Open banking standards tracker
This is the current version and publication date of each part of the UK Open Banking Standard, checked against primary sources. The latest Standard is v4.0.1, published 18 March 2026. Where a source does not publish a date or version, we mark it rather than guess.
All rows last checked 14 October 2026.
Current versions
| Component | Version | Published | What it governs | Source |
|---|---|---|---|---|
| Read/Write API | 4.0.1 | 18 Mar 2026 | Account information and payment initiation APIs: accounts, balances, transactions, standing orders, direct debits, parties, statements, products, domestic/international/file payments, VRP. | OBL |
| Security profile | FAPI 1 Advanced | 18 Mar 2026 | OAuth2/OIDC security referenced by R/W v4.0.1; FAPI1 ID2 and the legacy UK profile deprecated; CIBA optional. | github.io |
| Customer Experience Guidelines | 4.0.1 | 18 Mar 2026 | Journey and UX requirements for consent and authentication, plus the implementation checklist. | OBL |
| Operational Guidelines | 4.0.1 | 18 Mar 2026 | ASPSP operational obligations: availability and performance KPIs, incident and change management. | OBL |
| Open Data API | 2.3 | Date to verify | Unauthenticated reference data: ATM and branch locators, product information. | OBL |
| Dynamic Client Registration | 3.3 | Date to verify | Automated registration of a TPP's client with an ASPSP, using a Software Statement Assertion. | OBL |
| MI Reporting | 3.1.11 | Date to verify | Management-information reporting templates (ASPSP and TPP variants). | OBL |
| Directory technical overview | Directory 2.0, v1.6 | Date to verify | The Open Banking Directory / trust framework: participant identity, certificates, Software Statements. | OBL |
| Good Practice | Latest (unversioned) | Not dated on source | Non-normative guidance: VRP and data-management implementation, testing, disputes, change management, BCDR. | OBL |
| CEG Checklist | 4.0.1 | 18 Mar 2026 | Conformance checklist mapping CEG requirements for implementers. | OBL |
Rows marked in amber are version numbers we have confirmed but whose publication date is not shown on a single primary page; we are confirming them and will date them here.
What changed, and what is live
- · v4.0.1 moved payload signature verification from recommended to required, reclassified Meta and Links as conditional, split payment status codesets by payment type, added optional rate-limit headers and the OBIntermediaryAgent class. Release notes dated 1 April 2026.
- · Operational Guidelines require at least 2 availability and 4 performance KPIs per dedicated interface.
- · Commercial VRP is live via the UK Payments Initiative scheme; Wave 1 launched 2 June 2026 for regulated and lower-risk sectors, with general e-commerce (Wave 2) planned for H2 2026.
- · Adoption: over 18 million active users, and open banking passed 1 billion payments and 100 billion API calls (announced 30 July 2026).
The rules behind it
| Instrument | Citation | Status (Oct 2026) |
|---|---|---|
| Payment Services Regulations 2017 | SI 2017/752 | In force |
| EBA RTS (SCA & CSC) | Delegated Reg (EU) 2018/389 | Assimilated in UK law; applied via the FCA SCA-RTS |
| CMA Order 2017 | Retail Banking Market Investigation Order 2017 | In force, as varied (Dec 2019) |
| Consumer Duty | PS22/9 (with FG22/5) | In force (open products Jul 2023) |
| Responsible lending | FCA CONC 5 | Current |
| Data (Use and Access) Act 2025 | 2025 c. 18 | In force, commencing in stages; smart-data powers in Part 1 |
For who does what across the FCA, PSR, CMA9, OBL, JROC and the Future Entity, see who regulates open banking.
Primary sources
- standards.openbanking.org.uk: the Standard, split into Specifications, Security Profiles, Guidelines and Good Practice (checked 14 Oct 2026).
- Read/Write API v4.0.1 version control: release notes, dated 1 Apr 2026 (checked 14 Oct 2026).
- openbanking.org.uk: adoption statistics, VRP and JROC pages (checked 14 Oct 2026).
- legislation.gov.uk: Payment Services Regulations 2017 (checked 14 Oct 2026).
By James Fell, Founder & CEO, Credit Canary · About · LinkedIn · Last reviewed 15 October 2026
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.