For most of the past decade, open banking meant one thing: regulated access to current-account data and payment initiation through standardised APIs. That definition is now too narrow. Policy makers in Europe, the UK, Brazil, India and Australia are extending data-sharing rights to savings, credit, investments, pensions and insurance, while the United States is rewriting its own rule from scratch. The direction of travel is towards open finance. The pace, and the commercial terms, differ sharply by market.
The prize is large. McKinsey Global Institute has estimated that broad adoption of open financial data could add about 1 to 1.5% to GDP by 2030 in the EU, the UK and the US, and as much as 4 to 5% in India, through better credit decisions, lower friction and stronger fraud protection12. For banks, the question is not whether that value exists but how much of it they capture, and at what cost to their own economics.
Where the rules actually stand
European Union. The Parliament and Council reached a provisional agreement on the third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) on 27 November 20252. The Parliament's economic affairs committee approved the agreed texts on 5 May 2026, but as of August 2026 the package still awaited formal adoption by both institutions and publication in the Official Journal1. The PSR will require banks to share payment account data with authorised providers on non-discriminatory terms and give users dashboards to manage their permissions2. The broader Financial Data Access regulation (FIDA) has had a harder road: trilogues stalled in June 2025, and in April 2026 the Commission circulated revised proposals to restart talks, narrowing scope, shortening historical data look-back and phasing roll-out over roughly four years3.
United Kingdom. The Data (Use and Access) Act 2025 gives the government powers to create sector-specific Smart Data schemes and to put open banking on a statutory footing, with the FCA as lead regulator and an open finance roadmap covering savings, pensions, investments and insurance13. Usage keeps climbing. Open Banking Limited reported the ecosystem passed one billion cumulative payments in July 2026, with 40.16 million payments and 2.81 billion API calls in June alone, and variable recurring payments up 6.7% month on month8.
United States. The CFPB finalised its Section 1033 personal financial data rights rule in October 2024, but a federal district court in Kentucky has enjoined the Bureau from enforcing it, so the first compliance date of 1 April 2026 passed without effect4. The CFPB issued an advance notice of proposed rulemaking in August 2025 and, on 6 August 2026, sent a reconsideration proposal to the Office of Information and Regulatory Affairs for review. The central open question is whether banks may charge third parties reasonable fees for access, which the 2024 rule prohibited5.
Brazil, India and Australia. Brazil's central-bank-led Open Finance programme has reached 128 million active consents, according to a January 2026 industry report9. India's consent-based Account Aggregator network has processed more than 45 crore (450 million) cumulative consents and facilitated nearly 3.8 crore financial services in FY2610. Australia's Consumer Data Right is smaller, at about 1.2 million active users, and is extending to non-bank lenders from the second half of 202611.
Open finance is live almost everywhere, but legally settled almost nowhere
Status of major data-sharing regimes, September 2026
| Market | Regime | Status | Scale indicator |
|---|---|---|---|
| EU | PSD3 / PSR | Provisionally agreed Nov 2025; formal adoption pending12 | n/a |
| EU | FIDA | Trilogue restarted on narrower scope; ~4-year phased roll-out proposed3 | n/a |
| UK | Open banking / Smart Data | Statutory footing via Data (Use and Access) Act 2025; FCA lead13 | 1bn+ cumulative payments; 40.16m in June 20268 |
| US | CFPB §1033 | Final rule enjoined; reconsideration proposal at OIRA since Aug 202645 | n/a |
| Brazil | Open Finance | Live, central-bank-led9 | 128m active consents9 |
| India | Account Aggregator | Live, consent-based10 | 45 crore+ cumulative consents10 |
| Australia | Consumer Data Right | Live; non-bank lending from H2 202611 | ~1.2m active users11 |
Note: Sources are cited per cell; statuses reflect the latest public information available at the end of September 2026.
Source: European Parliament, “Revision of EU rules on payment services (Legislative Train Schedule)” (2026)
The economics: from free pipes to priced access
The most consequential development of the past year did not come from a regulator. In July 2025 an internal memo at one of the largest US banks, reported by CNBC, showed that aggregators had sent it 1.89 billion data requests in June, and that only 13% were initiated by a customer in the moment; the rest were background or recurring pulls6. The bank went on to agree paid data-access terms with aggregators, including Plaid, which serves more than 7,000 companies, while fintech trade bodies argued that such fees are unlawful7.
Most data traffic is not driven by the customer
Aggregator data requests received by a large US bank in June 2025 (total 1.89 billion), % (%)
Source: CNBC, “Large US bank says fintech data aggregators are 'massively taxing' its systems” (2025)
The episode exposes the real cost structure of open banking. Banks bear the infrastructure, security and fraud-liability burden; third parties capture much of the customer relationship. Where regulators prohibit fees, banks have little incentive to invest beyond the minimum. Where fees are allowed, they risk becoming a toll that stifles competition. The US reconsideration, and the EU's insistence on non-discriminatory access in the PSR, will set the terms for years.
Our view: open finance will not be won on API compliance. It will be won by the banks that know, at call level, what data sharing costs them and what it earns them.
What this means for bank strategy
Three strategic postures are emerging. Minimal compliers meet the letter of each regime and treat third-party traffic as cost. Platform operators run data access as a product, with service levels, tiered pricing where permitted and premium APIs beyond the mandated scope. Aggregators of others' data use inbound consents to underwrite, advise and cross-sell, becoming the third party themselves. Brazil and India suggest the third posture is where much of the value sits: consented data from other institutions is now routinely used for income verification and lending decisions10.
- Know your traffic. Meter every inbound call by consent, purpose, third party and cost to serve; the large-bank data showed how little of it may be customer-driven6.
- Price and contract where the law allows. Build commercial frameworks now, so the bank is ready whichever way the US fee question and EU implementing rules land.
- Consume, not just provide. Use inbound open finance data in underwriting, affordability and onboarding, where the benefit to the bank is direct.
- Prepare for scope creep. Savings, mortgages, pensions and insurance data will follow payments; data models and consent management need to span products, not just current accounts.
The legal detail will keep shifting through 2027. The strategic question will not: in a world where customer data moves freely, advantage goes to institutions that make the best use of data, whoever originally held it.