Open Banking Is No Longer an Experiment. The Next Frontier Is Open Finance.
Open banking allows consumers and businesses to authorize secure sharing of financial data - and in some systems initiate payments - through standardized digital connections such as APIs. But the model is developing differently around the world. This 2026 guide explains how open banking actually works, where adoption stands, what consumers gain, what can go wrong, and why the industry is now moving toward the broader idea of open finance.
What is open banking?
Open banking is a framework that allows a consumer or business to authorize a bank or other financial institution to share specified financial information with an eligible third-party service through secure digital interfaces.
Depending on the country and authorization, open banking can also allow a third party to initiate payments from a bank account.
The important word is authorize.
Open banking does not mean a person's bank account becomes publicly accessible, nor should an app automatically receive every piece of information held by the bank.
The customer selects a service, authenticates with the financial institution, grants permission and determines the scope allowed under the relevant system.
Open banking gives customers a structured way to tell one financial institution: "Share this permitted information with this service because I asked you to."
A typical open banking journey has three participants.
Chooses an app or service and decides to connect a financial account.
Authenticates the customer and confirms the requested permission under the applicable framework.
Receives the permitted information through a secure interface or initiates an authorized payment where supported.
What is an API?
API stands for Application Programming Interface.
In open banking, APIs provide standardized methods for software systems to request and exchange permitted financial information.
The UK Open Banking Standard, for example, includes read/write APIs that allow approved third-party providers to request account information or initiate payments with customer consent.
Why APIs are different from handing over a password
A well-designed API connection allows the customer to authenticate with the financial institution rather than handing the third party their normal banking username and password.
Current U.S. Section 1033 developer-interface rules similarly state that a data provider must not allow a third party to access the developer interface using credentials the consumer uses to access the consumer interface.
Secure technical architecture reduces some credential-sharing risks, but consumers can still be targeted by phishing, impersonation, malicious apps and payment scams. Regulation and technology cannot eliminate the need to verify who is requesting access.
Open banking can mean reading financial information or moving money. Those are not the same permission.
Data access
An authorized service may access permitted account information, balances or transaction history so it can provide services such as budgeting, account aggregation, affordability analysis or accounting.
Payment access
In supported frameworks, an authorized payment provider can initiate a bank-to-bank payment after receiving the customer's permission. That is different from merely reading transaction information.
Good open banking design therefore depends on permission scope.
A service that only needs to verify an account should not automatically require authority to initiate payments.
A budgeting app should not need unrestricted financial data merely because some financial data would improve its service.
A sensible question before granting access is: "Does this service actually need every permission it is asking for?"
The strongest use cases remove friction between financial institutions.
Account aggregation
People with accounts at different institutions can see permitted balances and transactions within one financial-management service.
Better cash-flow visibility
Transaction information can support categorization, budgeting, savings tools and alerts.
Financial-data verification
With appropriate permission, financial history can support affordability or underwriting processes without relying solely on manually uploaded statements.
Account-to-account payments
Payment initiation can create alternatives to entering card credentials for some transactions.
Accounting automation
Authorized bank data can feed accounting, reconciliation, cash-flow and lending tools.
Easier switching and comparison
Portable financial information can reduce some of the friction that historically kept customers locked inside one institution's product ecosystem.
Data sharing can enable better comparison and personalization, but it does not guarantee cheaper loans, better investment results, financial inclusion or lower consumer costs. Those outcomes depend on competition, product design, regulation and the customer's circumstances.
There is no single worldwide open banking system.
Countries have taken materially different approaches to consumer financial-data access.
| Market | 2026 position | Main framework | Direction |
|---|---|---|---|
| United Kingdom | Mature regulated ecosystem with millions of users and large payment/API volumes | Open Banking standards, FCA oversight and CMA foundations | Commercial recurring payments and open finance |
| European Union | PSD2 remains a major legal foundation while payment-services reform progresses | PSD2, with PSD3 / Payment Services Regulation reform process | Stronger payment rules and wider financial-data access |
| United States | Section 1033 regulation exists, but implementation remains legally and regulatorily unsettled | CFPB Personal Financial Data Rights framework | Rule amendments and future implementation |
| Australia | Consumer Data Right already operates in banking and extends beyond traditional banking | Consumer Data Right | Broader data portability and non-bank lending |
The UK shows what open banking looks like after it becomes real financial infrastructure.
The United Kingdom remains one of the world's most developed open banking markets.
The FCA reported more than 16 million active users entering 2026 and a 53% year-on-year increase in open banking payments during 2025.
In July 2026, Open Banking Limited announced that the UK's major banks had collectively passed:
- one billion cumulative open banking payments;
- 100 billion cumulative API calls; and
- a record 2.81 billion API calls during June 2026.
Those figures demonstrate a major difference from the environment in which this Wealthy Minds Pro article was originally written in 2023.
