Open banking explained

Open banking is a way of letting apps and services you choose see information from your bank account, or make payments from it, without you having to hand over your banking password. The Financial Conduct Authority describes it as "a secure and regulated way for people and businesses to share access to payments data from their bank account with trusted apps and services"¹. The Payment Systems Regulator explains the practical effect: it "allows people and businesses to link their accounts with third parties offering payment services", providing a secure and cost-effective alternative to using card networks².

It is not a bank, an account or a product in its own right. It is a set of rules and technical connections that the biggest UK banks must support, and that other banks and building societies have largely adopted as well. The Competition and Markets Authority mandated that nine of the UK's biggest banking providers must implement open banking for their retail and small business customers³. Since then it has grown quickly: the Payment Systems Regulator reports over 7 million active open banking users in the UK⁴, and by January 2024, 13% of digitally-active consumers were using open banking services to make payments or share their transaction data with third parties³.

What open banking is and what it lets you do

Open banking works by letting information held in your accounts be shared securely between organisations using Application Programming Interfaces, or APIs⁷. An API is a controlled channel between computer systems: your bank makes a limited, standardised set of data and payment functions available, and only firms authorised to use them can connect. Nothing is shared until you give explicit permission, and third-party providers need that explicit permission before they access your data⁵.

In practice, open banking lets you do two broad things. The first is data sharing: an app you have connected can read information such as your balance and transactions, usually to help you budget, compare products or verify your income. The second is payment initiation: a service can, with your permission, set up a payment that moves money directly from your bank account to a business or person, without a card in between. The Payment Systems Regulator describes these as account-to-account payments, which "move money directly from a payer's bank account to a payee's bank account without the need for intermediaries, such as credit or debit cards"².

The FCA also points to where this is heading. Open finance, its successor concept, "extends data-sharing principles to a wider range of services and products, from credit to mortgages, pensions and insurance, giving consumers greater control over their financial data"¹. Open banking today covers payment accounts; open finance would extend the same idea to products held elsewhere in your financial life.

What data you can share, and what stays private

The starting point is that nothing is shared unless you agree to it. Third-party providers need your explicit permission before they access your data, and you choose which account or accounts to connect⁵. The data that flows is the information held in the accounts you have chosen: typically your balance, your transactions and the account details needed to identify the account. It moves through the secure API channels described above, not through screenshots, statements or passwords⁷.

Two boundaries are worth knowing. First, your login credentials are never part of the deal. Your bank will never ask you for your PIN or your online account password, and neither will any trustworthy online retailer or service⁶. A genuine open banking connection works by redirecting you to your own bank's security process, where you approve the link, and the third-party firm then receives a limited token rather than your login.

Second, joint accounts have their own limits. Where an account is shared, the rules on disclosing information about payments made by a joint account holder allow, but do not force, the institution to give that information to the other holder⁸. In practice this means that if you connect a joint account to an app, the data the other holder's payments generate may be visible through the connection, and the bank has discretion about what it shares in response to a request. If you share a joint account, it is worth checking with your bank what its policy is before connecting it to a third-party service.

Pay by bank: paying straight from your account

Pay by bank is the payment side of open banking. Instead of typing a card number into a checkout, you choose the pay by bank option, are redirected to your own bank's app or website, log in as normal, and approve the payment. The money moves directly from your account to the business's account, with no card network involved².

Which? notes that pay by bank is used predominantly for one-off payments⁵. A real-world example of the scale it has reached: NS&I introduced pay by bank account as a way to top up its savings accounts, and its customers have used it to make over 5 million deposits worth over £25 billion⁹. To use it there, a customer needs an NS&I account that can be topped up online and a UK bank account that can be accessed online through the bank's app or website⁹.

The trade-off is protection. Which? warns that if you use open banking to make a payment to a business directly from your bank account, instead of using a debit or credit card, you lose Section 75 and chargeback⁵. Section 75 is the legal protection that makes a credit card provider jointly liable for purchases over £100 and up to £30,000, and chargeback is the card scheme process for disputing a card payment. Neither applies to a bank transfer, because there is no card in the transaction. Which? has warned shoppers to think carefully before using pay by bank for this reason¹⁰. For a payment to a business where something might go wrong with the order, a card may offer a route to a refund that pay by bank does not.

