Open banking

In plain words

Think of a valet key for a car. It lets someone park your car, but not open the boot or drive across the country, and you can take it back whenever you like. Open banking gives apps a valet key to your bank account: limited, approved by you, and easy to cancel.

Before open banking, an app that wanted to see your transactions usually asked for your online banking password and logged in as you, a practice called screen scraping. Open banking replaced that with a proper door. The app, or the provider behind it, is licensed. You approve the access with your own bank. The bank then shares only what you agreed to through an application programming interface (API), a defined channel between two computer systems.

There are two basic things an open banking provider can do. It can read your account data, which is an account information service (AIS). Or it can start a payment from your account, which is a payment initiation service (PIS). In Europe the legal right to do both comes from PSD2, and the UK kept the same rights after Brexit. ⁶ When the same idea extends to savings, pensions, insurance and investments, it is called open finance.

For a business owner, open banking matters for three reasons. It can replace card payments with cheaper bank payments. It can replace paper bank statements and manual checks with verified data in seconds. And it can confirm that a bank account really belongs to the person in front of you. This guide explains how it works under the hood, what the rules are in the UK, the EU, the Gulf and the wider Middle East and North Africa, who the main providers are, and how to decide whether and how to use it.

Illustration

Who sits where in an open banking connection

Swipe sideways to see the whole diagram.

How it works

How an open banking connection works

The customer sees a short hop to their bank and back, usually under a minute. Behind it, three parties agree.

1. 1

   The app asks

   The customer picks their bank and sees exactly what will be shared or paid, to whom, and for how long.

2. 2

   The bank checks it is them

   The customer is sent to their bank’s app and approves with strong customer authentication (SCA), such as a fingerprint. The app never sees a password.

3. 3

   The bank shares or pays

   The provider receives a token that works only for what was approved, and uses it to fetch the data or submit the payment.

4. 4

   The customer stays in control

   Data access lasts only as long as agreed and must be renewed. The customer can withdraw it from the app or the bank.

The providerAsks, then receives a limited token

The bankAuthenticates the customer and shares only what was approved

How authorisation works under the hood

The four steps above hide a lot of engineering. You do not need to build any of it if you use a provider, but you should understand it, because it explains why connections fail, why consent expires and what your provider is responsible for. There are two layers: getting the provider trusted by the bank once, and getting the customer’s consent every time.

Layer one: how a provider becomes trusted by banks

A bank will not talk to just anyone. Before a provider, called a third-party provider (TPP), can make a single call, it goes through a one-off onboarding with every bank or with a central hub:

1. A licence. The provider is registered or authorised by its regulator: as an account information service provider (AISP) for data, a payment initiation service provider (PISP) for payments, or as an e-money institution or bank, which can do both.
2. Digital certificates. The provider gets certificates that prove who it is. In the EU these are eIDAS certificates: a QWAC (qualified website authentication certificate) that secures the connection, and a QSealC (qualified electronic seal certificate) that signs messages. Both carry the provider’s licence number and roles. In the UK, the Open Banking Directory issues equivalent certificates.
3. Client registration. The provider registers its software with each bank, usually automatically through dynamic client registration (DCR): it presents a signed software statement from the directory, and the bank creates a client account for it.
4. Testing. Many markets require conformance testing before going live, such as the Open Banking Lab in Saudi Arabia or certification against the security profile.

This is why aggregators exist. A provider covering 2,000 banks has done this 2,000 times, keeps the certificates renewed and handles every bank’s quirks. In markets with a central hub, such as the UAE, the provider connects once and reaches every bank through the hub.

Layer two: the consent flow, step by step

Every connection then follows the same pattern, based on two widely used security standards: OAuth 2.0, which issues limited access tokens instead of sharing passwords, and OpenID Connect, which adds identity on top. The UK standard is the reference most others copied. ²

Illustration

The consent flow, message by message

Swipe sideways to see the whole diagram.

