Open Finance: A Complete Guide for Finance & Technology Leaders

Executive Summary

1. What Is Open Finance

1.1 Definition

Open finance is a model in which financial data and financial functionality — reading a balance, initiating a payment, pulling a transaction history, confirming an identity — are made available to authorised third parties through secure, standardised APIs, under the explicit, revocable consent of the account holder. It replaces two older, worse alternatives: manual document sharing (bank statements as PDFs) and screen scraping (a third party logging in as the user, with the user's credentials, to read the page and extract data).

The term is best understood as a scope expansion of open banking. Open banking, as legally defined in most markets, covers payment accounts: current accounts, the transactions that flow through them, and the ability to initiate a payment from them. Open finance takes the same architecture — APIs, consent, strong authentication, defined liability — and extends it to savings and time deposits, investment and brokerage accounts, pensions and retirement accounts, mortgages and consumer credit, and increasingly insurance. The underlying shift is philosophical as much as technical: financial data is reframed as something the customer owns and can direct, rather than something the institution that holds it exclusively controls.

1.2 Open Banking vs. Open Finance vs. Open Data

These three terms are frequently used interchangeably in casual conversation, which causes real confusion in strategy discussions. It's worth being precise:

In practice, "open finance" is the term to use when you mean the full-portfolio vision, and "open banking" when you specifically mean the payment-account slice most regulation started with. This guide uses open finance as the umbrella term and calls out open banking specifically where the distinction matters — most notably in the regulation section, where several markets are legally still in open banking territory while describing themselves as doing open finance.

1.3 A Brief History

The UK and EU effectively co-invented modern open banking. The UK's Competition and Markets Authority ordered the nine largest UK banks (the "CMA9") to open standardised APIs following a market investigation that found incumbents faced too little competitive pressure. The EU's second Payment Services Directive (PSD2), applying across the European Economic Area, took effect over the same period and mandated that banks give licensed third parties API access to payment accounts, formalising two new regulated roles: Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs).

The US took a different path. No comparable mandate existed until the CFPB finalised its Section 1033 "Personal Financial Data Rights" rule on 22 October 2024 — fourteen years after the underlying statutory authority was written into the 2010 Dodd-Frank Act, and, as it turned out, not the end of the story. CFPB, 2024 In the interim, the market organised itself around a voluntary standard — the Financial Data Exchange (FDX) — and a handful of large aggregators who built bilateral relationships with thousands of banks, at first largely via screen scraping and increasingly via direct API agreements.

Brazil took the most centralised and ambitious approach of any major economy. Rather than starting with payment accounts and expanding later, the Central Bank of Brazil designed Open Finance Brasil from the outset — rolling out in phases from February 2021 — to cover banking, payments, foreign exchange, investments, insurance and pensions. A full open finance regime from day one, with the regulator itself operating the central governance structure. Banco Central do Brasil That decision is the main reason Brazil is now the largest and most complete open finance market in the world, and it is the single clearest natural experiment the sector has produced: scope defined up front beats scope bolted on later.

2. How Open Finance Works

2.1 APIs and Data-Sharing Standards

At the technical core, open finance runs on REST APIs exposed by data holders (banks, brokerages, insurers) and consumed by data recipients (fintechs, aggregators, other banks), governed by a shared technical standard so that a client integrating with one bank doesn't have to rebuild everything for the next. The major regional standards are not interchangeable, which is itself a source of cost and friction for any company operating across borders:

• Berlin Group / NextGenPSD2 — the most widely adopted technical standard across continental Europe for PSD2 compliance.
• UK Open Banking Standard — maintained by Open Banking Limited (OBL), the entity that grew out of the original Open Banking Implementation Entity. A successor "Future Entity" with a long-term funding model has been under design by the Joint Regulatory Oversight Committee and the FCA. FCA / JROC
• FDX API — the US industry standard maintained by the nonprofit Financial Data Exchange. In January 2025 the CFPB formally recognised FDX as a standard-setting body under the Section 1033 rule, for a five-year term — the first such recognition issued. CFPB, 2025
• STET — a French-originated standard still used by some French and Belgian institutions alongside Berlin Group.
• Open Finance Brasil APIs — a single mandated standard across all participating Brazilian institutions, governed centrally.
• Consumer Data Standards (Australia) — maintained by the Data Standards Body for the Consumer Data Right.
• India's Account Aggregator specification — a consent-artefact-based standard routed through licensed intermediaries rather than direct bank-to-fintech connections.

A practical note for anyone budgeting an international rollout: standards fragmentation is the reason the aggregator layer has stayed commercially durable rather than being disintermediated by direct bank APIs. Absorbing four incompatible regimes is a real product, and most companies would rather buy it than build it.

2.2 Consent, Authentication & Security

Every open finance flow rests on three pillars: consent (the customer explicitly authorises a specific third party to access specific data for a specific purpose and duration), strong customer authentication (the customer proves it's really them, typically via the bank's own login and a second factor, never by handing credentials to the third party), and tokenised, revocable access (the third party receives a scoped, time-limited access token via OAuth 2.0 rather than a password, and the customer can revoke it at any time from the bank's own interface).

This is the structural reason open banking APIs are considered materially safer than the screen-scraping model they replaced: credentials never leave the bank's own systems, and access can be surgically switched off without a password reset. The scale of what is being replaced is easy to underestimate — Canada's own regulatory impact analysis estimated that around nine million Canadians were still sharing confidential banking credentials with third parties through screen scraping as of mid-2026. Canada Gazette, 2026

Regulators layer additional requirements on top: the EU requires Strong Customer Authentication (SCA) under PSD2's Regulatory Technical Standards; the UK requires equivalent dynamic linking of authentication to the specific transaction; most mature regimes cap consent duration — commonly 90 days before re-authorisation is required — to prevent indefinite, forgotten data access. That 90-day cap is also, in practice, one of the largest sources of connection churn in any product built on open finance, and a recurring theme in industry lobbying for longer consent windows.

