The Open Banking Standard is the UK set of specifications that make open banking work consistently across banks: the API specifications, the security profile, the Customer Experience Guidelines, the Operational Guidelines and Good Practice. Open Banking Limited maintains it, and the current version is v4.0.1, published 18 March 2026. This page is the orientation the Standard's own site does not give you.
What the Standard is, in parts
The Standard is not a single document; it is a family of specifications that together let any compliant bank and any compliant provider work with each other. The main parts are:
- API specifications: the Read/Write API (account information, payment initiation, confirmation of funds, variable recurring payments and event notification) and the Open Data API. These define the endpoints, fields and data model.
- Security profile: how parties authenticate and secure messages, based on FAPI 1 Advanced in v4. See the security profile.
- Customer Experience Guidelines (CEG): how the consent and authentication journey should work, so customers get a consistent, understandable experience.
- Operational Guidelines (OG): operational obligations on banks, including availability and performance KPIs. See availability and performance.
- Good Practice: non-normative guidance on implementation topics such as VRP, data management and testing.
For the current version of each part, dated, see the standards tracker.
Mandatory, conditional and optional
Every requirement in the Standard carries a classification, and understanding it saves a lot of confusion when you read a provider's capabilities:
| Classification | What it means for an implementer |
|---|---|
| Mandatory | Must be implemented. A compliant party has to support it. |
| Conditional | Must be implemented only if a related feature or product is offered. If you do the thing, you must do this too. |
| Optional | May be implemented at the party's discretion. Useful, but not required. |
This matters when comparing providers or banks: two can both be "compliant" yet differ on everything conditional and optional, which is often exactly the capability you care about. In v4, some fields moved classification, for example Meta and Links became conditional. See what changed in v4.
What is binding, and on whom
The Standard itself is a specification, not legislation. What binds comes from the law and regulation that sit around it, and it binds different parties differently:
- The CMA9 are bound by the CMA Order to implement the Standard for the relevant accounts.
- Providers (AISPs, PISPs) are bound by the Payment Services Regulations 2017 and the FCA's rules, including the security technical standards.
- Other banks are not mandated by the CMA Order but implement the Standard to participate.
So "compliance" is really compliance with the law, achieved by implementing the Standard. For who sets these obligations, see who regulates open banking.
Where each part lives
One of the genuine difficulties of the Standard is that it is spread across several places. Here is the map, so you can find things:
| Part | Where to find it |
|---|---|
| The Standard hub | standards.openbanking.org.uk: the index to all parts. |
| Read/Write API spec | openbankinguk.github.io: the profiles and data models. |
| Security profile | Within the Read/Write API site, referencing FAPI 1 Advanced. |
| CEG and OG | On the Standard hub under Guidelines. |
| Good Practice | On the Standard hub under Good Practice. |
We keep a consolidated, dated view on the standards tracker precisely because the primary estate is fragmented.
How versions work
The Standard is versioned, and the version number matters because banks and providers may be on different ones during a transition. The current version is v4.0.1, published 18 March 2026, with Read/Write API release notes dated 1 April 2026. Earlier major versions (the 3.1.x line) are still referenced for history and migration. When you integrate, you target a specific version, and you watch release notes for changes that affect you. The most consequential recent change was the move to FAPI 1 Advanced and mandatory payload signature verification in v4; see what changed in v4.
From the data consumer's side
You will rarely implement the Standard yourself; your provider does. But reading it well helps you ask the right questions: which version a provider is on, whether they support the conditional and optional features you need, and how they handle a bank that is behind on a version. Treat the Standard as the contract your provider is meeting on your behalf, and use this page and the tracker to check they are current.
How Credit Canary does it
Credit Canary works through a provider implementing the current Standard (v4.0.1, FAPI 1 Advanced), so you consume a maintained, up-to-date integration rather than tracking specifications yourself. We keep the tracker current as part of that.
Common questions
What is the Open Banking Standard?
It is the UK set of technical and process specifications that make open banking work: the API specifications, the security profile, the Customer Experience Guidelines, the Operational Guidelines and Good Practice. Open Banking Limited maintains it; the current version is v4.0.1, published 18 March 2026.
What do mandatory, conditional and optional mean in the Standard?
Mandatory elements must be implemented; conditional elements must be implemented only if a related feature is offered; optional elements may be implemented at the provider's discretion. The classification tells an implementer what they must support versus what they can choose.
Is the Open Banking Standard legally binding?
The Standard itself is a specification. What is binding comes from the law and regulation around it: the CMA Order on the CMA9, and the Payment Services Regulations and FCA rules on providers. The Standard is how firms meet those obligations in practice.
What is the latest version of the Open Banking Standard?
v4.0.1, published 18 March 2026, with Read/Write API release notes dated 1 April 2026. It adopts the FAPI 1 Advanced security profile and made payload signature verification mandatory.
Related pages
Primary sources
- standards.openbanking.org.uk, the Standard hub (checked 14 Oct 2026).
- Read/Write API v4.0.1 version control (checked 14 Oct 2026).
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.