In words: the provider first creates a consent object at the bank. For data, the UK standard calls it an account access consent and it lists permissions such as balances, transactions, standing orders and direct debits, plus the date range of history. For a payment, it is a payment consent with the amount, the payee and the reference already filled in. The bank stores it with the status “awaiting authorisation”.

The customer is then redirected to the bank. On a phone this is app-to-app: the bank’s own app opens, the customer approves with a fingerprint or face, and is sent back. The bank marks the consent as authorised and returns a one-time code, which the provider exchanges for an access token, usually short-lived, and a refresh token that lasts as long as the consent. From then on the provider calls the bank’s API with the token, and the bank checks every call against the consent.

The security layer, in business terms

Four ways the bank can check it is the customer

• Redirect. The customer goes to the bank’s website or app and comes back. The most common approach, and the default in the UK, the Gulf and much of the EU.
• App-to-app. A redirect on a phone that opens the bank’s app directly, so the customer can use biometrics. UK customer experience rules require banks to support it where the customer uses the bank’s app. It is the single biggest driver of conversion.
• Decoupled. The customer approves on a second device, for example a notification to the bank app while paying on a laptop or a shop terminal. Useful for desktop and in-store payments.
• Embedded. The customer types their credentials or a one-time code inside the provider’s own screen, which passes them to the bank. Allowed in some EU implementations, but rare and riskier, and some regulators treat it with caution.

How long consent lasts

Payment consent is usually for one payment, or for a mandate with limits (see variable recurring payments). Data consent is ongoing but not permanent, and the rules differ:

• UK: since 2022, customers no longer have to re-authenticate with their bank every 90 days. Instead the provider must ask the customer to re-confirm their consent at least every 90 days, inside the provider’s own app. If the customer does not, access must stop. ³
• EU: since 25 July 2023, banks must not demand SCA again for access through an AISP within 180 days, extended from 90. After that, the customer authenticates with the bank again. ⁷
• UAE: a long-lived data consent lasts at most one year, a single-use consent 24 hours, and the customer must complete authorisation within two hours of the consent being created. ¹¹

Re-consent is where many products quietly lose users. Design it as a feature, with a clear reminder and a one-tap renewal, rather than as an error. Our article on consent flows that survive scrutiny covers the user experience and audit trail side.

AIS vs PIS: what each one gives you

What data AIS actually returns

Under the UK standard, a bank can return account details (name, sort code and account number or IBAN), balances, transactions, standing orders, direct debits, saved payees, scheduled payments, statements, product information and, with the right permission, the account holder’s name and address. How far back transactions go depends on the bank and the consent: often 12 to 24 months, sometimes less. The UAE standard is one of the few that fixes a minimum, at least 24 months of banking history. ¹¹

Banks return raw data. Merchant names, spending categories, income detection and affordability scores are added by the provider, usually as a paid extra called enrichment. If your use case is lending or risk, the quality of that enrichment matters more than the number of banks covered.

Variable recurring payments

A standard PIS payment needs the customer to approve each payment. Variable recurring payments (VRPs) let the customer approve once, with limits, so the provider can take varying amounts over time without asking again. The mandate sets a maximum per payment, one or more limits per period (per day, week, month or year), and optionally a start and end date. The customer can cancel it at the bank or with the provider.

There are two kinds. Sweeping VRPs move money between a customer’s own accounts, for example topping up a savings account or paying down an overdraft. In the UK the nine largest banks must offer them free of charge. Commercial VRPs pay a business, such as a utility bill, a loan instalment or a subscription. Those are now arriving through an industry scheme (see the UK section). In June 2026, sweeping VRPs were around one in five UK open banking payments. ¹

The refund and dispute gap

A pay by bank payment is a push payment: the customer sends money, nobody pulls it. There is no chargeback like on cards. A refund is a separate payment back to the customer, which the merchant or provider must initiate, usually from a settlement account using the payer’s account details captured with the original payment. Plan how refunds work before launch, and be honest with customers about what protection they have. For purchases that go wrong (goods never delivered, not a scam), protection depends on the merchant’s own policy unless a scheme adds it, which is why the UK is designing purchase protection before commercial VRPs reach general e-commerce.

