Category guide
Open banking, and how to choose a provider
Open banking is the sharing of a consumer's banking data with a third party the consumer has explicitly authorised, through standardised APIs rather than credential sharing or screen scraping. It now operates under a distinct regulatory regime in most major markets — the CDR in Australia, PSD2 moving to PSD3 and FiDA in the EU, Section 1033 in the United States, the Customer and Product Data Act in New Zealand.
This page explains the category and how to evaluate providers in it. It is not a pitch: the comparison criteria below would be useful to you even if you end up choosing someone else. Where Fiskil is relevant, it says so and links out.
Open banking, open finance and open data
These three terms describe the same mechanism at widening scope, and providers use them loosely, which makes comparison harder than it should be.
Open banking covers transaction accounts — balances, transactions, direct debits, scheduled payments, payees and product information. Open finance extends the same consented, standardised model to the wider financial picture: lending, insurance, superannuation, investments and pensions. Open data infrastructure is the layer underneath all of it — the consent flows, authorisation, standardised APIs, audit trails and regulatory reporting between an organisation holding data and whoever the customer has authorised to receive it.
That last distinction matters when you are comparing providers, because the same layer carries data outside financial services. Energy data moves under the same consent model in Australia, and connected-product data will move under the EU Data Act. A provider built on the infrastructure rather than on one sector's API can cover more than one of these without a second integration.
Open banking by market
Open banking exists in over 140 countries, but the regimes differ in ways that change what a provider can actually do for you — whether payments are in scope, whether you need accreditation, and what data is designated. If you operate in more than one market, these differences matter more than any provider's feature list.
Australia — Consumer Data Right (CDR)
Live — banking since 2020, energy since 2022
Consumers can direct any designated data holder to share their data with an accredited recipient. Non-bank lenders enter the regime through staged commencement from 13 July 2026, which materially widens what "open banking" covers in Australia. Read-only: the CDR confers a right to receive data, not to initiate payments.
New Zealand — Customer and Product Data Act
Live — designated banking regime
New Zealand’s regime follows a similar consent-and-standards model to the CDR, with the Payments NZ API Centre standards defining the technical surface. The five major banks — ANZ NZ, ASB, BNZ, Westpac NZ and Kiwibank — are the core of the market.
United Kingdom — UK Open Banking Standard
Mature — live since 2018
The longest-running regime, originating in the CMA order and PSD2. It is the only major market where payment initiation and variable recurring payments are widely live, so "open banking" in a UK context often means payments rather than data alone — a common source of confusion when comparing providers across markets.
European Union — PSD2 → PSD3 / PSR, FiDA, EU Data Act
Live and expanding
PSD2 established account access and payment initiation across the EU. PSD3 and the Payment Services Regulation will replace it, while the Financial Data Access Regulation (FiDA) extends the model to the wider financial picture. Separately, the EU Data Act has applied since 12 September 2025 to connected-product data — the same consent-and-access mechanism outside financial services entirely.
United States — CFPB Section 1033
Phasing in from April 2026
The CFPB’s final rule, published 22 October 2024, requires covered institutions to make consumer financial data available through standardised interfaces, with FDX the emerging API standard. Obligations phase in by asset size: April 2026 above $500bn, 2027 above $50bn, 2028 above $850m, 2029 for all other covered institutions.
Latin America — Open finance (per country)
Commencing 2026–2028
Brazil and Mexico are furthest along; Colombia became mandatory in April 2026 with technical standards due later that year, and Chile, Peru and Argentina are at earlier stages. Timelines differ enough by country that "LATAM open banking" is not a single market.
Getting access: accreditation and its alternatives
Most regimes require you to be authorised in some form before you can collect data. What that authorisation is called and how heavy it is differs by market, and it is usually the single biggest driver of how long it takes you to go live.