2.3 The Roles: AISPs, PISPs, and TPPs

Regulated terminology varies by market but the functional roles repeat everywhere:

• Third-Party Provider (TPP) — the umbrella regulatory category for any licensed entity consuming open finance data or initiating payments on a customer's behalf.
• Account Information Service Provider (AISP) — a TPP licensed to read account data: balances, transactions, holdings.
• Payment Initiation Service Provider (PISP) — a TPP licensed to initiate a payment directly from the customer's account, without routing through card networks.
• Data Holder / ASPSP ("Account Servicing Payment Service Provider") — the bank or institution that holds the underlying account and exposes the API.
• Aggregator / Data Intermediary — a technical layer (Plaid, Tink, TrueLayer and others) that connects to many data holders and offers a single, normalised API to many TPPs, so that no fintech has to integrate with thousands of banks individually.
• FISP (proposed, EU) — Financial Information Service Provider, the new regulated category FiDA would create for firms accessing non-payment financial data.

India is the notable structural exception. Its Account Aggregator is a licensed intermediary that is explicitly forbidden from seeing or storing the data it routes — a "data blind" consent broker rather than a value-adding aggregator. That design choice trades away data-enrichment capability in exchange for a much simpler privacy story, and it is the most-copied alternative model for markets designing regimes now.

3. Use Cases

Open finance is infrastructure, not a product — its value shows up in what gets built on top of it. The following categories represent the large majority of commercial activity today.

3.1 Personal Financial Management (PFM)

The original and still most visible use case: apps that pull together a user's accounts across multiple institutions into a single dashboard for budgeting, net-worth tracking and spending insight. This category has consolidated hard. Intuit shut down Mint — the category's defining product, with roughly 3.6 million active users — on 1 January 2024, pushing its base toward Credit Karma and successors like Monarch Money and Copilot Money. CNBC, 2023

The lesson worth extracting is not that PFM failed but that it struggled as a standalone business. Aggregating accounts is expensive to maintain and hard to charge for directly. PFM now more often ships as a feature inside a bank's own app, where the return is retention rather than subscription revenue.

3.2 Lending & Cash-Flow Underwriting

Open finance data lets lenders underwrite using actual cash-flow history — real income, real expenses, real account behaviour — instead of relying solely on traditional credit bureau files. This matters enormously for "thin file" or credit-invisible borrowers: gig workers, recent immigrants, young adults, and small businesses with irregular revenue. Buy-now-pay-later providers and many SME lenders rely on live account connections to assess affordability in real time at the point of application, rather than waiting days for statement uploads.

It is also the use case regulators most consistently prioritise, because it is the one with a defensible public-interest story. The FCA named SME lending and mortgage access as its two "high-impact use cases" to prioritise first under the UK open finance roadmap. FCA, 2026 India's Account Aggregator framework reports facilitating loans worth ₹1.6 lakh crore across more than 18 million loan accounts. Sahamati, 2026

3.3 Account-to-Account (A2A) Payments

Open finance enables payments that move directly from a customer's bank account to a merchant or biller, authorised via the PISP flow, without touching a card network. Branded in the UK and Europe as "Pay by Bank," and enabled in the UK specifically through Variable Recurring Payments (VRPs) for subscriptions and recurring bills, A2A payments are cheaper for merchants (no interchange fee), settle faster, and reduce certain categories of fraud.

The UK is the clearest evidence that this is real rather than theoretical. Open banking payments reached 351 million transactions in 2025, up 57% year on year, with sweeping VRP volumes nearly doubling (+98%) and single domestic payments up 52%. Open Banking Limited, 2026 The ecosystem passed one billion cumulative payments in 2026, more than eight years after launch. Open Banking Limited, 2026 For scale context: as of March 2025, open banking payments represented roughly 7.9% of all UK Faster Payments — about one in thirteen. OBL Impact Report 7, 2025

GoCardless has built a specialised business around recurring A2A collection; Stripe, Adyen and the card networks themselves have all launched or acquired open-banking-payment capabilities defensively, recognising that A2A is a genuine long-term threat to card economics in markets where it gains merchant and consumer trust. That "where it gains trust" qualifier is doing real work — A2A has taken meaningful share in the UK, Brazil and India, and almost none in the US.

3.4 Wealth Management & Robo-Advice

Extending open finance beyond deposit accounts to brokerage and investment accounts lets a wealth manager or robo-advisor see a client's full portfolio — including assets held away from the primary platform — enabling genuinely holistic advice, automated rebalancing recommendations, and consolidated performance reporting. This is one of the clearest cases for why "open banking" (payments-only) is insufficient and true open finance (investments included) is where the real value for affluent and mass-affluent clients sits. It is also the use case most obviously blocked in markets whose regulation stopped at payment accounts.

3.5 Open Insurance

The newest and least mature branch: applying the same consent-and-API model to insurance policies, claims history and underwriting data. Early use cases include usage-based and behaviour-based pricing, faster claims processing by cross-referencing bank transaction data to verify a loss, and comparison/switching tools that need policy data portability to work well. Brazil's regime already includes insurance and pensions by design; the EU's proposed FiDA explicitly targets insurance data — though notably it excludes sickness and health insurance products, and occupational pensions are member-state opt-in. European Commission

3.6 SME & Business Banking

Small and mid-sized business accounting software (QuickBooks, Xero, Sage) increasingly connects directly to business bank accounts via open finance APIs for automated bookkeeping, reconciliation and cash-flow forecasting — removing the manual CSV-export workflow that defined small-business accounting for decades. The same connections power SME lending underwriting, treasury and cash-management dashboards for multi-bank businesses, and expense-management tools. EY's analysis for Open Banking Limited estimated an annual GDP uplift of £2.3 billion from SME open banking use within five years, slightly below the £2.5 billion consumer figure. EY / OBL, 2026

3.7 Embedded Finance & Banking-as-a-Service

Open finance is a prerequisite for much of embedded finance — the practice of a non-financial company (a retailer, a software platform, a marketplace) offering a financial product inside its own product experience. Embedded finance needs open finance rails both to originate the product and, often, to underwrite it using the customer's existing account data. The two topics are frequently confused: open finance is the data-and-consent layer; embedded finance is a distribution model that consumes it. You can do one without the other, but the interesting products do both.

