Open banking standards testing requirements

What open banking standards require

The EU legal layer. Directive (EU) 2015/2366 (PSD2) Article 66(3) forbids a payment initiation provider (payment initiation and account information providers are third-party providers, TPPs) to store sensitive payment data or to modify the amount, the payee, or any other feature of the transaction. Article 67(2) limits an account information provider to designated payment accounts and forbids a request for sensitive payment data. Chapter V of Delegated Regulation (EU) 2018/389 (checked on 2026-09-16) sets the interface rules:

• Article 30. The bank documents the interface, gives at least 3 months' notice of a specification change (Article 30(4)), and provides a testing facility for TPPs (Article 30(5)).
• Article 32. A dedicated interface offers the same availability and performance as the customer interface, and the bank publishes quarterly statistics for both.
• Article 33. Unplanned unavailability may be presumed when five consecutive requests get no reply within 30 seconds. Exemption from the fallback mechanism requires, among other conditions, at least 3 months of wide use (Article 33(6)), with criteria in EBA/GL/2018/07 (checked on 2026-09-16).
• Article 34. TPPs identify themselves with qualified eIDAS certificates for website authentication or electronic seals, which carry the PSD2 role and the name of the competent authority.
• Article 36. The bank gives an account information provider the same data the customer sees, and answers funds confirmation in a yes or no format. Errors return a notification message with the reason (Article 36(2)). Without the customer present, an account information provider accesses data no more than four times in 24 hours unless the bank and the provider agree a higher frequency (Article 36(5)(b)).

The UK Open Banking Standard. Open Banking Limited maintains the Open Banking Standard (checked on 2026-09-16): Read/Write API specification version 4.0.1, the security profile, and the Customer Experience and Operational Guidelines. Version 4 of the standard adopted the final FAPI 1 Advanced security profile of the OpenID Foundation. In the Read/Write Data API profile, a bank must treat a POST with the same x-idempotency-key from the same TPP within 24 hours as idempotent, and the key is at most 40 characters. Token expiry should not change the state of a long-lived consent. Pagination has no transaction isolation, so the same transaction can appear on more than one page.

Berlin Group NextGenPSD2. The Berlin Group publishes the NextGenPSD2 Access to Account Framework (checked on 2026-09-16). The Implementation Guidelines are the normative text. The OpenAPI file on the Berlin Group GitLab is version 1.3.16, dated 27 November 2025. It defines redirect, OAuth, decoupled, and embedded SCA approaches and the consent status values received, valid, revokedByPsu, expired, and terminatedByTpp, among others. frequencyPerDay is at most 4 unless agreed bilaterally, and HTTP 429 on account information calls carries the code ACCESS_EXCEEDED.

In the US, the CFPB announced on 8 January 2025 its recognition of Financial Data Exchange (FDX) as a standard-setting body; the rule's status is on the CFPB Section 1033 page. Authentication rules for account access are on the PSD2 SCA page.