Open Banking Explained: How It's Changing Your Finances

Disclosure: this page contains affiliate links. If you sign up through them we may earn a commission, at no extra cost to you. It does not change what we write.

What is open banking? It is a legal obligation on your bank to let you give a regulated third party access to your account data, or permission to make a payment from your account, through a secure interface — and to let you withdraw that permission whenever you want. You never share your banking password; you approve each connection inside your own bank's app. In the UK it is now mainstream: Open Banking Limited counted 40.16 million open banking payments in June 2026 alone, and more than one billion since the system started.

If you have linked an account to a budgeting app, topped up a savings app straight from your current account, or paid a bill by choosing "pay by bank" instead of typing in card details, you have already used it.

Where the rules came from

Two separate pieces of regulation created the market, and they are frequently conflated.

• The EU's PSD2 obliged banks across the bloc to give authorised third parties access to payment accounts.

• The UK's version came from a competition remedy, not a payments directive: a 2017 Competition and Markets Authority order required the nine largest UK current-account providers — "the CMA9" — to build common open banking APIs. The FCA is now the lead regulator for open banking, a role it states in its December 2025 update with the Payment Systems Regulator.

That difference in origin explains why the UK's implementation was more standardised and moved faster, while EU coverage varied a great deal by bank and country.

The four things an app can do with your permission

A permission to read is not a permission to pay. When an app asks for access, it should say which one you are granting and for how long.

How big it has become: the UK numbers

Open Banking Limited publishes monthly figures for the main UK banks. For June 2026, published on 30 July 2026, it reported 40.16 million payments, of which 32.43 million were single domestic payments and 7.73 million were sweeping variable recurring payments, plus 18.81 million user connections and 2.81 billion API calls in the month.

Two things are worth reading carefully in those figures:

• "User connections" is not the number of people. Open Banking Limited says it cannot identify individuals who use services through more than one brand, so the figure counts connections with the reporting brands, as its September 2025 release explains. One person with two connected apps counts twice.

• Variable recurring payments are the fast-growing part. 7.73 million out of 40.16 million is 7.73 ÷ 40.16 = about 19% of June's payments. In July 2025, sweeping VRPs were 4.26 million out of 29.89 million payments, about 14%. Total monthly payments rose from 29.89 million to 40.16 million between those two months — an increase of about 34%.

What open banking is genuinely good for

Seeing everything in one place. Aggregation across banks and cards without handing anyone your banking password, which is what the previous generation of apps required.

Account-to-account payments. The money moves directly from your bank to the payee rather than over a card network, so the merchant pays no card interchange on it.

Lending decisions based on behaviour, not just a score. A lender that can see twelve months of real income and outgoings can price risk for someone with a thin credit file — useful for the self-employed and for people new to a country. It also means the data genuinely matters, so share it deliberately.

Switching without guesswork. A provider that can read your actual usage can compare accounts on your real pattern of spending. Our bank account switching guide covers the mechanics once you have decided.

Worked example: why merchants push "pay by bank"

Take a £100 purchase on a UK consumer debit card. Interchange alone — only one part of what a merchant pays to accept a card — is capped at 0.2% of the transaction for UK debit cards under the UK version of the Interchange Fee Regulation, so up to 0.002 × £100 = £0.20, before the card scheme's and the acquirer's own charges. On a £1,500 annual energy bill paid by card, the interchange part alone can reach £3. A pay-by-bank payment carries none of those card-network costs, though the payment provider charges its own fee, which varies. That gap is why billers and marketplaces nudge you towards it — and why some pass a discount back.

Variable recurring payments: the 2026 development worth knowing

A variable recurring payment is a standing permission for payments that vary in amount within limits you agree in advance — the flexibility of a direct debit, but on open banking rails, with the cap and the end date under your control.

Sweeping VRPs, which move money between accounts in your own name, are already live and growing, as the figures above show.

Commercial VRPs extend that to paying businesses. In their December 2025 update, the FCA and the PSR said 31 firms had formed a new body, UK Payments Initiative (UKPI), to run a commercial VRP scheme; that "phase 1" covers utility payments, financial services payments and payments to local and central government; and that they expected the first live payments in the first quarter of 2026. Expansion into general e-commerce is tied to a long-term regulatory framework: HM Treasury was expected to legislate in 2026 to give the FCA new powers to set open banking rules, with the FCA consulting on those rules before the end of 2026. An earlier version of this article gave a firm second-half-2026 date for e-commerce; the regulators' own document does not, so neither do we.

