The API Economy of Financial Data: Who Owns the Pipes
A regulator's own words: most third-party financial data access runs through a handful of aggregators. Mapping the stack and where power sits.
Alfred BEditorial Reviews
Almost every product that reads a consumer bank account looks like an application from the outside. Underneath, most are renting the same short list of connections from the same short list of intermediaries.
The financial data stack has four working layers: institutions that hold the account, financial data aggregators that own the connections into it, applications built on top, and decision systems that consume the output. Margin and power concentrate in the connectivity layer, because it is expensive to build, slow to switch, and shared by everyone above it.
The evidence sits in regulatory filings, a public antitrust record and published adoption data.
What does the financial data stack actually look like?
A financial data aggregator is a company that maintains permissioned connections to consumer financial institutions and resells access to the resulting data through a single API.
The definition sounds narrow. The position it creates is not. An application that wants to read a checking account can build connections to thousands of institutions itself, buy access from an aggregator, or go without. The second option wins, and it wins for everyone at once.
| Layer | What it does | Who occupies it | What is scarce here |
|---|---|---|---|
| Data provider | Holds the account and the ledger | Banks, credit unions, brokerages | The data itself |
| Connectivity | Maintains and normalises connections across thousands of institutions | Financial data aggregators, plus bank-owned networks such as Akoya | Long-tail coverage, and uptime |
| Standards | Defines the shared API contract | The Financial Data Exchange | Agreement |
| Application | Turns connected data into a product | Lending, payments, accounting and personal finance apps | Distribution |
| Interpretation | Turns connected data into an answer somebody acts on | Underwriting, risk and verification systems | Judgement, and a record of it |
The consumer financial data stack: four working layers plus the standards contract that binds them, and the scarce input at each. Only connectivity is both hard to replicate and required by every layer above it.
Why does the connectivity layer capture the margin?
Because it is concentrated, and the regulator has said so in writing. In the preamble to its Required Rulemaking on Personal Financial Data Rights, published in the Federal Register on 18 November 2024, the Consumer Financial Protection Bureau states that "most third party access is effectuated via a small number of aggregators, although some third parties elect to access at least some data directly."
The volume running through that small number is not small. The same Bureau document estimates that as of 2022 at least 100 million consumers had authorised a third party to access their account data, and that the number of third-party access attempts on consumer financial accounts in 2022 "is estimated to have exceeded 50 billion and may have been as high as 100 billion."
The Bureau described the structural consequence in the same 18 November 2024 document, writing that "dependency on a handful of data aggregators creates incentives for them to rent-seek and self-preference." That is a statement about the shape of a market, made by a regulator in a rulemaking preamble. It is not a finding about the conduct of any particular company.
The most useful sentence in the filing is the quietest. The Bureau found "nearly universal consensus that safer forms of data access should supplant screen scraping," then explained why the transition had not happened: it required data providers to choose to build safer access, and required providers and third parties to agree on the resulting terms, "both of which have proved to be challenging propositions."
The industry agreed on the technology years ago. What it has not agreed on is the price. A migration that stalls on terms rather than on engineering is a migration about who gets paid for the pipe.
What does the public record say about how connectivity gets valued?
On 5 November 2020 the United States Department of Justice sued to block Visa's proposed $5.3 billion acquisition of Plaid. The complaint alleged that Visa was "a monopolist in online debit services," and alleged that Plaid was developing a lower-cost competing option for online debit payments. Those were allegations made in a complaint.
The Department's Antitrust Division update for Spring 2021 records what happened next: on 12 January 2021 Visa and Plaid announced that the companies had terminated their merger agreement. No court ruled on the allegations, and there was no finding of wrongdoing by either company.
What the record does establish is a number. A global payments network agreed to pay $5.3 billion for a company whose central asset, as the Department's Spring 2021 update describes the complaint's allegation, was existing technology including connections to 200 million consumer bank accounts in the United States. That was the price someone was willing to pay for the connectivity layer in January 2020, when the deal was announced.
Who is trying to build around the aggregators?
The data providers. American Banker reported on 20 February 2020 that Akoya, a data-sharing network spun out of Fidelity, would be jointly owned by Fidelity, The Clearing House and eleven banks including Bank of America, JPMorgan Chase, PNC, TD Bank, U.S. Bancorp and Wells Fargo.
That ownership list is the most legible signal in this market. Eleven institutions that compete with each other on almost everything took a joint position in the connectivity layer. Institutions build the thing they do not want to buy.
