Open banking payments explained: UK and EU rules

An open banking payment is a bank transfer that a licensed payment initiation service provider (PISP) starts on the customer's behalf: the customer picks their bank, approves the payment in their banking app, and the money goes straight from their account to the merchant's, with no card scheme involved. In the EU and UK this rests on the second Payment Services Directive (PSD2), transposed in the UK by the Payment Services Regulations 2017, and in the UK it was pushed further by a 2017 Competition and Markets Authority (CMA) Order requiring the nine largest banks to build standard APIs.

Open banking also covers account information services (AISPs), which read account data with consent but do not move money. This guide explains both, the rules behind them and how the UK and EU approaches differ.

Key dates

All checked 3 November 2026.

The parties and their legal definitions

Payment initiation and account information are payment services number 7 and 8 in Annex I of PSD2. In the UK, the FCA describes the Payment Services Regulations 2017 as bringing these services under regulation "for the first time".

How an open banking payment works

1. Checkout. The shopper chooses "pay by bank" and selects their bank.
2. Consent. The PISP shows the payment details (amount, payee, reference) and the shopper agrees.
3. Redirect and authentication. The shopper is sent to their bank's app or website and authenticates there, using strong customer authentication.
4. Initiation. The PISP sends the payment order to the bank through the bank's dedicated interface (API).
5. Execution. The bank sends the transfer over the local rails: Faster Payments in the UK, SEPA credit transfer or SEPA Instant in the euro area.
6. Confirmation. The PISP tells the merchant the payment has been initiated, and the merchant releases the goods.

The PISP does not need to hold the money. The FCA notes that firms providing only payment initiation or account information, without receiving customer funds, are not subject to the safeguarding requirement. Because no card is used, there is no interchange or card scheme fee. Refunds and disputes work differently from cards; see how card payments work for the card side.

Licensing: PISPs and AISPs

Source: FCA, "Account information services (AIS) and payment initiation services (PIS)", last updated 17 September 2024.

In the EU the same categories apply under each member state's PSD2 law, with authorisation or registration by the national authority. To check whether a provider is authorised, see our step-by-step guide on how to check a financial licence. The FCA's consumer guidance adds that a firm must be both authorised or registered and have permission for the specific service; otherwise customers may lose access to the Financial Ombudsman Service or the FSCS.

Strong customer authentication and bank APIs

PSD2 defines strong customer authentication as authentication that uses at least two independent elements from three categories: knowledge, possession and inherence (Article 4(30)). The regulatory technical standards in Delegated Regulation (EU) 2018/389 set out how SCA works and how banks must give licensed third parties secure access. The European Commission states these apply from 14 September 2019.

In its June 2018 opinion, the EBA said the bank (ASPSP) applies SCA and decides whether an exemption is used. It also said banks should not check the consent a customer has given to an AISP, PISP or CBPII, and that every SCA method the bank offers its customers must also work when the customer comes through a third party's API.

The UK model: the CMA Order and Open Banking Limited

The UK went further than PSD2. After its retail banking market investigation reported in 2016, the CMA issued the Retail Banking Market Investigation Order 2017. It required the nine largest banks and building societies in Great Britain and Northern Ireland (known as the CMA9) to adopt common open banking standards.

Open Banking Limited (OBL) maintains the Open Banking Standard (API specifications, customer experience guidelines and operational guidelines), the Open Banking Directory and a conformance service. The CMA confirmed in September 2024 that the CMA9 had completed the final Roadmap. In a February 2026 article, OBL said the long-term regulatory framework was still pending, that the CMA Order is expected to be revoked eventually, and that the Data (Use and Access) Act had become law. HM Treasury, the CMA, the FCA and the PSR have also issued a joint regulatory statement on the future of open banking and its extension into open finance.

Variable recurring payments

A variable recurring payment (VRP) lets a customer give a PISP a standing permission to make a series of payments within agreed limits, rather than approving each one. OBL's monthly CMA9 data reports "sweeping" VRPs (sVRPs) as a separate line. OBL said in February 2026 that the UK Payments Initiative (UKPI) had been incorporated to run commercial VRPs as a national scheme, describing it as the first new payment system since Faster Payments in 2008.

