Open Banking

Open Banking is a UK framework that lets a customer give a regulated provider secure, read-only access to their bank account data, or permission to initiate a payment, through standardised APIs. The customer is always in control: access is explicit, consent-based, time-limited and revocable. For lenders, it replaces guesswork and paper statements with a verified, real-time view of income and spending.

Where Open Banking came from

Open Banking in the UK grew out of two regulatory interventions: the EU's second Payment Services Directive (PSD2), which required banks to let authorised third parties access account data with consent, and the Competition and Markets Authority's 2016 retail banking order, which required the UK's largest banks to adopt a common API standard. The result is a regulated ecosystem overseen by the FCA, in which providers must be authorised as Account Information Service Providers (AISPs) or Payment Initiation Service Providers (PISPs).

The two core capabilities

• Account Information Services (AIS) — read-only access to balances and transaction history. This is what powers income verification, affordability assessment and categorised spending analysis.
• Payment Initiation Services (PIS) — the ability to initiate an account-to-account payment directly from the customer's bank, the basis for Pay by Bank and for Variable Recurring Payments.

Why lenders use it

A customer's current account is the most honest record of their financial life. Open Banking data lets a lender verify income from genuine credits, evidence real living costs, detect existing credit commitments and spot signs of financial stress — all with the customer's consent and without rekeying or document upload. For thin-file applicants, it is often the difference between a decline and a confident approval, because it scores behaviour rather than the absence of bureau history.

Because the data is categorised and current, it also shortens journeys. Verifying income from a connected account takes seconds, where a request for payslips and statements can add days and cause drop-off.

Consent, security and trust

Open Banking is built on strong customer authentication: the customer authorises access in their own banking app, and the provider never sees login credentials. Consent for ongoing data access is time-limited and must be renewed, and the customer can withdraw it at any time. Providers must be FCA-authorised or operate as an agent of an authorised firm, and are bound by data-protection and conduct rules. That regulated foundation is why Open Banking data is trusted for regulated lending decisions.

Open Banking and affordability

The clearest use of Open Banking in lending is affordability. Instead of relying on a stated income figure and average expenditure, a lender can build an affordability assessment from the customer's actual money in and money out over several months. Combined with bureau and identity data, it produces a decision that is both faster for the customer and more defensible for the lender under Consumer Duty.

Open Banking versus screen scraping

Before Open Banking, some services accessed bank data by “screen scraping” — asking customers for their online banking login and logging in on their behalf. That approach is insecure, fragile and hard to govern. Open Banking replaces it with dedicated, regulated APIs and strong customer authentication, so the customer authorises access in their own banking app and the provider never handles their credentials. For a regulated lending decision, that difference in security and governance matters.

From Open Banking to Open Finance

Open Banking covers payment accounts. The logical extension, often called Open Finance, would apply the same consent-based, API-driven model to a wider range of financial products such as savings, investments, pensions and insurance. The UK is developing the framework and the direction of travel is towards a broader data-sharing economy, but lenders should treat Open Finance as an evolving area rather than a settled set of capabilities.

Practical considerations for lenders

Open Banking is powerful but not universal. Not every customer will consent, and connection quality varies between banks, so a well-designed journey offers a fallback and explains clearly why access is being requested and what it will be used for. Consent is also time-limited: for ongoing monitoring the customer must re-authorise access periodically. Designing for these realities — clear consent, graceful fallback, and respect for the limits of the permission given — is what separates a trustworthy Open Banking journey from one that frustrates customers.