Plain-English definitions of the open banking terms you meet, written for a business reader. Each entry introduces the everyday meaning first and the term of art second, and links to where it is explained in depth.
Last reviewed 15 October 2026.
A screen on the bank's side where a customer can see every third party they have connected across all services, and cancel any of them. It is distinct from a provider's consent dashboard, which shows only what was shared with that provider.
Used on: consent
Whether a customer can repay a commitment without undue difficulty, judged as income minus committed expenditure minus essential living costs. It is the question most lending decisions turn on, and open banking grounds it in real spending rather than declared figures.
Used on: affordability assessment
A firm that provides regulated services under another firm's FCA permissions. The authorised firm is the principal; the agent operates under its authorisation. It is a legitimate, common model, but a provider should always state whose authorisation its service runs under.
Used on: choosing a provider
Reading a customer's bank account information, balances, transactions, standing orders and more, with their consent. It is read-only: AIS never moves money. It is the data source behind income verification and affordability.
Used on: AIS vs PIS
A firm authorised by the FCA to carry out account information services, that is, to read account data on a customer's behalf. Businesses usually use an AISP's service rather than becoming one.
Used on: AIS vs PIS
The defined, standardised way one piece of software talks to another. In open banking, banks expose APIs so that regulated providers can request data or submit payments in a consistent, secure way.
Used on: the Read/Write API
The Standard's term for the customer's bank or building society: the party that holds the account and exposes the open banking APIs. In plain terms, the bank.
Used on: how open banking works
The UK service that moves a customer's current account, including payments and direct debits, from one bank to another within a set timeframe. It is separate from open banking but often mentioned alongside it.
Used on: open banking data
A card issuer that uses confirmation of funds to check whether an amount is available on an account, without seeing the balance or transactions. A narrow permission, used mainly in card authorisation.
Used on: AIS vs PIS
Labelling each raw bank transaction into a meaningful category (salary, rent, subscriptions, and so on). Because raw descriptions are cryptic, categorisation quality is where providers differ and where the value of open banking data is created.
Used on: open banking data
The part of the Standard that sets out how the consent and authentication journey should work, so customers get a consistent, understandable experience across banks. Current version v4.0.1.
Used on: the Standard explained
An OpenID mechanism that supports decoupled authentication, where a customer approves in a separate channel such as their banking app. Optional in UK open banking; if implemented, it must follow the FAPI CIBA profile.
Used on: security profile
The Retail Banking Market Investigation Order 2017, which created UK open banking: it required the nine largest banks (the CMA9) to adopt a common standard and set up the body that became OBL.
Used on: who regulates open banking
The nine largest UK current account providers the CMA ordered to implement open banking: AIB Group (UK), Bank of Ireland, Barclays, Danske, HSBC, Lloyds Banking Group, Nationwide, NatWest Group and Santander.
Used on: who regulates open banking
A simple yes or no check of whether a specified amount is available on an account, without revealing the balance or any transactions. Used by card issuers (CBPIIs) when authorising a payment.
Used on: AIS vs PIS
The UK service that checks whether the name on a destination account matches before a payment is made, reducing misdirected and fraudulent transfers.
Used on: is open banking safe
A screen on the provider's side where a customer can see what they have shared with that provider and withdraw it. Distinct from the bank-side access dashboard.
Used on: consent
The limits set in a variable recurring payment consent, such as the maximum per individual payment, the maximum per period, and a valid date range, within which a business may collect varying amounts.
Used on: payment initiation API
A voluntary industry code on reimbursing victims of authorised push payment fraud. Relevant background to payment fraud protections, alongside Confirmation of Payee.
Used on: is open banking safe
A variable recurring payment that pays a business, as opposed to sweeping between a customer's own accounts. Live in the UK via the UK Payments Initiative scheme, with Wave 1 from 2 June 2026.
Used on: open banking payments
A grouping of related account data the Standard uses to describe what can be shared (for example balances, or transactions). We regroup these by what a lender actually needs on the data page.
Used on: open banking data
The mechanism by which a provider's software registers itself with a bank's authorisation server automatically, using a Software Statement Assertion, rather than by manual set-up for each bank.
Used on: DCR
A model where the customer approves in a separate channel, usually their banking app, without an in-line redirect from the business's page. Suits call-centre, in-person and cross-device journeys.
Used on: security profile
The central register that lets banks and providers trust each other: it enrols participants and issues the identifiers and certificates they present, so a bank can confirm a provider is genuine.
Used on: Directory and certificates
The framework underpinning qualified certificates used to identify parties and secure messages, including QWAC and QSeal. Its exact application in the UK has its own post-Brexit position.
Used on: Directory and certificates
The work of turning raw open banking transactions into something usable: clean categories, detected income, identified commitments and an affordability view. It is where providers add value over the raw feed.
Used on: open banking data
A bank telling a provider when something relevant changes, such as a consent being revoked or a resource updating, so the provider can react in near real time rather than only on its next call.
