Open finance explained: the rules in each market, American Express's position and what AI does with the data

What is open finance, and how is it different from open banking?

Open banking is the right of a bank customer to tell the bank to share their payment-account data with another firm, or to let that firm initiate a payment from the account, through a secure interface rather than by handing over a password. The EU wrote it into law with the second Payment Services Directive (PSD2), which created regulated account information and payment initiation services; the Commission non-paper circulated to the Council in April 2026 notes that PSD2 “opened up access to this data back in 2018”. The UK did the same by competition order: after its retail banking market investigation the Competition and Markets Authority ordered the nine largest retail banking providers to open up customer data using secure data protocols and to set up an independent implementation entity, today Open Banking Limited (OBL); open banking launched in 2017.

Open finance applies the same consent-based right to the rest of a customer's financial life: credit cards, mortgages and loans, savings and investments, pensions and insurance. The EU's proposed Financial Data Access regulation (FIDA) lists exactly those categories, from mortgage credit agreements and loans to savings, investments, crypto-assets, occupational and personal pensions and non-life insurance. The US rule finalised in 2024 already reaches past payment accounts to credit cards and digital wallets, so in substance it is an open-finance rule with a narrow first scope. The UK calls the cross-sector version Smart Data, and Australia calls it the Consumer Data Right, which already covers energy as well as banking.

Every model has the same moving parts, shown in Figure 1: a consumer who grants and can revoke consent; a data recipient (a lender, a budgeting app, a payment initiator, and increasingly an AI assistant); often an aggregator that holds the connections; and a data provider, the bank or card issuer that authenticates its customer and serves the data through an API. What differs between jurisdictions is who must provide data, which data, whether the provider may charge for it, who supervises the recipients, and whether the right extends from reading data to moving money.

What are the open-finance rules in each major jurisdiction as of October 2026?

Six regimes define the field. The table compares them on the same five questions; the sections that follow give the detail and the sources. Status is as of 16 October 2026.

United Kingdom: from CMA order to Smart Data and commercial VRPs

On 12 January 2023 the CMA determined that the six largest providers (Barclays, HSBC, Lloyds, Nationwide, NatWest and Santander) had implemented all of the Open Banking Roadmap and declared it substantially complete, when open banking had over 6 million active users. Usage has since multiplied. On 30 July 2026 OBL reported more than one billion open-banking payments and 100 billion API calls across the CMA9 since launch, a record 2.81 billion API calls in June 2026 and 40.16 million payments that month, with variable recurring payments (VRPs) up 6.7% month on month. Plaid, citing UK data, put 2025 at 351 million open-banking payments, up 57% on 2024, with VRPs about 16% of transactions.

Three changes define 2026. First, the legal base: the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, gives ministers powers in Part 1 to create Smart Data schemes and, in section 16, provides for the FCA's role and levies over financial services interfaces; our document page on the Act covers its automated-decision reforms. Second, the regulator: the FCA's open-finance roadmap of 14 April 2026 says it will consult on a long-term regulatory framework for open banking before the end of 2026 and work with HM Treasury on options for an open-finance framework by the end of 2027, prioritising SME credit and mortgages. Third, money movement: the UK Payments Initiative (UKPI) launched the commercial VRP scheme, which the FCA welcomed on 1 June 2026, opening Wave 1 to payments into regulated financial services, utilities and telecoms, rail, charities and government. Plaid describes the cVRP model as a single consent with clear limits, verified with the customer's bank, under which one-off or scheduled payments run with funds landing in near real time.

