Open Banking Regulations and Consumer Protections by Region

Open banking exists because regulators, not markets alone, forced banks to share customer data, but the rules vary sharply by country, shaping consumer rights, protections, and available services. In the EU and UK, open banking is mandatory, standardized, and backed by clear liability limits and strong authentication rules. In the U.S., it remains a delayed, market-led system under Section 1033 of the Dodd-Frank Act, with rules finalized in October 2024 but partially paused and under revision as of 2025. These differences determine whether data access is guaranteed, whether banks can charge fees, how disputes are resolved, and how safely your financial data is handled.

• EU & UK: Open banking is legally mandated under PSD2 and UK competition rules, with strict consent requirements, €50 liability caps for fraud, and mandatory strong customer authentication.
• United States: Data access rights exist under Section 1033, but implementation is delayed until at least 2026–2030 and may change, leaving fees, standards, and liability less defined.
• Standards matter: The UK uses a single national API standard, while the EU and U.S. rely on multiple industry or regional standards, affecting reliability and user experience.
• Global divergence: Countries like Brazil, Australia, and India show that strong central-bank or government-led frameworks can accelerate adoption and consumer protections.
• Where this is heading: Regulators are expanding from open banking to open finance, extending data-sharing rights to pensions, investments, insurance, and credit.

Open banking didn’t emerge organically from technological advancement or market forces. It required regulatory intervention, governments and financial authorities recognizing that the existing structure of banking stifled competition, locked consumers into incumbent institutions, and failed to enable the innovation that technology made possible. But regulatory approaches have varied significantly by jurisdiction, creating different frameworks with distinct consumer protections, implementation timelines, and competitive dynamics.

Understanding the regulatory landscape matters because it determines what rights you have, what protections apply when things go wrong, and what services are available in your region. The rules governing open banking aren’t uniform globally, and these differences have practical implications for anyone using or considering open banking services.

The United States: Market-Led Transition to Regulatory Framework

The United States is following a ‘market take the lead’ approach. For years, open banking has developed through market practices rather than regulatory mandate. Companies like Plaid and Yodlee provided aggregation services through bilateral agreements with banks or, where agreements didn’t exist, through screen scraping.

This market-led approach created innovation but also inconsistency. Security standards varied. Consumer protections were unclear. Banks and aggregators engaged in disputes about access, fees, and security responsibilities. The absence of clear regulatory framework left consumers uncertain about their rights and recourse when problems occurred.

Section 1033 of the Dodd-Frank Act, enacted in 2010, envisioned creating an open banking framework, but implementation took over a decade. The Consumer Financial Protection Bureau finally issued rules in October 2024, establishing consumers’ rights to access and share their financial data.

The CFPB’s Personal Financial Data Rights rule requires financial institutions to make consumer data available on request at no charge to consumers or authorized third parties. It establishes tiered compliance schedules, with larger institutions required to comply beginning April 2026 and full implementation envisaged by April 2030.

However, the rule’s future became uncertain following political changes. The rule was immediately challenged in federal court on grounds that the CFPB exceeded its statutory authority. Following the 2025 presidential inauguration, implementation was stayed to allow time for new CFPB leadership to be confirmed and potentially revise the rule.

By August 2025, the CFPB reopened rulemaking under Section 1033, revisiting core questions about who can access data, whether banks may charge fees, and what security standards should apply. This uncertainty has created challenges for the industry, with some banks signaling plans to impose fees and providers like Visa discontinuing US open banking services amid ongoing disputes.

The US approach differs from Europe and the UK in allowing industry standards bodies to define technical details rather than imposing government-built specifications. This could enable more flexible, market-responsive standards but also risks fragmentation if multiple competing standards emerge. Consumer protections under the US framework include data access rights and privacy requirements, but specific liability frameworks and consumer recourse mechanisms remain less clearly defined than in European jurisdictions.

The European Union: Regulatory Mandate Through PSD2

The European Union took the most prescriptive regulatory approach through the revised Payment Services Directive, commonly known as PSD2. This directive came into force on 13 January 2018, establishing a comprehensive framework for open banking across all 27 member states and the broader European Economic Area.

