Topic starter
24/06/2026 7:28 pm
TL;DR: Open banking is moving from regulated data sharing to a broader API economy, with the market projected to grow from $31.61 billion in 2024 to $135.17 billion by 2030, according to Kong and Grand View Research. The governance challenge is no longer adoption alone, but how banks and fintechs control consent, tokenised access, and third-party accountability at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “Open Banking: Guide to APIs, Regulations and FinTech”.
By the numbers:
- Consumers in the United Kingdom made a record-breaking 14.5 million open banking payments in January 2024.
- The UK had 10 million active open banking users by July 2024, about 15% of the population.
Key questions
Q: How should security teams govern consent-based API access in open banking?
A: Security teams should treat consent as a controlled entitlement with scope, expiry, monitoring, and revocation.
Q: What breaks when open-banking access is not tightly governed?
A: When consent, authentication strength, and API security are managed separately, third-party access can drift beyond its intended scope.
Q: Why do tokenised open banking models need stronger audit trails than screen scraping?
A: Tokenised access creates a formal trust chain, which means every request, approval, and revocation should be traceable.
Practitioner guidance
- Define consent lifecycle controls Track how user consent is granted, scoped, renewed, and revoked across every open banking API and third-party relationship.
- Inventory accredited third parties Maintain a live register of approved participants, including the APIs, data classes, and payment functions each one can access.
- Enforce token scope limits Bind access tokens to the minimum data set and payment action required, then validate that scopes cannot be broadened downstream.
Bottom line: Open banking replaces credential sharing with delegated API access, which shifts the primary control problem toward consent, scope, and revocation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:45 am
Consent is becoming the new perimeter in finance. Open banking shifts the governance problem from password protection to delegated authority, revocation, and proof of participant legitimacy. That is a different control plane, not a lighter version of the old one. IAM teams should read this as a move toward consent lifecycle governance rather than simple authentication hardening.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What is the difference between AIS and PIS from a governance perspective?
A: AIS governs read access to account and transaction data, while PIS governs the initiation of payments. The first is mainly about controlled disclosure and visibility, while the second adds direct financial action and therefore higher assurance requirements. Practitioners should not apply the same risk treatment to both, even when they use the same ecosystem.
👉 Read our full editorial: Open banking's API growth is reshaping finance governance