Not on its own. A data connection only lets an app read the information you approved. An app can start a payment only if you approve that payment with your bank, or if you've set up a variable recurring payment within a limit you chose.
Open banking lets you give a regulated app permission to see your bank account data, or to make a payment from your account, without handing over your banking password. You approve every connection with your own bank, and you decide what the app can see and for how long.
It’s the system that lets a budgeting app show every account in one screen, and lets a lender check your income without asking for a bank statement. More than 16 million users in the UK now connect through it, according to the Financial Conduct Authority’s December 2025 update.
This guide starts with where open banking came from, then follows a single connection from the moment you choose to connect an app to the moment its access ends. The sections after that build on the same walkthrough, first for payments and then for safety.
Open banking at a glance:
- It does two jobs. Account information services read the data you agree to share. Payment initiation services start a payment from your account once you approve it.
- Only regulated firms can use it. A firm has to be authorised or registered with the FCA, or registered as its agent, before it can offer either service.
- Your password stays with your bank. You log in on your bank’s own app or website, never the third party’s.
- Access has a time limit. An app must ask you to reconfirm your consent at least every 90 days, and you can withdraw it at any time.
Where did open banking come from?
Open banking is often described as a technology trend, but in the UK it started as a competition ruling. In 2016 the Competition and Markets Authority (CMA) finished an investigation into retail banking and concluded that the older, larger banks didn’t compete hard enough for customers.
Its remedy, the Retail Banking Market Investigation Order 2017, came into force in February 2017. The Order required the nine largest banks and building societies, known as the CMA9, to set up an organisation that would let customers share their transaction data safely with trusted third parties. The CMA9 are AIB Group, Bank of Ireland, Barclays, Danske Bank, HSBC, Lloyds Banking Group, Nationwide Building Society, NatWest Group and Santander.
That organisation became Open Banking Limited, which writes and maintains the technical standard. The service launched on 13 January 2018, and in September 2024 the CMA confirmed that all nine providers had finished the full programme of work it set them.
Smaller banks aren’t bound by the CMA Order. They still take part, because the Payment Services Regulations 2017, which came into force the same day, require providers of online payment accounts to give regulated third parties access with the customer’s consent. The FCA now requires providers of personal current accounts and credit card accounts to offer a dedicated interface for that access.
How does open banking work?
Open banking runs on application programming interfaces (APIs). An API is a secure channel that lets one company’s system ask another company’s system for data in a fixed format, and receive only that data back.
A typical connection to a budgeting app or a lender follows five steps:
- You choose to connect. Inside the app, you pick your bank and see what the app wants to access, such as your balance and transactions, and for how long.
- The app sends you to your bank. You leave the app and land on your own bank’s app or website.
- You log in with your bank. Your bank runs the same security checks as online banking, known as strong customer authentication. The app never sees your password.
- You approve the request. You confirm the request with your bank. Nothing is shared before you do.
- Your bank shares the approved data. The bank sends only what you agreed to, through its API, and the app can keep reading it while your consent lasts.
How an open banking connection works
- 1In the appYou choose your bank and what to share
- 2App to bankThe app sends you to your bank
- 3At your bankYou log in with your bank's usual securityYour password stays with your bank
- 4At your bankYou approve the request
- 5Bank to appYour bank shares only the approved data
- Any timeAccess ends if you withdraw consent, or don't reconfirm within 90 days
Steps two and three carry most of the security. Because you log in on your bank’s own system, your login details never pass through the app, and the bank, not the app, confirms that you’re the account holder.
What data can open banking share?
Open banking covers payment accounts, which is a legal category rather than a type of product. The FCA’s guidance counts current accounts, credit card accounts, flexible savings accounts, e-money accounts and current account mortgages as payment accounts. Fixed-term savings and some cash ISAs fall outside it.
For those accounts, an app can ask to see information such as your balance and your transaction history, which includes the direct debits and standing orders leaving the account. What the app receives depends on what you approved in step four, not on everything your bank holds about you.
Pensions and investments sit outside open banking today, as do most mortgages. Extending the same model to them is the job of open finance, which the last section covers.
How do open banking payments work?
Sharing data is only half of what open banking does. The other half, payment initiation, lets an app or website start a payment straight from your bank account, with no card involved.