PSD2’s core requirement is explicit: banks must provide access to customer account data and payment initiation capabilities to licensed third-party providers. This isn’t optional or market-driven. It’s a legal mandate with regulatory oversight and enforcement mechanisms. Banks that fail to provide adequate APIs face regulatory action from national financial authorities.

The consumer protections embedded in PSD2 are substantial. Strong Customer Authentication requirements mandate multi-factor authentication for electronic payments and account access, significantly reducing fraud compared to single-password systems. Consumer liability for unauthorized transactions is capped at €50, and in many circumstances consumers bear no liability at all if they report issues promptly.

The directive explicitly addresses consent management. Consumers must provide explicit consent for third parties to access their data or initiate payments. This consent must be informed, services must clearly explain what they’re accessing and why. Consent is time-limited, typically to 90 days, after which it must be renewed. And consumers retain the absolute right to revoke consent at any time.

Data minimization principles require that third parties request only the data necessary for their stated purpose. A budgeting app that only needs transaction categories shouldn’t demand access to standing order details or payee information. While enforcement of these principles varies across member states, the legal framework establishes clear expectations.

The challenge with PSD2 lies in implementation fragmentation. While the directive sets requirements, each member state interprets and enforces them somewhat differently. Multiple API standards coexist across Europe, the Berlin Group’s NextGenPSD2, France’s STET standard, and various proprietary implementations, creating technical inconsistencies that complicate service delivery for providers operating across borders and sometimes creating poor user experiences.

The European Union is now developing its next-generation framework. PSD3 and the Payment Services Regulation aim to harmonize rules, strengthen consumer protection, and create more level playing fields between banks and fintechs. These updated regulations are expected to address gaps and inconsistencies identified during PSD2’s implementation.

The United Kingdom: Competition-Driven Standards

The UK was part of the EU when PSD2 passed, but layered additional requirements driven by competition rather than payment services regulation. In 2016, following a market investigation, the Competition and Markets Authority ordered the nine largest UK banks to adopt a common API standard and share data with authorized third parties.

This mandate led to the creation of the Open Banking Implementation Entity, tasked with developing detailed technical standards, security protocols, and customer experience guidelines. The result is one of the most mature and standardized open banking ecosystems globally, with consistent API specifications, uniform security requirements, and standardized user flows.

UK consumer protections mirror many of PSD2’s provisions, Strong Customer Authentication, liability caps for unauthorized transactions, explicit informed consent, time-limited authorizations, and revocation rights. But the UK’s approach adds emphasis on customer experience through detailed guidelines that specify how services should present information, manage consent screens, and handle error conditions.

UK open banking has achieved significant adoption. By early 2025, industry reporting indicated approximately 13 million users and tens of millions of open banking payments processed monthly. In September 2024, the CMA confirmed completion of the final Open Banking Roadmap, meaning all nine mandated providers had delivered the required functionality.

The governance structure is evolving. The Financial Conduct Authority will act as the UK’s regulator for open banking going forward, ensuring effective engagement with other authorities. The FCA and Payment Systems Regulator are working together to advance the next phase, including expanded Variable Recurring Payments and the transition toward open finance.

Looking ahead, the UK envisions moving beyond open banking to open finance, where sharing extends to pensions, investments, insurance, and mortgages. The FCA expects regulatory foundations for the first open finance scheme to be in place by the end of 2027, representing the natural evolution of the framework.

Other Jurisdictions: Varied Approaches

Beyond these three major frameworks, open banking has developed differently across other regions, each reflecting local regulatory philosophies, market structures, and policy priorities.

Brazil has emerged as a global leader through its comprehensive open finance framework introduced in 2021. The regulatory approach extends beyond banking to include credit, insurance, investments, and pensions. Integration with Pix, Brazil’s instant payment system, has driven strong adoption, with the country processing significant transaction volumes and demonstrating how central bank leadership can rapidly transform payment ecosystems.

Australia implemented open banking through its Consumer Data Right framework, which takes a broader “smart data” approach applicable beyond financial services. The CDR gives consumers rights over their data across multiple sectors, with banking as the first implementation. The framework includes both reading and writing capabilities, representing an ambitious vision of consumer data control.

Singapore established the Financial Data Exchange, enabling cross-sector financial data sharing between banks, government agencies, and insurers. This model emphasizes government coordination and public-private partnership, with expansion into investment and pension data underway.