Budgeting, savings and borrowing apps that use open banking

The most common everyday use of open banking is apps that read your account data. Budgeting apps pull in balances and transactions from several banks at once, so you can see all your spending in one place without exporting statements. Savings services use the same connections to move money into a savings account from your current account, as NS&I's pay by bank option does⁹. Lenders and credit providers can use open banking to verify your income and outgoings from your actual account history, rather than relying only on a credit report, when assessing an application.

Most banks also have their own smartphone and tablet apps, available in the Google Play Store for Android devices and the App Store for Apple devices, which let you check your balance and send payments¹¹. Some banks have built open banking into their own apps too, so you can see accounts held with other banks inside one app. RBS, for example, describes open banking as an initiative designed to improve and enhance everyone's banking experience, and lets customers view eligible accounts from other providers alongside their RBS accounts⁷.

Research from the University of Bristol's Personal Finance Research Centre gives a sense of how far this has spread, and where it has not. There were over 300 regulated providers of open banking-enabled services in the UK in July 2024, compared with 135 in 2020³. But among consumers on lower incomes, the same research found little knowledge or awareness of open banking, and only a handful of focus group participants reported having used it³. Awareness, not availability, remains the gap for many people.

Open banking is free and optional for customers

Open banking is not compulsory. RBS states it plainly: although there are lots of benefits to open banking, it is not compulsory, and customers who take no action see nothing change⁷. If you never connect an app, your data is not shared and no payments are initiated. Nothing happens to your account by default.

For consumers, the connection itself is free. The costs of building and running open banking sit with banks and the third-party providers, some of which make their money from subscriptions, from fees paid by the businesses you pay, or from referrals. A third-party app may charge you for its own service, but that is the app's pricing, not a charge for open banking itself.

The wider support around banking is free too, where it matters. Basic bank accounts, the fee-free accounts that the largest banks must offer, are free to set up and use¹². The largest banks, including Barclays, Santander, Royal Bank of Scotland (including NatWest), HSBC, Nationwide, Co-operative Bank, Lloyds (including Halifax and Bank of Scotland), TSB and Virgin Money (including Clydesdale and Yorkshire Bank), have been required to offer fee-free basic bank accounts¹³, and certain banks must let undischarged bankrupts open a basic bank account for personal banking¹⁴. If you are refused a basic bank account and not told why, or you feel you have been turned down unfairly, you may be able to complain to the Financial Ombudsman Service¹⁵.

How to connect an app or service to your bank

The process is short, and the security check happens inside your bank's own systems, not the app's. To use open banking, you must be registered with online banking for each financial service provider you hold accounts with that you want to be able to view⁷. Online banking registration itself usually means registering via your bank's website, entering personal details, answering identity verification questions, entering an activation code sent by post or text, and setting up a username and secure password or passcode¹¹.

The steps in order:

1. Check the firm is genuine, using the Open Banking Directory at openbanking.org.uk, which provides a list of regulated firms and apps authorised to use open banking¹⁰.
2. In the app or service, choose the bank you want to connect. You will need online banking with that bank⁷.
3. You are redirected to your bank's own app or website, where you log in as normal and give your explicit permission for the connection⁵.
4. The app receives only the access you approved, through the secure API channel⁷.
5. Later, you can review or withdraw the permission through your bank's online banking or mobile app⁷.

At no point does the app see your password. The login happens between you and your bank, and the app receives a limited authorisation instead.

Who can use your data: FCA-regulated providers only

Only firms authorised by the Financial Conduct Authority can take part. The FCA publishes contact details for regulated financial businesses, and a firm's entry on the FCA's register shows whether it holds the permissions needed to provide payment or account information services¹⁶. The same principle runs through the regulatory system: the Financial Services Compensation Scheme only covers financial services firms that have been authorised by the FCA or the Prudential Regulation Authority to do business in the UK¹⁷, and specific activities can only be provided by firms that hold the specific FCA permission for that activity¹⁸.

For a consumer, the practical check is the Open Banking Directory. Searching it, at openbanking.org.uk, gives a list of regulated firms and apps authorised to use open banking¹⁰. If a service is not on the directory and not on the FCA register, it is not authorised to access your account data, and connecting it would mean sharing your banking login outside the regulated system, which is where the real risk lies.

The scale of the authorised market is large: over 300 regulated providers of open banking-enabled services were operating in the UK as of July 2024³. That number has more than doubled since 2020, when there were 135³.

Checking, changing or cancelling your connections

Participating banks and building societies should provide an authorisation dashboard, where you can see a list of providers with permission to access your account data, and you can withdraw permissions whenever you wish, at the press of a button⁵. RBS confirms the same from the bank's side: you can check or change your consents via your online banking or mobile app⁷.

