Coverage: February 2025 · Information to 9 February 2025
Originally Published as TGB Premium Intelligence
This report was first made available exclusively to TGB Premium subscribers. It is now available as open access as part of TGB's research archive.
TGB Monthly Regulatory Policy Brief · 9 February 2025
Between June 2024 and February 2025 the United States finalised its personal financial data rights rule, Brazil widened mandatory Open Finance participation, the UAE made open finance compulsory and the UK named the FCA as its future open banking regulator, yet the regimes still differ on payments, pricing, liability and timing.
The desk view
The direction of travel is the same almost everywhere: customer-permissioned data sharing through APIs, with screen scraping being pushed out. The design is not. The US rule mandates free data access but does not require payment initiation; Brazil, the UAE and Saudi Arabia have built payment initiation into their frameworks; the UK is moving open banking under the FCA; the EU's PSD3, PSR and FIDA proposals are still in the legislative process; and Australia has reset a regime whose costs, its Assistant Treasurer said, massively exceed original estimates. For banks with cross-border operations, the practical consequence is several API builds, consent models and liability regimes on different timetables, the first hard US deadline falling on 1 April 2026. Who pays for interfaces is also unsettled: the US and Canada require free access, while FIDA and the UK government contemplate compensation.
One idea, many legal routes
The Basel Committee on Banking Supervision's May 2024 report on the digitalisation of finance describes open banking and open finance regimes as varying along several lines: whether they are mandatory or voluntary, and regulatory-led or market-driven; their scope; the types of data that must be shared; whether API use and common protocols are mandated; the form and duration of consent; the licensing of third parties; and the distribution of costs. Their aims can include fostering innovation, improving competition and promoting financial inclusion.
The Committee sets out the bank-side case for APIs plainly. They are generally considered more secure than other data-sharing techniques and can give banks greater control over how customer data are accessed and by whom. In some jurisdictions banks must already use more secure methods, such as tokenised authentication through APIs, rather than screen scraping for certain types of account. Where sharing is reciprocal, banks may also be able to increase their knowledge of customers. The Committee also flags a supervisory gap: bank oversight of third parties can be limited where the third party has no regulatory authorisation, as under certain open banking frameworks.
United States: a free-access mandate phased to 2030
On 22 October 2024 the Consumer Financial Protection Bureau (CFPB) finalised its Personal Financial Data Rights rule. The rule requires financial institutions, card issuers and other providers to make a consumer's personal financial data available and to transfer it to another provider at the consumer's request, for free. It activates Section 1033 of the Consumer Financial Protection Act, an authority enacted by Congress in 2010 that had lain dormant. The data covered are those associated with bank accounts, credit cards, mobile wallets, payment apps and other financial products, and include transaction information, account balances, information needed to initiate payments, upcoming bill information and basic account verification information.
The privacy and consent terms are tight. Third parties may collect, use or retain data only to deliver the product the consumer asked for, and access can last no more than one year without express reauthorisation. When a consumer revokes access, it must end immediately, with deletion as the default. On the data-provider side, a bank cannot meet its obligation by letting third parties use screen scraping and must not unreasonably restrict how often it responds to authorised third parties' requests. The final rule sets a minimum developer-interface response rate of 99.5%.
The rule's limits matter as much as its reach. It requires data providers to share information but does not require them to let third parties initiate payments with it. In that respect the US mandate is narrower than the frameworks in Brazil and the UAE, where payment initiation is part of the regime.
The rule was published in the Federal Register on 18 November 2024 and took effect on 17 January 2025, but compliance is phased by size. The largest institutions must comply by 1 April 2026 and the smallest covered institutions by 1 April 2030, a span of four years; certain small banks and credit unions are not covered.
Compliance dates under the US Personal Financial Data Rights rule
| Tier | Data providers covered | Compliance date |
|---|---|---|
| 1 | Depository institutions with at least $250 billion in total assets; nondepository providers with at least $10 billion in total receipts in 2023 or 2024 | 1 April 2026 |
| 2 | Depository institutions with $10 billion to less than $250 billion in total assets; nondepository providers below the tier 1 receipts threshold | 1 April 2027 |
| 3 | Depository institutions with $3 billion to less than $10 billion in total assets | 1 April 2028 |
| 4 | Depository institutions with $1.5 billion to less than $3 billion in total assets | 1 April 2029 |
| 5 | Depository institutions with more than $850 million but less than $1.5 billion in total assets | 1 April 2030 |
The baseline the rule starts from is large and still dominated by credentials. The CFPB estimates that at least 100 million consumers had authorised a third party to access their account data as of 2022. At the end of 2022 only an estimated 5% to 10% of data providers offered credential-free APIs, up from less than 1% in 2021. Even among depositories with more than $10 billion in assets, only 10% to 20% had credential-free APIs at the end of 2022. That size band spans the first two tiers, whose deadlines are 1 April 2026 and 1 April 2027. The standards architecture is industry-led. On 8 January 2025 the CFPB approved FDX's application, filed on 16 September 2024, for recognition as a standard setter under the rule. FDX operates in the United States and Canada and has more than 200 member organisations.
