What Is Open Banking? How It Works and What It Shares

Open banking lets you instruct your bank to share your account data with, or start a payment for, a regulated app you choose, through a secure connection rather than by handing over your login. It is why a budgeting app can show all your accounts in one place and why an online checkout can offer "pay by bank" instead of a card. In the EU and UK it rests on payments law (PSD2), which limits what a data-reading app may access and use; in the UK, Open Banking Limited reported 40.16 million open banking payments and 18.81 million user connections in June 2026. Outside Europe the picture is patchier: the United States' data-rights rule has been under reconsideration since August 2025.

This guide explains the two things open banking actually does, the legal limits on apps that read your data, what the UK numbers show, and how to grant and revoke access safely.

The Two Things Open Banking Does

	Account information (reading data)	Payment initiation (moving money)
What it does	Lets an app read balances and transactions from accounts you choose	Lets an app start a payment from your account, which you approve in your bank's app
Typical uses	Budgeting apps, affordability checks, accounting software, switching tools	Pay-by-bank at checkout, paying a bill, topping up another account
Who provides it	A regulated account information service provider	A regulated payment initiation service provider
What you approve	Which accounts, what data, for how long	Each payment, or a set of payments within limits you agree

Keeping the two apart helps with the most common worry. An app that only reads data cannot move your money; moving money needs payment initiation, and each payment or mandate is approved with your bank.

What the Law Says a Data-Reading App May Do

In the EU, Article 67(2) of the revised Payment Services Directive (Directive (EU) 2015/2366) sets out obligations for account information service providers. They must:

provide services only on your "explicit consent";
keep your security credentials away from other parties;
identify themselves to your bank in each session;
"access only the information from designated payment accounts and associated payment transactions";
"not request sensitive payment data linked to the payment accounts"; and
not use, access or store data "for purposes other than for performing the account information service".

In practice that means a budgeting app you connect to one account should not see others you did not choose, and should not repurpose your data. The UK's rules were originally built on the same directive.

What the UK Numbers Show

Open Banking Limited, the body that set up the UK standard, publishes monthly figures for the nine largest banks. From its release of 30 July 2026:

Measure	Figure
Open banking payments in June 2026	40.16 million
of which single domestic payments	32.43 million
Sweeping variable recurring payments (VRPs) in June 2026	7.73 million, up 6.7% on the month
User connections in June 2026	18.81 million
Cumulative payments since launch	More than 1 billion
Cumulative API calls since launch	More than 100 billion

Two cautions about reading these. "User connections" is not necessarily the same as unique people, because one person can connect several apps. And the figures cover the largest banks reporting to Open Banking Limited, not every provider in the country.

A Worked Example: Sweeping With a VRP

Sweeping is the use of variable recurring payments to move money between your own accounts automatically, within limits you set once. The figures here are illustrative.

Say you want to keep 500 in your current account and move anything above that into savings at another bank each Friday. You set a VRP mandate from the current account with a maximum of 1,000 per payment and 3,000 per month.

Friday 1: balance 1,400. The app sweeps 1,400 - 500 = 900, within the 1,000 cap.
Friday 2: balance 2,100 after payday. The app could sweep 1,600, but the per-payment cap is 1,000, so it moves 1,000 and leaves 1,100.
By Friday 4, if 3,000 has already moved that month, the mandate stops until the next month starts.

The limits are the protection: the app can never move more than you agreed. If you want to move money into a higher-paying savings account automatically, a sweep like this is one way to do it; our high-yield savings guide covers where that money could go.

Open Banking Outside Europe

United States. The Consumer Financial Protection Bureau's personal financial data rights rule under section 1033 is being reconsidered: its advance notice of proposed rulemaking, dated 22 August 2025, asks for comments on who can act as a consumer's representative, fees, data security and data privacy. Check the CFPB's rulemaking page for the current position.
Elsewhere. Several countries run their own frameworks, often under the name "open finance" when they extend beyond bank accounts to savings, investments and insurance. Rules, coverage and consent processes differ, so check your own regulator's guidance.

How Open Banking Shapes Neobanks

Much of what feels seamless about app-based banks depends on these connections: reading your old account to help you switch, showing external accounts in one view, and letting you pay by bank. If you are moving your main account, our bank switching guide explains how the transfer of payments works, and our best neobanks of 2026 compares the apps themselves. Open banking is also one of the rails described in our guide to embedded finance, where financial services sit inside non-financial apps.

Granting and Revoking Access Safely

Connect only regulated providers. Check the provider's name on your regulator's register before you connect; our neobank safety guide shows how.
Read the consent screen. It should name the accounts, the data and the duration. Untick anything you do not need.
Never type your bank password into the app. A genuine open banking connection sends you to your bank's own app or website to approve.
Review connections regularly. Your bank's app usually lists the third parties with access; remove any you no longer use, and also revoke access inside the third-party app.
Keep payment mandates tight. For VRPs, set per-payment and monthly caps that match what you actually need.

Frequently Asked Questions

Is open banking safe?

It is designed to be safer than sharing passwords: you approve access with your bank, the app sees only the accounts and data you choose, and in the EU and UK providers must be authorised. The main risks are connecting an unregulated app and approving more access than you need.

Can an open banking app take money from my account?

Only if it provides payment initiation and you approve each payment or a mandate with limits. An app that only reads account information cannot move money.

How many people use open banking?

In the UK, Open Banking Limited reported 18.81 million user connections and 40.16 million payments in June 2026. User connections are not necessarily unique people.

How do I stop an app from accessing my bank data?

Remove it from the list of connected third parties in your bank's app and revoke access inside the app itself.

This is general information, not financial advice. Only connect regulated, authorised providers, and remember that data-sharing consent is separate from deposit protection or investment risk on any product you hold.