Open banking is transforming how consumers interact with their financial data, creating new opportunities for innovation, competition, and user control throughout the financial system. At the heart of this discussion is Section 1033 of the Dodd-Frank Act—the federal regulation that gives consumers the right to access and manage their own financial information. As regulators evaluate how the rule is being implemented, key questions have emerged: Who truly owns consumer financial data? Should banks be permitted to charge for access? And how will these decisions influence emerging technologies like AI, crypto, and real-time payments?
You will find the highlights of my conversation with Penny Lee, president and CEO of the Financial Technology Association (FTA). With a career spanning political strategy, startup investing, and regulatory advocacy, including leadership roles at K Street Capital and the tech incubator 1776, Penny offers a uniquely comprehensive perspective on the intersection of innovation and financial policy. Our conversation shed light on the future of data portability, consumer rights, security standards, and the evolving regulatory framework that will shape the next era of financial technology.
Below is a lightly edited and abridged transcript of our discussion. You can listen to this and other episodes of Explain to Shane on AEI.org and subscribe via your preferred listening platform. If you enjoyed this episode, leave us a review, and tell your friends and colleagues to tune in.
SHANE TEWS: What drew you into the combined policy expertise, startup investing, and then into your work now at FTA?
PENNY LEE: The first half of my career was in politics, working on campaigns and electing officials I hoped would affect change. After they were elected, I worked on various policies to make that change. When I left that world and went into multi-client lobbying, I saw a market gap: entrepreneurs in reg-tech were entering the regulated space without understanding the rules, parameters, or restrictions.
We formed K Street Capital to invest in these companies. Many of us came from the regulatory or policy world. We used our knowledge and networks to help build these companies and propel them toward success. That was the thesis behind K Street Capital.
Now, 12 years later, we have $65 million assets under management. We’ve had several unicorns, and it’s been exciting to see technology change how government operates. You see big unicorns like Palantir and Anduril making dynamic changes in how government works. We were on a smaller scale, but the pattern is similar.
Fast forward to financial technology and our association, and we’re seeing the same capability: innovators coming into the space to close marketplace gaps. Do consumers have access to investing platforms? Can we offer banking services without high fees? Can we offer accounts without overdraft fees? These innovations are changing how consumers and small businesses interact with financial services. it’s a path and a part of the journey, and really exciting to be a part of.
ST: Let’s talk about the work you’re doing now — especially removing friction in the market.
PL: A lot of our work is removing friction from the marketplace and making it easier for you to change or connect your accounts. For the last ten years, open banking has centered on the idea that consumers have the right to own their data and permission it to the apps and services they choose.
I have a bank account right now with a 0.003 interest rate on my savings. I don’t keep a lot of money there, and I move my funds into a higher-yield savings account. That ability for you to make that choice and move your own data is what open banking is about. That foundational piece says you, the consumer, have the right to your data.
The question now is whether consumers own this data, whether they can authorize a third party or fintech to access it, and whether banks have the right to charge for access. At FTA, we argue the statute is clear: banks shall make available to consumers, upon request, their financial information. It did not say “for a fee” or “for a toll.” It said, “upon request.”
We urge the Trump administration, which is reviewing the rule again — finalized in 2024 and now under review — to hold firm that consumers have the right to permission their data without exorbitant bank fees.
ST: Explain the shift from data scraping to APIs.
PL: When personal financial data sharing first appeared in the early 2000s, it was done through screen scraping. You gave over your credentials to your account, and the third party found information from that bank account to build a picture of your finances.
This has shifted to APIs, which are network communications between two entities allowing information to flow more securely and permissioned. APIs are often tokenized, meaning your credentials don’t stay in one place. The security is higher and safer.
The rule encouraged shifting away from screen scraping, and we’ve been supportive. Some smaller institutions still don’t have the tech stack to build APIs, so the shift requires time. We support phasing out screen scraping and moving to APIs, but in an appropriate way that allows everybody to make sure they have the right tech stack to do it.
APIs have very high standards — ISO, NIST, GLBA, and others — because financial data must be securely transferred, uncompromised, accurate, and used only as authorized. Ironically, the least secure form of payment is a check. A check contains your account and routing number, which can be misused. Sending a check in the mail doesn’t guarantee security.
We’re trying to get away from that. President Trump has emphasized moving government payments to electronic systems, which are far more secure.
ST: What’s in play right now with the rules — especially definitions like consumer, representative, and ‘upon request’?
PL: Several matters are in play. First is the definition of a consumer. The statute defines consumers as individuals, agents, representatives, or trustees. Large banks argue that agents, representatives, and trustees must have a fiduciary duty, even though they often don’t have a fiduciary duty to their own customers when receiving this information.
Banks want a barrier that requires a special relationship, but the legal definition of representative does not require fiduciary duty. A representative or fintech acts on behalf of the consumer to get information for personalized services. If banks only had to give consumers a PDF of their monthly bank statement, innovation would stop. There’s not much you can do with that.
So, defining a consumer and authorized third party is key.
Second is defining “upon request.” We argue that banks are required to provide information upon the consumer’s request without a fee.
There are other cascading issues — what accounts count toward a complete financial picture, how often data should be reauthorized, and what types of providers count as aggregators, but it comes down to defining who is a consumer or authorized third party and whether fees should be allowed.
ST: Is 1033 part of making sure I can feel secure about data protection and control?
PL: It is narrow to the financial side, but yes. The U.S. is still working toward a full data privacy bill, which has been before Congress for years. GLBA governs how financial data moves and what safeguards apply to it.
The final rule, effective in October 2024, added numerous security measures and gave consumers significant control over their data, including when they can grant permission, when they can revoke it, how long authorization lasts, and how long third parties can use it. These are protections we hope will continue under the new rule that comes out under President Trump, because it is important to have those clear defining moments to make sure the consumer is always in control of their data and can permission it for their own use and what they want, versus just letting somebody go wild with it.
So, measures were in there, and I hope they continue to be.
