UK open banking is overseen by several bodies at once. The CMA created it and ordered the nine largest banks to build it; the FCA regulates the firms that use it under the Payment Services Regulations 2017; the PSR oversees payment systems; and Open Banking Limited maintains the standard, now transitioning to a future entity under JROC. Here is who does what.
The CMA and the 2017 Order
Open banking began as a competition remedy. After investigating retail banking, the Competition and Markets Authority (CMA) concluded that large banks' grip on customer data held back competition, and in 2017 it made the Retail Banking Market Investigation Order. The Order required the largest providers to adopt a common open banking standard and set up a body to deliver it. This is why open banking exists at all, and why it started with current accounts rather than every product.
The CMA9
The Order named the nine largest providers of personal and business current accounts, known as the CMA9, who were required to build and fund the initial standard:
- AIB Group (UK), trading as Allied Irish Bank (GB) and First Trust Bank
- Bank of Ireland
- Barclays
- Danske Bank
- HSBC
- Lloyds Banking Group
- Nationwide Building Society
- NatWest Group (formerly Royal Bank of Scotland Group)
- Santander
Every other bank and building society can offer open banking too, but only the CMA9 were mandated. That is why coverage is near-universal for the big providers and varies for smaller ones, a point that matters when you assess a provider's bank coverage.
The FCA
The Financial Conduct Authority (FCA) is the conduct regulator. It authorises or registers open banking providers under the Payment Services Regulations 2017, supervises how they behave, and sets the technical standards for secure communication and strong customer authentication. If a firm wants to read account data or initiate payments, it is the FCA's permission it needs. Consumer protection rules that bear on how open banking data is used, such as the Consumer Duty and the responsible-lending rules in CONC, are also the FCA's.
The PSR
The Payment Systems Regulator (PSR) oversees the UK's payment systems and competition within them. Its relevance to open banking has grown as account-to-account payments, including variable recurring payments, become a real alternative to cards. The PSR works jointly with the FCA on the direction of open banking payments.
Open Banking Limited
Open Banking Limited (OBL), originally the Open Banking Implementation Entity (OBIE), is the body the CMA created to design, build and maintain the standard and the central Directory that lets banks and providers trust each other. OBL declared the original CMA roadmap complete in January 2023 and has since focused on stewardship and the next phase. It is not a regulator; it is the custodian of the technical standard. Its current state is tracked on our standards tracker.
JROC and the Future Entity
The Joint Regulatory Oversight Committee (JROC), led by the FCA and the PSR, sets the strategic direction for the next phase of open banking and is overseeing the move from OBL to a long-term "future entity". Alongside this, the Data (Use and Access) Act 2025 created the legal powers for a wider smart data regime that can extend open-banking-style data sharing to other sectors. As of October 2026 the transition to the future entity is in progress; no final named successor or dated timetable is published, so we do not state one. For where this is heading, see open banking vs open finance.
Who does what, at a glance
| Body | Role |
|---|---|
| CMA | Created open banking through the 2017 Order; mandated the CMA9. |
| CMA9 | The nine largest current account providers required to build the initial standard. |
| FCA | Authorises and supervises providers; sets security and conduct rules. |
| PSR | Regulates payment systems; co-leads open banking payments policy. |
| Open Banking Limited | Builds and maintains the Standard and the Directory. |
| JROC | FCA and PSR committee steering the next phase. |
| Future Entity | The successor body taking on long-term stewardship (in transition). |
| HM Treasury | Sets the legislative framework, including the Data (Use and Access) Act 2025. |
From the data consumer's side
You do not need to track all of this to use open banking, but two points are practical. First, your provider's authorisation is the FCA's, not the CMA's, so when you check a provider's status you are checking an FCA register entry. Second, the CMA9 history is why bank coverage is a real differentiator between providers: everyone connects to the big nine, but the long tail of smaller banks and building societies varies. See choosing a provider.
How Credit Canary does it
Credit Canary provides open banking through fumopay limited, an FCA-authorised provider of which Credit Canary is an agent. That means your use of open banking sits under FCA authorisation without you holding the licence, and you work with one platform that combines open banking with credit bureau and identity data.
Common questions
Who are the CMA9?
The nine largest UK current account providers the CMA ordered to implement open banking: AIB Group (UK), Bank of Ireland, Barclays, Danske Bank, HSBC, Lloyds Banking Group, Nationwide, NatWest Group and Santander.
Is open banking regulated by the FCA?
Yes. Open banking providers are authorised or registered by the FCA under the Payment Services Regulations 2017. The CMA set up the standard and the CMA9; the FCA regulates the firms that use it.
What is Open Banking Limited?
Open Banking Limited, formerly the Open Banking Implementation Entity, is the body the CMA created to build and maintain the Standard and the Directory. It is transitioning to a future entity under JROC.
What is the Future Entity?
The successor arrangement that will take over long-term stewardship of open banking from OBL, overseen by JROC. As of October 2026 the transition is in progress; no final named entity or date is published.
Related pages
Primary sources
- CMA Retail Banking Market Investigation Order 2017 (checked 14 Oct 2026).
- Payment Services Regulations 2017, SI 2017/752 (checked 14 Oct 2026).
- openbanking.org.uk, JROC (checked 14 Oct 2026).
- Data (Use and Access) Act 2025, c. 18 (checked 14 Oct 2026).
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.