Open banking
Also called open finance, account information sharing
Open banking lets customers allow regulated third parties to access their bank account data or start payments from their accounts through secure application programming interfaces. Banks must give access once the customer consents. The UK and EU launched it in January 2018, and other jurisdictions have built their own versions.
How it works
In the UK and EU, firms authorised as account information service providers can read account data, and payment initiation service providers can start payments, with the customer's explicit consent. Banks expose standard APIs and authenticate the customer with strong customer authentication. The UK's nine largest banks were required by the CMA to build common API standards, which set the template for the market.
For compliance teams, open banking changes both risk and control. Payment initiation enables account to account payments that sit outside card scheme protections, raising fraud and liability questions. Account data supports affordability checks, income verification and faster onboarding. In the US, the CFPB's section 1033 rule, finalised in 2024, has been under reconsideration since August 2025.
The rules
Requires account providers to give authorised third parties access to payment accounts, with strong customer authentication.
Banks, payment institutions and third-party providers in the EURequired the largest banks to build and maintain common open banking API standards and an implementation entity.
The nine largest UK current account providersRequires covered providers to make consumer financial data available to authorised third parties; under CFPB reconsideration since August 2025.
US banks, card issuers and data recipientsCommon questions
What is the difference between open banking and open finance?
Open banking covers payment accounts such as current accounts. Open finance extends data sharing to savings, mortgages, investments, pensions and insurance. The UK and EU are both working on wider frameworks, and some markets already include more products in their data sharing rules.
Is open banking safe?
Third parties must be authorised and supervised, customers must give explicit consent, and banks must apply strong customer authentication. Customers do not share their banking passwords. Fraud risk remains, especially for account to account payments, so firms apply transaction monitoring and confirmation of payee checks.
Does the US have open banking rules?
The CFPB finalised a section 1033 personal financial data rights rule in 2024. In August 2025 it started a new rulemaking to reconsider parts of the rule, covering who may act for a consumer, fees, data security and privacy. Its 2026 regulatory agenda keeps that reconsideration open.
What will PSD3 change for open banking?
The EU's PSD3 and Payment Services Regulation will replace PSD2. The Parliament and Council have agreed the texts, which await formal adoption. They tighten API performance requirements for banks, give customers a dashboard to manage permissions and strengthen fraud rules. They will apply after a transition period once published.