Worked example: how a VRP limit protects you

Suppose you set up a commercial VRP for a utility with a limit of £150 a month. A £96 bill in May goes through. A £182 winter bill does not go through automatically — it is above the limit you set, so the payment needs your fresh approval or a higher limit. With a card stored on file, nothing in the payment itself would stop the £182. (The amounts are illustrative; the limit is whatever you choose.)

What is coming next in the EU

The Payment Services Regulation and PSD3, the EU's rewrite of PSD2, were agreed provisionally by the Council and the Parliament on 27 November 2025. The European Parliament's legislative train, updated 20 September 2026, lists the file as "close to adoption": the agreed text was approved in the ECON committee on 5 May 2026 and still needs formal adoption by Parliament and Council before it can enter into force. Application dates follow from that, so any date you see quoted for compliance is an estimate until the text is in the Official Journal.

FIDA — open finance. The Financial Data Access regulation would extend the same access model to investments, pensions, insurance and mortgages. It has stalled: the Austrian Economic Chamber's status page, dated 10 September 2026, reports no date for further trilogue meetings, no active negotiation under the Irish Council presidency, and uncertainty over whether the file will be pursued in the current Commission term.

The UK is going its own way, building its long-term open banking framework through domestic legislation rather than adopting the EU texts.

Privacy, consent and the checks worth doing

Access is consent-based and revocable, and only regulated firms may connect. Three practical habits follow:

• Verify the firm is authorised. In the UK that means the FCA register; in the EU, the national regulator's register. The brand in the app store is not the regulated entity — check the legal name in the terms. How to check a bank licence shows where each register is.

• Re-read what you granted. Consent has a scope and an expiry. Read-only access to one account is a very different thing from ongoing access to all of them.

• Revoke through your bank, not just the app. Deleting an app does not necessarily end the permission. Every bank in the regime has a screen listing connected third parties, and that is the one that actually cuts access.

What open banking does not do

It does not make an app safe. Regulated access to your data says nothing about whether the firm holding your money is a licensed bank — a distinction that decides what happens if it fails, and one we cover in the neobank safety guide and in embedded finance.

It does not eliminate fraud. Because open banking payments are pushed by you, they fall outside card chargeback protection, and authorised push payment fraud is exactly the risk the current round of UK reform is aimed at. Treat a "pay by bank" prompt on an unfamiliar site with the same caution as a bank transfer, because that is what it is. In the UK, the PSR's APP scam reimbursement rules cover payments made via Faster Payments or CHAPS from one UK bank account to another — a different and narrower safety net than a card chargeback.

Frequently asked questions

Is open banking safe?

The connection itself is: you approve access inside your own bank, never share your password, and can revoke it at any time, and only regulated firms can connect. The risks are the usual ones — giving access to a firm you have not checked, and approving a payment to a scammer, which is a bank transfer rather than a card payment and has no card chargeback.

What is the difference between open banking and a direct debit?

A direct debit lets a business pull payments from your account under a mandate you sign once. A commercial VRP also allows varying recurring payments, but you set an amount limit and an end date, and you can see and cancel the permission in your bank. In the UK, commercial VRPs started with utilities, financial services and government payments.

How many people use open banking in the UK?

Open Banking Limited reported 18.81 million user connections in June 2026. That is not a count of people: it counts connections, so one person using two apps appears twice. The same month saw 40.16 million open banking payments.

How do I stop an app accessing my bank account?

Revoke the connection in your bank's app or online banking, in the section that lists connected apps or third-party access. Deleting the third-party app alone does not necessarily end the permission.

The verdict

Open banking is the plumbing beneath most of what makes modern banking apps feel modern — aggregation, instant top-ups, pay-by-bank, faster lending decisions. The first phase is mature and widely used. The second phase — commercial variable recurring payments and open finance — is where the consumer gains stop being incremental, and on the regulators' own documents it is arriving in stages rather than on a single date.

Related reading

Understand the wider shift with embedded finance explained, how neobanks make money, and the providers built on it in the best neobanks of 2026. This is general information, not financial advice.