What is open banking, and how does it actually work?

#What does open banking mean in simple words?

Your bank holds a lot of information about you: your balance, every payment in and out, your direct debits. For most of banking history, only the bank could use that information. Open banking changes this. It means you can tell your bank to share some of that data with another company, or let that company start a payment from your account, so it can offer you a service. The Basel Committee on Banking Supervision, the global group of bank supervisors based at the Bank for International Settlements, describes open banking as the sharing and leveraging of customer-permissioned data from banks with third-party developers and firms to build applications and services⁠^[1].

The key word is permission. Nothing is shared unless you agree. A budgeting app, an accounting tool or a lender might ask to connect to your account; you are sent to your bank to confirm, and the bank then passes the data or the payment instruction through a secure channel. That channel is an API, short for application programming interface: a set of rules that lets two computer systems talk to each other in a controlled way.

#What can an open banking app actually do?

Most open banking services fall into two families, which the EU's second Payment Services Directive (PSD2) brought under regulation⁠^[2]. UK law defines both of them in plain terms. An account information service is an online service that gives you consolidated information on one or more payment accounts you hold with other providers. A payment initiation service is an online service that starts a payment order at your request from an account you hold somewhere else⁠^[3].

Built on top of these two services you will find many products: apps that combine several bank accounts in one view, lenders that check your income from real transactions, accounting software that pulls in a small business's bank feed, and checkout buttons labelled 'pay by bank'. Our guide to pay by bank explains that payment side in detail.

#How does open banking work, step by step?

In the UK standard, the app first creates a request (called a consent or 'intent') describing what it wants, then redirects you to your bank. Your bank checks it is really you, and only then issues the app an access token tied to you and to that one request⁠^[5]. The app uses that token to call the bank's API. Because the token is linked to one specific permission, it cannot be used to do something you did not approve. Our guide on how banking APIs work walks through this in more depth.

The law also limits what the app may do with the data. UK rules say an account information provider must not access information other than from the accounts you designated and must not use or store it for any purpose except providing the service you asked for⁠^[6]. A payment initiation provider must not change the amount, the payee or any other feature of the payment you approved⁠^[4].

#Who makes the rules for open banking?

There is no single global law. Each region chose its own route, which is why the same idea can feel different in different countries.

• European Union: PSD2 brought payment initiation and account information services under EU law and applies from 13 January 2018⁠^[7]. New rules (PSD3 and a Payment Services Regulation) were provisionally agreed in November 2025⁠^[8] and were still awaiting formal adoption in October 2026⁠^[9]. See PSD2 explained.
• United Kingdom: the Competition and Markets Authority's 2017 retail banking order set the timetable for introducing open banking⁠^[10]; it applied to the nine largest banks and building societies, known as the CMA9⁠^[11], and the Payment Services Regulations 2017 define the services⁠^[3].
• United States: section 1033 of the Dodd-Frank Act gives consumers a right to access their financial data⁠^[12]. The CFPB's 2024 rule to put that right into practice is blocked by a court while the agency reconsiders it⁠^[13]. See the CFPB 1033 rule explained.
• Australia: the Consumer Data Right has been rolled out to banking and energy, with non-bank lending to follow, and the ACCC accredits providers⁠^[14].

#How big is open banking today?

The UK publishes detailed monthly figures, because its largest banks report to Open Banking Limited, the body that governs the UK framework. By mid-2026, more than eight years after launch, the UK ecosystem had passed one billion open banking payments and 100 billion API calls⁠^[11].

The budgeting example is the classic account information use case: the app reads three balances through the banks' APIs and adds them up for you. It cannot move any of that money unless you separately approve a payment.

#Is open banking safe?

Open banking was designed to be safer than the older method, where apps asked for your online banking username and password and logged in as you (a technique called screen scraping). European rules made banks provide a dedicated communication channel for authorised providers and said that accessing customer data through screen scraping would no longer be allowed once the technical standards applied⁠^[7]. You can read the full comparison in screen scraping vs APIs.

Safer does not mean risk-free. Supervisors list data protection, cyber security and the management of third-party relationships among the main challenges⁠^[1]. The biggest everyday risk for you is usually not a technical hack but a scam: someone persuading you to connect an app, or to approve a payment, that you would not have approved if you knew the truth. Our guide to authorised push payment fraud covers this.

#Where is open banking heading next?

Regulators are pushing in two directions. The first is wider scope: the European Commission proposed in 2023 a framework for sharing data beyond payment accounts, often called open finance, with dedicated permission dashboards so customers can see who accesses their data⁠^[15]. The second is better payments: in the UK, regulators are backing commercial variable recurring payments so people can use open banking for regular bills⁠^[16]. In the US, the shape of the national rule depends on the CFPB's reconsideration, which its 2026 regulatory agenda still lists as planned work⁠^[17]; a proposed revision went to White House review in August 2026⁠^[18].