Open banking, PSD2, and payment APIs
How customers let regulated third parties see their accounts or start payments through consented, authenticated bank APIs instead of screen-scraping.
IN ONE LINE
Imagine your bank account is a locked room, and only you hold the key.
For years, if you wanted a budgeting app to see what was inside, you handed it your key and let it walk in pretending to be you.
That is roughly what screen-scraping did: the app logged in with your password and copied whatever it could see.
It worked, but nobody could tell the app apart from you, and your password was now in someone else's hands.
Open banking replaces that arrangement.
Instead of handing over your key, you tell the bank at the door: this named, licensed helper may look at my balance, or may start one specific payment, and nothing more.
The bank checks it is really you asking, lets the helper in through a proper side entrance, and keeps a record.
You can withdraw permission whenever you like.
The helper never learns your password, and the bank always knows exactly who came in and what they were allowed to do.
WHAT IT ACTUALLY IS
Open banking is a way for a customer to let a regulated outside firm either read their account information or start a payment on their behalf, using a controlled connection the bank provides.
Two services sit at its heart.
Payment initiation lets a trusted app tell your bank to send a payment straight from your account, so an online shop can be paid directly rather than through a card.
Account information lets an app read your balances and transactions, for example to show all your accounts in one place.
Both rest on your explicit consent: you decide who is allowed, for what, and for how long.
The connections use application programming interfaces (APIs), which are agreed, structured doorways that let one system ask another for something in a predictable way.
Because the bank builds these doorways, it can identify the outside firm, confirm it is you approving, and log every request.
This is safer and clearer than the older habit of sharing your login and letting software copy your screen.
HOW IT WORKS
In the European Union, open banking was mandated by PSD2 (the Second Payment Services Directive).
PSD2 requires banks to open access to accounts, with customer consent, to licensed outside firms called third-party providers (TPPs).
A TPP comes in two flavours.
A payment initiation service provider starts payments from the customer's account.
An account information service provider reads account data to offer aggregation or insight.
Both must be authorized by a regulator and must connect through the bank's regulated interface, not by impersonating the customer.
PSD2 also requires strong customer authentication (SCA): confirming the payer with at least two independent factors, drawn from something they know, something they have, and something they are, so that stealing one factor is not enough.
A successor framework, often called PSD3, is under development to refine these rules.
Together, licensing, consent, APIs, and SCA turn account access into something a bank can supervise rather than something that happens behind its back.
THE WORDS
- Open banking
- A model where customers let regulated third parties access account data or initiate payments on their behalf through standardized APIs.
- PSD2 (Second Payment Services Directive)
- The EU directive that regulates payment services and mandates open banking access for licensed third-party providers with customer consent.
READ FIRST
CONNECTED TO
SOURCES
- PSD2 and the RTS on strong customer authentication and secure communication — European Banking Authority
- Payments Signal editorial teaching models — Payments Signal
Derived from Open banking, PSD2, and payment APIs. Every claim on this card is sourced on that page.