India’s Account Aggregator framework provides a consent-based mechanism for individuals and businesses to share financial data across banks, insurers, and non-bank lenders. Combined with the Unified Payments Interface, which processed $2.2 trillion in transactions in 2023, India demonstrates how emerging markets can bypass traditional card-based systems through digital infrastructure.

As of December 2024, 60 jurisdictions worldwide have implemented open banking rules, according to research from Cambridge Centre for Alternative Finance. This global proliferation reflects widespread recognition of open banking’s potential benefits, though implementation quality and adoption rates vary considerably.

Cross-Border Challenges and Opportunities

The fragmentation of regulatory approaches creates both challenges and opportunities. For consumers using services across borders, understanding which protections apply and which services are available requires navigating different regulatory frameworks. A fintech authorized in one EU member state can operate across others through passporting rights, but an EU-authorized service cannot automatically operate in the UK or US without separate authorization.

For service providers, regulatory fragmentation means different compliance requirements, technical standards, and consumer protection obligations in different markets. Building a service that works across Europe, the UK, and the US requires managing these variations, potentially limiting which providers can achieve global scale.

Yet this fragmentation also enables regulatory experimentation. Jurisdictions can learn from each other’s successes and mistakes. The UK’s emphasis on standardized user experience informed later European thinking. Brazil’s success with instant payments integrated into open banking provides lessons for other regions. The US market-led approach may reveal whether industry standards can achieve outcomes comparable to mandated specifications.

The Future: Toward Open Finance

Across jurisdictions, the regulatory trajectory points toward expanding open banking into open finance. The EU’s Financial Data Access framework would enable sharing broader data beyond payment accounts, including information from credit institutions, investment firms, and insurance companies. The UK is building foundations for open finance through its Smart Data initiative and the Data (Use and Access) Bill.

This expansion raises new regulatory questions. How do consumer protections need to adapt when data sharing extends to pensions and insurance? What happens when financial data is combined with non-financial data like property or energy information? How can regulators ensure innovation while preventing the creation of dominant platforms that could recreate the market concentration open banking was meant to address?

In March 2025, the UK’s FCA ran a sprint bringing together over 100 stakeholders to explore foundations needed for open finance. Participants identified key building blocks including data portability and standardization, interoperability, transparent consent, and robust frameworks for trust and accountability. The collaborative approach reflects recognition that open finance success requires coordination across regulators, financial firms, fintechs, technology providers, and consumer organizations.

Understanding Your Rights

For consumers, understanding which regulatory framework applies to your situation determines what rights and protections you can rely upon. If you’re in the EU, you have explicit rights under PSD2 with clear liability caps and strong authentication requirements. In the UK, you benefit from both PSD2-equivalent protections and the standardized Open Banking framework with its detailed customer experience guidelines.

In the US, the situation is more fluid as new regulations take shape, but you have data access rights under Section 1033 once implemented, along with existing consumer financial protection laws. The specific privacy protections, security requirements, and liability frameworks continue evolving as the CFPB finalizes its approach.

Regardless of jurisdiction, certain principles apply universally in legitimate open banking services. You should always provide explicit consent before any data sharing begins. You should understand what data is being shared and for what purpose. You should be able to revoke access at any time. Services should implement strong security measures including encrypted communications and authentication protocols. And there should be clear processes for raising concerns or reporting problems.

When something goes wrong, unauthorized access, service failures, disputed transactions, knowing where to turn depends on your regulatory environment. In the EU and UK, national financial regulators oversee open banking providers and can investigate complaints. In the US, the CFPB handles consumer complaints about financial services. Most jurisdictions also have financial ombudsman services providing dispute resolution.

The regulatory landscape for open banking remains dynamic, with frameworks evolving to address gaps, extend scope, and respond to emerging technologies and business models. Staying informed about regulatory changes in your jurisdiction helps you understand your rights, assess whether services meet required standards, and know where to seek recourse when needed. Open banking’s promise of consumer empowerment depends not just on technology but on regulatory frameworks that protect consumers while enabling innovation.

This topic is part of the broader banking system. For a complete explanation of accounts, transfers, fees, and consumer protections, see our Banking & Cash Management guide.