3.8 Fraud Prevention & Identity Verification

Account and transaction data accessed through consented APIs is now a standard signal in fraud and identity workflows: confirming account ownership before a payment, detecting synthetic identities by cross-referencing account tenure and behaviour, and verifying income or employment continuity without requesting pay stubs. Because the data arrives via authenticated API rather than a user-uploaded document, it is materially harder to falsify than a PDF bank statement. Juniper Research specifically flagged underwriting and identity as the segments expected to drive the next phase of open banking user growth. Juniper Research, 2025

4. What the Adoption Numbers Actually Show

Open finance is unusually prone to strategy decks that cite forecasts as though they were results. This section separates the two. Everything in the table below is a measured figure reported by a regulator, a scheme operator or an industry body — not a projection.

4.1 Why Brazil and Australia diverged

Both markets mandated data sharing. Both built competent technical standards. One has 154 million active consents; the other has 1.3 million users. The difference is instructive and worth being blunt about, because it is the closest thing this sector has to a controlled comparison.

Scope was defined up front in Brazil and incrementally in Australia. Brazil's regime covered investments, insurance, pensions and foreign exchange from the design stage, so the first thing a consumer could do with it was see something they couldn't see before. Australia started with payment accounts and expanded sector by sector, which meant the early product surface was thin.

Brazil had a payments story attached. Open Finance Brasil launched alongside and interoperates with Pix, Brazil's instant payment system, which achieved near-universal adoption on its own merits. Open finance rode a rail people were already using.

Australia's compliance cost fell hardest on the institutions least able to absorb it. An industry strategic review commissioned by the Australian Banking Association reported roughly A$1.5 billion of bank investment in the CDR, with disproportionately higher per-customer compliance costs for mid-tier and regional banks — the exact institutions the regime was meant to help compete. ABA Strategic Review, 2024 This is an interested party's number and should be read as such, but the Australian Treasury ran its own compliance costs review in parallel and the government announced a CDR "reset" in August 2024, narrowing banking data scope and cutting the required data history from seven years to two. Australian Treasury, 2024

The generalisable lesson: mandating supply does not create demand. Every market that has built a data-sharing regime and then been disappointed by uptake has made some version of the same mistake — sequencing the obligation before the use case.

4.2 How to read the forecasts

The headline global numbers in this space are forecasts, and should be handled accordingly. Juniper Research projected global open banking users rising from 183 million in 2025 to over 645 million by 2029 (+250%), and open banking API call volumes from 137 billion to 720 billion over the same period (+427%). Juniper Research, 2025 Those are models built on assumptions about regulatory timelines that have since slipped in at least two major markets. They are useful for order-of-magnitude reasoning and nothing more precise than that.

The same caution applies to economic-impact modelling. EY's analysis for Open Banking Limited put the UK's full-maturity annual opportunity at £43 billion, against £8.3 billion of cumulative benefit estimated as actually delivered to date and £7.4 billion of annual benefit projected within five years. EY / OBL, 2026 The £43bn figure is a ceiling contingent on adoption the market has not yet achieved; the £8.3bn is the measured floor. Quoting the former without the latter is the single most common distortion in open finance strategy decks.

5. The Industry Landscape: Brands & Companies

No logos here by design — this section is a map of who does what, organised by function rather than prestige. Company presence and ownership change quickly in this space, so treat this as a snapshot of categories and representative names rather than an exhaustive or permanent directory. Verify current licensing status directly before relying on any of it commercially.

5.1 Data Aggregators & API Platforms

The connective-tissue layer: companies that integrate with thousands of banks so that fintechs and other institutions only have to integrate once.

The pattern worth noticing: the two largest acquisitions in this tier were both by card networks, and the one that was blocked was also by a card network. Incumbent payment rails have consistently treated open finance as something to own rather than something to compete with.

5.2 Incumbent Banks Exposing Open APIs

Large institutions that have built, or been mandated to build, developer-facing API platforms: JPMorgan Chase, BBVA (an early and vocal API-first pioneer among global banks), Citi, HSBC, Standard Chartered, NatWest and the other UK CMA9 banks, Capital One (notable for a dedicated public API platform), and DBS Bank in Singapore (frequently cited as a benchmark for API-marketplace strategy in Asia).

5.3 Neobanks & Challenger Banks

Digital-first banks that both consume open finance data (to onboard and underwrite customers quickly) and, as licensed institutions themselves, are increasingly subject to the same API-exposure obligations as incumbents: Revolut, Monzo, Starling Bank and N26 in Europe and the UK, Chime in the US, and Nubank in Brazil — the latter operating inside the world's largest open finance regime.

5.4 Payments Infrastructure

Card networks and payment processors have moved from treating open finance as a threat to treating it as a product line: Visa (via Tink and its broader open banking unit), Mastercard (via Finicity), Stripe (through account-linking and financial-data products bundled into its payments stack), Adyen, and GoCardless all now offer some form of open-banking-powered payment or data product.

5.5 Standards Bodies & Governance

The rules of the road are set by nonprofit or regulator-run bodies rather than any single company: the Financial Data Exchange (FDX) in the US, industry-run and CFPB-recognised since January 2025; the Berlin Group in continental Europe; Open Banking Limited in the UK, with a successor Future Entity under design; the Data Standards Body in Australia; Sahamati in India, formally recognised by the Reserve Bank of India as the Account Aggregator ecosystem's Self-Regulatory Organisation in 2026 Sahamati / RBI, 2026; and Brazil's Open Finance governance structure, operated under the Central Bank of Brazil.

