Open-banking payment vs card payment
Two ways to pay a merchant online. An open-banking payment initiation asks the payer's own bank to send a bank-to-bank credit transfer on the payer's consent; a card payment presents a card credential that runs through the acquirer, network, and issuer. They differ in who holds credentials, how finality and disputes work, and which rails settle.
| DIMENSION | Open-banking payment | Card payment |
|---|---|---|
| Who moves the money | The payer's own bank (the ASPSP), on the payer's consent. A PISP initiates but never holds the funds. | The issuer authorises and the acquirer collects, with the card network routing between them; several intermediaries sit in the flow. |
| Credentials the merchant handles | None to store. The payer authenticates directly with their bank, so no card number or token sits with the merchant. | A card credential or device token, which brings storage, tokenisation, and PCI DSS scope considerations for the merchant. |
| Authentication | Strong customer authentication happens at the payer's bank — a redirect to the bank app or a decoupled push — before the debit. | Strong customer authentication is applied through the card flow, often via 3-D Secure, and exemptions may remove the challenge. |
| Finality and disputesThis is the trade-off that most changes the payer's protection. | Settles as a normal credit transfer, which is push-based and hard to reverse; there is no card-style chargeback, so refunds are a separate outbound payment. | Carries the card scheme's chargeback and dispute rights, so a payer can dispute a charge and have it reversed under scheme rules. |
| Rails and settlement | A SEPA credit transfer in the euro area, clearing and settling like any other transfer on its own timing. | The card scheme's clearing and settlement cycle, with interchange and scheme fees. |
Sources for this comparison3
- Official requirement
PSD2 and the RTS on strong customer authentication and secure communication ↗ — European Banking Authority · RTS on SCA and secure communication; PISP access to the account
Referenced from the European Banking Authority's public summaries, guidelines, and technical standards on payment services.
- Scheme-specific rule2025 version 1.1 (EPC125-05)
2025 SEPA Credit Transfer rulebook ↗ — European Payments Council · SEPA credit transfer settlement leg
Version 1.1 replaced version 1.0 at publication on 5 October 2025 and is stated to remain in effect up to 21 November 2027. It moves the date from which the unstructured address format is no longer permitted to 15 November 2026.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal
What this simplifies: Shows one single, consented open-banking payment against a straightforward card authorisation. Real deployments add recurring and variable payments, differing bank authentication journeys, and exemption logic. Exact SCA thresholds are not quoted, and the cast is synthetic.
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.