Citibank and US Bank, have already established developer portals and API functionalities that seem to surpass those required by Section 1033. However, most of the other 4,000+ banks in the United States have yet to offer any form of API connectivity to their banking operations. This exposes them to a significant capability gap and consequential time pressure. Given the historical difficulties that banks have faced in their efforts to comply with PSD2, it is likely that more ‘Compliance-as-a-Service’ providers will begin to emerge in the US to offer banks off-the-shelf solutions for becoming Section 1033 compliant.

Implementation approaches for banks to become compliant

Ultimately, the cost of complying with Section 1033 will largely depend on how banks decide to approach their compliance efforts. They will essentially be able to choose between three main strategic options:

1. Building the required technical capabilities in-house
2. Outsourcing this to external firms by implementing their solutions
3. Acquiring an external firm to obtain the capabilities to build the connectivity in-house

Of these three options, outsourcing is likely to be the fastest and most cost effective. This option would, however, also mean banks having to sacrifice control and flexibility. Meanwhile, building the connectivity in-house is an option likely reserved only for firms with sufficient financial resources, capacity and know-how. Acquiring an external firm to gain access to the necessary technological capabilities usually requires the largest investment. This option is often utilised to speed up time to market and obtain proven capabilities. 

It is important to note that all these costs cannot be offset by monetising the obligated API products, as Section 1033 prohibits banks from charging usage fees. Therefore, banks will have to find alternative ways to capture value from their newly created connectivity, such as offering complementary value-added services and nascent API functionalities beyond the functionality included in Section 1033. Banks can pursue their own strategies around premium APIs and can also collaborate with other market players to introduce premium API services. In Europe, for example, banks and third parties collaborate on premium API services in the context of the SEPA Payment Account Access (SPAA) scheme managed by the European Payments Council.  

Outlook on implementation 

With a cutoff point of $850M in managed assets, Section 1033 will affect all but the smallest regional banks in the United States. As many of these institutions have yet to embark on their Open Banking journey, this will represent a huge leap forward in the broader realm of Open Banking in the US. Most financial accounts will soon be accessible through third-party applications leveraging API connectivity, giving consumers the ability to have more control over their data and utilise services that better fit their financial needs and preferences (e.g. creditworthiness and personal financial management solutions). 

However, it remains to be seen how far the industry will go to create solutions that go beyond Section 1033 compliance. Given the relatively mixed results of PSD2 in driving innovation and competition, this is what will decide the future of Open Banking in the United States. More and more players across the globe are attempting to capture the opportunities created by Open Banking beyond compliance. INNOPAY’s Open Banking Monitor highlights banks’ efforts to expand their API product offering and improve the developer experience.

Reach out to learn more about how INNOPAY can support you in designing, launching and scaling your Open Banking API platform and strategy. In the meantime, stay tuned for more insights on the Open Banking market in the United States. Further articles in this series* will document the current functionalities and developer experiences of leading US banks. Keep a lookout for these articles on our social media channels and be sure to subscribe to our newsletter to ensure you don’t miss any new publications! 

*While this series is focused on the effects and status of depository institutions, Section 1033 will also affect non-depository institutions, payments firms and mobile wallets.