UK usage figures

The 2025 and 2026 figures use different bases (the June 2026 data covers the CMA9 only), so they should not be compared line by line.

The EU model: PSD2 plus market standards

The EU did not mandate a single API standard. Banks must provide access, but the technical format is left to the market. The Berlin Group's NextGenPSD2 Access to Accounts framework, published as version 1.0 in February 2018, is one such standard. It covers account information, payment initiation and the payment instrument issuer service (PIIS), and uses RESTful and JSON standards with ISO 20022 data elements. The Berlin Group said its public consultation drew about 1,000 comments from 59 organisations, and that its aim was to reduce the complexity caused by several competing standards.

Instant payments as the rail

Open banking payments in the euro area are only as fast as the transfer behind them. The SEPA Instant Credit Transfer scheme has run since November 2017, with a 10-second maximum execution time in its rulebook. Regulation (EU) 2024/886, in force since April 2024, required banks in the euro area (the first group it covers) to be able to receive instant euro payments by 9 January 2025 and to send them by 9 October 2025. According to the Austrian central bank (OeNB), from that second date providers must also offer verification of payee (checking the payee's name against the IBAN), and may not charge more for instant transfers than for standard ones.

What comes next

The EU is replacing PSD2 with a new directive and a directly applicable Payment Services Regulation. For the current status, see our explainer on PSD3 and the PSR.

Who uses open banking payments

Common uses include e-commerce checkout ("pay by bank"), bill payments and account top-ups. Our company profiles, including Trustly and GoCardless, set out each provider's licences and products, and our Wise vs Revolut comparison covers two account providers side by side. For how bank payments compare with wallets, BNPL and local schemes, see alternative payment methods explained. More in the open banking hub.

Frequently asked questions

What is an open banking payment?

An open banking payment is a bank transfer that a licensed payment initiation service provider (PISP) starts on the customer's behalf. The customer picks their bank, approves the payment in their banking app, and the money goes straight from their account to the merchant's, with no card scheme involved.

What is the difference between a PISP and an AISP?

A PISP initiates a payment order at the user's request from an account held elsewhere. An AISP reads account data with consent and provides consolidated account information, but does not move money. In the UK a PISP needs FCA authorisation, while a firm offering only account information registers with the FCA as a RAISP.

Are there card fees on open banking payments?

No interchange or card scheme fee applies, because no card is used. Refunds and disputes also work differently from cards; see how card payments work for the card side.

What is a variable recurring payment?

A variable recurring payment (VRP) lets a customer give a PISP a standing permission to make a series of payments within agreed limits, rather than approving each one. OBL said in February 2026 that the UK Payments Initiative had been incorporated to run commercial VRPs as a national scheme.

What is the CMA Order on open banking?

The CMA's Retail Banking Market Investigation Order 2017 required the nine largest banks and building societies in Great Britain and Northern Ireland, known as the CMA9, to adopt common open banking standards. The CMA confirmed in September 2024 that the CMA9 had completed the final Roadmap.

How many people use open banking in the UK?

Open Banking Limited reported 13.3 million active open banking users, consumers and small businesses, in March 2025. Its CMA9 data shows 40.16 million total payments in June 2026 and more than 1 billion cumulative open banking payments to July 2026.

Key terms

• AISP: account information service provider; reads account data with consent.
• ASPSP: account servicing payment service provider; the bank or institution holding the account.
• CBPII: card-based payment instrument issuer; can request confirmation of available funds.
• CMA9: the nine UK banking groups covered by the CMA's 2017 Order.
• PISP: payment initiation service provider; starts a payment from the customer's account on their instruction.
• RAISP: registered account information service provider (UK).
• SCA: strong customer authentication; two or more independent factors.
• VRP: variable recurring payment; a standing permission for a PISP to make payments within limits.
• XS2A: access to account; the PSD2 right of licensed third parties to reach payment accounts.