European Union: PSD2 still governs while three files wait
On 28 June 2023 the European Commission proposed to turn the Payment Services Directive (PSD2) into PSD3 and to create a directly applicable Payment Services Regulation (PSR). The package aims to improve the functioning of open banking by removing remaining obstacles and improving customers' control over their payment data.
The same day the Commission proposed a Financial Data Access (FIDA) regulation, which would oblige data holders such as financial institutions to make customer data available to data users, with customer permission, beyond payment accounts. FIDA would require dedicated permission dashboards and membership of financial data sharing schemes that set standards, liability and dispute resolution. It would let data holders receive reasonable compensation for high-quality interfaces, with smaller firms paying only at cost.
The European Parliament adopted its position on the PSR on 23 April 2024 by 511 votes to 22 with 75 abstentions, and on the directive by 484 votes to 8 with 118 abstentions. Its text says customers must give permission for their personal data to be processed and should be able to opt out of data sharing or withdraw access.
On FIDA, Parliament's Economic and Monetary Affairs Committee adopted its position on 18 April 2024 by 43 votes to 1 with 5 abstentions. The committee would bring holdings of savings, investments in financial instruments and insurance-based investment products into scope while excluding data on sickness and health cover. It proposed that gatekeepers designated under the Digital Markets Act, listed as Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft, should not be eligible to become financial information service providers. It backed compensation for data holders covering the costs of providing access and of building and maintaining APIs. It also wanted to give small firms 12 more months to apply the rules.
Work on all three proposals passed to the Parliament elected on 6-9 June 2024. Until the proposals are adopted, the operative EU regime remains PSD2, under which third parties can already initiate payments. For EU banks the open questions are the scope of FIDA, whether gatekeepers are excluded and how far compensation for APIs survives the negotiations.
United Kingdom: from the CMA Order to an FCA-led scheme
The UK built open banking on the Payment Services Regulations and the 2017 CMA order, through which, HM Treasury says, the UK led the way in making customer data available to authorised third parties through a standard set of API standards. On 9 September 2024 the Competition and Markets Authority (CMA) determined that all nine banking providers subject to the 2017 Retail Banking Market Investigation Order, the CMA9, had completed the implementation phase of the Open Banking Roadmap, later than anticipated. The last two, Allied Irish Bank and Bank of Ireland, completed variable recurring payments (VRPs) for sweeping. The CMA said development beyond the Order was being taken forward by the Joint Regulatory Oversight Committee (JROC).
HM Treasury's National Payments Vision of 14 November 2024 put the number of current UK open banking users at 11 million. HMRC alone has taken more than 10 million payments worth almost £33 billion through open banking. The Vision was frank about governance: progress through JROC has been slow, partly because of uncertainty about the future regulatory direction, and firms report that engaging with it has been challenging. JROC, intended as temporary, will be wound down at the earliest opportunity.
The government has asked the Financial Conduct Authority (FCA) to be the UK's open banking regulator, as envisaged by the Data (Use and Access) Bill. The long-term framework will include a new central body to take on and expand the role of Open Banking Limited, with the FCA as sole regulator of that body and of the open banking smart data scheme.
The Vision also opens the commercial question. The government agrees with the Garner Review that open banking's current economics give data holders little incentive to invest beyond the regulatory minimum of the CMA Order, and wants premium services beyond the Order to run on a commercial model. The Payment Systems Regulator has led work on a commercial model for the first phase of VRPs, whose pilot is confined to a limited number of lower-risk use cases such as paying bills. The government treats open banking account-to-account payments for e-commerce as a strategic short to medium term priority and has asked the FCA to start work on that commercial model in parallel with the pilot. It will consider reciprocal obligations or reasonable compensation where certain APIs are accessed at significant scale, while committing to protect existing fintech business models. Card payments currently offer greater consumer protection than bank transfers.
The Data (Use and Access) Bill was introduced on 23 October 2024, with the government saying it would create the conditions to support the future of open banking and new smart data schemes. The Bill completed its House of Lords stages on 5 February 2025 and was sent to the House of Commons.
