Glossary
Open banking is a framework (often driven by regulation) that lets customers securely share their banking data with, and initiate payments through, authorized third-party providers via standardized APIs, rather than the bank being the sole gatekeeper of the customer’s financial data. It’s reshaping financial services by enabling new apps and services built on access to bank data, with the customer’s consent.
The core idea is that a customer’s financial data belongs to the customer, who should be able to grant trusted third parties access to it (to power budgeting apps, lending decisions, account aggregation, or payment initiation) safely and with control.
Banks expose APIs that authorized third-party providers can call, with the customer’s explicit consent, to access account data (account information services) or initiate payments (payment initiation services). The customer authenticates and authorizes the specific access, the third party receives scoped, revocable permission (via OAuth-based flows), and the data or payment capability flows through secure, standardized APIs. Strong security profiles like FAPI govern how this access is secured.
Open banking is often mandated or encouraged by regulation. The EU’s PSD2 was a landmark, requiring banks to provide API access to licensed third parties and mandating strong customer authentication. The UK, Australia, Brazil, and many other markets have their own open-banking regimes, and "open finance" extends the concept beyond banking to broader financial data. These frameworks share the goals of competition, innovation, and customer control over data.
Open banking lives or dies on security and identity. Exposing financial data and payment initiation to third parties is only safe with strong authentication (SCA), robust authorization and consent (the customer must clearly grant and be able to revoke access), and hardened API security (FAPI). Identity is the linchpin: reliably authenticating the customer, capturing granular consent, and securing the API access are what make open banking trustworthy. This is why open banking and modern CIAM/identity capabilities are tightly linked.
Open banking enables innovation (aggregation, smarter lending, embedded finance, better payments) and gives customers more control and choice. The considerations are security (a larger attack surface as data flows to more parties), consent management (keeping it clear and revocable), and fraud (new flows like account-to-account payments intersect with APP fraud risk). Done with strong identity, consent, and API security, open banking delivers its benefits without compromising trust.
What is open banking?
A framework letting customers securely share banking data and initiate payments through authorized third parties via APIs, with their consent.
How does open banking work?
Banks expose consented, scoped API access to licensed third parties for account information or payment initiation, secured by standards like FAPI.
What regulations drive open banking?
PSD2 in the EU and similar regimes in the UK, Australia, Brazil, and elsewhere; "open finance" extends the concept further.
What security does open banking require?
Strong customer authentication (SCA), robust consent and authorization, and hardened API security (FAPI).
What is open finance?
An extension of open banking beyond bank accounts to broader financial data (investments, pensions, insurance), applying the same consented-API principles.
What are the main open banking services?
Account information services (accessing account data) and payment initiation services (initiating payments), both with customer consent.
Related: PSD2 · FAPI 2.0 · Strong Customer Authentication (SCA) · API Security · Consent Management · OAuth 2.0