5.6 Regional Coverage Beyond the Core Markets

6. Industry Roles & Career Paths

Open finance has matured into a distinct career track that sits across banks, fintechs, aggregators and consultancies. The table below reflects the roles most commonly hired for.

A useful heuristic for leaders assessing where to build capability internally: compliance and partnerships expertise is hardest to hire externally and most valuable to grow in-house, while API engineering capacity can often be accessed through an aggregator partnership rather than built from scratch. The scarcest profile in the market is the person who can hold both the regulatory text and the API specification in their head at once — that role is usually titled product manager and is usually underpaid relative to its leverage.

7. Regulation by Market

This is the section that changes fastest, and where precision matters most for anyone making budget or roadmap decisions. Dates below are stated as of early August 2026 and should be re-verified against the relevant regulator before anything is committed to a plan.

7.1 European Union

PSD2 remains the current binding law, mandating payment-account API access and defining AISP/PISP roles across the European Economic Area. Its successor package — PSD3 (a directive) and the Payment Services Regulation (PSR) (a directly applicable regulation) — reached provisional political agreement between the European Parliament and Council on 27 November 2025. COREPER endorsed the trilogue texts in April 2026 and the Parliament moved to formal approval in May 2026, with publication in the Official Journal expected during 2026 after legal-linguistic review. European Parliament The rules generally apply 21 months after publication, which puts practical entry into force in 2027 and full PSD3 national transposition later still.

On a separate and slower track, the Financial Data Access Regulation (FiDA), published by the Commission on 28 June 2023 in the same package, would extend data sharing well beyond payment accounts — to savings, investments, mortgages, non-life insurance and crypto-asset holdings — and create the new FISP category. European Commission Trilogue negotiations stalled during 2025 and restarted in 2026 with a materially narrowed scope, excluding credit rating agencies, large corporates and smaller financial institutions. The most contested issue throughout has been the compensation mechanism between data holders and data users. Phased application from 2027 onward is the working expectation, but the timeline is genuinely uncertain and has already slipped more than once.

7.2 United Kingdom

The UK's open banking regime was originally created by the CMA's Order on the nine largest banks and now sits within a broader statutory "Smart Data" framework covering banking, energy, transport, telecoms and other sectors. The transitional governance question — who runs the scheme after the CMA Order is discharged — has been worked through by the Joint Regulatory Oversight Committee, which proposed a "Future Entity" to succeed Open Banking Limited, with an interim entity bridging the gap. FCA / JROC

The substantive move to open finance came on 14 April 2026, when the FCA published its open finance roadmap — a plan running to 2030 with three phases: collaboration and evidence-gathering through 2026, framework design and coordination in 2027, and scaling and delivery of sustainable open finance schemes across 2028–2030. The FCA prioritised SME lending and consumer access to mortgages as its first two high-impact use cases, with a discussion paper on the first open finance scheme expected in Q4 2026. FCA, 2026

Worth reading the sequencing here as a deliberate correction of Australia's mistake: the FCA is choosing use cases first and designing the scheme around them, rather than mandating a data surface and hoping products appear.

7.3 United States

The US has no open banking-specific statute; the relevant authority derives from Section 1033 of the Dodd-Frank Act (2010). The CFPB used it to finalise the Personal Financial Data Rights rule on 22 October 2024, effective 17 January 2025, with tiered compliance beginning 1 April 2026 for depository institutions holding at least $250 billion in assets and non-depository providers with at least $10 billion in receipts, and running out to 2030 for the smallest institutions. CFPB / Federal Register, 2024

That timeline did not hold. The rule was challenged in Forcht Bank, N.A. v. CFPB in the Eastern District of Kentucky, brought with the Bank Policy Institute and Kentucky Bankers Association. The CFPB initially told the court the rule exceeded its statutory authority and should be vacated, then reversed course on 29 July 2025, withdrawing the vacatur request and moving to stay the case while it rewrote the rule. The court granted the stay. On 22 August 2025 the Bureau published an Advance Notice of Proposed Rulemaking (docket CFPB-2025-0037, 90 FR 40986) seeking comment on four areas: who may make a request on a consumer's behalf, how to defray the costs of requests, information security, and privacy. Comments closed 21 October 2025. CFPB, 2025

The practical position as of mid-2026 is unusual: the compliance date has passed without becoming an enforcement trigger, no replacement rule has been finalised, and the market continues to run on the voluntary FDX standard — which the CFPB itself recognised as a standard-setting body on 8 January 2025, for a five-year term, with FDX submitting quarterly adoption reports to the Bureau from Q1 2026. CFPB, 2025 In other words, the US infrastructure is considerably more mature than the legal mandate underneath it, and several states have begun legislating in the federal gap.

7.4 Brazil

Brazil's Open Finance regime, designed and operated by the Central Bank of Brazil, is the world's largest and most complete live implementation. Rolled out in phases from February 2021, it expanded beyond banking as early as 2022 to include foreign exchange, investments, pensions and insurance — a genuinely full open finance scope, not open banking with ambitions. It marked five years of operation on 1 February 2026.

Scale as reported by the scheme's own citizen dashboard: more than 100 million connected customers (individuals and companies), 154 million active consents, 143% growth in unique consents between 2024 and 2025, and more than 5 billion weekly communications between institutions. Open Finance Brasil, 2026 The regime continues to expand into corporate open finance and credit portability.