European Union: PSR and PSD3 agreed, FIDA stalled

On 27 November 2025 Parliament and Council negotiators agreed the Payment Services Regulation (PSR) and the third Payment Services Directive (PSD3). For open banking the deal reduces barriers for account information and payment initiation providers, prevents banks from discriminating against them, includes a list of prohibited obstacles to data access, and gives payment service users a dashboard to monitor and manage the permissions they have granted. The deal “needs to be formally adopted by Parliament and Council before it can come into force”; as of 16 October 2026 we found no publication in the Official Journal, so PSD2 still governs. FIDA, proposed on 28 June 2023, has not reached agreement: the Council adopted its general approach on 4 December 2024, Parliament confirmed its negotiating mandate on 18 December 2024 (excluding Digital Markets Act gatekeepers from becoming financial information service providers), and a Commission non-paper dated 6 April 2026 set out options for finalising trilogues.

Australia, Brazil and India

Australia's Consumer Data Right began with the four major banks sharing consumer data from 1 July 2020 and now covers banking and energy. Rules that commenced on 4 March 2025 extend it to non-bank lenders and narrow the banking data in scope; non-bank lenders share product data from 13 July 2026 and the initial providers (more than A$10 billion of resident loans and leases) must answer consumer data requests from 9 November 2026.

Brazil runs the largest system by consents. The Banco Central do Brasil's Annual Report 2025 says that by end-2025 Open Finance connected 96 million bank accounts with more than 154 million active consents, processed more than BRL 15 billion in payments and transfers during 2025 (about BRL 3 billion in December alone), and supported BRL 31 billion of data-driven lending from 2021 to June 2025. The redirect-free journey delivered in 2025 enables contactless Pix, Pix Automático can be contracted through Open Finance payment initiators, and Joint Resolution BCB/CMN 15 of 28 November 2025 introduced credit portability, starting with non-collateralised personal credit in February 2026. The BCB lists AI integration among its next actions.

India's model is different in design: the RBI's Master Direction of 2 September 2016 (updated to 6 September 2024) licenses Account Aggregators as NBFCs that move a customer's financial information from providers to users only with the customer's explicit consent; the information “shall not be the property of the Account Aggregator, and not be used in any other manner”, and aggregators may not request or store customer credentials. The RBI publications we could open give no current usage count; industry figures exist only on hosts outside this site's source list, so we leave them out.

Where does the US Section 1033 open-banking rule stand in October 2026?

The CFPB finalised its Personal Financial Data Rights rule on 22 October 2024 to implement Section 1033 of the Consumer Financial Protection Act, the consumer-data provision of the 2010 Dodd-Frank Act. It requires financial institutions, credit card issuers and other providers to make transaction information, account balances, information needed to initiate payments, upcoming bill information and basic account verification information available to consumers and authorised third parties, “without charging fees”. Third parties may collect, use and retain data only as needed for the product the consumer asked for; access lasts at most one year without reauthorisation; and the CFPB said the rule would help move the industry away from screen scraping. The rule was published in the Federal Register on 18 November 2024 and took effect on 17 January 2025, with compliance phased from 1 April 2026 for the largest providers to 1 April 2030 for the smallest. Card issuers are covered: American Express's own 10-K describes the rule as applying to financial institutions “including us”.

The Financial Data Exchange is the standards half of the rule. Under a separate June 2024 rule, the CFPB can recognise standard-setting bodies whose consensus standards firms can use to show compliance; FDX announced its recognition on 9 January 2025, when it said its API standard served over 94 million customer accounts. FDX now cites more than 114 million North American connections on FDX-aligned APIs and about 200 member organisations.

Then the rule stalled. Bank trade groups immediately sued, American Banker reported; the case is Forcht Bank, N.A. v. CFPB, No. 5:24-cv-304 in the Eastern District of Kentucky. American Express's 2025 10-K records the next steps: in July 2025 the court stayed the litigation after the CFPB announced it would reexamine the rule, and in August 2025 the CFPB issued an advance notice of proposed rulemaking. The CFPB dates that advance notice 22 August 2025 and says it discussed possible amendments to the rule. On 29 October 2025 the court stayed the rule's compliance dates, as the CFPB's own compliance page now states; the first deadline of 1 April 2026 therefore never bound anyone. On 4 August 2026 the CFPB sent a proposed rule titled “Personal Financial Data Rights Reconsideration” to the White House Office of Information and Regulatory Affairs, which American Banker reported is expected to let banks charge fintechs and other third parties for data access.

