A practical guide to build versus buy, platform requirements, cost, and implementation timelines

More than half of U.S. banking leaders now rank open finance as a high priority, and that share is set to grow. In a 2026 Akoya-sponsored American Banker survey of 218 banking professionals, 51% said open finance is a high priority at their institution today, while 64% expect it to become a high or critical priority within three years (American Banker, 2026).

Once an institution commits to open finance, a set of practical decisions follows: whether to build or buy; what the platform must include; who will manage consent, third-party reviews, and contracts; and how much time and investment to plan for. This guide addresses each in turn, and Akoya's guide to what open finance is and how it works covers the fundamentals.

What banks and credit unions expect to gain

When American Banker asked institutions what they expect from open finance, the leading answers centered on the customer: higher engagement (61%), a better customer experience (57%), and the ability to remain competitive (53%). More than half (54%) also expect to deliver real-time cash management and treasury tools to their business clients (American Banker, 2026).

Mastercard's 2026 State of Open Finance research points in the same direction: 76% of consumers said they would switch providers for better digital money-management tools, and 75% of executives reported revenue gains from their open finance initiatives (Mastercard, 2026).

Connections running on APIs aligned to the Financial Data Exchange (FDX) standard grew from 16 million in 2021 to roughly 114 million in 2025, yet FDX notes that tens of millions of consumers still share data by handing their bank login credentials to a third party (FDX, 2025). Those connections remain outside the institution's visibility and control.

Should a bank buy or build its open finance platform?

Most banks and credit unions are better served by partnering than by building, because the APIs themselves represent a smaller part of the work. The larger and more permanent commitment is the program that surrounds them: reviewing and recertifying third parties, negotiating data access agreements, supporting developers, managing consent, and keeping pace with a standard that continues to evolve.

Among institutions actively integrating open finance, 34% describe third-party risk management as a significant challenge and another 43% describe it as moderate, with data access agreements and API maintenance close behind (American Banker, 2026).

Three paths to open finance

What an in-house build includes

An institution that builds owns every element of the program for as long as the program runs:

1. Scalable, secure APIs aligned to industry standards such as FDX
2. Consumer consent management with full transparency and auditability
3. Third-party onboarding, certification, and ongoing monitoring
4. Real-time reporting and audit trails for internal and external stakeholders
5. Developer documentation, testing tools, and support
6. Continuous updates as security standards, consumer expectations, and regulation evolve

Akoya's internal research estimates the cost of an in-house build at more than $8 million upfront, plus $6 million or more a year to maintain. That second figure can persist for the life of the program, since the standard and the roster of third parties requesting access both continue to change.

What should a financial institution look for when evaluating an open finance platform?

At a minimum, institutions should look for no credential sharing, consent controls embedded in their own online and mobile banking, FDX-aligned APIs, and a partner prepared to take on third-party operations. The checklist below goes further, pairing each criterion with a question to put to every vendor under consideration.

What type of developer interface should a bank provide?

A developer interface is the complete set of tools and processes that third parties use to request and receive consumer-permissioned data from a financial institution. It typically includes:

1. Standardized data APIs covering accounts, balances, transactions, statements, and other common data elements
2. A developer portal where third parties register, review documentation, test in a sandbox, and manage their apps
3. Published policies and performance standards, including availability and response-time commitments
4. Consumer authentication, account selection, and a permission dashboard for ongoing control
5. Third-party security and risk reviews, plus data access agreements
6. Monitoring, reporting, and audit trails for internal and regulatory stakeholders

The CFPB finalized its Personal Financial Data Rights rule in October 2024 (CFPB, 2024), a federal court then blocked enforcement while the Bureau reconsiders it (Cozen O'Connor, 2026), and the CFPB sent a revised proposal for review in August 2026 (Consumer Finance Monitor, 2026).

How should financial institutions handle consumer consent and revocation?

Consent should live within the digital banking experience customers already use, where they authenticate with their institution directly, select the accounts and data they choose to share, and can review or revoke any connection from a permission dashboard.

When customers manage their connected apps within the institution's own experience rather than from within a third party, the institution becomes the trusted steward of their financial data, which strengthens the relationship over time. Behind the scenes, each permission should record the recipient, the data in scope, and the purpose, and revocation should end that recipient's access.

How can a bank see which third parties are accessing its customers' data?

The most reliable approach is to move data sharing onto APIs and govern it from a single console. An aggregator that screen-scrapes signs in with the customer's username and password, which makes it indistinguishable from the customer in the institution's systems, while an API connection belongs to a named, vetted recipient.

A strong administrator dashboard shows every data recipient, the purpose behind each connection, the data being accessed, and the status of each risk review and contract. Risk teams rely on that visibility for oversight, and Product teams gain something equally useful from it: a clear view of which applications the institution's customers depend on most.

APIs also help institutions contain automated traffic, which accounted for 51% of all web traffic in 2024. Financial services drew more account takeover attacks than any other industry, with 22% of incidents (Imperva, 2025). Once legitimate aggregators move to APIs, the automation that does not belong becomes far easier to identify and block.

Who can manage legal agreements and third-party vetting for a bank's data sharing program?

A managed open finance partner can administer both on the institution's behalf, bringing in Legal and Risk teams whenever a decision requires their sign-off, while the institution retains authority over who gets access.

