How open banking works
PSD2 names two services. An account information service gives a consolidated view of payment accounts held with other providers, and a payment initiation service places a payment order on an account held with another provider.
The bank has to offer an interface for both, in practice an API, under technical standards that have applied since 14 September 2019. In the usual flow the customer is sent to the bank to authenticate, and the third party never sees the bank login.
The directive says that access may not depend on a contract between the third party and the bank. A payment initiation provider may not hold the payer's funds at any time, nor change the amount or the payee.
Open banking in the UK
In the UK, open banking began as a competition remedy. The Competition and Markets Authority's Retail Banking Market Investigation Order, published on 2 February 2017, required the nine largest banks in Great Britain and Northern Ireland to release current account data to third parties.
The standards are maintained by Open Banking Limited, the implementation entity created under that order.
Why open banking matters to a product
Account data feeds onboarding, affordability checks, bookkeeping and account aggregation. Payment initiation is the basis of pay by bank at a checkout and of account top-ups, with no card scheme involved.
A firm either becomes authorised or registered for these services itself, or works through a licensed provider that holds the permissions and the bank connections.
Open banking, pay by bank or open finance?
- Pay by bank
- One use of open banking: a payment initiated from the customer's bank account at a checkout.
- Open finance
- The same kind of data sharing extended beyond payment accounts, to savings, investments, pensions and insurance.
- Screen scraping
- Logging in with the customer's own credentials to read the bank's web pages. Open banking replaces it with a dedicated interface and no shared password.
Where Open banking shows up in a platform
Modules that do the work
- Accounts & IBANsCustomer accounts with their own IBANs, on the partner bank and the rails you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
Platforms that need it
Guides that go deeper
- EMI or payment institution licence in the EU, and the agent routeWhat an e-money institution and a payment institution may do in the EU, the capital each needs, safeguarding, passporting, and launching as an agent first.
- EMI or payment institution licence in the UK, or launch under a partnerE-money or payments, authorised or small: what the FCA asks for in capital, safeguarding and people, how long it takes, and when an agent or banking partner is the faster route.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, Articles 4, 66, 67 and 115 (EUR-Lex)
- Commission Delegated Regulation (EU) 2018/389, strong customer authentication and secure communication (EUR-Lex)
- CMA, Retail banking market investigation: the Order of 2017 and open banking (GOV.UK)
General information, not legal advice: what applies to you depends on your services and your market.