The Infrastructure Layer Behind Every Financial Transaction

Open banking is a system in which banks provide licensed third-party providers with access to customer account data and payment functionality through secure APIs, but only with the customer’s explicit consent. It means you can authorise your accounting software to read your business bank transactions directly, or allow a lending platform to assess your financial health based on real transaction data rather than submitted documents. The technical foundation is a set of standardised APIs that banks are required to build and maintain, combined with a licensing framework that ensures only authorised and regulated companies can access the data.

PSD2, which came into full effect in 2019, established the legal framework for open banking in Europe by requiring banks to provide API access to licensed third parties. PSD3, proposed by the European Commission in 2023, builds on this foundation by addressing several shortcomings: it improves API reliability requirements, strengthens fraud prevention rules, harmonises implementation through a directly applicable regulation (the PSR) rather than a directive, and enhances consumer protections around authorisation and consent management. PSD3 also works alongside the proposed FIDA regulation to extend open data principles beyond payment accounts to investments, insurance, and pensions.

A TPP is a company that is licensed by a financial regulator to access bank account data or initiate payments on behalf of customers through open banking APIs. There are two main categories: Account Information Service Providers (AISPs), which can read account and transaction data, and Payment Initiation Service Providers (PISPs), which can initiate payments from a customer’s account. TPPs must be authorised or registered with a national competent authority and are subject to ongoing regulatory requirements including security standards, data protection obligations, and professional indemnity insurance.

Screen scraping involves a third party logging into a bank’s online banking portal using the customer’s credentials and extracting data from the web pages — essentially automating what a human would do manually. This approach is fragile (it breaks when the bank changes its website), insecure (it requires sharing login credentials with a third party), and unreliable. Open banking replaces this with dedicated, standardised APIs that provide structured data in a secure, consent-based framework. The customer never shares their banking credentials; instead, they authorise access through a controlled authentication flow managed by their bank. Open banking is faster, more reliable, and orders of magnitude more secure than screen scraping.

Banking-as-a-Service refers to platforms that allow non-bank companies to offer financial products — accounts, cards, payments, lending — by connecting to a licensed bank’s infrastructure through APIs. While open banking is primarily about data access and payment initiation, BaaS goes further by enabling third parties to embed actual banking products within their own applications. A software company might use BaaS to offer its customers integrated business accounts, or an e-commerce platform might embed lending at checkout. BaaS relies on the same API-first architecture that open banking promotes, and the two ecosystems often share infrastructure providers, but they serve different use cases and are governed by different regulatory frameworks.

Yes. While the EU and UK were among the first to mandate open banking through regulation, the model has spread globally. Australia implemented its Consumer Data Right, which covers banking and is expanding to energy and telecommunications. Brazil launched a comprehensive Open Finance framework covering payment accounts, credit cards, loans, investments, and insurance. India’s Account Aggregator framework enables consent-based data sharing across financial institutions. In the United States, the Consumer Financial Protection Bureau has been developing rules under Section 1033 of the Dodd-Frank Act to establish open banking requirements, though the approach is more market-driven than the European model. Countries in Southeast Asia, the Middle East, and Africa are at various stages of developing their own frameworks.

Our primary readership includes product managers and engineers at fintech companies building on open banking APIs, banking technology leaders evaluating their API strategy and partnership ecosystems, compliance and regulatory affairs professionals tracking PSD2/PSD3/FIDA developments, investors and analysts researching the financial data infrastructure market, and founders building in the embedded finance and BaaS space. We write at a level that assumes familiarity with financial services and technology concepts — our goal is to provide analysis that helps experienced professionals make better decisions, not introductory explainers aimed at a general audience.