How open banking works in the UK

Open banking in the UK lets authorised providers read a customer's account data or start payments from their account, with the customer's consent, through interfaces that banks have to provide. The rules come from the Payment Services Regulations 2017, the law that brought the EU's PSD2 into the UK. The common API standard comes from a 2017 order by the Competition and Markets Authority on the nine largest banks.

Open banking payments in the UK normally travel over Faster Payments. Many platforms also run Confirmation of Payee, Pay.UK's name check, alongside them.

The rules

PSD2 created two regulated services, account information and payment initiation. It also required banks to give authorised providers access to customers' online payment accounts. The Payment Services Regulations 2017 (PSRs 2017) put those rules into UK law. The Financial Conduct Authority authorises or registers the providers and supervises them. The customer's bank applies strong customer authentication when the customer approves access or a payment.

The Competition and Markets Authority's 2017 order went further for the largest banks. It required the nine largest current account providers, often called the CMA9, to build their open banking interfaces to a common standard. That's why the big UK banks' open banking APIs look much the same.

Who does what

• The customer's bank (in the regulations, the account servicing payment service provider) holds the account and runs the open banking interface.
• An account information service provider (AISP) reads balances, transactions and account details with the customer's consent.
• A payment initiation service provider (PISP) starts a payment from the customer's account on their instruction. The guide to PISPs explains the flow.
• Aggregators connect to many banks and offer account information, payments or both through one API. Plaid, TrueLayer, Tink and Yapily, in the tables below, work this way.
• Your platform chooses the providers, owns the customer relationship and keeps its own compliance duties.

1. Your app Asks for data or a payment
2. Instruction: API call
3. AISP or PISP Authorised or registered by the FCA
4. Instruction: open banking interface
5. Customer's bank Runs the interface and SCA
6. Money: Faster Payments
7. Payee's bank Receives the payment

The payment rails underneath

Open banking sets who may ask a bank for what. The money itself moves on the UK's payment systems:

• Faster Payments carries single payments in near real time and is operated by Pay.UK. Open banking payments normally go this way.
• Bacs, also operated by Pay.UK, runs Direct Debit and Bacs Direct Credit. Many employers pay salaries by Bacs Direct Credit. It isn't part of open banking, though variable recurring payments are often compared with Direct Debit.
• CHAPS, the Bank of England's high-value system, carries large same-day payments such as house purchases. Everyday checkout payments rarely use it.

Variable recurring payments

Each single open banking payment needs the customer's approval. A variable recurring payment (VRP) works from a standing consent. The customer approves a mandate once, with limits such as a maximum amount per payment and per period. The provider can then make payments within those limits until the customer cancels the mandate.

VRP comes in two kinds. Sweeping VRP moves money between accounts in the customer's own name, such as topping up savings or paying down a credit card. The CMA required the largest banks to support it. Commercial VRP pays other businesses, for bills or subscriptions. It works only where both the bank and the provider support it. The tables below show which providers offer each kind in the UK.

Providers offering sweeping VRP in the UK

Providers offering commercial VRP in the UK

Confirmation of Payee

Confirmation of Payee (CoP) checks the name on an account before a payment is sent. The payer's bank compares the name the payer typed with the name on the payee's account and returns a match, a close match or no match. The payer can then stop before money goes to the wrong person. The service is run by Pay.UK, with banks and payment firms taking part (Pay.UK's description).

Platforms that pay out, onboard payees or take account details from users often run CoP alongside open banking, though it's a separate service. In the euro area, Verification of Payee does the same job. The EU's Instant Payments Regulation has required payment providers there to offer it since October 2025.

Where Unirail fits

If you contract with more than one UK provider, Unirail decides which one should run each payment or bank link. It works out what each option will cost under your contracts and shows its reasons, including the providers it ruled out. Your providers and your platform keep their regulated roles. Provider credentials stay in your own vault.

Start with the open banking API for links and payments, or the provider directory to see who covers what. Unirail doesn't route Confirmation of Payee checks yet. The providers in the CoP table above are listed for comparison only.