The regulations give each half its own name. A firm that reads your data is an account information service provider (AISP), and a firm that starts payments is a payment initiation service provider (PISP). Many firms hold both permissions.
A one-off open banking payment follows the same route as the data connection above. You pick your bank at checkout, get sent to your banking app, and approve that specific payment with your bank’s own security. HMRC and some utility firms already take bill payments this way.
Variable recurring payments (VRPs) go a step further. You set a limit once, and a trusted firm can then take payments within that limit without asking you each time. VRPs made up 16% of open banking payments by December 2025. The first commercial VRP scheme, run by the UK Payments Initiative, launched in June 2026, starting with uses such as utility bills, financial services and payments to government.
Is open banking safe?
No system is free of risk, and open banking is no exception, but it was designed to remove the riskiest part of the older method. Before open banking, linking an app to your bank often meant typing your banking login into the app, so it could sign in as you and copy what was on screen. That practice is called screen scraping, and the FCA doesn’t count an interface that relies on it as the dedicated access banks must provide. Kevin Allen covers how lenders moved away from it here.
Open banking adds several protections on top of the walkthrough above:
- Firms have to be regulated. Only firms authorised or registered with the FCA, or registered as an agent of one, can offer open banking services. You can check a firm on the FCA register or on Open Banking Limited’s regulated providers page.
- Your password stays with your bank. Because you log in with your bank in step three, the app has no login details to lose or misuse.
- You set the scope. The app sees only the data you approved, for the period you approved.
- Unauthorised payments are covered. Your bank or building society will normally refund payments you didn’t authorise, and you can take a complaint to the Financial Ombudsman Service.
The refund point covers payments you didn’t approve. Approving a payment is still your decision, so the usual care about who you’re paying still applies.
How long does an app keep access to my account?
When you first connect, you log in with your bank using strong customer authentication. After that, the app has to ask you to reconfirm your consent at least every 90 days. If you don’t reconfirm, the app must stop accessing your account information.
Until September 2022, you had to log back in with your bank every 90 days instead. The FCA moved that check to the app, while keeping the first login with your bank, so that the person granting access is confirmed as the real account holder at the start.
You can also withdraw your consent in the app at any time, and the app loses access. Open Banking Limited describes this as you choosing when, and for how long, you give access.
Why do budgeting apps and lenders use open banking?
The FCA’s own description of account information services names both uses. It lists an online dashboard that shows several accounts in one place, and passing account information to another party, such as a lender, on your instruction.
Without open banking, a budgeting app needs you to type in figures or import statements. With a connection in place, the app reads each account directly, so the picture stays current without you copying numbers between screens. Updraft’s guide to building a budget you can stick to covers what to do with that picture once you have it.
Lenders use open banking to check affordability. A credit file shows how you’ve repaid credit, but not what you spend on rent or food, and open banking lets a lender see income and regular costs from the account itself, often without asking for documents. Kevin Allen looks at how lenders read that data, and where it can introduce bias, in his latest blog.
Updraft is one of those lenders. When you apply, Updraft uses open banking, alongside your credit file, to check your income and regular spending. How Updraft works explains the full process.
How many people use open banking in the UK?
More than 16 million, according to industry figures the FCA quoted in December 2025. Open Banking Limited counts user connections rather than unique people, because it can’t tell when one person uses several apps, so the number of individuals may be lower.
Payments are growing quickly. Open banking payments rose 53% year on year in 2025, and in July 2026 Open Banking Limited reported more than one billion open banking payments across the CMA9 since launch.
Do I have to use open banking?
Open banking is optional. You can keep track of your money in a spreadsheet or in your bank’s own app. Without a connection, you move the figures between places yourself, which is the part open banking takes away. Some lenders ask you to connect an account as part of an application, so check what a lender needs before you apply.
What’s next for open banking in the UK?
Open banking still runs under the CMA Order and the Payment Services Regulations 2017, but that is set to change. In April 2026, HM Treasury said it would give the FCA new powers to regulate the future of open banking, including new open banking payments within commercial schemes.
The Treasury’s consultation on modernising payment services regulation ran from 14 July 2026 to. The government has also said it will lay regulations under the Data (Use and Access) Act 2025 by the end of 2026 to support the long-term framework.