7.5 Australia

Australia's Consumer Data Right (CDR) was an early mover — live in banking from 2020 and extended to energy in 2022 — and became the sector's most-studied cautionary tale. Consumer adoption stayed low, business-side innovation was limited, and in August 2024 the government announced a CDR reset: narrowing the scope of banking data required to be shared and reducing the required data history from seven years to two, explicitly to cut compliance costs. Australian Treasury, 2024

Expansion resumed on a narrower basis. Version 8 rules extended the CDR to non-bank lenders — mortgage lenders, car finance, personal loans and BNPL providers — with product data obligations commencing 13 July 2026, consumer data sharing from 9 November 2026 for initial providers and 10 May 2027 for large providers, bringing at least 35 new data holders into the regime. The ACCC reported approximately 1.3 million Australians using the CDR at that point, up around 135% year on year. ACCC, 2026 Real growth, from a very small base.

7.6 India

India's Account Aggregator (AA) framework, overseen by the Reserve Bank of India, takes a structurally distinct approach: rather than banks exposing APIs directly to any licensed fintech, a regulated intermediary — the Account Aggregator — acts purely as a consent-management and data-routing layer between Financial Information Providers (banks, mutual funds, insurers) and Financial Information Users (lenders, wealth platforms), never storing the underlying data itself.

By June 2026 the ecosystem reported 2.88 billion+ accounts enabled, 493 million+ consent requests fulfilled, 295 million+ monthly data shares, and 1,117 live regulated entities — 176 FIPs, 1,076 FIUs and 17 operational Account Aggregators — with ₹1.6 lakh crore of loans facilitated across more than 18 million loan accounts. Sahamati, 2026 The RBI formally recognised Sahamati, the industry collective, as the ecosystem's Self-Regulatory Organisation in 2026. The framework is explicitly positioned as financial-inclusion infrastructure.

7.7 Canada

Canada moved from perennial study to law during 2026, and anyone still describing it as "in consultation" is out of date. The Consumer-Driven Banking Act received Royal Assent in March 2026, establishing an API-based framework overseen by the Bank of Canada, building on its existing responsibilities under the Retail Payment Activities Act. Draft Consumer-Driven Banking Regulations were prepublished in the Canada Gazette on 27 June 2026 with an extended 60-day consultation.

Phase One is read-only access covering deposit accounts, payment products, investment accounts and lending accounts, explicitly excluding commercially derived data; write access and payment initiation are deferred to a second phase. The government's own regulatory impact analysis put the problem it is solving plainly: roughly nine million Canadians were already sharing confidential banking credentials with third parties through unregulated screen scraping. Canada Gazette, 2026

7.8 Other Notable Markets

Singapore operates SGFinDex, launched by the Monetary Authority of Singapore and the government's digital agency — the first public digital infrastructure to combine a national digital identity with a centrally managed consent system, letting individuals retrieve deposits, cards, loans, investments, insurance and government-scheme data across participating institutions in one place. MAS Saudi Arabia, Bahrain and Nigeria have regulator-led frameworks live or in rollout, and a growing number of markets across Africa, the Middle East and Southeast Asia are designing regimes, generally drawing on the UK, EU, Brazilian or Indian models as templates. The Indian consent-broker model is increasingly the reference architecture for markets that want the privacy story without the aggregator economics.

7.9 Cross-Cutting Compliance Themes

Regardless of jurisdiction, a handful of compliance questions recur everywhere and are worth building institutional competence in directly: consent lifecycle management (capture, scope, expiry, revocation); liability allocation when fraud or error occurs across multiple parties in a data-sharing chain; data minimisation and retention limits, often in direct tension with a fintech's desire to retain historical data for model training; security certification expectations (SOC 2, ISO 27001, and increasingly sector-specific certifications); and the overlap with general data-protection law — GDPR in Europe, CCPA/CPRA in California — which applies in parallel to, not instead of, sector-specific open finance rules.

8. Value Proposition by Stakeholder

9. The Honest Part: Risks, Failures and What Hasn't Worked

Most writing on open finance is produced by people selling it. This section is the counterweight — the failures are as instructive as the successes, and a leader who only knows the optimistic case will make predictable mistakes.

9.1 Consent theatre: the Plaid settlement

9.2 Mandating supply does not create demand

Covered in detail in section 4.1, but it belongs here too because it is the most expensive mistake in the sector. Australia spent an industry-reported A$1.5 billion building a regime that 0.31% of bank customers were using at the end of 2023, and had to reset scope downward to make it sustainable. The failure was not technical. It was a sequencing decision: obligations were mandated before use cases existed to justify them, and the compliance burden landed hardest on the mid-tier institutions the regime was designed to help.

9.3 Regulatory whiplash is a real project risk

The US case is the cleanest example. A rule finalised in October 2024 with compliance dates running to 2030 was stayed within nine months, with the agency that wrote it arguing in court that it was unlawful before reversing and reopening the rulemaking. Firms that had budgeted and staffed against the April 2026 compliance date carried that cost against an obligation that did not arrive. The EU's FiDA timeline has slipped repeatedly. The generalisable point: in this sector, a published compliance date is a planning assumption, not a fact, and roadmaps should be built with that explicitly priced in.

9.4 Data security and the widened breach surface

Every additional party with access to financial data — however well-consented — is an additional potential point of failure. The move from credential-based screen scraping to tokenised API access shrinks this surface materially, but does not eliminate it: aggregators and fintechs downstream of the bank still hold sensitive data and are themselves attractive breach targets. The concentration of the aggregator tier means a single compromise can have unusually wide blast radius.

9.5 Liability ambiguity

When a payment is initiated incorrectly, or fraud occurs through a chain involving a bank, an aggregator and a fintech, the question of who is financially liable is not always cleanly resolved by current rules. This is a live area of regulatory refinement in nearly every market covered above, and one of the reasons bank legal teams are structurally cautious about voluntary data sharing beyond the mandated minimum.

9.6 Standards fragmentation

A fintech operating in the UK, EU, US, Brazil and India today must integrate against at least five materially different technical and legal regimes. This raises the cost of international expansion and is a principal reason the aggregator layer has remained commercially durable rather than being disintermediated by direct bank APIs.