What open banking can and cannot do

Do you need your own licence?

Usually not at first. A merchant using pay by bank at checkout, or a lender reading bank data through a provider, is the provider’s customer, and the provider holds the permission. You need your own permission when you provide the regulated service to your own customers in your own name. Most businesses move along this ladder:

Even with your own licence, many firms still buy bank connectivity from an aggregator, because maintaining hundreds of bank integrations is a business in itself. In the Gulf the licence names differ, and they are covered country by country below.

Open banking in the United Kingdom

The UK is the world’s reference market. It began with competition law, not payments law: a 2017 order by the Competition and Markets Authority (CMA) required the nine largest current account providers, the CMA9, to fund a common standard and build open APIs. It went live on 13 January 2018, the same day the UK’s version of PSD2, the Payment Services Regulations 2017, took effect. One standard, written by what is now Open Banking Limited (OBL), means a provider builds once and reaches almost every UK bank the same way.

How big it is

In June 2026 UK open banking processed just over 40 million payments in a month, including about 7.7 million sweeping VRPs, and passed one billion payments in total since launch. API traffic is around 2.8 billion calls a month, about four in five of them for account data, and there were around 18.8 million active user connections. ¹ OBL’s 2025 impact research put use at around one in five consumers and small businesses. Large merchants now offer pay by bank: HMRC takes tax payments that way, and Amazon added pay by bank for UK shoppers in February 2026.

Commercial VRPs and the UK Payments Initiative

The biggest change of 2026 is commercial VRP. An industry company, the UK Payments Initiative (UKPI), runs a scheme with common rules, liability and pricing. Its first wave went live on 2 June 2026 for regulated financial services (loan repayments, savings, investments, insurance), utilities, government and charities. ⁴ Payment providers pay the customer’s bank a central per-transaction access fee, set through a process the regulators oversee. General e-commerce is planned as a later wave, after purchase protection is designed, and had no confirmed date at the time of writing. For a UK utility, insurer or lender, this is the first real alternative to Direct Debit with instant settlement and better data.

Who runs it now, and what is changing

• Regulator: the FCA authorises AISPs and PISPs and is becoming the lead regulator for open banking. The Payment Systems Regulator is being merged into the FCA through legislation still in Parliament in autumn 2026.
• Legal basis for the future: the Data (Use and Access) Act 2025 gives the government powers to create “smart data” schemes. Regulations giving the FCA open banking rule-making powers were expected in late 2026, followed by an FCA consultation on the long-term framework.
• Standards body: a new independent “Future Entity” will take over standards from OBL. In September 2026 it was still in design, with an independent chair appointed and a blueprint expected by the end of the year.
• Fraud: open banking payments run over Faster Payments, so the mandatory APP fraud reimbursement rules, up to £85,000 per claim since October 2024, cover consumers who are tricked into paying a fraudster this way. The cost falls on the sending and receiving payment firms, not the PISP, which makes banks careful about risk checks on unusual pay by bank payments.
• Payee checks: Confirmation of Payee checks the name against the account before a transfer, and is offered by more than 320 UK payment firms.

UK scenario. A Manchester lender making small business loans asks applicants to connect their business account instead of uploading six months of PDF statements. It gets verified, categorised transactions in under a minute, makes decisions the same day, and collects repayments by commercial VRP instead of Direct Debit, seeing each payment settle in seconds.

Open banking in the European Union

The EU took the opposite route to the UK: a law first, standards second. PSD2 gives licensed providers the right to access any online payment account in the European Economic Area, with the customer’s consent, and obliges banks to provide an access interface without obstacles. ⁶ It did not prescribe one API standard, so several grew up.

One law, many standards

This fragmentation is the main reason most EU businesses use an aggregator rather than connecting to banks directly. The European Banking Authority has repeatedly listed practices it treats as obstacles, such as forcing an extra redirect, making the customer type in their IBAN, or asking for more SCA steps than needed. API quality has improved, but still varies by bank and country.