Open banking in the UK is no longer primarily a technology demonstration. It is being used at infrastructure scale.
Variable Recurring Payments
Variable Recurring Payments, or VRPs, allow customers to authorize certain flexible recurring payments rather than separately approving every individual transfer.
The UK's development of commercial VRPs progressed materially in 2026 with the launch of the UK Payments Initiative scheme.
The FCA views commercial recurring payments as one route toward increased competition in recurring account-to-account payments.
The regulatory question is shifting from "Can open banking work?" toward "How should a mature open banking and open finance ecosystem be governed, funded and expanded?"
U.S. open banking has a formal federal rule - but its implementation path is unsettled.
Section 1033 of the Consumer Financial Protection Act provides the basis for U.S. consumer financial-data rights.
The CFPB's Personal Financial Data Rights framework requires covered financial-data providers to make certain consumer financial information available electronically to consumers and authorized third parties under the rule.
It also includes requirements around authorization, standardized interfaces, security and third-party obligations.
However, describing the U.S. rule as simply "live" would be misleading.
On October 29, 2025, a federal court stayed the rule's compliance dates. The CFPB had also announced work considering amendments to the Personal Financial Data Rights Rule. As a result, the regulation exists, but its implementation timeline and final operational shape remain subject to legal and regulatory developments.
What the rule is designed to accomplish
The current regulatory text provides for consumers and authorized third parties to request covered data electronically and places obligations on data providers and third parties.
The developer-interface provisions also contemplate standardized, machine-readable data and security requirements rather than simply giving third-party applications a consumer's ordinary login credentials.
Of the major markets covered in this article, the U.S. legal position is particularly capable of changing. Future Wealthy Minds Pro reviews should verify the CFPB rule, litigation and compliance timeline before retaining any U.S. implementation date.
PSD2 helped institutionalize open banking in Europe. The next payment-services framework is still evolving.
Europe's second Payment Services Directive, PSD2, established important rights and obligations around payment services, including account access for regulated third-party providers.
The European Commission subsequently proposed a new Payment Services Directive, commonly called PSD3, together with a directly applicable Payment Services Regulation.
Political agreement on the PSD2 review was reached in November 2025.
That does not mean every PSD3 and PSR provision should be described as already fully operational throughout the EU.
Do not publish "PSD3 has replaced PSD2" merely because the reform package exists. Legislative agreement, formal adoption, entry into force and application dates are different stages.
The broader European policy direction is toward stronger digital payments, improved fraud protections, competition and wider financial data access.
Australia's model demonstrates how open banking can evolve into an economy-wide data-right framework.
Australia approaches data portability through the Consumer Data Right, or CDR.
CDR began with banking but is designed as a wider consumer data-sharing framework rather than a banking-only system.
Consumers can authorize data to be shared with accredited businesses for services such as financial management, switching and lending.
The Australian government has also been expanding CDR into non-bank lending, with implementation beginning from mid-2026.
The Australian model is useful because it frames banking data as one part of a broader consumer-data portability system rather than treating open banking as the final destination.
Secure APIs solve some problems while creating a larger ecosystem that must still be trusted.
A service may request more data or a longer period of access than the customer understands or needs.
Once permitted financial information reaches another organization, that organization becomes part of the security and privacy chain.
Criminals can imitate banks or fintech services and attempt to trick customers into approving fake access or payments.
A technically authorized payment can still be the result of manipulation, impersonation or an investment scam.
Detailed transaction histories can reveal sensitive information about habits, income, locations and personal relationships.
Data rights, liability rules and third-party oversight differ across countries and services.
Open banking fraud is not the same as API hacking
Fraud can occur even when the underlying API infrastructure works exactly as designed.
Open Banking Limited's June 2026 fraud analysis found that Authorised Push Payment fraud remained the dominant form of reported open-banking payment fraud.
That distinction matters.
A victim can authorize a technically legitimate payment after being deceived by a criminal.
"The connection is secure" does not mean "the person asking you to connect is trustworthy."
Open finance is the logical expansion of the same principle.
Open banking largely focuses on bank-account and payment data.
Open finance aims to extend consumer-controlled financial-data sharing across a wider financial life.
Depending on the eventual framework, that could involve areas such as:
- mortgages;
- investments;
- pensions;
- insurance;
- consumer credit;
- business finance; and
- other financial products.
In April 2026, the UK Financial Conduct Authority published an open-finance roadmap running toward 2030.
Its initial priorities include exploring high-impact use cases such as improving SME access to lending and consumer access to mortgages.
Bank-centric
Primarily connects account, transaction and payment information held within banking and payments systems.
Financial-life centric
Extends similar permission and portability principles across additional categories of financial products and institutions.
The long-term competition may not be about which bank owns the customer's relationship. It may increasingly be about which service can securely organize the customer's entire financial life with permission.
