Straight answers to the 30 questions businesses ask most about UK open banking. Each answer stands alone; follow the link for the full explanation.
Last reviewed 15 October 2026.
Open banking is the UK framework that lets an FCA-regulated provider, with a customer's consent, securely read their bank account data or start a payment through standardised APIs. For a business it means verified income, real affordability and account-to-account payments, without handling login details. Read more →
Yes. The customer authenticates with their own bank, so no login is shared; access is read-only unless a payment is separately approved; every provider is FCA-regulated; and access can be withdrawn at any time. It is safer than sharing a password or a statement. Read more →
The CMA created it and mandated the CMA9; the FCA authorises and supervises providers under the Payment Services Regulations 2017; the PSR oversees payment systems; and Open Banking Limited maintains the Standard, now transitioning to a future entity under JROC. Read more →
The customer connects their bank: they choose it, authenticate in the bank's own app or website, and approve exactly what is shared. The bank then releases the agreed data, or makes the payment, to a regulated provider through a secure API. The provider never sees the login. Read more →
AIS, account information services, reads bank data such as balances and transactions. PIS, payment initiation services, starts a payment from the account. They are separate FCA permissions, and one provider can hold both so a single connection can verify and collect. Read more →
An Account Information Service Provider: a firm authorised by the FCA to read a customer's account data on their behalf. It can see balances and transactions but cannot move money. Most businesses use an AISP's service rather than becoming one. Read more →
A Payment Initiation Service Provider: a firm authorised to start a payment from a customer's account once they approve it. The PISP never holds the money; it instructs the customer's bank to make the transfer. Read more →
A one-off check is a single snapshot and the connection ends. Ongoing access can run for up to 90 days before the customer has to reconfirm it, and the customer can set a shorter period or withdraw at any time. Read more →
For continuing account-information access, the customer must reconfirm their consent at least every 90 days, so access does not continue indefinitely. How the reconfirmation is done has evolved under the FCA's rules. Read more →
They can withdraw access in the provider's consent dashboard, or cancel the connected party in their own banking app. Revoking stops further access; data already shared is handled under retention and data protection obligations. Read more →
Balances, transactions, standing orders, direct debits, account holder details, statements and product details, for the accounts the customer connects, commonly up to around 24 months of history. It is raw until a platform enriches it into categories and income. Read more →
Yes. It detects salary and other recurring income directly from real transactions, over several months, which is harder to fake than a document and more current than a payslip. It works for self-employed and irregular income too, with careful interpretation. Read more →
It is usually more accurate than declared figures or national averages because it uses a customer's actual income and spending. Accuracy depends on categorisation quality, which varies by provider, so it should be used proportionately within your lending policy. Read more →
A single, immediate account-to-account payment made through open banking. The customer approves it at their own bank, money moves directly with no card details, and it usually settles in near real time. Read more →
A VRP is a consent that lets a business take payments of varying amounts within limits the customer sets, such as a maximum per payment and per period. It is a flexible account-to-account alternative to Direct Debit or a card on file. Read more →
Commercial VRP: a variable recurring payment that pays a business, rather than sweeping between a customer's own accounts. It is live in the UK via the UK Payments Initiative scheme, with Wave 1 from 2 June 2026. Read more →
The automatic movement of money between a customer's own accounts via a variable recurring payment, such as moving a surplus to savings or paying down a loan or overdraft. It is a protected use case. Read more →
The nine largest UK current account providers the CMA ordered to implement open banking: AIB Group (UK), Bank of Ireland, Barclays, Danske, HSBC, Lloyds Banking Group, Nationwide, NatWest Group and Santander. Read more →
Open Banking Limited, formerly the Open Banking Implementation Entity, is the body the CMA created to build and maintain the Standard and the central Directory. It is not a regulator, and it is transitioning to a future entity under JROC. Read more →
The proposed extension of open banking's consented-sharing model beyond payment accounts to savings, pensions, investments, mortgages and insurance. In the UK it is being enabled through the smart data framework rather than fully live today. Read more →
The UK framework for secure, consented sharing of customer data across sectors, including finance and energy. The Data (Use and Access) Act 2025 created the powers to establish sector-specific smart data schemes. Read more →
FAPI, the Financial-grade API profile from the OpenID Foundation, is a hardened set of OAuth 2.0 and OpenID Connect rules for high-value APIs. UK open banking v4 uses FAPI 1 Advanced; older profiles are deprecated. Read more →
Confirming a customer's identity with at least two independent factors. In open banking it is performed by the customer's own bank during authorisation, which is why a stolen password alone cannot connect an account. Read more →
The core set of UK open banking APIs for reading account data and initiating payments with consent. It is organised into five profiles sharing a common data model, and the current version is v4.0.1. Read more →
v4 adopted the FAPI 1 Advanced security profile, made payload signature verification mandatory, reclassified Meta and Links as conditional, split payment status codesets by payment type, added optional rate-limit headers and introduced the OBIntermediaryAgent class. v4.0.1 was published 18 March 2026. Read more →
DCR lets a provider's software register itself with a bank's authorisation server automatically, using a Software Statement Assertion from the Directory, rather than by manual set-up for each bank. Your provider handles it. Read more →
Generally reliable, and banks must publish availability and performance figures under the Operational Guidelines, which require at least two availability and four performance KPIs per interface. Reliability varies by bank, so expect high but not perfect availability and keep a manual fallback. Read more →
Usually priced on volume rather than a fixed licence, via per-connection, per-call, per-user or platform-fee models. Credit Canary's entry pricing starts at £250 per month and scales with volume; the right price depends on your mix of data and payments. Read more →
Score candidates on regulatory status, bank coverage for your customers, data enrichment quality, payments, SLAs, security certification, data residency, pricing transparency and exit terms, and test the enriched output on your own real cases rather than the brochure. Read more →
No. Open banking shows real, current money in and out of connected accounts; a credit bureau shows borrowing history and a score across the market. They answer different questions, and most lenders use both together. Read more →
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.