9.7 The unsettled commercial model

Banks generally bear the cost of building, securing and maintaining the APIs that make open finance possible, while much of the resulting commercial value has historically accrued to the fintechs and aggregators building on top. Premium API tiers, revenue-sharing partnerships and reciprocal data access are the leading attempts to correct this imbalance, but no jurisdiction has settled on an accepted model. That this has been the single most contested issue in the EU's FiDA negotiations — and one of the four questions the CFPB reopened in its ANPR — tells you it is unresolved at the level of principle, not just implementation.

10. Build vs. Buy: A Decision Framework

This is the question most teams actually face, and it is usually answered on instinct. The framework below is editorial judgement rather than an industry standard, but it reflects how the cost curves in this category behave in practice.

Two things reliably surprise teams making this decision. First, the initial integration is the cheap part; connection maintenance and reauthentication drop-off are where the recurring cost lives. Second, transaction categorisation quality — not connectivity — is what determines whether a data-driven product actually works, and it is the hardest thing to evaluate during a vendor trial because it degrades quietly rather than failing loudly.

11. Metrics That Matter

If you are running or sponsoring an open finance initiative, these are the numbers worth putting on a dashboard. As with the section above, this is editorial judgement rather than an industry standard — but each of these tends to expose a failure mode before it becomes expensive.

12. The Future of Open Finance

From open finance to open data. The UK's Smart Data framework and Australia's cross-sector CDR both signal that the API-and-consent architecture proven in banking is being generalised across sectors — energy, telecoms, transport — with finance as the proof of concept rather than the endpoint. Australia also demonstrates that the generalisation is harder than it looks.

Convergence with embedded finance. As more non-financial platforms embed financial products, the distinction between "a fintech that uses open finance data" and "a retailer with a financial product" will continue to blur, raising unresolved questions about which regulatory regime applies where.

AI agents as a new class of data recipient. Autonomous or semi-autonomous financial agents — acting on a user's behalf to move money, rebalance a portfolio, or negotiate a bill — will need the same consent, authentication and liability infrastructure built for human-directed apps. Existing consent frameworks assume a human reading a screen; an agent acting continuously on a standing authorisation does not fit that model cleanly, and this is likely to be the next significant regulatory gap. Juniper Research explicitly flagged AI integration as a primary driver of its forecast growth in open banking API volumes. Juniper Research, 2025

Real-time payments convergence. As instant payment rail coverage expands globally, account-to-account payment initiation becomes materially more useful. Brazil's Pix is the proof: open finance adoption there was accelerated substantially by being attached to a payment rail people already used daily.

Continued consolidation among aggregators. Visa's acquisition of Tink and Mastercard's of Finicity suggest the aggregator layer will keep consolidating around a small number of large, well-capitalised platforms, particularly as compliance and security expectations rise. The DOJ's successful challenge to Visa–Plaid is the countervailing signal that this consolidation has a competition-policy ceiling.

The compensation question gets answered, somewhere. Whichever major jurisdiction first settles on a workable model for paying data holders for API access will set the template others copy. FiDA is the most likely venue; the CFPB's reopened rulemaking on cost defrayal is the other. Neither has landed.

13. Frequently Asked Questions

What is the difference between open banking and open finance?

Open banking is the practice of sharing payment-account data and initiating payments through APIs, typically scoped to current/checking and payment accounts and defined narrowly by laws like PSD2. Open finance is the broader superset: extending that same API-and-consent model to savings, investments, pensions, insurance, mortgages and credit data. Every open banking market is a subset of a fuller open finance vision; most markets have not gotten there yet. Brazil is the main exception, having included investments, insurance and pensions by design.

Is open finance mandatory or voluntary?

It depends on the jurisdiction. In the EU and UK it is a regulatory mandate. In Brazil it is mandated and centrally governed by the Central Bank. In the United States the CFPB finalised a Section 1033 rule in October 2024, but that rule was stayed by a federal court in July 2025 and the Bureau has reopened the rulemaking, so US open banking currently runs on the voluntary FDX industry standard rather than a binding federal mandate.

How many people actually use open finance?

Adoption varies enormously by market. Brazil reports more than 100 million connected customers and 154 million active consents as of February 2026. The UK reported 16.5 million active user connections in December 2025, up 36% year on year, and passed one billion cumulative open banking payments in 2026. Australia, by contrast, reported around 1.3 million Consumer Data Right users in July 2026 after six years of operation. Juniper Research forecast global open banking users rising from 183 million in 2025 to over 645 million by 2029 — a forecast, not a measurement.

Who are the key players in open finance?

The ecosystem includes data aggregators and API platforms (Plaid, Tink, TrueLayer, MX, Yodlee, Akoya, Belvo, Salt Edge, Yapily), incumbent banks exposing APIs (JPMorgan Chase, BBVA, Citi, HSBC, DBS, NatWest), neobanks and challengers (Revolut, Monzo, N26, Nubank, Chime), payments infrastructure providers (Stripe, Visa, Mastercard, Adyen, GoCardless), and standards bodies that govern the technical and legal rules (FDX in the US, the Berlin Group in continental Europe, Open Banking Limited in the UK, and Open Finance Brasil's governance structure under the Central Bank of Brazil).

What are the main risks of open finance?

The most commonly cited risks are data security and breach exposure across a wider network of connected parties, ambiguity in liability allocation when something goes wrong, fragmented technical standards across jurisdictions raising integration costs, consent that is legally valid but not genuinely understood by consumers, and an unresolved commercial model for the banks that bear most of the infrastructure cost. Australia's Consumer Data Right is the clearest cautionary case: the Australian Banking Association reported roughly A$1.5 billion of bank investment against 0.31% consumer adoption at the end of 2023, prompting a government reset.

What roles exist in the open finance industry?