The rules that shape 2025 to 2028

• 180-day re-authentication for account data via an AISP, from July 2023. ⁷
• Instant payments: under the Instant Payments Regulation, euro-area banks must receive instant euro transfers since January 2025, and send them at no extra cost since October 2025, with Verification of Payee on every transfer. Banks outside the euro area follow in 2027. ⁹ This makes pay by bank in euros as fast as a card authorisation, with settlement in seconds.
• PSD3 and the Payment Services Regulation: the successor rules, politically agreed in November 2025, with final texts published in April 2026 and formal adoption pending in autumn 2026. ⁸ For open banking they require every bank to run a dedicated interface performing at least as well as its own customer channels, give customers a permission dashboard in their banking app to see and withdraw every access they have granted, and add a list of banned obstacles. Most provisions are expected to apply about 21 months after publication, so realistically from 2028. Read more under PSD3.
• Open finance (FiDA): the proposed Financial Data Access regulation would extend access to savings, investments, pensions and insurance. Negotiations stalled in 2025 and in late 2026 there was still no agreement, with a narrower scope under discussion. Do not build a business case on it yet.
• Premium APIs (SPAA): the European Payments Council’s SEPA Payment Account Access scheme defines paid, above-PSD2 services such as recurring payments. Providers have signed up, but in 2026 no bank had yet joined as a data holder, so it is not usable in practice.

Country by country

• Germany. Historically Europe’s strongest pay by bank market through Sofort, now folded into Klarna. The banks’ giropay shut down at the end of 2024, and Wero, the wallet of the European Payments Initiative, started e-commerce payments in Germany in November 2025. Most German banks use the Berlin Group standard.
• Netherlands. iDEAL handles most Dutch online payments and is a bank-run scheme, not PSD2 open banking. It is migrating to Wero, with co-branding from 2026 and iDEAL itself phased out over the following years. Online shops selling to Dutch customers need to follow that migration.
• Poland. BLIK, the banks’ mobile payment system, processed about 2.9 billion transactions in 2025, and PolishAPI is the national open banking standard. Pay by bank via PIS competes with a very strong local habit.
• France. The STET standard and a strong B2B and public sector uptake: the French tax administration chose an open banking provider for collecting public receivables in 2025.
• Spain. Bizum dominates person-to-person and growing online payments; most banks expose Berlin Group-style APIs through Redsys.
• Nordics. High digital banking use, mature APIs, and some of Europe’s biggest aggregators, including Tink in Sweden and Enable Banking in Finland.
• Lithuania. A licensing hub: the Bank of Lithuania has authorised many payment and e-money institutions that passport across the EU, including open banking providers. It also shows the risk. In September 2024 it revoked the licence of the open banking payment firm Kevin for breaching capital and reporting rules, after the firm entered insolvency. ¹⁸

EU scenario. A Lisbon online retailer selling across the euro area adds pay by bank through one aggregator licensed in Ireland. Since instant transfers became mandatory, the money arrives in seconds for most customers. It still keeps cards and local methods, because Dutch shoppers expect iDEAL (and then Wero), Polish shoppers expect BLIK, and German shoppers often still prefer invoice and PayPal.

The biggest open banking providers

Open banking providers fall into three groups: aggregators that sell data and payments to businesses, payment-focused providers that compete with card acquirers, and bank-side vendors that build banks’ own APIs. The market consolidated hard in 2024 to 2026, so check ownership and coverage when you choose. The table lists the best-known names, based on their own published information; coverage claims are the providers’ own.

On the bank side, vendors such as Ozone API build and run banks’ open banking APIs; Ozone is also part of the consortium behind the UAE’s central hub. A warning from the last two years: providers fail, change owners or close products. One Lithuanian provider lost its licence, a popular free data API closed to new users, and several firms cut staff. Ask every provider what happens to your customers’ consents if it is sold or closes.

What it costs

For many payment types, pay by bank costs the merchant a fraction of card acceptance, and money arrives in seconds rather than days. The trade-off is conversion: customers who have never used it may drop off at their bank, and some banks’ journeys are slower than others.

