Open Banking Explained: How It's Changing Your Finances

Open banking sounds technical and is actually simple: it is a legal obligation on your bank to let you hand a regulated third party access to your account data, or permission to move money out of it, through a secure interface — and to let you withdraw that permission whenever you want.

If you have ever linked an account to a budgeting app, topped up a neobank straight from your main current account, or paid a bill by choosing "pay by bank" instead of entering card details, you have used it.

Where the rules came from

Two separate pieces of regulation created the market, and they are frequently conflated.

• The EU's PSD2 obliged banks across the bloc to expose account access to authorised third parties.

• The UK's version came from a competition remedy, not a payments directive: a 2017 Competition and Markets Authority order required the nine largest UK current-account providers — "the CMA9" — to build common open banking APIs. The FCA is now the lead regulator for the regime.

That difference in origin explains why the UK's implementation was more standardised and moved faster, while the EU's coverage varied a great deal by bank and country.

The two things it actually lets an app do

Nearly every open banking feature is one of these, and the distinction is worth holding on to because the risk is different.

Account information (read) — the app can see balances and transactions. This is what account aggregation, budgeting tools and affordability checks run on. Nothing can be moved.

Payment initiation (write) — the app can instruct a payment from your account, with your authentication, without touching a card network. This is what "pay by bank" is, and it is the part that displaces card fees.

A permission to read is not a permission to pay. When an app asks for access, it should be clear which one you are granting, and for how long.

What it is genuinely good for

Seeing everything in one place. Aggregation across banks, cards and, increasingly, savings — without sharing your banking password with anyone, which is what the pre-open-banking generation of apps required.

Account-to-account payments. Money moves directly, usually settles in seconds, and the merchant avoids card interchange. That saving is why so many billers and marketplaces now offer it, and why some pass a discount back to you.

Lending decisions based on behaviour, not just a score. A lender that can see twelve months of real income and outgoings can price risk for someone with a thin credit file. This is a real improvement for the self-employed and for people new to a country — it also means the data genuinely matters, so share it deliberately.

Switching without guesswork. Because a provider can read your actual usage, comparisons stop being hypothetical. Our bank account switching guide covers the mechanics once you have decided.

The 2026 development worth knowing: variable recurring payments

The most significant change in years is commercial variable recurring payments (cVRP). A VRP is a standing permission to take varying amounts within limits you set — the flexibility of a direct debit, but running on open banking rails, with the cap and the end date under your control.

The UK is rolling this out in waves under the FCA and the Payment Systems Regulator: wave one covers regulated and trusted sectors such as financial services and utilities, with wave two extending to general e-commerce, expected in the second half of 2026.

If it lands as intended, it is the first credible alternative to the card for recurring payments — subscriptions, energy bills, top-ups — with a consumer-visible limit attached, which a card-on-file arrangement has never had.

What is coming next

PSD3 and the Payment Services Regulation are the EU's rewrite of PSD2. Final compromise texts were published in April 2026, with the final vote and Official Journal publication expected in the second half of 2026, entry into force twenty days later, and a transition period that puts mandatory compliance in late 2027. Member states are expected to transpose PSD3 into national law across 2027–2028.

FIDA — open finance. Proposed alongside PSD3, the Financial Data Access regulation would extend the same access model beyond current accounts to investments, pensions, insurance and mortgages. It remained in trilogue negotiation as of spring 2026. This is the bigger shift for consumers: current accounts are the least interesting financial data most people hold.

The UK is going its own way rather than adopting PSD3, with domestic reform on APP fraud, open banking and safeguarding running through 2026–2028.

The honest summary is that open banking's second phase is legislated but not yet delivered, and dates in this area move.

Privacy, consent and the checks worth doing

Access is consent-based and revocable, and only regulated firms may connect. Three practical habits follow:

• Verify the firm is authorised. In the UK that means the FCA register; in the EU, the national regulator's register. The brand in the app store is not the regulated entity — check the legal name in the terms.

• Re-read what you granted. Consent has a scope and an expiry. Read-only access to one account is a very different thing from ongoing access to all of them.

• Revoke through your bank, not just the app. Deleting an app does not necessarily end the permission. Every bank in the regime has a screen listing connected third parties, and that is the one that actually cuts access.

What open banking does not do

It does not make an app safe. Regulated access to your data says nothing about whether the firm holding your money is a licensed bank — a distinction that decides what happens if it fails, and one we cover in the neobank safety guide and in embedded finance.

It does not eliminate fraud. Because open banking payments are pushed by you, they fall outside card chargeback protection, and authorised push payment fraud is exactly the risk the current round of UK reform is aimed at. Treat a "pay by bank" prompt on an unfamiliar site with the same caution as a bank transfer, because that is what it is.

The verdict

Open banking is the plumbing beneath most of what makes modern banking apps feel modern — aggregation, instant top-ups, pay-by-bank, faster lending decisions. The first phase is mature and works. The second phase, variable recurring payments and open finance, is where the consumer gains stop being incremental, and 2026–2027 is when it either arrives or slips again.

Related reading

Understand the wider shift with embedded finance explained, how neobanks make money, and the providers built on it in the best neobanks of 2026. This is general information, not financial advice.