Common roles include open banking/API product managers, regulatory and compliance specialists, API and data engineers, solutions architects, risk and fraud analysts, partnerships and business development leads, privacy counsel, and enterprise fintech sales professionals. These roles exist on both sides of the market: inside banks building compliant APIs, and inside fintechs and aggregators consuming and productising that data.

Should we build our own bank connections or use an aggregator?

For almost every company that is not itself an infrastructure provider, start with an aggregator. Direct bank integration only pays off at high volume across a small number of institutions, or where an aggregator's coverage or data quality is genuinely inadequate for the use case. The costs that surprise teams are rarely the initial integration — they are connection maintenance, reauthentication drop-off, transaction categorisation quality, and consent lifecycle management. See section 10 for the full framework.

What is FiDA and when does it apply?

FiDA is the EU's proposed Financial Data Access Regulation, published by the European Commission on 28 June 2023 alongside PSD3 and the Payment Services Regulation. It would extend open-banking-style data sharing beyond payment accounts to savings, investments, mortgages, non-life insurance and crypto-asset holdings, and would create a new regulated category called the Financial Information Service Provider (FISP). It remained in trilogue negotiation through 2026, with scope narrowed during negotiations and compensation between data holders and data users the most contested issue. Phased application from 2027 onward is the working expectation, but the timeline is not settled and has slipped before.

Is open finance safer than screen scraping?

Structurally, yes. In an API model the customer authenticates with their own bank and the third party receives a scoped, time-limited, revocable token rather than the customer's password. Credentials never leave the bank's systems and access can be switched off without a password reset. Screen scraping requires handing over credentials, which is why regulators have pushed to replace it — Canada's own regulatory analysis estimated around nine million Canadians were still sharing banking credentials this way in 2026. The API model shrinks the risk surface but does not eliminate it: aggregators and fintechs downstream still hold sensitive data and remain breach targets, and the consent layer sitting on top remains the weakest link.

Does open finance make money for banks?

Rarely on a direct basis, and this is the sector's least resolved question. Banks bear most of the cost of building, securing and maintaining APIs, while much of the downstream commercial value accrues to fintechs and aggregators. Premium API tiers beyond the regulatory minimum, embedded finance revenue share, reciprocal data access for the bank's own underwriting, and retention gains from better in-app financial tools are the leading answers. No jurisdiction has settled on a single accepted model, and compensation between data holders and data users has been the most contested item in the EU's FiDA negotiations for precisely this reason.

What is a Variable Recurring Payment (VRP) and why does it matter?

A Variable Recurring Payment is a UK open banking mechanism that lets a customer authorise a third party to initiate a series of payments of varying amounts within agreed limits, without re-authenticating each time. It matters because it is the piece that makes account-to-account payments viable for subscriptions and bill pay rather than one-off checkout. Sweeping VRP volumes nearly doubled year on year in the UK during 2025, growing faster than single domestic payments, and VRPs accounted for roughly 13% of total open banking payments as of March 2025.

Which country is furthest ahead in open finance?

Brazil, by most measures. Its regime was designed from the outset to cover banking, payments, foreign exchange, investments, insurance and pensions rather than starting with payment accounts and expanding later, and it is operated centrally by the Central Bank of Brazil. As of February 2026 it reported more than 100 million connected customers and 154 million active consents. The UK leads on payment-initiation maturity and ecosystem economics; India's Account Aggregator framework leads on architectural distinctiveness and raw scale of accounts enabled.

How long does it take to become a licensed AISP or PISP?

It varies by regulator and by the quality of the application, but multi-quarter timelines are the norm rather than the exception, and the obligations do not stop at authorisation — ongoing regulatory reporting, governance and capital requirements continue for as long as the licence is held. Most companies whose use case can be served through an aggregator's licence should use one, and revisit the question only when regulatory standing becomes part of what they are selling.

14. Glossary

AISP

Account Information Service Provider — a licensed entity authorised to read account data.

PISP

Payment Initiation Service Provider — a licensed entity authorised to initiate payments directly from an account.

TPP

Third-Party Provider — umbrella regulatory term for AISPs, PISPs and similar licensed data/payment intermediaries.

ASPSP

Account Servicing Payment Service Provider — the institution (typically a bank) that holds the account and exposes the API.

FISP

Financial Information Service Provider — the new regulated category the EU's proposed FiDA would create for firms accessing non-payment financial data.

A2A Payments

Account-to-account payments — funds move directly between bank accounts, bypassing card networks.

VRP

Variable Recurring Payment — a UK open banking mechanism for authorising recurring payments of variable amounts, such as subscriptions or bill pay.

BaaS

Banking-as-a-Service — licensed banking infrastructure offered to non-bank companies so they can embed financial products.

Embedded Finance

Financial products (accounts, cards, lending) offered inside a non-financial company's product experience.

Cash-Flow Underwriting

Credit risk assessment based on actual bank transaction history rather than solely on credit bureau data.

Screen Scraping

The legacy method of data access in which a third party logs into a bank's site using the user's own credentials to extract data — being replaced by API access, but still widespread in markets without a live framework.

SCA

Strong Customer Authentication — a regulatory requirement (notably under PSD2) for multi-factor authentication on payments and account access.

FDX

Financial Data Exchange — the nonprofit body maintaining the dominant voluntary open finance API standard in the United States, CFPB-recognised as a standard-setting body since January 2025.

FiDA

Financial Data Access Regulation — the EU's proposed extension of open-banking-style rules to investments, insurance, mortgages and pensions, still in trilogue as of 2026.

PSD2 / PSD3 / PSR

The EU's Payment Services Directives and the new directly applicable Payment Services Regulation that together define payment-account data access and payment initiation.

Consumer Data Right (CDR)

Australia's cross-sector data-portability and open banking framework, covering banking, energy and non-bank lending.

Account Aggregator (AA)

India's regulated consent-broker model for routing financial data between institutions without the aggregator itself storing the data.

