What is an open banking API?

An open banking API is a defined software interface through which an authorized third-party provider can request account information or initiate a payment with the customer's consent. The API exposes specified operations without giving the provider direct access to the bank's internal systems. Authentication, authorization, data formats, errors and service levels are part of the interface.

The customer starts in a third-party app and is redirected to the bank for authentication. The bank records consent and returns a short-lived token with limited scope. The provider then calls account or payment endpoints. The benefits of an open banking API depend on strong customer authentication and financial-grade security profiles. The bank can revoke access when consent expires or the authorization changes.

Account-information services combine accounts for budgeting, cash management or credit assessment. Payment-initiation services send a transfer directly from the account. Banks also use APIs for partner products and embedded finance. Standards reduce one-off integrations, but Europe still has differences in implementations, certificates and error handling. Aggregators hide some variation and create another provider dependency.

The main risks are stolen consent, weak redirects, excessive scope, unavailable interfaces and inconsistent data. A secure design keeps bank credentials at the bank, binds tokens to the authorized provider and logs each access. Fraud controls must distinguish a valid API call from a valid customer intention. Operational monitoring also compares API availability and response times with customer-facing channels.

PSD2 created regulated account-information and payment-initiation services in the EU. The regulatory technical standards govern strong customer authentication and secure communication. The Berlin Group publishes a widely used European API specification, while the UK Open Banking Standard defines its own profiles. GDPR governs personal-data processing and consent is not the only possible legal basis.

BaFin authorizes German payment services, the FMA Austrian providers and FINMA applies Swiss rules outside PSD2. German banks commonly implement Berlin Group interfaces. Frankfurt payment firms, banks and the Bundesbank connect open banking with instant payments and ISO 20022. An API moves instructions and data; settlement still occurs through the relevant payment rail and central-bank or commercial-bank accounts.