Canada and Australia: one building, one resetting
Canada announced an initial consumer-driven banking framework in Budget 2024 and passed the Consumer-Driven Banking Act in June 2024. About nine million Canadians share financial data by giving their banking credentials to service providers, and the government aims to launch the framework in early 2026.
The Canadian design is prescriptive. Participation will initially be mandatory for banks above a specified retail-volume threshold, all participants will be supervised by the Financial Consumer Agency of Canada (FCAC), and a single technical standard will be mandated. All entities will be subject to reciprocal access as a condition of entry and continued participation, in-scope data will be shared free of charge, and consent must be reconfirmed every 12 months or after certain events. Payment initiation may be added later, and the prohibition of screen scraping is to come into force only once the framework is fully operational.
Australia moved the other way. On 9 August 2024 the government announced a reset of the Consumer Data Right (CDR), releasing an independent compliance-costs review that found the regulatory costs of implementing the CDR on its current track to be substantial. The Assistant Treasurer said costs massively exceeded original estimates, that the burden on small customer-owned banks was acute and that consumer take-up had been low, describing the regime as "a good idea, badly executed". He also said businesses were not incentivised to use CDR data for key use cases such as lending and energy switching, and that screen scraping, with its potential consumer harms, had continued to be used.
The reset narrows and refocuses rather than abandons the regime. The priority use cases are consumer finance and borrowing, energy switching and accounting services for small businesses. Proposed rule changes would let consumers give multiple consents in a single action. The government signalled that it would extend the CDR to non-bank lending in early 2025 and make that operational by mid-2026. The government said it would not rush to declare new action types until the CDR was back on track. Treasury was also asked to advise over the following 12 months on a full and formal ban of screen scraping.
Brazil and the Gulf: central banks write the rules
Brazil's Open Finance completed three years of operation in 2024. It covers two kinds of sharing: data, and services, the latter so far limited to payment initiation. Under the rules in force in June 2024 only institutions in prudential segments S1 and S2 were mandatory participants in data sharing. The central bank said that criterion covered about 51% of existing financial relationships and that the resulting lack of a level playing field increased the risk of regulatory arbitrage.
Joint Resolution No 10 of 4 July 2024 responded on several fronts. From 1 January 2025, institutions and conglomerates with more than five million customers become mandatory data-sharing participants, which the central bank estimated would cover about 95% of all financial relationships. An institution counts as above the threshold after two consecutive quarters and then has six months to join. From 1 July 2025, if one institution in a conglomerate participates voluntarily, the others must also join. The resolution also permits payment initiation without redirection to other environments; the consent for such payments must state at least the payment method, its validity period and the maximum amounts per transaction and per day.
Concentration explains the payment-initiation design. Brazil has more than 800 account-holding institutions, but about 99% of successful Open Finance payment initiations occur in customer accounts at the 13 largest conglomerates. The central bank therefore proposed relaxing the mandatory criterion for account holders, and under the resolution mandatory participation in payment initiation applies to mandatory Pix participants, account-holding institutions in conglomerates with a mandatory Pix participant, and payment initiation institutions.
On 27 June 2024 the Central Bank of the UAE (CBUAE) issued its Open Finance Regulation, which makes participation mandatory for all CBUAE-supervised financial institutions for the products and services in scope. Licensed institutions must give framework participants access to customer data and the ability to initiate transactions, always subject to users' express consent. The regime consists of a Trust Framework, an API Hub and Common Infrastructural Services for cross-sectoral data sharing and transaction initiation. It will come into effect in phases as notified by the CBUAE.
The Saudi Central Bank (SAMA) took a staged route. On 2 September 2024 it issued the second release of its Open Banking Framework, covering the Payment Initiation Service and building on earlier guidance on the Account Information Service. SAMA's open banking initiative sits under the National Fintech Strategy, which the Council of Ministers approved in 2022.
Asia: infrastructure-led models
India's Account Aggregator framework rests on Reserve Bank of India directions first issued on 2 September 2016 and updated on 6 September 2024. No customer financial information may be retrieved, shared or transferred by an Account Aggregator without the customer's explicit consent. No customer financial information accessed by an Account Aggregator may reside with it, and the Aggregator may not access customers' authentication credentials. The model places a regulated intermediary that cannot hold the data between data holders and users, a different answer to the trust problem from FIDA's proposed scheme membership.
Korea took the market-led route. Its open banking system was implemented in 2019 as market-led financial infrastructure, with the Korea Financial Telecommunications and Clearings Institute acting as the central hub. Any licensed or authorised institution can choose to participate. At end-2023 there were 136 participants, including all 19 commercial banks, all 8 credit card companies, 20 securities companies and 79 fintechs, and about 35 million subscribers, or 68% of the population. Unlike systems that primarily offer inquiry APIs, Korea's also provides transfer APIs.