FIP / FIU

Financial Information Provider and Financial Information User — the data-holder and data-recipient roles in India's Account Aggregator framework.

Section 1033

The provision of the US Dodd-Frank Act (2010) granting consumers rights over their financial data, and the legal basis for the CFPB's Personal Financial Data Rights rule.

Smart Data

The UK's cross-sector framework generalising consent-based data portability beyond financial services into energy, telecoms and transport.

Sources

Every figure on this page is attributed to its original source and dated, so you can judge it yourself. Where a claim could not be traced to a primary or clearly identified source, it was left off the page rather than estimated. Regulatory status in this sector moves fast — verify current compliance dates against the relevant regulator's own publications before making commitments tied to specific deadlines.

• Open Banking Limited & EY (2025–2026) UK adoption data (16.5m user connections, 351m payments in 2025, 24.0bn API calls), the one-billion-payments milestone, and the £43bn / £8.3bn / £7.4bn economic impact analysis. 2025 year in review (Jan 2026) · EY economic analysis (Mar 2026) · Impact Report 7 (May 2025)
• Financial Conduct Authority / JROC (2025–2026) The UK open finance roadmap published 14 April 2026, its 2026–2030 phasing and priority use cases; and the design of the Future Entity succeeding Open Banking Limited. Open finance roadmap · FS25/4: Design of the Future Entity
• Consumer Financial Protection Bureau (2024–2025) The Personal Financial Data Rights final rule of 22 October 2024 and its tiered compliance dates; the August 2025 reconsideration ANPR; and the January 2025 recognition of FDX as a standard-setting body. Final rule (Federal Register) · Reconsideration rulemaking · ANPR (90 FR 40986) · FDX recognition order
• European Commission, Parliament & Council (2023–2026) The June 2023 financial data access and payments package, the FiDA proposal COM(2023)360, the Council general approach of December 2024, and the PSD3/PSR legislative progress including the 27 November 2025 provisional agreement. Commission: framework for financial data access · FiDA proposal (EUR-Lex) · Council general approach · EP legislative train: payment services
• Open Finance Brasil / Banco Central do Brasil (2023–2026) Brazilian scale figures — 100m+ connected customers, 154m active consents, 143% growth in unique consents 2024–2025, 5bn+ weekly inter-institution communications — as reported by the scheme's citizen dashboard in February 2026, and the Central Bank's own phase reporting. Open Finance Brasil · Banco Central do Brasil · Finsiders Brasil (Feb 2026)
• ACCC, Australian Treasury & Australian Banking Association (2024–2026) CDR adoption (~1.3m users, +135% YoY), non-bank lender obligation dates, the 2024 CDR reset, and the industry-commissioned strategic review reporting ~A$1.5bn of bank investment against 0.31% adoption at end-2023. Note the A$1.5bn and 0.31% figures come from a banking-industry review and should be read as an interested party's estimate. ACCC: non-bank lenders join CDR (Jul 2026) · CDR rollout timeline · Treasury: CDR compliance costs review · ABA CDR Strategic Review (Jul 2024)
• Sahamati / Reserve Bank of India (2026) Account Aggregator ecosystem statistics — 2.88bn+ accounts enabled, 493m+ consent requests fulfilled, 295m+ monthly data shares, 1,117 live entities, ₹1.6 lakh crore of loans facilitated — and the RBI's recognition of Sahamati as the ecosystem's Self-Regulatory Organisation. Sahamati ecosystem dashboard · RBI SRO recognition
• Government of Canada (2026) The Consumer-Driven Banking Act (Royal Assent March 2026), the Bank of Canada's supervisory role, Phase One read-only scope, and the estimate that ~9 million Canadians share banking credentials via screen scraping. Canada Gazette Part I: Consumer-Driven Banking Regulations (27 Jun 2026) · Department of Finance: consumer-driven banking framework
• Juniper Research (2025) Global forecasts: open banking users rising from 183m (2025) to 645m+ (2029), and API call volumes from 137bn to 720bn over the same period. These are analyst models, not measurements, published February 2025 and built on regulatory timelines that have since slipped in at least two major markets. API call volume forecast · User number forecast
• Plaid privacy litigation (2021–2022) The $58m class action settlement granted final approval in July 2022 in the US District Court for the Northern District of California, the allegations regarding bank-lookalike login screens, and the injunctive relief requiring data deletion and minimisation. Final approval (Lieff Cabraser) · Settlement administration site
• Aggregator M&A (2020–2022) Visa's abandoned $5.3bn Plaid acquisition following the DOJ's antitrust suit, Visa's completed €1.8bn acquisition of Tink in March 2022, and Mastercard's $825m acquisition of Finicity announced June 2020. DOJ Antitrust Division: Visa/Plaid · Visa completes Tink acquisition · Mastercard to acquire Finicity
• Monetary Authority of Singapore SGFinDex, the national-digital-identity-based financial data exchange, and its participating institutions. MAS: SGFinDex
• Mint shutdown (2023–2024) Intuit's discontinuation of Mint on 1 January 2024 and the migration of users toward Credit Karma; the ~3.6m active user figure is as reported contemporaneously. CNBC

A note on what these numbers are. Figures reported by scheme operators and regulators — the UK, Brazilian, Indian, Australian and Canadian data above — are measurements of their own ecosystems, and are as reliable as the operator's methodology. Figures from Juniper Research and EY are models: forecasts and impact estimates, useful for order-of-magnitude reasoning and nothing more precise. The Australian A$1.5bn investment figure comes from a review commissioned by the banking industry, which had an interest in the conclusion, and is labelled as such where it appears. The build-vs-buy framework in section 10 and the metrics in section 11 are editorial judgement rather than industry standards, and are labelled as such. Company listings reflect publicly reported activity at time of writing and change frequently — verify current licensing and ownership status directly.