Last week, I shared the news that JPMorgan has started charging for API access, a move that many see as a death blow to pay-by-bank and open banking in the US. While this might sound dramatic, I believe it’s a necessary reset. The truth is, the current model was never sustainable, and with the CFPB’s recent move to vacate its unlawful 1033 rule, the writing is on the wall. Open banking as we know it is dead in the US.

The core of the issue has always been a fundamental misunderstanding of value. Consumers own their data, but for that data to be truly useful in a transactional context (ie like verifying a balance for a payment) it needs a bank’s attestation. Data “self-attested” by a consumer is just a list of transactions; it lacks the bank’s assertion that the account is in good standing and the user is who they say they are. This attestation is not free. It’s built on a foundation of massive investments in compliance, security, and customer service. As the former head of online channels for two major banks, I can tell you firsthand that a significant portion of our operational costs and call center volume was driven by aggregators scraping data.

This isn’t just about banks wanting to make more money. It’s about a broken business model where aggregators and FinTechs have built commercial services on the back of bank infrastructure, often creating competing products, without sharing in the costs. A commercial relationship without shared economics is doomed to fail. As I discussed in my 2023 blog, “APIs and Trust,” the value of bank APIs is tied to the bank’s attestation, not the raw data itself.

The banks are on solid ground here. The CFPB’s 1033 rule, which would have forced banks to provide free data access, was flawed from the start. The Bureau itself has now sought to vacate the rule, citing that it was beyond its congressional mandate. This is a huge win for banks and a clear signal that the regulatory landscape is shifting to a more rational approach. Banks have real costs in supporting aggregators, and the “good enough” verification that came with free credential sharing is over. The fact that the proposed API fees are still below the pricing of other commercially available identity and account verification services reinforces the fairness of the new model.

This fight is just beginning, and banks are ready for it. They want the opportunity to show how consumer data is being used. Aggregators often have access to highly sensitive information, like payroll data, which can then be used to segment customers for marketing purposes. I don’t believe this is what consumers signed up for when they linked their accounts.

The impact of these fees is already being felt. Pay-by-bank, already challenged by compressed margins from Durbin non-exempt rates, will find it even harder to compete. Companies like Verizon, which have championed pay-by-bank, will be a key case study to watch. The entities most affected are the aggregators and the billers and FinTechs that rely on them.

This move by JPM isn’t the end of innovation; it’s the beginning of a more mature, economically viable phase for payments and banking. It also provides the economic incentive for alternative models, like stablecoins and DeFi, that don’t depend on bank APIs. The free lunch is over, and that’s a good thing for the entire financial ecosystem.