The federal banking agencies' interagency guidance describes how institutions shouldmanage third-party relationships from due diligence through ongoing monitoring (Federal Reserve, FDIC, and OCC, 2023), and repeating that process for every app and aggregator that requests access can become a program of its own. This is often where open finance programs stall. In a managed model, every participant on the network completes the same security review and signs the same agreement terms, with annual recertification.

Should a bank choose an open finance network or a point-to-point platform?

In a point-to-point model, sometimes called a direct or bilateral model, an institution builds and maintains a separate connection with each third party that requests access to its customers' data. Every connection carries its own integration, data access agreement, and risk review, and the institution manages each one individually. An open finance network takes a different approach: the institution connects once and reaches a shared group of vetted data recipients that operate under common rules.

If the goal is to give customers access to a broad range of applications, a network is usually the stronger choice, since the institution integrates once rather than once per app. Point-to-point can make sense for institutions that plan to work with only a handful of partners and have the staff to manage each relationship directly.

How long does it take a financial institution to implement an open finance platform?

An open finance implementation timeline is shaped largely by the institution itself: its size, the maturity of its digital and data infrastructure, the complexity of its core banking environment, and the length of its internal security and procurement reviews. Depending on those variables, institutions should plan for anywhere from 3 to 15 months. Institutions with modern infrastructure and a focused initial scope tend to fall toward the shorter end of that range, while large banks with multiple core systems and broader data requirements should expect the longer end.

Institutions of every size benefit from committing to dates early. In the American Banker survey, 38% of institutions still assessing or developing their strategy had no concrete implementation timeline (American Banker, 2026).

How much does an open finance platform cost for a bank?

There is no single price, and the license or build cost represents only part of the picture. Institutions should evaluate options over a multi-year horizon, accounting for the staff and processes required to run the third-party side of the program.

Managed providers typically price by subscription, by usage, or a combination of the two, so institutions should ask each vendor to model expected volumes over a three- to five-year term.

Where the return comes from

The most immediate return is the build the institution no longer has to fund, along with the time its team no longer spends on third-party onboarding, reviews, contracts, and support. Moving aggregators to APIs also keeps customer credentials out of third-party systems and reduces bot traffic across the institution's digital channels.

Data-sharing activity adds a strategic return as well, revealing which apps and services customers value and informing cross-sell and product decisions. Some institutions may also be able to charge for data access, depending on where the CFPB ultimately lands on fees (CFPB, 2025).

In the American Banker survey, 61% of regional banks and 52% of credit unions said they can already show a clear ROI from open finance (American Banker, 2026).

Where Akoya fits in

The most immediate return is the build the institution no longer has to fund, along with the time its team no longer spends on third-party onboarding, reviews, contracts, and support. Moving aggregators to APIs also keeps customer credentials out of third-party systems and reduces bot traffic across the institution's digital channels.

Akoya's Open Finance Solution is a white-labeled platform for banks and credit unions that combines standards-aligned technology with expert managed services. It includes a developer portal, an admin console for managing third parties, a consumer permission dashboard, branded API documentation, and reporting, along with managed security and risk reviews, data access agreement services, and 24/7 support for third parties.

Next steps: Explore the Open Finance Solution, see how Akoya partners with financial institutions, or revisit the fundamentals in What is open finance?

Sources

1. American Banker/Arizent, "The open finance imperative: State of Open Finance 2026," survey of 218 banking professionals, October 2025. Sponsored by Akoya. https://akoya.com/open-finance-report-americanbanker-akoya
2. Mastercard and FT Longitude, "The State of Open Finance 2026." https://mastercard.com/us/en/news-and-trends/Insights/2026/the-state-of-open-finance-2026.html
3. Financial Data Exchange, "114 Million Reasons to Keep Moving Forward on Industry-Led Standard for Secure Data Sharing," April 2025. https://financialdataexchange.org/fdx-feed/114-million-reasons-to-keep-moving-forward-on-industry-led-standard-for-secure-data-sharing/
4. Financial Data Exchange, "FDX Hits 94 Million Accounts," 2024, and prior FDX adoption metrics releases. https://financialdataexchange.org/fdx-feed/fdx-hits-94-million-accounts-cfpb-publishes-fdxs-standard-setting-application/
5. Thales, "2025 Imperva Bad Bot Report" press release, April 2025. https://cpl.thalesgroup.com/about-us/newsroom/2025-imperva-bad-bot-report-ai-internet-traffic
6. Board of Governors of the Federal Reserve System, FDIC, and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management," June 2023. https://federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm
7. Consumer Financial Protection Bureau, "Required Rulemaking on Personal Financial Data Rights." https://www.consumerfinance.gov/personal-financial-data-rights/
8. Consumer Financial Protection Bureau, "Personal Financial Data Rights Reconsideration." https://www.consumerfinance.gov/rules-policy/rules-under-development/personal-financial-data-rights-reconsideration/
9. Cozen O'Connor, "Section 1033 Compliance Date: Open Banking Rule Enjoined and Under Reconsideration," April 2026. https://www.cozen.com/news-resources/publications/2026/section-1033-compliance-date-open-banking-rule-enjoined-and-under-reconsideration
10. Consumer Finance Monitor, "CFPB Sends New Section 1033 Open Banking Proposal to OIRA for Review," August 2026. https://www.consumerfinancemonitor.com/2026/08/06/cfpb-sends-new-section-1033-open-banking-proposal-to-oira-for-review/
11. Akoya internal research on in-house build and maintenance cost.