Open banking
A framework that lets customers securely share their bank data with, or start payments from, authorized third-party apps without handing over their passwords.
In short
- Access goes through regulated APIs, replacing screen scraping with stored credentials.
- The UK and EU have required it for years. Canada is building its own framework, called consumer-driven banking.
- For finance teams, it powers bank feeds, account verification and pay-by-bank payments.
Open banking gives customers control over their banking data. With the customer's consent, a bank provides account information, such as balances and transactions, to an authorized third party through a secure API, or lets that third party initiate a payment from the customer's account.
How it differs from screen scraping
Before open banking, many apps connected to bank accounts by asking customers for their online banking username and password and logging in on their behalf. Open banking replaces that with token-based access: the customer authenticates with their bank directly, grants specific permissions, and can revoke them at any time.
Where it stands
- United Kingdom: the largest banks were required to open standardized APIs from 2018.
- European Union: the second Payment Services Directive (PSD2) requires banks to provide access to licensed providers.
- Canada: the federal government passed legislation in 2024 to create a consumer-driven banking framework, with the Financial Consumer Agency of Canada overseeing it, and is rolling it out in phases.
- United States: rules have been developed under the Consumer Financial Protection Bureau.
Uses in business finance
Bank feeds into accounting software, instant verification of a supplier's bank account, cash flow forecasting across banks and pay-by-bank payments at checkout all rely on open banking or similar connections. Richer, more reliable transaction data also makes matching receipts and reconciling accounts faster.
Worked example
Verifying a supplier's bank account
During onboarding, a supplier is asked to confirm its bank details through an open banking connection. It logs in to its own bank, approves read-only access to account ownership, and the buyer's system confirms the account name matches the supplier's legal name. No voided cheque is emailed, and the risk of a fraudulent account being entered drops sharply.