Regulators as active players, not referees

• US Section 1033 (Dodd-Frank Act, CFPB rule 2024). Modeled loosely on the UK's approach, this rule aimed to give Americans a legal right to their own financial data. Unlike the UK, the US had no mandated technical standard and no single regulator with full authority to force banks to comply cheaply. The result: more litigation, more ambiguity, a slower and messier version of the same power shift.

• PSD2 in the EU (2018). The EU's second Payment Services Directive required banks across the bloc to open payment initiation and account data to licensed third-party providers, under supervision from national regulators coordinated by the European Banking Authority (EBA).

In each case, the regulator's decision determined whether fintechs got a legal right to bank data, or had to beg for it, scrape it, or buy access. That's not officiating. That's redistributing market power.

What "opening the APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète →" actually redistributes

Before Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif., UK banks held a structural advantage: they were the only ones who could see a customer's full transaction history. That data advantage let them cross-sell, underwrite, and retain customers without much competitive pressure.

Mandated APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → access broke that monopoly on data, not on capital or licenses. Once TrueLayer, Tink (acquired by Visa in 2021), or a lender like Klarna could see a customer's real income and spending with consent, several things happened:

1. Underwriting became less bank-exclusive. Any lender with data access could build a competing credit decision, using the same information the incumbent bank had.

2. Distribution shifted toward whoever owned the customer relationship, not whoever held the account. Budgeting apps, comparison sites, and lenders became the new front door.

3. Banks were pushed toward becoming utilities, holding deposits and regulatory licenses, while other players captured the customer interface and the data-drivendata-drivenAn approach where decisions are systematically informed by data analysis rather than intuition alone.Voir la définition complète → margin.

This is the general pattern worth remembering: regulation that mandates data or infrastructure access shifts power from whoever controls the pipe to whoever controls the interface.

The regulator's own incentives are not neutral

Regulators aren't disinterested either. Understanding their incentives helps you predict their next move.

• Competition regulators (like the UK's CMA or the EU's DGDGData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → Competition) often want more challengers, because concentrated banking markets are a policy problem for them. Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. served a competition agenda as much as a consumer-rights one.
• Prudential regulators (in the US, the OCC, the Federal Reserve, the FDIC; in the EU, national central banks and the ECB) worry more about systemic stability than about fintech competition. They tend to slow down data-sharing mandates if they fear fraud, deposit flight, or opaque risk in unregulated intermediaries.
• Consumer protection regulators (the CFPB, the UK's FCA, the Financial Conduct Authority) balance both: they want competition to lower prices, but they don't want to hand a fragile system to under-capitalized challengers.

When these mandates compete inside one government, the result is exactly what happened with Section 1033: years of delay, litigation, and reversal, because no single "referee" was ever fully in charge. Contrast that with the UK, where the CMA had clear authority and a hard deadline, and Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. rules shipped roughly on schedule. Institutional design, not technology, decided the speed of disruption.

For a primary-source view of how one regulator frames its own role, the CFPB's official summary of the Section 1033 rule is a useful, free reference, worth reading with the awareness that its legal status is still contested as of 2026.

Reading the next move: how to think like a player, not a spectator

If you want fintech fluency, don't just track what a regulation says. Track who it benefits and who it threatens, because that tells you where the next lobbying fight, delay, or loophole will appear.

Ask three questions about any new fintech rule:

1. Whose data or infrastructure does it open up?

Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. opened bank data. The EU's Digital Markets Act (2022) opened Big Tech platforms (Apple, Google) to competing app stores and payment rails. Same logic, different incumbent.

2. Who bears the compliance cost, and who captures the upside?

UK banks paid to build Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. APIs. Fintechs captured most of the new customer relationships built on top of them. That asymmetry is common: incumbents fund the infrastructure that empowers their own challengers, because the regulator forces it.

3. Does the regulator have enough authority to make the mandate stick?

The UK's CMA had a clean enforcement path. The US CFPB, operating under a statute (Dodd-Frank Section 1033) written in 2010 for a rule finalized in 2024, faced court challenges and a change in political leadership before implementation even began. Authority and durability matter more than the ambition of the original text.

A useful habit: whenever a regulator finalizes a rule, look for who sued, and who lobbied for it in the first place. That tells you who thinks they'll win or lose from the power shift, often more honestly than the press release does.

Key Takeaways

• Regulators actively redistribute competitive power in fintech; they are not neutral referees. The UK's Open BankingOpen BankingCadre réglementaire (PSD2 en Europe) obligeant les banques à partager les données clients via des API standardisées, avec consentement, transformant les données bancaires en actif compétitif. mandate (CMA, 2018) and the US CFPB's Section 1033 rule (finalized 2024, contested through 2026) both aimed to shift control of customer data from banks to challengers, with very different degrees of success.
• The mechanism to watch: mandated access to data or infrastructure moves margin and customer relationships from whoever holds the pipepipeAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète → (banks) to whoever controls the interface (fintechs, aggregators).
• Regulatory outcomes depend on institutional design, not just intent. Clear, single-authority mandates (UK CMA) move faster than fragmented, multi-regulator, litigation-prone processes (US CFPB under Dodd-Frank).
• To assess any new fintech rule, ask: whose data does it open, who pays for compliance versus who captures the upside, and does the regulator have durable authority to enforce it.