How to choose a provider

Open banking in the Gulf and MENA, country by country

The Gulf did not inherit open banking from a single law. Each central bank built its own framework, mostly borrowing the UK’s standards and security model, and they now sit at very different stages. Bahrain was first, Saudi Arabia and the UAE are the biggest, and several others have rules on paper but little live activity. Be precise about the difference between a framework issued and a service actually live.

Illustration

Where each Gulf and MENA market stands in late 2026

Swipe sideways to see the whole diagram.

United Arab Emirates (mainland)

The UAE went straight to open finance. The Central Bank of the UAE (CBUAE) issued its Open Finance Regulation in 2024 and an updated version in force from 10 July 2025. It covers banking, insurance, credit, savings, investments, payments and wallets, in two licensed activities: data sharing and service initiation. A third party needs a CBUAE Open Finance licence. Under the original regulation the minimum capital was AED 1 million plus professional indemnity insurance, and existing banks, insurers and payment firms are treated as licensed but still need the central bank’s approval before offering the service. The open finance licence is separate from the retail payment services licence categories.

What makes the UAE different is the plumbing. Instead of each bank exposing its own API, the CBUAE’s Al Etihad Payments set up a single central API hub and trust framework, built by a consortium led by Core42 with Ozone API and Raidiam. ¹⁰ The hub is run by Nebras, and customers see the consent journey under the brand AlTareq. A provider connects once and reaches every participating bank and insurer. The UAE standards use the FAPI 2.0 security profile, and payments settle over Aani, the UAE’s instant payment system.

• Phases: banks and insurers first; fintechs, exchange houses and payment firms as participants later.
• Live: the first banks fully activated open finance at the end of 2025, with Commercial Bank of Dubai among the first and First Abu Dhabi Bank going live around the turn of the year. ADIB became the first UAE bank licensed as a third-party provider itself in April 2026.
• Providers: Lean, Spare and Tarabut received approval in principle in mid-2025, and payment providers such as Pay10 went live early. Approval in principle is not yet a full licence, so check the status of any partner.
• Scope: the CBUAE regulation applies on the mainland. It does not apply in the DIFC or ADGM free zones, which have their own regimes (see DIFC vs ADGM).

UAE scenario. A Dubai wallet licensed as a stored value facility wants customers to top up from their bank instead of by card. It connects to the hub through a licensed provider, customers approve in their bank’s app via AlTareq, and the money arrives over Aani in seconds. To read account data for its own credit product later, it would need a data sharing licence or a licensed partner. For more context, see open finance in the UAE for UK founders.

DIFC and ADGM free zones

The two financial free zones license open banking activities but do not force banks to open APIs. In the Dubai International Financial Centre, the Dubai Financial Services Authority (DFSA) added providing an account information service and providing a payment initiation service to its money services regime in 2020; Tarabut was the first firm authorised for both, in 2022. In Abu Dhabi Global Market, the Financial Services Regulatory Authority (FSRA) introduced the activity of “providing third party services” in 2021, and Lean received the first permission in 2022. ¹⁷ A free zone licence is a good base for a regional business, but bank access still depends on the banks’ own frameworks or the mainland hub.

Saudi Arabia

The Saudi Central Bank (SAMA) publishes the Open Banking Framework in releases: the first, for account information, in November 2022, and the second, for payment initiation, in September 2024. ¹² Each release includes business rules, customer experience guidelines, API specifications and a security profile derived from FAPI. SAMA’s Open Banking Lab, launched in January 2023, lets banks and providers test against simulated bank APIs and certify before going live. Unlike the UAE, there is no central hub: each bank exposes its own APIs to the common standard.

For years providers operated in SAMA’s sandbox. Formal licensing began in March 2026, when Lean received a major payment institution licence and Neotek a licence for payment services based on account information access, followed by further account information licences during 2026. Open banking providers are licensed within SAMA’s payments regime rather than under a separate category. Open banking sits within the Financial Sector Development Program of Vision 2030, which targets a large shift to cashless payments.

