For years, banks were on top. They kept your information, they decided whether anyone else could reach their system, and they set the rules for what new financial products or ways of paying might be possible. Enter open banking. You could now give your information to approved third-party providers, paving the way for new products and ways to pay.
Now the bigger question is what happens next. In 2026, the UK is working towards a long-term framework for open banking as businesses look beyond account information to direct payments, flexible recurring bills and wider financial data sharing. This article looks at the regulatory shift, the role of APIs, A2A payments, VRPs, consumer protection and the road towards Open Finance.
The UK’s Long-Term Regulatory Framework in 2026
The UK’s open banking journey started with a competition problem. Many large banks had customer information that other financial providers required in order to create valuable services. The Competition and Markets Authority (CMA) pushed for consistent access that empowers customers and enables authorized third parties to connect with banks.
That was the starting point. Keeping the system useful as payment services grow is a different challenge.
The Joint Regulatory Oversight Committee (JROC) played a vital part in the coordination of development of the next stage of open banking. The FCA is going to play a significant role in the development of a long-term regulatory framework. The objective is the creation of a framework capable of sustaining commercial operations, while maintaining high standards for security, accessibility, and accountability.
Technical aspects of this development are equally important. According to a Google Cloud case study of 2026 on Deutsche Bank, the implementation of a central API catalogue is critical in allowing developers to discover banking APIs in real-time. Access control, OAuth 2.0 scopes, governance policy, and call logging were used in this setup. Developers who once spent days locating customer-data APIs could search for them instead.
This is an example of API management, not a requirement imposed by UK regulators. Still, it shows why the details matter. Standardized APIs are useful only when banks and third parties can manage access without creating security gaps.
The next phase of open banking regulation must deal with both sides of the problem. Banks need clear rules, while fintech’s need reliable access. Customers need confidence that their data will not be misused.
Fueling the Digital Payments Revolution Through A2A and VRPs
Card payments are familiar. The consumer knows how to use it, and the merchant has all the systems in place to support such transactions. An account-to-account (A2A) payments system is yet another avenue. The payments go from one bank account to another via the payment service which is connected to it.
It doesn’t mean that the card is no longer relevant. It needs to be convenient, reliable and trusted by the customer. The payment option that is less costly but more complicated or difficult to process is unlikely to succeed.
Variable recurring payments (VRP) could help explore new options. The consumer gives permission to pay within the terms and limits agreed upon. The amount to pay varies depending on the needs instead of giving permission every time.
Businesses can utilize the commercial VRPs for recurring payments and subscriptions. However, availability depends on the specific provider, the scheme and the requirements. Not every bank or merchant can assume these services are ready for every use case.
A June 2026 partnership between Mastercard and PaidBy, developed by Xryma, points to another possibility. The companies announced plans to expand open-banking-powered cross-border A2A payments, including local-currency payments and merchant settlement in a preferred currency.
The idea is to make direct bank payments more useful across markets. But an announcement is not proof that the service is available everywhere or that it will replace cards.
For merchants, the opportunity is worth exploring. A2A payments could provide another way to collect money, while VRPs may simplify certain recurring transactions. The sensible move is to assess where these options solve a real payment problem instead of adopting them simply because they are new.
The Balancing Act Between Security, Consent and Consumer Protection
Easy payments might be attractive to customers, but they probably aren’t so keen to have their money or data compromised. That’s the true challenge open banking will have to tackle.
You can add robust customer authentication (SCA) to verify the identity if needed. Financial-grade API (FAPI) security standards and implementation guidelines, such as FAPI, specify standards to secure sensitive data and limit access. The detailed requirements will vary based on the regulations and method. FAPI should not be presented as a universal legal requirement for every UK open banking service.
Similarly, consent is very important. It is essential that consumers know what data they are sharing and why. They should also have means to control and retract their consent from the concerned entity. Otherwise, consent would just be a box to tick.
Also Read: What Is Digital Supply Chain Risk Management and How Can Technology Improve Supply Chain Resilience?
It is very difficult to prevent frauds. In a case of Authorized Push Payment (APP) fraud, the consumer makes a payment to the fraudster. The consumer may have consented to the payment, although he made the decision due to deception.
Visa reported a 75% increase in fraud detection during the first six months of deployment of its A2A Protect solution. The company says the service gives financial institutions real-time risk insights to help identify suspicious payments before money leaves a customer’s account.
This is a result reported for one product, not the fraud reduction rate for open banking as a whole. Still, it illustrates why payment providers are investing in fraud detection as A2A payments develop.
Secure APIs cannot stop every scam. Consumers also need clear complaint procedures and understandable rules about who is responsible when something goes wrong. If customers have to chase several providers to recover their money, trust in the system will suffer.
Fostering Competition and Leveling the Playing Field
Regulation for open banking provides an opportunity for small financial institutions to develop products on the existing banking infrastructure. FinTech’s may develop solutions for money management, payment processors can come up with alternative methods of payment collection, while neobanks can improve their services using connectivity through data.
However, just the availability of this information is not enough. A startup still needs clients, reliable technology and business model. Standardized APIs reduce some hurdles, but do not eliminate all the advantages traditional banks possess.
Moreover, customer preferences would also define the competition. According to Mastercard’s report The State of Open Finance 2026, 76% of interviewed consumers were willing to change their financial institution for more advanced digital money management capabilities. Consumers from the US, Europe and Australia took part in the survey, so it cannot be considered as a switching rate in the UK.
This result illustrates a common business truth. Consumers are willing to change their providers for a better money management experience. Banks that rely on familiarity alone could find that harder to defend as alternatives improve.
For fintech’s, the opening is clear, but the work is not done. They must turn access to financial data into something customers find useful enough to adopt. Regulation can make competition possible. It cannot create demand by itself.
The Horizon Beyond Open Banking and Towards Open Finance
Open banking focuses mainly on payment accounts and the services built around them. Open Finance extends the idea to a wider range of products, potentially including savings, mortgages, pensions and insurance. The goal is to let customers share relevant financial information across services, subject to the applicable rules and permissions.
Consider someone applying for a loan. Having to collect and submit financial details from different sources can make the process slow and frustrating. Permissioned data sharing could help providers assess an application with less repeated paperwork. It could also support services that bring different parts of a person’s finances together.
In Mastercard’s 2026 consumer-permissioned data research, consumers indicated that they would be willing to share data in exchange for easier loan applications and better approval prospects or interest rates by eight or more of ten respondents.
That leads to a conclusion that customers could be happy to give data if they receive a tangible benefit. It doesn’t mean they will consent to every wish or that a full Open Finance ecosystem is already well-established in the UK.
More data also brings more responsibility. Providers must explain why they need it, protect it properly and avoid collecting information without a clear purpose. Wider access should give customers more useful choices, not leave them wondering who has their financial details.
Open Finance has potential, but its success will depend on how well the system handles these concerns. Convenience alone is not enough.
Conclusion
Open banking regulation is becoming an important part of digital payments, but businesses should avoid treating it as a trend to follow blindly. A2A payments and VRPs may suit some transactions better than cards. For others, the existing method will remain the more practical choice.
Merchants and fintech’s should assess available services, payment costs, customer needs and fraud controls before committing to a new model. They also need to follow regulatory changes closely, since commercial access and consumer protections are still developing.
The UK has an opportunity to make open banking work at a broader commercial scale. The real measure of success will be whether customers gain more control, businesses get useful payment options and financial providers remain accountable when things go wrong.