Before connecting a financial account, check the permission - not just the app.
Open Banking Permission Safety Check
Tick each statement only when you can confidently answer yes.
Review every permission before connecting a financial account.
Educational checklist only. It cannot verify whether a particular provider is legitimate, regulated or secure. Regulatory arrangements vary by country. Verify providers using the relevant official regulator or open-banking directory where available.
Open banking does not mean banks simply hand everybody your financial history.
"My bank data becomes public."
Open banking is built around authorized sharing, not publication of personal transaction histories.
"Every fintech can access everything."
Legitimate access should operate within the provider eligibility, authorization and consent rules of the relevant framework.
"Open banking is cryptocurrency."
Open banking typically connects regulated financial accounts and third-party services through APIs. It does not require blockchain or cryptocurrency.
"Open banking is one global standard."
The UK, EU, U.S., Australia and other jurisdictions use different legal frameworks, standards and implementation models.
Open banking in 2026: quick answers.
What is open banking in simple terms?
Open banking allows a customer to authorize a financial institution to share specified account information with an eligible third-party service through secure digital connections. Some frameworks also allow authorized payment initiation.
Is open banking safe?
Regulated open banking systems use security standards, authentication, consent and controlled interfaces. However, no financial system is risk-free. Consumers can still face phishing, social engineering, malicious services, data misuse and payment scams.
Does open banking give apps my bank password?
Modern API-based open banking is designed so that customers authenticate with their bank or data provider rather than simply handing their normal banking credentials to the third-party app. Exact technical arrangements depend on the jurisdiction.
Is open banking mandatory for consumers?
No. Consumers generally choose whether to use an open banking service and whether to authorize access. Regulatory obligations may require financial institutions to make data-access mechanisms available, but that is different from forcing customers to share data.
What is the difference between open banking and open finance?
Open banking primarily concerns banking and payment information. Open finance extends similar consumer-controlled data-sharing principles into additional areas such as investments, pensions, mortgages, insurance and other financial products.
What can open banking APIs do?
Depending on the relevant standard and consumer authorization, APIs can make account information available to authorized services and may also support payment initiation.
How large is UK open banking?
The FCA reported more than 16 million active users entering 2026. Open Banking Limited reported in July 2026 that the ecosystem had exceeded one billion cumulative open banking payments and 100 billion API calls across the major participating banks.
Is U.S. open banking regulated?
The CFPB issued a Personal Financial Data Rights rule implementing Section 1033. However, the compliance dates were stayed by a federal court in October 2025, and the CFPB has considered changes to the framework. The U.S. implementation position therefore remains subject to legal and regulatory developments.
Has PSD3 replaced PSD2 in Europe?
It is more accurate to say that the EU has been progressing a reform package involving PSD3 and a Payment Services Regulation. Political agreement on the PSD2 review was reached in November 2025, but legislative agreement and full application of new rules are different stages.
What is Australia's Consumer Data Right?
Australia's Consumer Data Right is a broader consumer data-sharing framework that began with banking and enables consumers to authorize data sharing with accredited recipients. Its scope extends beyond traditional open banking.
Will open banking replace credit cards?
Open banking can increase competition in account-to-account payments, but that does not mean cards disappear. Cards bundle acceptance, credit, fraud protections, rewards and other services that open banking payments may not replicate in exactly the same way.
Open banking is becoming infrastructure. The real debate is now about what gets built on top of it.
When this article was first published in 2023, it described open banking as the dawn of a financial revolution.
That framing now understates how far some markets have progressed.
In the UK, millions of people are already using open banking and billions of API interactions occur each month.
Australia has embedded banking data sharing inside the broader Consumer Data Right.
Europe is reforming the payment-services framework created around PSD2.
The United States has established a formal federal data-right framework under Section 1033, although its implementation remains legally and regulatorily unsettled.
The next phase is increasingly about open finance: extending consumer-controlled financial data beyond current accounts and payments.
That expansion could enable better financial tools and greater competition.
It also increases the amount of sensitive information flowing between organizations.
The long-term success of open banking will therefore depend on more than APIs.
It will depend on trustworthy consent, secure infrastructure, effective fraud protections, meaningful competition and consumers remaining genuinely in control of their data.
Financial data portability is powerful only when the customer controls the permission rather than becoming the product.
Explore the wider financial system.
Primary regulatory and industry sources used for this 2026 rebuild.
Wealthy Minds Pro provides independent financial education. Open banking rules, technical standards, consumer protections and implementation timelines differ by jurisdiction and can change. This article summarizes publicly available information as reviewed in September 2026 and does not constitute legal, regulatory, cybersecurity or individualized financial advice. Verify current requirements with the relevant regulator or provider before relying on jurisdiction-specific rules.
Thank you for taking the time to share your thoughts with us. We appreciate your feedback and value your contribution to the discussion.