The news: Another data-access domino fell this week as Charles Schwab followed Fidelity’s move to restrict credential-based access for fintechs and other third parties.

How we got here: The vendors that use customers’ credentials to log into their accounts have historically used “screen scraping” technology, which poses data security and liability risks for financial services companies. But it was necessary for customers to share their credentials with third parties for fintechs and other software providers to access financial accounts. Now, as APIs have proliferated, agreements between FIs and data aggregators make credential-sharing unnecessary in many cases.

Recent headlines: JPMorgan Chase set off a firestorm when it introduced fees for fintechs’ customer data access, after the Trump administration withdrew the Consumer Financial Protection Bureau’s (CFPB’s) “personal financial data rights” rule. The rule’s 2024 publication was a watershed moment in data access that heavily favored the fintech industry. But with newfound negotiating power, banks are revising agreements to their favor

Meanwhile, the banking industry is trying to weaken the open banking rule that’s on the horizon. Representatives recently argued that fintechs should not be allowed to access bank data only because a consumer gave permission, that the CFPB can’t prohibit banks from charging fees for access, and that the original rule introduced too much risk for banks and their customers.

Our take: The Schwab and Fidelity issue is just the latest battle in a protracted war between banks and fintechs over consumer data access. Brokerage firms have had no recently regulated reason to adapt to open banking. Even the defunct open banking rule only applied to deposit accounts, digital wallets, and credit cards—not investment accounts like Schwab and Fidelity’s.

Open banking for bank accounts has thrived in the private sector as banks, vendors, and trade groups have partnered to enable a rich ecosystem of fintechs and other software providers. Data security and liability are only reasonable excuses for FIs to kick third-parties out of their systems when they don’t have the resources to build alternative access methods.