Saudi scenario. A Riyadh buy now, pay later company uses account data from a licensed provider to check income and spending before approving a customer, replacing salary certificates and statements. Once payment initiation is available through its provider, it can collect instalments straight from the customer’s bank account over the instant payment system, sarie, rather than by card.

Bahrain

Bahrain was the first in the region. The Central Bank of Bahrain (CBB) issued open banking rules in December 2018 and made them mandatory for retail banks in 2019. The Bahrain Open Banking Framework of October 2020 added detailed API specifications, security standards, operational guidelines and customer journey guidelines, and a second phase due by 30 June 2022 extended it to standing orders, international, future-dated and bulk payments. ¹³ Providers are licensed as ancillary service providers, acting as an AISP, a PISP or both. Tarabut began as the first graduate of the CBB sandbox in 2018. The market is small but mature, which makes Bahrain a sensible place to test a Gulf product.

Oman, Kuwait and Qatar

• Oman. The Central Bank of Oman consulted in July 2024 and approved its Open Banking Regulatory Framework, with a companion technology framework, in December 2024. ¹⁴ It covers account information and payment initiation; banks are treated as authorised, and other providers need a CBO open banking licence. In late 2026 there was no sign of live third-party services.
• Kuwait. The Central Bank of Kuwait issued a draft Open Banking Regulatory Framework for consultation in June 2025, covering data sharing (aggregation, product comparison, faster loans) and payments (bills, e-commerce, standing orders), with licensed open banking service providers and a phased launch. ¹⁵ No final version had been issued by late 2026; activity is limited to the central bank’s sandbox.
• Qatar. Qatar Central Bank’s fintech strategy names open banking as a priority, but no binding open banking regulation had been issued by late 2026. Some banks offer APIs voluntarily, and open banking payment firms have been admitted to the central bank’s sandbox. Any product here is a bilateral deal with a bank.

Jordan, Egypt, Morocco and Israel

• Jordan. The Central Bank of Jordan issued open finance instructions in late 2022 that require banks and payment firms to give consented third parties API access for account information and payments. The Jordan Payments and Clearing Company (JoPACC) launched the Jordan Open Finance Standards in February 2024. ¹⁶ The first open banking provider entered the central bank’s sandbox in January 2025; live third-party services were not yet confirmed in 2026.
• Egypt. No open banking framework was in force in 2026. The Central Bank of Egypt has built strong instant payment infrastructure through InstaPay and new digital identity rules, which are likely foundations, but do not plan an Egyptian open banking product yet.
• Morocco. Bank Al-Maghrib is preparing a framework with World Bank support, starting with banking and widening later. Not yet issued.
• Israel. Israel’s Financial Information Service Law of 2021 created licensed financial information service providers and obliges banks, card companies and other financial institutions to share data, so it is open finance from the start. Banks follow the Berlin Group standard, and payment initiation is being added through separate payments legislation.

Gulf frameworks side by side

Should your business use open banking?

Open banking is a tool, not a strategy. It earns its place when it removes a cost or a step that matters to your numbers. A practical way to decide:

1. Name the jobCheaper collection, faster onboarding, verified income, account ownership checks, or automatic reconciliation. One job per launch.
2. Check the customer baseWhich countries and banks your customers use, on which devices, and whether those banks support app-to-app journeys and the data you need.
3. Check the rulesWhether the market is live, mandated, or only licensed; whether your provider holds the right permission there; and whether your use case needs your own licence.
4. Model the economicsProvider fees against card or Direct Debit costs, minus fraud and chargeback savings, adjusted for the conversion you will lose at first and gain later.
5. Design the failure pathsAbandoned approvals, bank outages, expired consent, refunds and disputes. Each needs a screen and an operations process.
6. Launch narrow, then widenStart with the use case and market with the clearest win, measure completion by bank, and expand once it works.

Example: Sara launches pay by bank in London and Dubai

Common misconceptions

FAQ