By mid-2023, Open Banking in the UK has been live for five years. The Open Banking Implementation Entity has published its final report and wound down its mandate; the newly formed Joint Regulatory Oversight Committee — the FCA and PSR jointly — has taken over the direction of the next phase. This transition is a useful moment to assess not just what Open Banking has achieved but where the original design made assumptions that turned out to be wrong, and what the corrected architecture of the next phase needs to address.
The most significant gap between PSD2’s intent and the market that actually developed is on the commercial model for data sharing. PSD2 established the legal right to share account data but did not create a commercial framework for compensating banks for providing that access. The implication — which the original policy design treated as unproblematic — was that banks would provide Open Banking APIs as a regulatory cost, and third parties would build commercial products on top of them without any revenue sharing with the data source. Banks, unsurprisingly, invested the minimum required to meet the regulatory standard in their API implementations rather than investing to make those APIs genuinely competitive. The result is a market where the regulatory right to data access exists but where the API quality is highly variable and where the banks providing the best API implementations receive no commercial reward for that investment.
The liability framework is the second major gap. When a payment initiation under Open Banking fails — the customer authenticated, the payment was instructed, but the funds did not arrive — the liability allocation between the payment initiation service provider, the account servicing payment service provider (the bank), and the payment recipient is governed by the Payment Services Regulations and is, in practice, frequently contested. The rules exist but the dispute resolution infrastructure to apply them efficiently does not. A merchant that has instructed a payment under Open Banking and sees it fail has no equivalent to the card scheme chargeback process — no standardised claim form, no defined timeline, no scheme arbitration. This absence of an operational dispute resolution layer is one of the most concrete factors limiting Open Banking payment initiation adoption at scale in consumer-facing use cases.
PSD3, which the European Commission published as a draft directive in June 2023 and which will influence UK post-Brexit regulatory thinking regardless of direct applicability, addresses both of these gaps more directly than its predecessor. The draft includes provisions for financial compensation to banks for Open Banking data provision, a clearer liability allocation for payment initiation failures, and a mandate for premium-tier APIs with defined performance standards. If the UK’s JROC-led Open Banking roadmap moves in a similar direction — and the indications from the PSR’s engagement suggest it will — the commercial infrastructure that PSD2 failed to create will be mandated rather than left to market development.
The next phase of Open Banking will also need to address variable recurring payments at the commercial level. The mandatory VRP framework, currently limited to sweeping use cases, represents a fundamental change to the direct debit and standing order ecosystem if extended to commercial payments. A VRP-based subscription billing infrastructure would allow a business to debit a customer’s account for a variable amount within agreed parameters — without a monthly billing file, without a seven-day advance notice requirement, and with real-time settlement rather than the two to three day clearing window of BACS direct debit. The infrastructure companies building reconciliation, consent management, and customer notification tooling for VRP are positioning for a product category that does not fully exist yet. That is, in our view, exactly the right time to be building it.