CPCU iMobile Banking API integration (OpenBanking & OpenData)

Deliverables checklist

• OpenAPI 3.1 specification for the integration surface (auth, accounts, transactions, transfers, deposits, alerts)
• Protocol & auth flow report — member login, MFA challenge, session refresh, biometric step-up, and cookie chain analysis
• Runnable Python and Node.js client SDKs with typed models and example notebooks
• Webhook handlers for transaction posting, deposit clearing, and Zelle events
• Compliance package — CFPB Section 1033 mapping, GLBA Safeguards checklist, retention & consent templates
• Test plan with positive, negative, and rate-limit scenarios; CI-friendly fixtures

Engagement models

Two ways to work with us, both designed to keep risk and upfront cost low for community-bank and fintech teams:

• Source code delivery from $300 — we hand over runnable API source code and full documentation; pay after delivery upon satisfaction.
• Pay-per-call hosted API — access OpenFinance Lab’s managed endpoint and pay only per call, ideal for pilots and PFM apps with unpredictable volumes.

1. PFM aggregation for credit-union members

A regional Personal Finance Management (PFM) app wants to show CPCU members a unified view alongside their non-CPCU accounts. We map the iMobile login and balance endpoints into a token-keyed account-list call, then stream the 90-day transaction window with category tags. The flow mirrors how WECU uses Plaid to power a unified PFM in-app, but works on a smaller credit-union footprint.

2. Accounting-software sync (small-business members)

Small businesses banking with CorePlus often run QuickBooks or Xero. We deliver a nightly OFX/CSV/JSON export of share-draft transactions plus posted Zelle and bill-pay events, keyed by member-issued OAuth tokens, so reconciliation no longer requires manual statement download.

3. CFPB 1033 consumer-permissioned data export

Section 1033 of Dodd-Frank, finalised by the CFPB in October 2024, requires covered institutions to make consumer financial data available to authorised third parties at no cost, with at least 24 months of transaction history once fully phased in. We build a 1033-style endpoint that wraps the iMobile data layer with consent, scoping, and revocation primitives.

4. Mortgage & auto-loan refinancing leads

A digital lender wants to surface refinance offers to CPCU members. We expose loan-balance, rate, and payoff-date fields under explicit consent, push them through the lender’s underwriting model, and return personalised quotes back into the member’s alerts feed.

5. Treasury reconciliation for non-profit members

A Connecticut non-profit using CorePlus needs Zelle and bill-pay events in its general ledger. We deliver a webhook bridge that converts each Zelle send/receive and recurring payment into a journal-entry-ready record with payee, memo, and posted date, eliminating spreadsheet copy-paste.

Member authentication (OAuth-style, with biometric step-up)

POST /api/v1/cpcu/auth/token
Content-Type: application/json

{
  "member_id": "user@example.com",
  "credential": "<encrypted-password>",
  "device": {
    "platform": "android",
    "biometric": "face_id",
    "device_id": "d-7c1f..."
  },
  "scope": ["accounts.read", "transactions.read", "zelle.read"]
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "mfa_required": false
}

Statement / 90-day transaction pull

GET /api/v1/cpcu/accounts/{account_id}/transactions?from=2026-02-01&to=2026-04-30&page=1
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: cns_8a2f...

200 OK
{
  "account_id": "acc_share_drft_001",
  "currency": "USD",
  "page": 1, "per_page": 50,
  "items": [
    {
      "txn_id": "t_2026_03_18_044",
      "posted_at": "2026-03-18T14:02:11Z",
      "amount": -42.17,
      "type": "DEBIT_CARD",
      "merchant": "STOP & SHOP #0612",
      "category": "groceries",
      "status": "POSTED"
    }
  ]
}

Zelle® event webhook

POST https://your-app.example.com/webhooks/cpcu/zelle
X-OFL-Signature: t=1714670400,v1=...

{
  "event": "zelle.payment.completed",
  "member_id": "m_44102",
  "direction": "OUTBOUND",
  "amount": 120.00,
  "currency": "USD",
  "counterparty": {"alias": "+15555550143", "type": "phone"},
  "memo": "Rent share",
  "completed_at": "2026-04-30T15:48:02Z"
}

// Verify HMAC, then upsert into ledger.

Regulatory alignment

For US credit-union data, our integrations are designed around the CFPB’s Personal Financial Data Rights rule (Section 1033 of Dodd-Frank, finalised on October 22, 2024). Covered depository institutions with $850M+ in assets must make consumer-permissioned data available in machine-readable form, with the largest providers in scope from April 1, 2026 and the smallest by April 1, 2030. We additionally honour GLBA Safeguards Rule expectations for a credit-union service-provider relationship and follow NCUA letters on third-party data sharing.

Privacy & data-minimisation

Every integration we ship enforces explicit, scoped, and revocable member consent; uses field-level redaction for SSN, account numbers, and check images; and emits an immutable audit log per request. Tokens are short-lived (30 minutes by default) with refresh rotation, and we never persist plaintext member credentials. Where card information moves through the pipeline, we follow PCI DSS v4.0 segmentation guidance.

About OpenFinance Lab

We are an independent studio focused on fintech and OpenData / OpenFinance / OpenBanking API integration for mobile financial apps worldwide. Our team includes engineers from US community banks, Indian payment gateways, European PSD2 TPPs, and protocol-analysis specialists. For credit-union work specifically, we know NCUA expectations, CFPB Section 1033 implementation timelines, and how aggregator partners such as Plaid, MX, Finicity, Akoya, and Yodlee actually behave on long-tail credit-union endpoints.

• Community banking, credit unions, neobanks, and cross-border clearing
• Enterprise API gateways, consent ledgers, and security reviews
• Custom Python / Node.js / Go SDKs and CI-friendly test harnesses
• End-to-end pipeline: protocol analysis → build → validation → compliance sign-off
• Source code delivery from $300 — runnable code and full docs, paid after satisfaction
• Pay-per-call hosted API — usage-based pricing for pilots and unpredictable volumes

Contact

To request a quote or share your CPCU iMobile Banking integration requirements (specific endpoints, member volumes, target SLA), open our contact page:

Contact page

For general member-side questions about the live app, CorePlus operates a dedicated iBanking and iMobile hotline at 860-886-0576 — we are not affiliated with that line.

Engagement workflow

1. Scope confirmation — which iMobile surfaces (auth, accounts, transactions, Zelle, RDC, alerts) and target consumer systems.
2. Protocol analysis & API design (2–5 business days, depending on MFA and aggregator-routing complexity).
3. Build and internal validation against a sandbox or member-permissioned test account (3–8 business days).
4. Documentation, sample notebooks, and test cases (1–2 business days).
5. Typical first delivery in 5–15 business days; CFPB 1033 readiness reviews can extend timelines.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance for a US credit union app?

Can you support Zelle and mobile check deposit specifically?