What Is Open Banking?

Open banking is a regulated way for a third party to access your payment-account data, or to start a payment from your account, through an interface the bank provides, and only with your consent. You approve the access on your bank’s own login page. The third party never sees your banking password.

Before open banking, a company that wanted its bank data in another tool had two options: download a statement file and upload it, or hand its bank login to a service that “scraped” the online banking screens. Open banking replaces the second option with a standard, supervised channel and makes the first one less frequent.

The rules behind it: PSD2

In the European Union and the European Economic Area, open banking rests on the revised Payment Services Directive, known as PSD2. It requires banks that run online payment accounts to give access to licensed third parties when the account holder agrees. The European Banking Authority’s technical standards set how that access is secured, including strong customer authentication (SCA): the account holder proves who they are with two separate factors, such as a password and a phone.

The framework is under revision. The European Commission has proposed a third directive (PSD3) and a Payment Services Regulation. Until they are adopted and apply, PSD2 and its national transpositions are the rules in force. See the Commission’s payment services page.

The United Kingdom built its own open banking standard from 2018, and other countries run their own frameworks. The words are similar; the rules and the banks covered are not.

Two services, not one

PSD2 defines two services that people often group under “open banking”:

Service	What it does	Who provides it
Account information (AIS)	Reads balances and transactions from one or more accounts	An Account Information Service Provider (AISP)
Payment initiation (PIS)	Starts a payment from the account, which the holder confirms at the bank	A Payment Initiation Service Provider (PISP)

A provider can hold one licence or both. When you connect an account, the consent screen tells you which service is requested. A reconciliation tool needs account information only: it reads what came in, it does not move money.

Who takes part

• You, the account holder. You choose the accounts to share and approve the access with your bank.
• Your bank. In the regulation it is the ASPSP (Account Servicing Payment Service Provider). It runs the interface and decides which fields it exposes.
• The licensed provider. An AISP or PISP, supervised by a national authority, connects to the banks on behalf of applications.
• The application. The tool you actually use, which receives the data through the provider for an agreed purpose.

How a connection works

1. In the application, you pick your country and your bank.
2. You are sent to your bank’s own login page and authenticate there, with strong customer authentication.
3. You choose which accounts to share and confirm the consent.
4. Your bank sends you back to the application, which can now read the accounts you approved.
5. The application refreshes the data while the consent is valid.
6. The consent ends when it expires or when it is withdrawn. A new consent needs a new login at the bank.

Consent has a limited life. Under the current technical standards, account access can last up to 180 days before the account holder must authenticate again. The exact period also depends on the bank and the provider.

What data a bank shares

For account information, a bank typically exposes:

• the list of accounts, with their IBAN, currency and name;
• balances;
• transactions, with amount, currency, booking date and often a value date;
• the name, and sometimes the account, of the other party;
• the payment reference: a structured creditor reference, free remittance text, or both;
• a status: booked, or pending for some banks.

Every field is conditional. One bank sends the payer’s IBAN, another does not. One keeps the customer’s remittance text intact, another shortens it. How far back the history goes also varies.

Open banking compared with statement files

	Open banking	Statement files (camt.053, MT940, CSV)
How data arrives	Pulled through the bank’s interface after consent	Downloaded or delivered by the bank, then imported
Frequency	As often as the application refreshes	As often as someone exports, or the bank sends, a file
Setup	A login at the bank and a consent	A file format to map, or a bank delivery to arrange
Renewal	The consent expires and must be renewed	None, but someone must produce each file
History	Limited by the bank, often a few months	Whatever period the file covers
Coverage	Banks and accounts reachable through the provider	Any bank that can export the format

Most finance teams use both: open banking for day-to-day lines, and a statement file to load older history or to cover an account the provider cannot reach. In Germany, France, Austria and Switzerland, banks also deliver statement files over EBICS, a bank-to-corporate channel set up by contract: see What Is EBICS?.

What open banking does not do

• It does not match payments to invoices. It delivers the bank lines. Deciding which invoice a payment settles is a separate step.
• It does not make banks consistent. Field names, references and history depth still differ from bank to bank.
• It does not prove completeness. A successful connection is not proof that every transaction of the period arrived. Balances and counts still need checking.
• It does not certify the application. The provider is supervised; the tool that uses the data is not certified by the regulation.

In Invunion

Invunion uses open banking for account information only. It connects bank accounts through Enable Banking, a licensed account information provider. You approve the access on your bank’s page. The banks offered depend on your country, on the provider and on whether your Entity is a sandbox or production Entity.

• The first sync of a connected account requests the previous 90 days. The bank may return less.
• Invunion then syncs newer lines on its own while the consent is valid.
• Invunion requests access for up to 180 days. After that, someone with the bank login connects the account again.
• A notification rule can tell you when a bank is disconnected.
• When a bank is not reachable, or for older history, you can import camt.053, MT940, CSV or JSON statement files instead, or download statements from your bank over EBICS. See What Is EBICS?
• The IBANs and account numbers Invunion receives are stored encrypted and shown masked.

A sandbox Entity includes test banks, so you can try a connection without a real account: see Connect the test bank. To see how bank lines become matched invoices, read Open Banking for Reconciliation.

Sources

• European Commission, Payment services
• European Commission, Financial data access and payments package
• European Banking Authority, PSD2 interactive single rulebook
• European Banking Authority, RTS on strong customer authentication and secure communication

Updated 22 October 2026