Used on: event notifications
A hardened set of OAuth 2.0 and OpenID Connect rules for high-value APIs, from the OpenID Foundation. UK open banking v4 uses the FAPI 1 Advanced profile; older profiles are deprecated.
Used on: security profile
The successor arrangement that will take on long-term stewardship of open banking from OBL, overseen by JROC. As of October 2026 the transition is in progress, with no final named entity or dated timetable published.
Used on: who regulates open banking
The committee led by the FCA and the PSR that sets the strategic direction for the next phase of open banking and oversees the move to a future entity.
Used on: who regulates open banking
A reference implementation of the Standard, provided by Ozone, that behaves like a compliant bank so integrations can be tested safely without real accounts or money.
Used on: testing and sandbox
The original name of the body the CMA created to build open banking. It later became Open Banking Limited (OBL).
Used on: who regulates open banking
The body that builds and maintains the Open Banking Standard and the central Directory. Not a regulator; the custodian of the technical standard, now transitioning to a future entity.
Used on: who regulates open banking
The part of the Standard setting banks' operational obligations, including publishing at least two availability and four performance KPIs per dedicated interface.
Used on: availability and performance
The unauthenticated open banking API for reference data such as ATM and branch locations and product information. It needs no customer consent because it exposes no personal data.
Used on: the Read/Write API
The proposed extension of open banking's consented-sharing model beyond payment accounts to savings, pensions, investments, mortgages and insurance, in the UK via the smart data framework.
Used on: open banking vs open finance
A single, immediate account-to-account payment made through open banking. The customer approves it at their own bank, money moves directly, and no card details are used.
Used on: open banking payments
A specific data type a customer grants in an account-access consent, such as ReadBalances or ReadTransactionsDetail. A provider can read only what the permissions allow, so you request the least you need.
Used on: account and transaction API
Starting a payment from a customer's account with their consent. The provider never holds the money; it instructs the customer's bank to make the transfer.
Used on: AIS vs PIS
A firm authorised by the FCA to initiate payments on a customer's behalf. Businesses collecting payments usually use a PISP's service rather than becoming one.
Used on: AIS vs PIS
The FCA-authorised firm whose permissions an agent operates under. When a provider is an agent, the principal is the authorised party, and should be named.
Used on: choosing a provider
The second Payment Services Directive, the EU legislation whose approach the UK mirrors in the Payment Services Regulations 2017. Often referenced when distinguishing the UK and EU regimes.
Used on: what is open banking
The regulator of UK payment systems. It works with the FCA on the direction of open banking payments, including variable recurring payments.
Used on: who regulates open banking
SI 2017/752: the UK legislation that provides the legal basis for open banking and under which the FCA authorises providers.
Used on: who regulates open banking
The Standard's term for the customer: the person or business whose account it is and who gives consent. In plain terms, your customer.
Used on: what is open banking
A qualified electronic seal certificate used to sign and seal messages so their origin and integrity can be verified. Held and managed by the provider.
Used on: Directory and certificates
A qualified website authentication certificate used to secure and identify the transport connection between parties. Held and managed by the provider.
Used on: Directory and certificates
The core open banking APIs for account information and payment initiation, organised into five profiles sharing a common data model. Current version v4.0.1.
Used on: the Read/Write API
The requirement that a customer reconfirm ongoing account-information access at least every 90 days, so long-lived connections are revisited and stale access is cleared. The exact mechanism has evolved under the FCA's rules.
Used on: consent
The common model where the customer is sent to their bank's app or website to authenticate and then returned, often app-to-app for a smooth mobile experience.
Used on: security profile
Technical standards that sit under the payment services rules, including those on strong customer authentication and secure communication (the SCA-RTS).
Used on: is open banking safe
Confirming a customer's identity with at least two independent factors. In open banking it is performed by the customer's own bank during authorisation, not by the provider.
Used on: is open banking safe
Reading an account by taking the customer's online banking login and logging in as them. The insecure predecessor to open banking, which never shares credentials.
Used on: vs screen scraping
The UK framework for secure, consented sharing of customer data across sectors, including finance and energy. The Data (Use and Access) Act 2025 created the powers to make sector-specific schemes.
Used on: open banking vs open finance
A signed statement issued by the Directory that describes and vouches for a provider's software. A bank verifies it during dynamic client registration before registering the provider.
Used on: DCR
Automatic movement of money between a customer's own accounts via a variable recurring payment, for example moving a surplus to savings or paying down a loan. A protected use case.
Used on: open banking payments
The general term for a regulated provider that is not the bank: an AISP, PISP or CBPII. It is the party that reads data or initiates payments on the customer's behalf.
Used on: what is open banking
A firm that supplies technology and integration to a regulated provider without itself holding the regulatory permissions. The TSP does the engineering; the authorised provider holds the responsibility.
Used on: Directory and certificates
A consent that lets a business take payments of varying amounts within limits the customer sets. Sweeping moves money between a customer's own accounts; commercial VRP (cVRP) pays a business.
Used on: open banking payments
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.