Status on 16 October 2026: the 2024 rule is on the books but its compliance dates are stayed; the replacement proposal has not been published (a search of the Federal Register for “personal financial data rights” returns the August 2025 advance notice as the latest CFPB rulemaking document; American Banker describes the 2024 rule as paused by a federal judge); nothing is enforceable. The market moved ahead of the rule. On 16 September 2025 JPMorganChase and Plaid announced a renewed data-access agreement that “includes a pricing structure”, a public sign that pricing had entered bank–aggregator contracts before the reconsideration settles whether the rule allows it.

How does the data actually move: screen scraping, APIs or aggregators?

Four technical models carry consented data today. Regulation has pushed each market from the first towards the second and third; India built the fourth from scratch. FDX says a majority of user-permissioned connections in North America have moved to token-based APIs aligned with its standards, many of them reached through aggregators, which is why the JPMorganChase–Plaid pricing deal mattered more than any single bank's API launch.

For AI the distinction matters in two ways. Model quality depends on connection reliability: a cash-flow model that loses a borrower's main account mid-application scores the wrong person. And governance depends on scope: under an API token the provider knows which recipient holds which data for how long, which is the basis for the revocation dashboards in the EU deal and the one-year reauthorisation limit in the US rule. Screen scraping offers neither.

What is American Express's open-finance strategy, and how should it be evaluated?

American Express sits on both sides of open finance. As a card issuer it is a data provider under the US rule, and in the UK and France it runs PSD2 interfaces. As a lender to small businesses and an operator of cash-flow tools it is also a data recipient. Its strategic position, in its own words, is defensive first: the 2025 Form 10-K, filed on 6 February 2026, says the CFPB rule requires financial institutions “including us” to give consumers and authorised third parties access to their data free of charge, and that the rulemaking and “other open banking initiatives” could present “challenges to our business model, such as limiting advantages provided by our integrated payments platform, as well as opportunities since we may also act as an authorized third party and receive data from data providers.” The competition section adds that open banking initiatives “may result in a number of challenges to our business model, such as disintermediating us from our customers, steering customers away from our products and services or decreasing our attractiveness to partners”, and the technology section lists open banking among the areas where Amex must keep investing.

The record behind that language is an API-first provider strategy. Amex joined FDX in its first membership wave (announced 25 February 2019). Its developer portal describes the Account Financials API as “modeled after Financial Data Exchange working group APIs” and driven by OpenID Connect, OAuth 2.0 and Financial-grade API authentication, alongside an Account and Transaction API and a PSD2 Confirmation of Funds API for American Express Services Europe in the UK and American Express Carte in France. On 8 June 2023 Amex announced a customer-permissioned data-sharing agreement with Plaid over that API, giving Card Members connections to Plaid's 8,000-plus apps without sharing their Amex password, with connections supported by the OAuth2 protocol. Through those pipes Amex data now reaches AI assistants: OpenAI's May 2026 personal-finance preview in ChatGPT connects accounts through Plaid at more than 12,000 institutions, with American Express named among them.

On the recipient side, Amex bought its way into cash-flow data. It acquired Kabbage, a small-business cash-flow platform, in 2020, and on 31 January 2023 launched Business Blueprint, a cash-flow hub that “builds on the Kabbage platform”. Its My Insights feature aggregates data from Amex business products and linked external business-bank accounts to show money-in and money-out analyses, two years of history and 30-day cash-balance projections. The Intent Intelligence framework published on 13 October 2026 extends the same logic to AI agents: the Create Intent API captures the customer's instructions and limits, the customer authenticates, and an Intent ID and Proof of Intent Token carry that consent through the transaction, which is the card-network version of the scoped consent open banking uses for data. The wider agentic record is on the American Express profile.

