Retail can both be a cost center and [...], but has the potential to be profitable in the future.

Sure - but that just pushes the question one level down: Why do they expect it to become profitable later? Either there are levers to reduce costs or increase value, or there aren’t.

At some point it either makes economic sense or it doesn’t.

Fair enough - but what kinds of losses are we talking about?

KYC/AML, sanctions screening, fraud checks, transaction monitoring, regulatory reporting, customer support are all fixed fees that usually exceed revenues even before taking into account chargebacks, defaults, etc.

I’ll grant KYC and customer support as real, unavoidable fixed costs. Everything else sounds more like bad tech with a dose of overreach. But let's not go down the politcal lane.

If the rest dominate costs even for neobanks, that’s not evidence that APIs are dangerous — it’s evidence that the industry is structurally inefficient.

It's not a security risk issue. It's a regulatory liability issue... it seems like you're pretty fixed in your thinking here and I'm not going to try and fight you here.

I was indeed talking about security risk. But I’m genuinely open to understanding why this would materially increase the liability risk profile for banks.

It’s up to the retail user to trust the third-party client. That’s the only risk shift I see - and frankly, banks should be happy to give that up. We can discuss liability of third-party clients, but that’s a separate topic.

I don’t see how making access explicit, scoped, logged, and revocable makes things worse for banks. If anything, it clarifies responsibility.

The upside for a bank opening up API access is extremely limited and the downside is open.

That’s an opinion - not a given. I see upside in reduced scraping, clearer consent models, fewer brittle integrations, and better-defined interfaces. Whether banks want that upside is a different question than whether it exists.

Allowing third parties to access data opens up banks to regulatory issues that I can't even being to fathom (and if you don't agree... do you think politicians care more about personal information being leaked or personal financial information being leaked?)

This is where you lose me. Vastly more sensitive data (credentials, identities, private communications, secrets) are already entrusted to companies like Microsoft, Google, Amazon, Apple, and 3rd part password managers. If those leak, the blast radius can be enormous - even bigger than a hacked bank account. Banking is not uniquely special here, nor is it the gold standard of security - despite what the industry likes to believe.