If you want to end a connection, the steps are:

1. Open your bank's online banking or mobile app and find the authorisation dashboard, or the equivalent list of connected apps and consents⁵.
2. Find the third-party provider you want to remove.
3. Withdraw its permission. The firm's access to your data stops from that point⁵.
4. If you also want to stop using the app itself, delete your account with the provider, so it no longer holds data it collected while connected.

Withdrawing consent stops future access, but it does not delete data the firm has already collected. For that, you need to contact the third-party provider directly and ask it to delete what it holds. If the provider does not respond or refuses, that is a matter you can take to the Financial Ombudsman Service, as set out below.

Is open banking safe?

The regulated system is built around several layers of protection. Only FCA-authorised firms can connect¹⁶. Your explicit permission is required before any access⁵. Your bank never asks for your PIN or online account password, and neither will any trustworthy online retailer or service⁶. And the information that moves is protected and encrypted to the same level of security as the bank's own online banking, as RBS states of its open banking service⁷.

The risks sit mostly outside the regulated system. The danger is not open banking itself but imitations of it: a fake app or a phishing message that asks you to "connect your bank" by entering your login details on a page that is not your bank's. Because your bank will never ask for your PIN or online account password⁶, any request for those details is a warning sign regardless of who claims to be asking. The University of Bristol research found little knowledge or awareness of open banking among consumers on lower incomes³, and low awareness makes imitation scams easier, which is why checking the directory before connecting matters¹⁰.

One further point on safety: open banking does not give a connected firm the ability to move money at will. Payment initiation requires your approval for the payment in question, and data access is limited to what you consented to. The authorisation dashboard gives you a single place to see and cut off every connection⁵.

When a payment goes wrong

If a payment is taken through a third-party provider without your permission, the rules are strong. Your bank must refund you immediately, unless it has grounds to suspect fraud or negligence. If the third-party was at fault, the bank can recover the funds from them⁵. This comes from the payment services regulations, which require a bank to refund the amount of the unauthorised payment transaction to the payer and, where applicable, restore the debited payment account to the state it would have been in had the unauthorised payment transaction not taken place¹⁹.

Payments you authorised yourself are different. If you sent money to the wrong account, the outcome depends on whether the account exists. If it does not, the payment should fail and the money should automatically bounce back to you²⁰. If the account does exist, you will need to contact your bank to request your money back²⁰. Under the misdirected payments code of best practice, the code does not guarantee that you will always recover any money paid in error, but in most instances your bank should be able to get it back for you²⁰. The dedicated guide to paying money to the wrong person by mistake covers this in detail.

Where an unauthorised payment was taken from your bank account for a purchase over the internet, by telephone, TV or teletext, you may have a right to get your money back²¹, and the bank may be able to cancel the payment or put the money back into your account²². But remember the pay by bank gap: a payment you authorised to a business carries no Section 75 and no chargeback, so a dispute about the goods or services has to be taken up with the business itself⁵.

Where protection stops and how to complain

Open banking's protections stop at the regulated perimeter. A firm that is not on the Open Banking Directory or the FCA register is outside it entirely, and money shared with such a firm may have no route back through the payment rules. Even inside the system, an authorised pay by bank payment to a business that goes wrong leaves you without card-style protection⁵, and the misdirected payments code does not guarantee recovery of money sent in error²⁰.

If something goes wrong with an open banking service, the complaint route is clear. Complaints go first to the third-party provider the data was shared with, and if the provider does not resolve the issue, the Financial Ombudsman Service can consider it⁵. The ombudsman can look at complaints about bank accounts and bank cards, and about problems with loans²³, but it can only look at complaints about things the provider is responsible for²⁴. Its service is free and easy to use²³.

The ombudsman's workload gives a sense of the volume of banking disputes it handles: in the first quarter of 2026/27 it opened 2,103 complaints about personal loans and 33 about credit broking²⁵. Individuals and small businesses who feel they have been de-banked unfairly can also complain to the Financial Ombudsman Service if unsatisfied with how their bank deals with their complaint²⁶.

Free, impartial help is available at each stage. MoneyHelper provides free guidance on banking and basic bank accounts¹², and the Financial Ombudsman Service explains how to complain and provides its contact details¹⁶. If you are struggling rather than disputing, the ombudsman notes that discussing your options with your lender, while you are up to date with payments, will not have any impact on your credit file²⁷, and free debt advice charities can help before problems escalate.