Open banking

What it means

Open banking means giving third parties access to bank account data and payment initiation, with the client's consent, through secure interfaces. It was introduced by the PSD2 directive, which required banks to give licensed providers access to clients' accounts through an API.

There are two main types of service. Account information services let an app read balances and transactions, for example to import them into accounting software or provide a financial overview. Payment initiation services let a payment be made directly from the client's account, for example when buying from an online shop without a card.

Providers of these services must be licensed as a payment institution or registered, and they are supervised. Access always requires the client's consent and strong customer authentication, so the third party never receives the client's online banking credentials.

How it works in practice

In accounting, open banking allows bank statements to be imported into accounting software automatically. Transactions load continuously, the system matches them with invoices by payment reference, and the accountant checks only the exceptions. Manual downloading and uploading of statements disappears.

Online shops use payment initiation as an alternative to cards. The customer chooses their bank, confirms the payment in the banking app, and the money leaves their account directly, often as an instant payment. For the merchant this can be cheaper than card fees.

Consent to access account data must be renewed periodically, usually every 180 days, according to the rules of the bank and the provider. A company should track when consent expires so that statement imports do not stop in the middle of the month or before the close.

What to watch out for

Before giving consent, check that the provider is licensed and what data it will read. Consent should be limited to the accounts and purpose needed. Online banking usually offers an overview of consents given and the option to revoke them.

Fraudsters misuse the idea of open banking to create fake pages that look like a bank login. Login details should be entered only in your own bank's app or website, never on a page reached through a link in an unknown email or text message.