Loading field map
Open Banking is the practice and regulatory movement of allowing customers and authorized third-party providers to access a bank's customer financial data and payment initiation services through standardized, secure application programming interfaces (APIs). At its core, it transforms the bank account from a closed, proprietary system into a platform upon which other firms can build financial products and services. The term originally referred to a specific regulatory initiative in the United Kingdom, but it has since become a generic label for a global shift toward data sharing and interoperability in retail finance.
For most of modern banking history, a customer's transaction history, account balances, and payment capabilities were locked inside the bank that held the account. If a customer wanted a budgeting app to track spending, the app typically required the customer to provide their online banking credentials—a practice known as "screen scraping"—which gave the third party broad, uncontrolled access to the account and created significant security vulnerabilities. If a customer wanted to switch banks or compare loan offers based on their actual financial behavior, they had to manually gather statements or rely on self-reported information.
Open banking addresses this information asymmetry and data portability problem. It establishes a legal right for customers to share their financial data with authorized third parties, and it mandates that banks provide access through secure, documented APIs rather than through fragile and risky credential sharing. The stakes are considerable: control over financial data determines who can build products on top of the banking system, how competition in financial services functions, and how much privacy and security customers can expect when they use fintech applications.
The modern open banking movement emerged from a convergence of regulatory action, technological standardization, and commercial interest. The most influential early template was the United Kingdom's Open Banking Initiative, which was itself a response to a competition investigation. In 2016, the UK's Competition and Markets Authority found that the largest retail banks did not compete effectively and mandated that they create a standardized API framework to allow third parties to access customer data with customer consent. The UK's implementation, which went live in 2018, established a technical standard, a governance structure, and a regulatory regime that became a reference point for other jurisdictions.
The UK initiative was closely tied to the European Union's Revised Payment Services Directive (PSD2), which came into force around the same time. PSD2 was broader in scope: it required all banks in the EU to open customer account data and payment initiation to licensed third-party providers, though it left much of the technical implementation to national authorities and industry bodies. The UK, despite leaving the EU, retained its own open banking framework, which was more prescriptive than the EU's approach.
Other regions followed with their own models. In Australia, the Consumer Data Right extended the logic of open banking to other sectors, starting with banking before moving to energy and telecommunications. In the United States, no federal mandate exists; instead, a market-driven approach has developed, with aggregators and fintech firms negotiating data access agreements with banks, and with regulators issuing guidance rather than imposing a single standard. In parts of Asia, Latin America, and Africa, open banking has been adopted as a tool for financial inclusion, allowing new entrants to build services on top of incumbent banks' infrastructure.
The global landscape of open banking is not a single unified movement but rather a set of distinct approaches that differ in their regulatory force, technical standards, and commercial logic. Three broad approaches can be distinguished.
The regulatory mandate approach, exemplified by the UK and the EU, treats open banking as a matter of competition policy and consumer protection. Governments or regulators compel banks to provide data access and payment initiation services to licensed third parties, set the technical standards, and enforce compliance. The organizing assumption is that banks, left to their own devices, will not voluntarily open their systems, and that the public interest requires intervention.
This approach has the advantage of creating a level playing field: all banks must comply, and all licensed third parties have a guaranteed right of access. Its limits are also clear. Regulatory mandates are slow to adapt to technological change, and the standards they set can become outdated. Moreover, the licensing regime creates a two-tier system in which regulated third parties have access while unregulated firms do not, which can push some activity into less transparent channels.
The market-driven approach, most visible in the United States, relies on commercial agreements rather than regulatory compulsion. Banks negotiate data access agreements with data aggregators and fintech firms, often charging fees for API access or for premium data features. The organizing assumption is that competition and customer demand will drive the development of data-sharing arrangements without the need for a government-mandated standard.
This approach is more flexible and allows for innovation in business models, but it has significant drawbacks. Without a mandated standard, each bank may implement different APIs, forcing third parties to build and maintain multiple integrations. Smaller fintech firms may struggle to negotiate favorable terms with large banks, and customers may not have a clear right to share their data with the provider of their choice. The result is a fragmented ecosystem that can favor incumbents despite the rhetoric of openness.
A third approach, often operating within or alongside the other two, is industry-led standardization. Here, banks, fintech firms, and technology companies collaborate to develop common technical standards and governance frameworks, sometimes with regulatory encouragement but without direct government mandate. Examples include the Berlin Group's NextGenPSD2 standard in Europe and various national API standards developed by banking associations.
This approach aims to combine the interoperability benefits of a single standard with the flexibility of private-sector governance. Its weakness is that it depends on the willingness of competitors to cooperate, and it can be slow to reach consensus. In practice, industry-led standards often become the technical foundation for regulatory mandates, as happened in the UK where the Open Banking Implementation Entity worked with industry to develop the API standard that the regulator then required.
Beneath the regulatory and commercial differences lies a shared technical core. Open banking APIs are typically RESTful web services that allow third-party applications to read account information, transaction history, and beneficiary details, and to initiate payments on behalf of the customer. The security architecture relies on OAuth 2.0 for authorization and OpenID Connect for authentication, with the customer granting consent through a bank-controlled screen. Strong customer authentication—often involving two-factor verification—is required for payment initiation and for access to sensitive data.
The operational challenges are substantial. Banks must build and maintain APIs that are reliable, secure, and fast enough to support real-time use cases. Third parties must manage the complexity of integrating with multiple banks, each of which may have slightly different implementations even when following a common standard. Consent management—allowing customers to grant, review, and revoke access—is a persistent design problem, as is the question of how long consent should last and how granular it should be.
The current landscape of open banking is characterized by several durable features. First, the regulatory mandate model has proven influential but not universal; jurisdictions continue to choose different combinations of compulsion, market incentives, and industry cooperation. Second, the technical standards have largely converged on common patterns, even where the governance differs, which means that the underlying engineering skills and security practices are broadly transferable across markets.
Third, the commercial use cases have expanded beyond the initial consumer-facing budgeting and account aggregation apps. Open banking APIs now support small-business lending decisions, automated accounting, fraud detection, personalized financial advice, and "pay by bank" services that offer an alternative to card networks. The data made available through open banking has also become a foundation for more advanced analytics, including credit scoring based on cash-flow data rather than traditional credit bureau records.
Fourth, the relationship between open banking and the broader concept of open finance—extending data sharing to savings, investments, mortgages, and insurance—is an active area of policy and commercial development. Some jurisdictions are already moving toward open finance frameworks, while others are still consolidating their open banking foundations.
Finally, the security and privacy concerns that motivated the original design remain live. The more parties that have access to financial data, the larger the attack surface for fraud and data breaches. The consent mechanisms that protect customers are only as good as the authentication systems that support them, and the liability arrangements between banks, third parties, and customers continue to be negotiated and tested in practice.
Open banking is best understood not as a finished achievement but as an ongoing renegotiation of the boundaries of the banking system. It has succeeded in establishing the principle that customers, not banks, should control access to their financial data, and it has created the technical and regulatory infrastructure to make that principle operational. The open questions—who should be allowed to access data, under what conditions, at what price, and with what safeguards—are likely to remain central to financial technology for the foreseeable future.