The standards layer is the other flank. The Financial Data Exchange, which describes itself on its own site as of August 2026 as a consortium of over 200 financial institutions, fintechs, aggregators and industry participants, exists to make the API contract common. A common contract lowers the cost of switching aggregators, and getting that many parties to agree one took years.
Does open access widen the market or just open the door?
Both, and the gap between the two is where practitioners get misled.
Research published by the Bank for International Settlements in BIS Papers No 168, dated March 2026, records that over 4,500 third-party providers of financial services had entered the market for retail financial services in the EU and UK as of December 2024. That figure gets quoted often.
Open Banking Limited's Impact Report 7, published 16 May 2025, reports the narrower one for the UK: 145 third-party providers with a live-to-market open banking proposition, with 33 live-to-market providers having exited since 2022 against 23 new firms replacing them. Registration is wide. Sustained live presence is narrow, and over that period it ran slightly negative.
Entry counts measure permission, not viability. Treating one as a proxy for the other is how a market gets described as competitive when what happened is that a lot of firms bought a licence and then discovered what coverage costs.
What happens when someone sets the price of a connection?
The pricing question is on the table in two jurisdictions.
In the United States, the Consumer Financial Protection Bureau opened an advance notice of proposed rulemaking on 22 August 2025 reconsidering its personal financial data rights rule. Among the implementation issues it reopened is the approach to assessing fees to defray the costs a covered person incurs in responding to customer-driven data requests.
In Canada, the Canada Gazette of 27 June 2026 published proposed consumer-driven banking regulations setting an accreditation fee of $2,500, adjusted annually for inflation, across four accreditation pathways covering fintechs, payment service providers registered under the retail payments framework, financial institutions and third-party service providers. The same notice states that about nine million Canadians currently access financial data sharing services by providing their confidential banking credentials.
Note the asymmetry. Two thousand five hundred dollars is not a barrier to entry for anyone. The barrier is what accreditation does not confer: a working connection to every institution an applicant actually banks with, including the credit union with 40,000 members that will appear on no coverage list this year. Anyone who has watched an intake queue on a Friday afternoon knows the shape of it. The connection succeeds for applicants at the big five, and the rest of the file falls back to documents.
What we don't know
There are no independently published market share figures for any financial data aggregator. None. Every share estimate in circulation traces back to a company's own materials or to a note reconstructing them, and any figure an aggregator publishes about its own coverage, connection counts or institution totals is company marketing.
There is no public volume or revenue data at the aggregator level either. The 50 billion to 100 billion access instances for 2022 is a market-wide estimate from the Bureau's 18 November 2024 filing, not a breakdown, and it attributes volume to nobody.
For Canada there is no published market structure data at all: no aggregator counts, no coverage figures, no volume. The framework is not operational, so there is nothing to measure yet. The fee question in both jurisdictions is open, and what any regulator decides, or when, is not something this piece will guess at.
Common questions
What is a financial data aggregator?
A financial data aggregator is a company that maintains permissioned connections to consumer financial institutions and resells access to that data through one API. Applications use aggregators instead of building and maintaining thousands of institution connections themselves, which is why the layer concentrates.
How concentrated is financial data aggregation?
The Consumer Financial Protection Bureau wrote in the Federal Register on 18 November 2024 that most third-party access is effectuated via a small number of aggregators. No independently published market share figures exist for any individual aggregator, so the concentration is documented in kind rather than in percentages.
What happened with Visa and Plaid?
The Department of Justice sued on 5 November 2020 to block Visa's proposed $5.3 billion acquisition of Plaid, alleging harm to competition in online debit. The Department's Spring 2021 update records that the companies terminated the merger agreement on 12 January 2021. No court ruled and there was no finding of wrongdoing.
Why has screen scraping not been replaced yet?
The Consumer Financial Protection Bureau found in its 18 November 2024 filing a nearly universal consensus that safer access methods should supplant screen scraping, but noted the transition required data providers to build those methods and to agree terms with third parties, which it described as challenging propositions.
How many providers have entered open banking markets?
The Bank for International Settlements recorded in BIS Papers No 168 of March 2026 that over 4,500 third-party providers had entered EU and UK retail financial services as of December 2024. Open Banking Limited reported on 16 May 2025 that 145 UK providers had live propositions.
Carousel sits in the interpretation layer, turning connected data into a decidable file. See how verification fits your flow
