← Payment Reference GuidesOpen Banking Reference

Open Banking & PSD2 Flows

How regulated third parties access bank accounts and initiate payments on a customer's behalf — the PSD2 roles, the consent and SCA flows, the FAPI security profile, and the regional API standards (UK Open Banking, Berlin Group, STET) that implement them.

What is Open Banking?

Open Banking is the regulated practice of letting customers share their bank data and initiate payments through licensed third parties via secure APIs. In the EU/EEA it is mandated by PSD2 (the revised Payment Services Directive, in force since 2018), which forces account-holding banks (ASPSPs) to expose two capabilities to authorised third-party providers (TPPs): read access to account information, and the ability to initiate payments — both only with the customer's explicit consent and Strong Customer Authentication.

AIS

Account Information

Read balances and transaction history across a customer's accounts to power budgeting, lending decisions, accounting, and account aggregation.

PIS

Payment Initiation

Push a credit-transfer (e.g. SEPA Credit Transfer / Faster Payments) directly from the customer's bank account — an account-to-account alternative to card rails.

CBPII

Funds Confirmation

A yes/no check that sufficient funds are available, used by card-based payment instruments issued by third parties.

Account-to-account (A2A) vs cards. PIS bypasses the card networks entirely: funds move bank-to-bank over domestic rails, so there is no interchange and settlement is often near-instant. This is why A2A and "Pay by Bank" are growing fast in Europe, the UK, Brazil (Pix), and India (UPI).

Put it into practice

Next steps

ToolIBAN ValidatorValidate IBANs against the SWIFT IBAN Registry (89 countries): length, BBAN structure and MOD 97-10 check digits; extracts country, check digits and BBAN.Open the tool ToolVerification of Payee SimulatorPlay the Responding PSP in the EPC Verification Of Payee scheme: payee name + IBAN versus the name on file → MTCH / CMTC / NMTC / NOAP, with every normalisation and similarity step explained.Open the tool ToolISO 20022 ValidatorValidate pain.001, pacs.008, pacs.002, pacs.004 returns, camt.053 and camt.054: mandatory elements, data types, IBAN/BIC, totals, return reasons and statement balances, plus CBPR+ and SEPA rules.Open the tool FlowOpen banking consent and payment flowsSee the animated message flow, step by step, between every party involved.Watch the flow

Keep reading

Authentication3D Secure (EMV 3DS)Authentication flows, message types, ECI values, SCA exemptionsRead article IdentityEUDI Wallet & PaymentseIDAS 2.0 deadlines, the SD-JWT VC / mdoc / OID4VP stack, wallet-based PSD2 SCARead article Card RailsSettlement & ClearingClearing files, net settlement, dispute timelines, interchange economicsRead article Crypto Railsx402 Payment ProtocolHTTP 402 as a payment rail: quote/sign/verify/settle, PAYMENT-* headers, EIP-3009Read article

Common questions

What is the difference between an AISP and a PISP?

An AISP reads account data (balances, transactions) with the customer's consent; a PISP initiates payments from the customer's account. Both are regulated PSD2 third-party providers identified by eIDAS certificates.

How does SCA work in open banking?

The customer authenticates with their own bank — usually via a redirect to the bank's app or web authentication — using two factors, with the amount and payee displayed for payment initiation (dynamic linking).

What is FAPI?

The Financial-grade API security profile: a hardened set of OAuth 2 / OIDC constraints (mTLS, PAR, PKCE, sender-constrained tokens) that open banking ecosystems mandate for their APIs.

Do open banking payments have chargebacks?

No — pay-by-bank transactions are credit transfers, so card-style chargebacks do not apply; recourse runs through transfer recall procedures instead.