Comparing the regimes
Open banking and open finance regimes compared, February 2025
| Jurisdiction | Legal basis | Participation | Payment initiation | Status and next date |
|---|---|---|---|---|
| United States | CFPB rule under Section 1033 | Mandatory for covered data providers; free access | Not required | Effective 17 January 2025; first compliance 1 April 2026 |
| European Union | PSD2; PSD3, PSR and FIDA proposed | Payment accounts under PSD2; FIDA would go beyond payment accounts, with scheme membership | Yes, under PSD2 | Parliament position on PSD3 and PSR, and committee position on FIDA, adopted in April 2024 |
| United Kingdom | 2017 CMA Order; Data (Use and Access) Bill | Obligations on the CMA9 | Yes; VRPs for sweeping | Roadmap completed; Bill passed the Lords on 5 February 2025 |
| Canada | Consumer-Driven Banking Act | Mandatory for banks above a retail-volume threshold; reciprocal | May be added later | Launch targeted for early 2026 |
| Australia | Consumer Data Right | Banking and energy; non-bank lending planned | Government will not rush to declare new action types | Non-bank lending operational by mid-2026 |
| Brazil | Joint resolution on Open Finance, amended July 2024 | S1 and S2, plus institutions with more than 5 million customers | Yes, including without redirection | Customer threshold from 1 January 2025; conglomerate rule from 1 July 2025 |
| UAE | CBUAE Open Finance Regulation | Mandatory for CBUAE-supervised institutions | Yes | Phased entry into effect |
| Saudi Arabia | SAMA Open Banking Framework | Guidelines and technical standards | Yes, second release | Payment initiation release issued 2 September 2024 |
| India | RBI Account Aggregator directions | Consent-based sharing through Account Aggregators | Not covered by the cited directions | Directions updated 6 September 2024 |
| Korea | Market-led infrastructure | Voluntary for licensed or authorised institutions | Yes, transfer APIs | 136 participants at end-2023 |
Source: Consumer Financial Protection Bureau, CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services, 22 October 2024; Consumer Financial Protection Bureau (Federal Register), Required Rulemaking on Personal Financial Data Rights; Final Rule (89 FR 90838), 18 November 2024; European Commission, Modernising payment services and opening financial services data: new opportunities for consumers and businesses (IP/23/3543), 28 June 2023; Basel Committee on Banking Supervision (BIS), Digitalisation of finance, 16 May 2024; European Parliament, MEPs want to enhance fraud protection and access to cash in payment services, 23 April 2024; European Parliament, Committee MEPs want to enhance customers' control over their financial data, 18 April 2024; Competition and Markets Authority, OBL update on remaining Roadmap items (CMA letter to Open Banking Limited), 9 September 2024; HM Treasury, National Payments Vision, 14 November 2024; UK Parliament (Hansard, House of Lords), Data (Use and Access) Bill [HL]: Third Reading, House of Lords, 5 February 2025 (Volume 843), 5 February 2025; Department of Finance Canada, 2024 Fall Economic Statement: Canada's Complete Framework for Consumer-Driven Banking, 16 December 2024; Australian Treasury portfolio (Assistant Treasurer and Minister for Financial Services), Albanese Government to reset Consumer Data Right, 9 August 2024; Conselho Monetário Nacional / Banco Central do Brasil, Voto 36/2024-CMN (attaching Voto 93/2024-BCB): proposta de alteração da resolução conjunta sobre a implementação do Open Finance, 26 June 2024; Banco Central do Brasil / Conselho Monetário Nacional, Resolução Conjunta nº 10, de 4 de julho de 2024, 4 July 2024; Central Bank of the UAE, CBUAE issues the Open Finance Regulation to ensure the soundness and efficiency of services and promote innovation and competitiveness, 27 June 2024; Saudi Central Bank (SAMA), SAMA Announces Issuance of Second Release of Open Banking Framework, 2 September 2024; Reserve Bank of India, Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016 (Updated as on September 06, 2024), 6 September 2024.
Reported users of data sharing, million
Source: Consumer Financial Protection Bureau (Federal Register), Required Rulemaking on Personal Financial Data Rights; Final Rule (89 FR 90838), 18 November 2024; Basel Committee on Banking Supervision (BIS), Digitalisation of finance, 16 May 2024; HM Treasury, National Payments Vision, 14 November 2024; Department of Finance Canada, 2024 Fall Economic Statement: Canada's Complete Framework for Consumer-Driven Banking, 16 December 2024.
