🔗 Open banking and pay-by-bank

From PSD2 to open banking

Open banking is the opening of payment accounts to licensed third parties, as mandated by EU regulation. Banks must expose APIs through which a third party, with the customer's consent, can view the customer's accounts or initiate payments. This access right comes from PSD2 (Directive 2015/2366, applicable since January 2018, with APIs mandatory since September 2019). Before PSD2, aggregators “screen-scraped” online banking sites using their customers' login credentials, in a legal gray area. The directive replaced that practice with regulated access. The third party identifies itself to the bank, and customers share their credentials only with their own bank.

PSD2 APIs under the hood

PSD2 account access runs through an interface that each bank designs itself, within the framework set by the RTS (Delegated Regulation 2018/389), because the directive imposed no single technical standard. Two industry initiatives have limited the resulting fragmentation: the Berlin Group (NextGenPSD2), dominant in Europe, and STET in France. TPPs identify themselves with eIDAS certificates (QWAC/QSEAL), and every call is logged. The uneven quality of bank APIs remains the industry's main pain point, with patchy availability, variable documentation, and authentication flows that differ from bank to bank. The PSD3/PSR package makes it one of its priorities.

• AIS consent: valid for 180 days, renewable (extended from 90 to 180 days in 2023 by the RTS revision, to reduce friction).
• SCA every time for payment initiation: the customer authenticates with their own bank (app-to-app or web redirect), never with the TPP.
• Possible SCA exemption for account access: after the first authentication, the bank can let the AISP refresh data up to 4 times a day without SCA.
• Fallback interface: required unless the supervisor grants an exemption because the API meets the required quality level.
• No mandatory contract between bank and TPP: access is a free regulatory right, limited to data from payment accounts accessible online.

POST /v1/payments/sepa-credit-transfers
X-Request-ID: 5e3d02b1-9c4a-4f7e-b0aa-1d2f6a9c1e77
TPP-Redirect-URI: https://checkout.shop.example.com/psu-return
Content-Type: application/json

{
  "instructedAmount": { "currency": "EUR", "amount": "128.40" },
  "debtorAccount": null,
  "creditorName": "Example Shop SAS",
  "creditorAccount": { "iban": "FR7630001007941234567890185" },
  "remittanceInformationUnstructured": "Order CMD-84512"
}

HTTP/1.1 201 Created
{
  "transactionStatus": "RCVD",
  "paymentId": "pmt-7f21c",
  "_links": {
    "scaRedirect": { "href": "https://customer-bank.example.com/sca/pmt-7f21c" },
    "status": { "href": "/v1/payments/sepa-credit-transfers/pmt-7f21c/status" }
  }
}

How a pay-by-bank payment works

Two points set this flow apart from a card payment. The first is status: PSD2 guarantees the PISP information on the initiation of the payment, but not always on its final settlement. With standard SCT, there was a lag between “accepted” and “credited,” during which the merchant did not know whether the funds had arrived. The switch to instant payments solves this, since the final status comes back within seconds. The second is irrevocability: an executed transfer cannot be charged back. The merchant has no chargebacks to provision for, but the consumer has no scheme recourse in a commercial dispute.

Verification of Payee (VoP), mandatory for euro credit transfers since October 9, 2025, adds an anti-fraud check. Before the payer approves the transfer, the payer's bank checks whether the payee's name matches the IBAN and shows the result: match, close match, or no match. In merchant pay-by-bank, where the PISP prefills the IBAN, VoP alerts the payer to any mismatch between that IBAN and the stated merchant name. That curbs fake bank-detail fraud, which is common in B2B payments.

Pay-by-bank vs. cards, head to head

• Where pay-by-bank already wins: large amounts (travel, furniture, cars), account top-ups (trading, iGaming), bills and taxes, B2B, and sectors with high MSCs.
• Where cards still rule: small baskets with high conversion rates, subscriptions, travel with deposits, and situations where cardholder protection is decisive.
• The cultural factor: the Netherlands (iDEAL, now part of Wero/EPI) and Poland (BLIK) show that a well-integrated A2A method can dominate a national e-commerce market.

Players and markets

Visa's acquisition of Tink and Mastercard's acquisition of Aiia reflect the same strategy at both networks. Rather than suffer the rise of A2A, each bought account-access infrastructure and sells that service whichever rail wins. Wero (EPI), which started as an interbank wallet, has been expanding into e-commerce since late 2025, offering pan-European account-to-account payments built on instant transfers that are now universal. EPI's absorption of iDEAL and its migration to Wero illustrate the ongoing consolidation of European A2A.

FIDA and PSD3/PSR: what comes next

In June 2023, the European Commission proposed a three-part package. PSD3 is a directive covering licensing and supervision, so each member state will have to transpose it. The PSR is a regulation on payment services with directly applicable rules, including those on open banking. FIDA (Financial Data Access) extends data access beyond payment accounts to savings, credit, insurance, and investments, known as “open finance.” Parliament and the Council reached a political agreement on PSD3 and the PSR on November 27, 2025, and formal adoption is under way in 2026. FIDA is still under negotiation. PSD3 and the PSR are not expected to apply before the second half of 2028, and FIDA later still.

• Merged licenses: e-money institutions are folded into the payment institution license, and licensing rules are cleaned up.
• Stronger open banking: mandatory dedicated interfaces with performance requirements, consent management dashboards (“permission dashboards”) at banks, and an end to unjustified obstacles.
• Fraud prevention: payee verification extended across the board, fraud data sharing between PSPs, and reimbursement extended to victims of impersonation fraud (spoofing).
• Access to bank accounts: payment institutions and EMIs get the right to open an account with a bank (banks' “de-risking” of fintechs becomes regulated).
• FIDA: financial data sharing schemes, with possible compensation for banks where PSD2 required free access, a major change in the business model.