> I appreciate that some of the larger banks might actually consider the impact of a data breach at an aggregator but reading this a couple of times it really sounds like a whine that they feel they have to provision more capacity for both their user base + the load put on by the aggregators their user base is using. They don't have a way to charge the aggregator for their use like they do the customer.

They absolutely charge their aggregators. Most of the aggregators can't screenscrape without permission of the aggregators. Why on earth would you think they can't? Why do you think Mint doesn't need to do MFA for so many banks and can just get away with a user-pass challenge?

This is about holding control of their customer base, plain and simple. They know everyone else, even other banks, are eager to dis-intermediate their customer base. They're spending too much money maintaining branches and offering inferior savings products to compete digitally, so they would rather delay that as long as possible.