When Regulation Doesn't Remove Friction. Instead it Relocates It.

Regulations leave a lot to be desired. That’s not a controversial statement, but it’s one that credit union leaders need to sit with—especially on open banking.

At Fintech Meetup 2026, one of the Main Stage keynotes—“The confidence gap: What open Finance still gets wrong—and who has to fix it”—featured NCUA Chairman Kyle Hauptman, the FCA’s Jessica Rusu, and Invela Network’s Louise Beaumont. One topic discussed was the question of liability in open banking—a question that remains unanswered, with the cost of leaving it open mounting by the day.

Hauptman was direct. He told the room that sixteen years after Dodd-Frank ordered the rule to be written, traditional finance institutions are still objecting—and the objections are legitimate. The regulation lacks clear liability rules, has security gaps, and requires banks to share sensitive data with third parties who face no equivalent oversight. Hauptman’s Target example made the point perfectly: when Target’s data breach forced credit unions to reissue debit cards, members didn’t blame Target. “It doesn’t matter what you write in the envelope,” Hauptman said. “People still blame them (the credit unions).” Liability in open banking isn’t a legal abstraction. It’s who your member calls when something breaks. And right now, that’s the institution—whether you caused the problem or not.

If you’ve read my recent pieces, you know I’ve been writing about regulatory capture—how large players manipulate regulatory bodies into frameworks that only they can afford to comply with, effectively locking out competition. But this conversation surfaced a different failure mode: regulation for the sake of regulating. Sloppy frameworks that generate complexity without producing clarity. And open banking in the US is sitting squarely in that second category.

Rusu described how open banking works in the UK around data minimization principles—an app doesn’t need your birthdate, just confirmation you’re over eighteen. Your bank already knows the answer. So instead of handing personal data to a stranger, the app asks your bank a yes-or-no question, gets the answer, and moves on. Nobody stored anything they didn’t need.

When she said that, I realized I’d never thought about open banking at the consumer level of detail. My focus has always been on the operational side. I hadn’t considered the consumer value proposition—what open banking is supposed to deliver to the people we serve. And that value is significant, but only if the execution is right.

Here’s the problem nobody on that panel said out loud: an open banking model that delivers value to the consumer presumes an informed consumer. What we actually have is a consumer who clicks “Accept All Cookies” four hundred times a week without reading a word (author included). If open banking requires members to read fifty pages of regulatory disclosures explaining what they’re granting and what they’re not, it won’t be innovation—just bureaucracy masquerading as value. The friction just moves from one place to another, and adoption dies.

And there’s a darker failure mode. Data minimization only works if it’s actually enforced. If a company can say, “Sure, we only need to know you’re over eighteen, but if you don’t give us your full birthdate, your transaction history, and your address, we won’t serve you”—then we’re right back where we started. That’s not consumer empowerment. That’s extortion with a consent form. There has to be a mechanism—regulatory, architectural, or both—that prevents companies from conditioning access to services on the surrender of data they don’t actually need. Otherwise, data minimization is a principle on paper and a fiction in practice.

The panel used aviation as an analogy: you need air traffic control before you scale the airspace. I’d add that air traffic control isn’t a policy document. It’s an engineered system with accountability at every altitude. In open banking, that means an orchestration layer that enforces data minimization at the API level, monitors risk continuously across every connected party, and—most importantly—routes and attributes liability to the entity that caused the problem. Let the regulators define the airspace. Let the market build the radar.

Open banking has real potential to deliver something meaningful to consumers—not just to institutions and fintechs fighting over the plumbing. But only if we build it honestly. That means controls that protect people who don’t read the fine print. Education that meets members where they are, not where we wish they were. And guardrails that prevent the principle of minimization from being negotiated away at the point of service.