The Open Banking Directory is the central register that lets banks and providers trust each other without vetting one another individually. It enrols participants and issues the identifiers and certificates they use to prove who they are and to secure messages. Your provider holds and manages all of this, so you never obtain a certificate yourself.
The Directory
For open banking to work, a bank needs to know that a provider asking for access is genuine, and a provider needs to know it is talking to a real bank. The Directory solves this centrally: it enrols participants, records who they are, and issues the credentials they present to each other. When a provider registers with a bank or makes a call, the bank can check the Directory rather than trusting the provider on its word. This is the backbone behind dynamic client registration.
Certificates
Trust is carried by certificates, which do two jobs: identifying a party and securing or sealing messages. The main types you will hear named are:
| Type | What it does |
|---|---|
| QWAC | A qualified website authentication certificate: secures and identifies the transport connection between parties. |
| QSeal | A qualified electronic seal certificate: signs and seals messages so their origin and integrity can be verified. |
| OB-issued | Certificates issued through the Open Banking Directory, used within the UK ecosystem. |
The eIDAS framework underpins the qualified certificate types. Since the UK left the EU, the exact mix of eIDAS and Open Banking-issued certificates has its own current position, so when it matters, confirm the up-to-date certificate policy rather than assuming. In all cases, these are obtained and rotated by your provider, and the reason to understand them is to ask a provider how they manage certificate lifecycle, because an expired certificate is a common cause of outages.
Technical Service Providers
Not every firm in the chain is the regulated party. A Technical Service Provider (TSP) supplies technology, integration and infrastructure to a regulated provider, without holding the regulatory permissions itself. This is a normal and useful separation: the TSP does the heavy engineering, the authorised provider holds the AIS or PIS permissions and the regulatory responsibility. When you assess a service, it helps to know which role each named party plays.
How agents appear
An agent operates under an authorised principal's permissions rather than its own, and that relationship is reflected in the regulatory and Directory records. This is a legitimate and common model, but it is one more reason to be clear about whose authorisation a service runs under: a provider should be able to state plainly whether it is the principal or an agent, and name the principal. See choosing a provider and who regulates open banking.
From the data consumer's side
You will not touch the Directory or hold a certificate, but two questions are worth asking a provider: how they manage certificate lifecycle (to avoid expiry-driven outages), and exactly whose authorisation their service runs under (principal or agent, and who the principal is). Clear answers to both are a sign of an operationally mature, transparent provider.
How Credit Canary does it
Credit Canary operates through a regulated principal that holds the Directory enrolment and certificates and manages their lifecycle. Credit Canary provides open banking as an agent of that principal, so the trust framework is handled for you and the regulatory position is clear.
Common questions
What is the Open Banking Directory?
The Open Banking Directory is the central register that lets banks and providers trust each other. It enrols participants, issues the identifiers and certificates they use, and is what a bank checks to confirm a provider is genuine.
What certificates do you need for open banking?
Parties use certificates to identify themselves and sign messages. These include eIDAS-style certificates (QWAC for transport, QSeal for sealing) and Open Banking-issued certificates. Your provider holds and manages these, so you do not obtain them yourself.
What is a Technical Service Provider?
A Technical Service Provider (TSP) supplies technology to a regulated provider without itself being the regulated party. It is a common model: the TSP handles integration while the authorised provider holds the permissions.
How do agents appear in the Directory?
An agent operates under an authorised principal's permissions, and that relationship is reflected in the regulatory and Directory records. Confirm whose authorisation a service runs under when assessing a provider.
Related pages
Primary sources
- Open Banking Standard, Directory technical overview (checked 14 Oct 2026).
- openbanking.org.uk, regulated providers and agents (checked 14 Oct 2026).
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.