Open finance would take the same consent-based model beyond payment accounts. The FCA’s roadmap, published on 14 April 2026, names SME credit and mortgages as its first priorities, with a discussion paper on the first scheme due in the final quarter of 2026.
Sources
- Competition and Markets Authority, Retail Banking Market Investigation Order 2017, 2 February 2017.
- Competition and Markets Authority, CMA publishes findings of ‘Lessons Learned’ review into Open Banking, gov.uk, 2022.
- Financial Conduct Authority, PERG 15.3: Payment services, FCA Handbook.
- Financial Conduct Authority, PERG 15: Guidance on the scope of the Payment Services Regulations 2017, FCA Handbook.
- Financial Conduct Authority, PS21/19: Changes to the SCA-RTS and to the guidance in ‘Payment Services and Electronic Money: Our Approach’, 29 November 2021.
- Financial Conduct Authority, Strong Customer Authentication, updated March 2022.
- Financial Conduct Authority, Open banking: a year of progress, 16 December 2025, updated 12 February 2026.
- Financial Conduct Authority and Payment Systems Regulator, Commercial variable recurring payments: update on delivery, December 2025.
- HM Treasury, UK fintech backed to embrace future payments technology, gov.uk, 21 April 2026.
- HM Treasury, Modernising Payment Services Regulation (consultation), gov.uk, 14 July 2026.
- Open Banking Limited, UK’s Open Banking to launch on 13 January 2018, undated.
- Open Banking Limited, Regulatory, undated.
- Open Banking Limited, What is open banking?, undated.
- Open Banking Limited, Why open banking is safe, undated.
- Open Banking Limited, FAQs, undated.
- Open Banking Limited, Open banking surges to 15 million UK users as July marks record adoption, 1 September 2025.
- Open Banking Limited, UK Open Banking ecosystem surpasses one billion payments and 100 billion API calls, 28 July 2026, as republished by Open Banking Expo (secondary copy).
- The Payment Services Regulations 2017, SI 2017/752, legislation.gov.uk.
- Secondary: A&O Shearman, Modernising UK payments: HM Treasury’s proposed overhaul of the payment services regime, July 2026.
- Secondary: Asima, Modernising payment services regulation: what Open Banking teams need to decide, July 2026.
- Secondary: Freshfields, Open Finance: The FCA Maps Out a Smart Data Future, April 2026.
Final Thought
Looking to pay off credit card debt? Updraft helps people consolidate credit card debt and cut interest costs, download the Updraft app today.
About Updraft
Updraft helps people pay off credit card debt. The app connects to your accounts, shows you what your borrowing costs, and where it makes sense replaces card and overdraft balances with a single Updraft loan. We’re rated 4.8 out of 5 on Trustpilot by the people using it to do exactly that. More about Updraft
Updraft Awards & Recognition
Recognised for helping borrowers take control of card debt.
Frequently asked questions
Does open banking give an app access to my money?
What's the difference between an AISP and a PISP?
An account information service provider (AISP) reads the account data you agree to share, for example to build a budget. A payment initiation service provider (PISP) starts a payment from your account after you approve it with your bank. Some firms hold both permissions.
How do I stop an app using open banking?
Withdraw your consent in the app, and it loses access. Access also stops if you don't reconfirm your consent when the app asks, which it must do at least every 90 days.
Which accounts can I connect through open banking?
Payment accounts you can use online. The FCA says these include current accounts, credit card accounts, flexible savings accounts and e-money accounts. Fixed-term savings and some cash ISAs are not payment accounts.
How do I check that an open banking app is regulated?
Search for the firm on the FCA register, or on Open Banking Limited's regulated providers page. Open Banking Limited advises using only apps and websites run by regulated firms.
Is open banking the same as open finance?
No. Open banking covers payment accounts such as current accounts and credit cards. Open finance would extend the same consent-based model to products such as mortgages and pensions, and the FCA published its roadmap for it in April 2026.
Who runs open banking in the UK?
The FCA authorises and supervises the firms that offer open banking services. Open Banking Limited maintains the technical standard that the nine largest banks and building societies use under the CMA's 2017 Order. HM Treasury has said the FCA will get new powers over open banking's future.