What is open banking, and how does sharing your bank data work?
Open banking lets you tell your bank to share your account data with another app, or to let that app start a payment for you. It began as a competition fix in Europe and is still being worked out in the U.S.
The short answer
Open banking lets you have your bank share your data with another regulated app, or let it start a payment, only with your consent. The EU made it law through PSD2, the UK imposed it on its biggest banks in 2017 and the U.S. adopted a disputed rule in 2024.
Key takeaways
- Open banking covers two main services: reading your account information, and starting a payment from your account at your request1.
- In the EU, the PSD2 directive (adopted 2015, applied from January 2018) created these services and requires your explicit consent1.
- In the UK, a 2017 order from the Competition and Markets Authority made the nine largest banking providers open up customer data through secure, standard connections23.
- In the U.S., the CFPB finalized a personal financial data rights rule in October 2024, but it is being reconsidered and its compliance dates have been pushed back by court order45.
- Only connect regulated providers, and review which apps still have access to your accounts.
What does open banking actually mean?
Your bank holds a detailed record of your financial life: balances, payments in and out, regular bills. Without open banking, that record mostly stays with your bank. Open banking changes that by letting you decide to share it with another provider, such as a budgeting app, a lender or a payment service.
European law set out the two building blocks. An account information service gives you combined information about one or more of your payment accounts, even if they sit at different banks. A payment initiation service starts a payment from your account at your request1. In both cases, the provider needs your explicit consent before it can act1.
The two core open banking services under EU law
| Account information | Payment initiation | |
|---|---|---|
| What it does | Reads balances and transactions you choose to share | Starts a payment from your account when you ask |
| Typical use | Budgeting apps, loan affordability checks | Paying a merchant or a bill straight from your bank account |
| Key legal limit | Cannot use your data for any other purpose1 | Cannot hold your money at any point in the payment1 |
| Needs your consent? | Yes, explicit consent1 | Yes, explicit consent1 |
How does an open banking connection work in practice?
The design principle is that you prove who you are to your own bank, not to the app. The app sends you to your bank, your bank checks it is really you, and you approve exactly what is being shared or paid. PSD2 requires strong customer authentication, a tougher login than a password alone, when you access your account online or start an electronic payment1.
Figure · Connecting an app through open banking
- 01You choose an appand pick your bank
- 02Your bankchecks it is you
- 03You approvedata or payment
- 04App gets accessonly what you allowed
A typical first connection
- 1
Start in the app
Choose to link a bank account and select your bank from the list.
- 2
Get passed to your bank
You are redirected to your bank's own app or website, not a lookalike form inside the third-party app.
- 3
Authenticate and review
Log in with your bank's usual checks, then read which accounts and data, or which payment, you are approving.
- 4
Confirm and return
Approve the request. The app receives the data or confirmation through a secure connection.
Where did open banking come from?
Europe and the UK moved first, by different routes: the EU through payments law, the UK through a competition investigation. The U.S. came later and is still settling its approach.
Figure · Key open banking milestones
- Nov 2015EU adopts PSD2
- Feb 2017UK CMA order published
- Jan 2018PSD2 applies
- Oct 2024U.S. CFPB final rule
- Aug 2025CFPB reopens the rule
European Union. The second Payment Services Directive, Directive (EU) 2015/2366, was adopted on 25 November 2015 and applied from 13 January 20181. It brought account information and payment initiation services under EU payment rules, including duties on consent, security and data use1.
United Kingdom. The Competition and Markets Authority published its Retail Banking Market Investigation Order on 2 February 2017, setting a timetable for remedies including open banking to address competition problems in personal and small-business current accounts2. The order made the nine largest retail banking providers, known as the CMA9, open up customer data using secure data protocols and set up an independent Open Banking Implementation Entity3. In January 2023 the CMA said the six largest providers had implemented all of the roadmap's requirements and that open banking had over 6 million active users3.
What is the U.S. rule on sharing financial data, and is it in force?
The U.S. route runs through section 1033 of the Consumer Financial Protection Act of 20104. On October 22, 2024, the Consumer Financial Protection Bureau (CFPB) finalized its Personal Financial Data Rights rule, which requires data providers to make data about covered financial products available electronically to consumers and to third parties they authorize4.
The rule has not settled. A bank and two trade associations challenged it in federal court in Kentucky, and in July 2025 the court paused the case after the CFPB said it would reexamine the rule5. The original compliance dates ran from April 1, 2026 for the largest providers to April 1, 2030 for the smallest, and a court order pushed them back by 90 days5. On August 22, 2025, the CFPB asked for public comment on four questions: who counts as a consumer's representative, whether providers may charge fees, data security and data privacy4. Its regulatory agenda, published on 14 August 2026, still lists a rulemaking to reconsider parts of the 2024 rule6.
