In October 2024, the CFPB (Consumer Financial Protection Bureau, the US federal agency overseeing consumer financial products) finalized a rule requiring banks to let customers move their own transaction data to competitors, for free, on request. By mid-2025, banking trade groups had sued to block it, a federal court stayed parts of it, and the agency itself moved to unwind portions of the rule under new leadership. The rule's fate is still unsettled as of early 2026. That back-and-forth is the lesson: a regulator's pen stroke can hand an entire industry to challengers, or just as easily take it back.
Most people think of regulators as referees: they set rules, blow the whistle on fouls, stay neutral. In fintech, that model is wrong. Regulators decide who gets to compete at all. This lesson treats them as players with strategic interests, not neutral umpires.
Why regulators behave like players, not referees
A referee doesn't change who's on the field. A fintech regulator does, constantly.
Three real cases show this:
UK Open Banking (2018 onward). The Competition and Markets Authority (CMA, the UK's competition regulator) ordered the nine largest UK banks to build standardized APIs (application programming interfaces, technical channels that let software systems exchange data) so customers could share their bank data with licensed third parties. This didn't referee an existing market. It created one. Companies like TrueLayer and Plaid built entire businesses on API access that banks were forced to provide.
API
Application Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.
US Section 1033 (Dodd-Frank Act, CFPB rule 2024). Modeled loosely on the UK's approach, this rule aimed to give Americans a legal right to their own financial data. Unlike the UK, the US had no mandated technical standard and no single regulator with full authority to force banks to comply cheaply. The result: more litigation, more ambiguity, a slower and messier version of the same power shift.
PSD2 in the EU (2018). The EU's second Payment Services Directive required banks across the bloc to open payment initiation and account data to licensed third-party providers, under supervision from national regulators coordinated by the European Banking Authority (EBA).
In each case, the regulator's decision determined whether fintechs got a legal right to bank data, or had to beg for it, scrape it, or buy access. That's not officiating. That's redistributing market power.
What "opening the APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition →" actually redistributes
Before Open Banking, UK banks held a structural advantage: they were the only ones who could see a customer's full transaction history. That data advantage let them cross-sell, underwrite, and retain customers without much competitive pressure.
Mandated APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → access broke that monopoly on data, not on capital or licenses. Once TrueLayer, Tink (acquired by Visa in 2021), or a lender like Klarna could see a customer's real income and spending with consent, several things happened:
1. Underwriting became less bank-exclusive. Any lender with data access could build a competing credit decision, using the same information the incumbent bank had.
2. Distribution shifted toward whoever owned the customer relationship, not whoever held the account. Budgeting apps, comparison sites, and lenders became the new front door.
3. Banks were pushed toward becoming utilities, holding deposits and regulatory licenses, while other players captured the customer interface and the data-drivendata-drivenAn approach where decisions are systematically informed by data analysis rather than intuition alone.View full definition → margin.
This is the general pattern worth remembering: regulation that mandates data or infrastructure access shifts power from whoever controls the pipe to whoever controls the interface.
The regulator's own incentives are not neutral
Regulators aren't disinterested either. Understanding their incentives helps you predict their next move.
Competition regulators (like the UK's CMA or the EU's DGDGData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → Competition) often want more challengers, because concentrated banking markets are a policy problem for them. Open Banking served a competition agenda as much as a consumer-rights one.
Prudential regulators (in the US, the OCC, the Federal Reserve, the FDIC; in the EU, national central banks and the ECB) worry more about systemic stability than about fintech competition. They tend to slow down data-sharing mandates if they fear fraud, deposit flight, or opaque risk in unregulated intermediaries.
Consumer protection regulators (the CFPB, the UK's FCA, the Financial Conduct Authority) balance both: they want competition to lower prices, but they don't want to hand a fragile system to under-capitalized challengers.
When these mandates compete inside one government, the result is exactly what happened with Section 1033: years of delay, litigation, and reversal, because no single "referee" was ever fully in charge. Contrast that with the UK, where the CMA had clear authority and a hard deadline, and Open Banking rules shipped roughly on schedule. Institutional design, not technology, decided the speed of disruption.
For a primary-source view of how one regulator frames its own role, the CFPB's official summary of the Section 1033 rule is a useful, free reference, worth reading with the awareness that its legal status is still contested as of 2026.
Knowledge check
1. What is the core distinction the lesson draws between a 'referee' and a 'player' model of fintech regulation?
2. Why did the CMA's UK Open Banking mandate lead to a more stable, faster-moving market than the CFPB's Section 1033 rule in the US?
3. A fintech founder is deciding whether to build a business dependent on a newly announced data-sharing rule that has not yet survived legal challenges. Based on the lesson's framing, what is the most strategically sound approach?
MULTIPLE CHOICE
4. Select ALL correct answers describing ways the CFPB's Section 1033 rule illustrates regulators acting as 'players' rather than 'referees.'
Select all the correct answers.
MULTIPLE CHOICE
5. Select ALL correct answers about what the UK Open Banking mandate demonstrates about regulatory power in fintech.
Select all the correct answers.
Reading the next move: how to think like a player, not a spectator
If you want fintech fluency, don't just track what a regulation says. Track who it benefits and who it threatens, because that tells you where the next lobbying fight, delay, or loophole will appear.
Ask three questions about any new fintech rule:
1. Whose data or infrastructure does it open up?
Open Banking opened bank data. The EU's Digital Markets Act (2022) opened Big Tech platforms (Apple, Google) to competing app stores and payment rails. Same logic, different incumbent.
2. Who bears the compliance cost, and who captures the upside?
UK banks paid to build Open Banking APIs. Fintechs captured most of the new customer relationships built on top of them. That asymmetry is common: incumbents fund the infrastructure that empowers their own challengers, because the regulator forces it.
3. Does the regulator have enough authority to make the mandate stick?
The UK's CMA had a clean enforcement path. The US CFPB, operating under a statute (Dodd-Frank Section 1033) written in 2010 for a rule finalized in 2024, faced court challenges and a change in political leadership before implementation even began. Authority and durability matter more than the ambition of the original text.
A useful habit: whenever a regulator finalizes a rule, look for who sued, and who lobbied for it in the first place. That tells you who thinks they'll win or lose from the power shift, often more honestly than the press release does.
Key Takeaways
Regulators actively redistribute competitive power in fintech; they are not neutral referees. The UK's Open Banking mandate (CMA, 2018) and the US CFPB's Section 1033 rule (finalized 2024, contested through 2026) both aimed to shift control of customer data from banks to challengers, with very different degrees of success.
The mechanism to watch: mandated access to data or infrastructure moves margin and customer relationships from whoever holds the pipepipeAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → (banks) to whoever controls the interface (fintechs, aggregators).
Regulatory outcomes depend on institutional design, not just intent. Clear, single-authority mandates (UK CMA) move faster than fragmented, multi-regulator, litigation-prone processes (US CFPB under Dodd-Frank).
To assess any new fintech rule, ask: whose data does it open, who pays for compliance versus who captures the upside, and does the regulator have durable authority to enforce it.
Track lawsuits and lobbying around a rule as a signal of who expects to win or lose power, it's often more informative than the rule's stated purpose.