From Open Banking to Open Finance: PSD3, the PSR, FDX and the Section 1033 Saga

Open banking began with a simple idea: customers own their account data and should be able to share it with a provider of their choice, and to let that provider initiate payments on their behalf. In Europe, the second Payment Services Directive (PSD2) wrote that idea into law, applying from January 2018. In the UK, a Competition and Markets Authority order required the largest banks to build standardized APIs. Other markets, from Australia to Brazil, followed with their own frameworks.

Almost a decade later, the results are real but uneven. Account aggregation, affordability checks and pay-by-bank have become established products. Yet many third-party providers still cite unreliable bank APIs, inconsistent customer journeys and limited commercial incentives for banks as reasons adoption has lagged expectations. The next wave of regulation is aimed squarely at those problems, and at extending data sharing beyond payment accounts.

Europe: PSD3 and the Payment Services Regulation

In June 2023, the European Commission proposed splitting its payments framework in two. A revised directive, PSD3, would govern the licensing and supervision of payment and e-money institutions. A new Payment Services Regulation (PSR) would set conduct rules directly, including those governing open-banking access, without the need for national transposition.

The shift from directive to regulation matters. Under PSD2, differing national interpretations created friction for providers operating across borders. A directly applicable regulation should narrow those differences. Among the open-banking changes discussed during the legislative process are stronger requirements on the performance and availability of banks' dedicated interfaces, clearer rules against obstacles that make third-party journeys worse than a bank's own, and permission dashboards that let customers see and revoke access they have granted.

The package has moved through the EU legislative process since then, with the institutions working toward a final agreement. Final texts, and the transition periods that will follow formal adoption, determine when obligations actually bite. Providers should plan on the basis of adopted texts rather than proposals.

Beyond payments: open finance

Alongside PSD3 and the PSR, the Commission proposed a framework for financial data access (often referred to as FIDA) that would extend data-sharing rights to savings, investments, pensions and insurance. Its scope and future have been debated, and readers should check its current status. The UK is pursuing its own route, with powers for smart-data schemes across sectors and a program of work on the next phase of open banking, including commercial variable recurring payments.

Open banking proved that customers will share data when the value is clear. Open finance tests whether that logic extends to the parts of their financial lives they rarely look at.

The United States: FDX and Section 1033

The US took a different path. For years, data sharing relied largely on screen scraping, with aggregators logging into bank websites using customers' credentials. The industry responded by developing a common API specification through the Financial Data Exchange (FDX), and many large banks and aggregators have migrated to token-based API access.

Regulation arrived later. Section 1033 of the Dodd-Frank Act gives consumers a right to access their financial data, and in October 2024 the Consumer Financial Protection Bureau issued a final rule implementing it for many deposit accounts, credit cards and payment accounts. The rule required covered institutions to make data available through developer interfaces, restricted secondary use of data by third parties and phased in compliance by institution size. The bureau also recognized FDX as a standard-setting body under the rule's framework in early 2025.

The rule's path since then has been turbulent. It was challenged in court by banking groups, and in 2025 the bureau moved to reconsider it, with compliance dates affected as a result. The underlying questions, including whether banks may charge for data access and how liability is allocated when data is misused, remain live. Product teams should treat the timetable as uncertain while continuing to build on FDX-style APIs, which are becoming the market norm regardless of the rule's final shape.

What product teams should do now

Regardless of jurisdiction, several design choices look robust.

• Build consent as a first-class component: clear scopes, durations, revocation and a user-facing record of what has been shared.
• Minimize data: request only the fields a use case needs, and document why.
• Instrument API reliability bank by bank, so that performance problems can be evidenced when new rules provide a route to raise them.
• Prepare for payments, not just data. Variable recurring payments and pay-by-bank are where commercial value is increasingly concentrated.

The bigger picture

Open banking regulation has shifted from a question of whether banks must share data to how well they must do it and who pays. Europe is betting on tighter, directly applicable rules. The UK is layering commercial frameworks on top of its regulated foundation. The US is working through a contested rulemaking while the market standardizes on its own. The winners in every market will be the providers that make data sharing feel safe and simple enough that customers barely notice it is happening.