Note
Status can change quickly
This section reflects official documents up to the CFPB's August 2026 regulatory agenda. Before relying on any date, check the CFPB's own page on personal financial data rights for the latest position.
For the regulators involved on each side of the Atlantic, see our Policy section.
Is open banking safe to use?
Open banking comes with legal safeguards, but it is not risk-free. Under EU law, providers must get your explicit consent and must not reuse your data for unrelated purposes, and payment initiators may not hold your money1. The risks are mostly about who you connect and what you approve.
Figure · What helps and what to watch
Built-in safeguards
- Explicit consent for each service
- Strong checks by your own bank
- Data use limited to the service
Still your job
- Check the provider is authorized
- Read what you are approving
- Remove apps you no longer use
Risk warning
Protect your login and your money
Never type your online banking password into a form inside a third-party app or website. A standard open banking connection sends you to your own bank to log in. Be wary of any app that promises loans or returns in exchange for access to your account, and check the provider on the regulator's register first, as explained in our guide on checking a regulated firm.
What mistakes do beginners make with open banking?
Common beginner mistakes
Approving without reading
The consent screen lists which accounts and data you are sharing. Untick accounts the app does not need.
Forgetting old connections
Access you granted to an app you no longer use may still be live. Check your bank's and the app's settings for connected accounts and remove the ones you do not need.
Mixing up open banking and crypto
Open banking connects ordinary bank accounts. It has nothing to do with blockchains or tokens, despite similar-sounding marketing.
Assuming the rules are the same everywhere
EU and UK rules are in force; the U.S. rule is under reconsideration4. Protection depends on where you and the provider are.
Frequently asked questions
Can an open banking app move my money without asking?
Who were the CMA9?
The nine largest UK retail banking providers named in the 2017 order: Allied Irish Bank, Bank of Ireland, Barclays, Danske Bank (Northern Bank), HSBC, Lloyds, Nationwide, NatWest and Santander3.
Can an app sell the data I share through open banking?
Does open banking cost me anything?
Any charges are set by each provider, so read the app's terms before you connect. Whether U.S. data providers may charge fees is one of the questions in the CFPB's 2025 notice4.
How is open banking related to neobanks?
They are different things. A neobank is an app-based bank or banking service; open banking is a way of sharing data between providers. See our neobanks explainer.
The bottom line
Open banking puts you in charge of who sees your bank data and who can start payments from your account. In the EU and UK it rests on binding rules about consent, authentication and data use; in the U.S. the framework is still being reworked. Use it with regulated providers, read every consent screen and prune old connections.
Sources
- Directive (EU) 2015/2366 on payment services in the internal market (PSD2) — EUR-Lex, European Union, 2015 Primary source
- Retail banking market investigation order 2017 — Competition and Markets Authority, GOV.UK, 2017 Primary source
- Millions of customers benefit as Open Banking reaches milestone — Competition and Markets Authority, GOV.UK, 2023 Primary source
- Required Rulemaking on Personal Financial Data Rights — Consumer Financial Protection Bureau Primary source
- Personal Financial Data Rights Reconsideration (advance notice of proposed rulemaking) — Federal Register, Consumer Financial Protection Bureau, 2025 Primary source
- Regulatory Agenda (2026 Unified Agenda) — Consumer Financial Protection Bureau (Federal Register), 2026 Primary source
How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.
Read next
Fintech · ExplainerWhat is a neobank, and is your money protected in one?A neobank looks like a bank on your phone, but behind the app it may or may not be one. Who actually holds your money decides whether deposit insurance protects it, and how quickly you could get it back if something breaks.
Fintech · ExplainerWhat is fintech, and how does it change the way money moves?Fintech is the umbrella word for the apps, software and new firms that handle money with technology. Knowing what sits behind the app on your phone tells you who is actually holding your money and which protections apply.
Fintech · ExplainerWhat are real-time payments, and how do they move money in seconds?In a growing number of countries, money can leave one bank account and be usable in another a few seconds later, at any hour. Here is how these systems work, where they came from and why an instant payment needs extra care.
Policy · ExplainerHow do you check whether a financial or crypto firm is regulated?A licence number in a website footer proves nothing until you check it yourself. Official registers are free, public and take a few minutes. Here is which one to use and what to look for.
Fintech · ExplainerWhat are embedded finance and banking as a service, and who holds your money?More and more apps that are not banks now offer accounts, cards and loans. Behind most of them is a licensed bank you may never have heard of, and the way the pieces connect decides how safe your money is.