During fall 2024, the Consumer Financial Protection Bureau will adopt open banking in the United States through the Personal Data Rights rule under Dodd Frank section 1033. 

The adoption of open banking entails significant increases in consumer financial data sharing from FIs to third parties, specifically through the API channel. 

Open Banking APIs already constitute a high risk due to their public accessibility and other factors. The risk is further increased due to the scope, sensitivity and large amounts of data typically shared in open banking customer journeys. 

This presentation describes the modern approach to securing financial-grade APIs and the current recommendation of the Financial Data Exchange Security and Authentication Working Group.