How to evaluate it. The strength is that Amex moved early to tokenised, FDX-modelled APIs and aggregator agreements, so a revived US rule would cost it less engineering than banks still relying on scraping; its closed-loop network also means it already holds both sides of most transactions, the “integrated payments platform” its 10-K says open banking could erode. The exposure is the same platform: mandated free data access lets competitors and AI assistants read Card Member spending that used to stay inside Amex. The option value is on the recipient side, through Blueprint and its commercial tools, if the final rule lets Amex act as an authorised third party at low cost. What is not on the record: we found no American Express comment letter on the 1033 rulemaking among sources we could open, no statement from the company on data-access fees, and no update to the 1033 language in its 2026 quarterly filing.

What does AI do with open-finance data?

Consented account data is the richest feature set a lender or fraud team can get outside its own book, and AI is how it is turned into decisions. Four uses are on the record, plus a fifth that is arriving now: payments initiated by AI agents inside a consent the customer granted.

Cash-flow underwriting

Cash-flow underwriting scores a borrower on income, spending and balances read from their accounts rather than on bureau history alone. Plaid's LendScore 2, released on 6 October 2026, claims 42% greater predictive power than traditional credit data alone, and its Instant Link lets a borrower permission cash-flow data once through Plaid's consumer reporting agency so later lenders retrieve the insights in under two seconds. That route matters for compliance: a score built on permissioned data and sold by a consumer reporting agency feeds the ECOA adverse-action duties lenders already carry. See our AI credit underwriting page for the bank-side record.

Personal financial management, fraud and verification

Aggregated transactions power budgeting, forecasting and next-best-action engines; the cleanest bank example is Amex's own My Insights, and the largest consumer one is ChatGPT's Plaid-connected finance preview. On fraud, the same connections confirm that an account exists and belongs to the applicant before money moves (the US rule lists basic account verification information as covered data), and network-level models score the risk: Plaid says its Trust Index 3, announced in May 2026, catches up to 41% more fraud at the same false-positive rate in testing.

Agentic payments on open-finance consent

Open banking already lets a third party initiate payments within a mandate, which makes it the natural rail for AI agents. A UK commercial VRP is a single consent with limits under which recurring payments run; Brazil's Pix Automático can be contracted through Open Finance payment initiators. Standard setters are adjusting: on 14 April 2026 FDX launched an initiative on agentic AI in permissioned data sharing, asking for input on agent identity and classification, consent and delegation, data minimisation and downstream accountability. Card networks are building the equivalent consent object for cards, as Amex's Proof of Intent Token shows. In the FCA's open-finance announcement, Innovate Finance called open finance “a foundation for widespread adoption of agentic AI”. See agentic banking for the bank side.

Which banks and fintechs on this site disclose open-finance AI?

The tables below are computed from this site's bank and fintech profiles: every bank use case and fintech record that mentions open banking, open finance, Plaid, Section 1033, cash-flow data, FDX or VRPs, with the profile's own source. The list is short, which is itself a finding: few US banks describe AI built on other institutions' data. Elsewhere in the profiles, PNC chief executive Bill Demchak said on 11 June 2026 that moving money quickly “will be more driven by open banking and [application programming interface] connectivity than it will be on AI”, Frost Bank connected nearly 400,000 customers to Plaid in 2022, and Regions picked Axway in January 2025 for open-banking API management with client approval controls; see the PNC, Frost and Regions profiles.

Plaid is the hub of the US record; its profile covers its transaction foundation models and the agent connections (ChatGPT, Meta's Muse, Sierra, Decagon). The vendor side, including bank personalisation engines that draw on open-finance data, is on the Personetics page.

1. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services — Consumer Financial Protection Bureau, Oct 22, 2024 (consumerfinance.gov)
2. Required Rulemaking on Personal Financial Data Rights (final rule, 89 FR 90838) — Federal Register, Nov 18, 2024 (federalregister.gov)
3. Personal financial data rights: compliance resources (compliance dates stayed) — Consumer Financial Protection Bureau, Oct 29, 2025 (consumerfinance.gov)
4. FCA sets out vision for open finance to empower consumers and businesses — Financial Conduct Authority, Apr 14, 2026 (fca.org.uk)
5. Open banking takes next step forward with launch of UK Payments Initiative scheme — Financial Conduct Authority, Jun 1, 2026 (fca.org.uk)
6. Millions of customers benefit as Open Banking reaches milestone — Competition and Markets Authority (GOV.UK), Jan 12, 2023 (gov.uk)
7. Data (Use and Access) Act 2025 (c. 18) — legislation.gov.uk, Jun 19, 2025 (legislation.gov.uk) · our page on Data (Use and Access) Act 2025
8. Payment services deal: More protection from online fraud and hidden fees — European Parliament, Nov 27, 2025 (europarl.europa.eu)
9. Open Finance Framework (FIDA), Legislative Train Schedule — European Parliament, Oct 16, 2026 (europarl.europa.eu)
10. FIDA: Commission non-paper on options for finalising trilogue negotiations (WK 5041/2026) — Council of the European Union, Apr 6, 2026 (data.consilium.europa.eu)
11. Compliance guide for data holders in the banking and non-bank lenders sectors — Consumer Data Right (ACCC and OAIC), Jul 11, 2025 (cdr.gov.au)
12. Update to CDR timeline announced — Consumer Data Right, Dec 19, 2019 (cdr.gov.au)
13. Annual Report 2025 — Banco Central do Brasil, Aug 14, 2026 (bcb.gov.br)
14. Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016 — Reserve Bank of India, Sep 2, 2016 (rbi.org.in)
15. Open Banking surpasses one billion payments and 100 billion API calls — Open Banking Limited, Jul 30, 2026 (openbanking.org.uk)
16. FDX Recognized by CFPB as a Standard-Setting Body, a Step Forward for Open Banking — Financial Data Exchange, Jan 9, 2025 (financialdataexchange.org)
17. Agentic AI, Open Finance, & Technical Standards (call for input) — Financial Data Exchange, Apr 14, 2026 (financialdataexchange.org)
18. Financial Data Exchange Adds 16 Members — Financial Data Exchange, Feb 25, 2019 (financialdataexchange.org)
19. American Express Company Annual Report on Form 10-K for 2025 — American Express (SEC filings), Feb 6, 2026 (sec.gov)
20. American Express and Plaid Announce Customer-Permissioned Data Sharing Agreement to Boost Digital Finance Options for Customers — American Express, Jun 8, 2023 (about.americanexpress.com)
21. Open Banking APIs (Account Financials, Account and Transaction, Confirmation of Funds PSD2) — American Express Developers, Oct 16, 2026 (developer.americanexpress.com)
22. American Express Launches New Cash Flow Management Hub, Expanding Its Powerful Backing for Small Businesses — American Express, Jan 31, 2023 (about.americanexpress.com)
23. American Express Publishes Intent Intelligence Framework for Trusted Agentic Commerce — American Express via FT Markets, Oct 13, 2026 (markets.ft.com)
24. What we know about the CFPB's forthcoming open-banking rule — American Banker, Aug 5, 2026 (americanbanker.com)
25. OpenAI launches ChatGPT for personal finance, will let you connect bank accounts — TechCrunch, May 15, 2026 (techcrunch.com)
26. cVRP: a new standard for recurring payments in the UK — Plaid, Jun 1, 2026 (plaid.com)
27. Effects 2026 recap (Trust Index 3, Plaid Income) — Plaid, May 21, 2026 (plaid.com)
28. Instant Link and the next generation of LendScore — Plaid, Oct 6, 2026 (plaid.com)
29. JPMorganChase and Plaid reach renewed data access agreement — JPMorganChase, Sep 16, 2025 (jpmorganchase.com)