The four figures measure different things, from authorised third-party access in the United States to subscribers of a payment-capable platform in Korea, so they indicate scale rather than rank adoption.
What the patchwork means for banks
The first divergence is pricing. The US rule bars fees for covered data, and Canada will share in-scope data free of charge, while FIDA would allow reasonable compensation for interfaces and the UK government is weighing compensation or reciprocal obligations where APIs are accessed at significant scale. Banks with operations on both sides of that line will be building interfaces they cannot charge for in one market and may be able to monetise in another.
The second is payments. Brazil, the UAE, Saudi Arabia and Korea build payment initiation into their frameworks, and the UK is prioritising open banking payments for e-commerce, whereas the US rule stops at data sharing and Canada may add payment initiation later. Where payments are in scope, fraud liability and consumer protection follow: Parliament's PSR text would make providers that fail to apply appropriate fraud-prevention mechanisms responsible for compensating losses, and the UK government noted that card payments currently offer greater protection than bank transfers.
The third is the timing of screen-scraping bans. The US rule does not let banks meet their obligation through screen scraping, Canada will prohibit it only once its framework is fully operational, and Australia has asked Treasury for advice on a formal ban. Until bans take effect, credential-based access will continue alongside APIs, and the Basel Committee notes that bank oversight of third parties without regulatory authorisation can be limited.
The fourth is the role of large technology platforms. Parliament's committee would exclude designated gatekeepers from FIDA's financial information services, and the FCA has examined the competition impact of data asymmetry between Big Tech companies and financial services firms. Reciprocity, which Canada makes a condition of entry, is the other tool on offer.
What to watch
- 1 April 2026: compliance date for US depository institutions with at least $250 billion in assets and nondepository providers with at least $10 billion in receipts.
- 1 July 2025: Brazil's rule requiring all conglomerate members to join Open Finance when one participates voluntarily comes into force.
- Early 2026: target launch of Canada's consumer-driven banking framework.
- Mid-2026: target for the Australian CDR to be operational in non-bank lending.
- House of Commons stages of the Data (Use and Access) Bill, sent from the Lords on 5 February 2025.
Primary sources: UK Parliament (Hansard, House of Lords), Data (Use and Access) Bill [HL]: Third Reading, House of Lords, 5 February 2025 (Volume 843), 5 February 2025; Consumer Financial Protection Bureau, CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services, 22 October 2024; Conselho Monetário Nacional / Banco Central do Brasil, Voto 36/2024-CMN (attaching Voto 93/2024-BCB): proposta de alteração da resolução conjunta sobre a implementação do Open Finance, 26 June 2024; Central Bank of the UAE, CBUAE issues the Open Finance Regulation to ensure the soundness and efficiency of services and promote innovation and competitiveness, 27 June 2024; HM Treasury, National Payments Vision, 14 November 2024; Basel Committee on Banking Supervision (BIS), Digitalisation of finance, 16 May 2024; Consumer Financial Protection Bureau (Federal Register), Required Rulemaking on Personal Financial Data Rights; Final Rule (89 FR 90838), 18 November 2024; Australian Treasury portfolio (Assistant Treasurer and Minister for Financial Services), Albanese Government to reset Consumer Data Right, 9 August 2024; Banco Central do Brasil / Conselho Monetário Nacional, Resolução Conjunta nº 10, de 4 de julho de 2024, 4 July 2024; Saudi Central Bank (SAMA), SAMA Announces Issuance of Second Release of Open Banking Framework, 2 September 2024; European Parliament, MEPs want to enhance fraud protection and access to cash in payment services, 23 April 2024; European Parliament, Committee MEPs want to enhance customers' control over their financial data, 18 April 2024; Australian Treasury portfolio (Assistant Treasurer and Minister for Financial Services), Address to Committee for Economic Development of Australia, 9 August 2024; Department of Finance Canada, 2024 Fall Economic Statement: Canada's Complete Framework for Consumer-Driven Banking, 16 December 2024; European Commission, Modernising payment services and opening financial services data: new opportunities for consumers and businesses (IP/23/3543), 28 June 2023; Consumer Financial Protection Bureau, Decision and Order: Financial Data Exchange, Inc. Application for Recognition (2024-CFPB-PFDR-0001), 8 January 2025; Competition and Markets Authority, OBL update on remaining Roadmap items (CMA letter to Open Banking Limited), 9 September 2024; Department for Science, Innovation and Technology, New data laws unveiled to improve public services and boost UK economy by £10 billion, 24 October 2024; Reserve Bank of India, Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016 (Updated as on September 06, 2024), 6 September 2024.