In the EU and UK you are typically an authorised or registered third-party provider — an AISP for data, a PISP for payments — regulated by a national competent authority. In the United States, Section 1033 places the obligation on the data holder rather than creating an accreditation regime for recipients, so the compliance burden sits differently.
Australia is the most prescriptive, and worth understanding in detail because it is where the alternatives to accreditation are most developed. There are three routes:
Unrestricted accreditation — the full level. Requires an independent third-party assurance report on your information security, plus a privacy framework, external dispute resolution membership, insurance and the technical capability to meet the Consumer Data Standards. Most control, most overhead.
Sponsored accreditation — replaces the independent assurance report with a self-assessment and attestation, available where you have an arrangement with an unrestricted accredited person acting as your sponsor.
CDR representative — you are not accredited at all. You operate under a written arrangement with an accredited principal, and the principal remains responsible for compliance. This is the shortest route for most businesses, and the first thing worth asking any prospective provider about. Fiskil acts as principal for CDR representatives.
A fourth Australian pathway exists but is not accreditation: a consumer can nominate a trusted adviser — a class defined in the CDR Rules covering accountants, lawyers, tax agents, financial advisers and mortgage brokers — and consent to their data being disclosed to that adviser.
How to compare providers
Six things separate providers in practice, in any market. None of them is the headline number on the homepage.
1. Coverage, verified
Ask for the list, not the number. Providers count differently — institutions, brands, or what is theoretically reachable rather than live. The only question that matters is whether the specific institutions your customers bank with are live today, in the markets you operate in.
2. Which authorisation model they support
Can the provider act as your principal or sponsor so you do not need your own authorisation? In Australia that is the difference between weeks and months. In the EU and UK, ask whether they are the regulated entity or whether you must be.
3. Market and sector scope
If you operate across markets, check it is one integration rather than one per regime. If you need energy or connected-product data as well as banking, check the same — a provider built on the infrastructure rather than one sector’s API should not charge you for a second project.
4. The consent experience
Your customers see the provider’s consent flow, not your product. Completion rates vary considerably between implementations, and it is the single biggest driver of how much data you actually end up with. Ask to see it on a phone, not in a deck.
5. The uptime commitment in the contract
Not the figure on the website. Ask what is committed, at what plan tier, whether service credits attach, and what the measurement window is. Regimes also set their own minimum availability obligations on data holders, which is a different number again.
6. How pricing scales
Per connected consumer and per bank connection produce very different bills at volume. Ask which it is, whether enrichment or categorisation costs extra, whether there is a platform fee, and what the minimum term is.
Where Fiskil fits
Fiskil is an open data infrastructure platform providing open banking, open finance and energy-data connectivity across Australia and New Zealand. Fiskil's Data API supports 200+ banks, lenders and energy providers across Australia and New Zealand.
If you want to access data, that is the Banking API and the Energy API, available directly or under Fiskil's accreditation as a CDR representative. If you are a bank, lender or energy retailer that has to share data — under the CDR, Section 1033 or the EU Data Act — that is Data Provider, with Product Portal for product reference data.
On the first criterion above: live connection health is published at fiskil.com/institution-status, so Fiskil's own coverage can be checked rather than taken on trust.
Glossary
The terms a buyer has to understand before they can evaluate anyone.
Open banking
Open banking is the sharing of a consumer’s banking data with a third party the consumer has explicitly authorised, through standardised APIs rather than credential sharing or screen scraping. In Australia it operates under the Consumer Data Right; in New Zealand under the Customer and Product Data Act.
Open finance
Open finance is the extension of open banking beyond transaction accounts to the wider financial picture — lending, insurance, superannuation, investments and pensions — under the same model of consumer-authorised, standardised data access.
Open data infrastructure
Open data infrastructure is the layer that moves data between organisations with the customer’s consent: the consent flows, authorisation, APIs, audit trails and regulatory reporting that sit between a data holder and whoever the customer has authorised to receive the data. Open banking, open finance and energy data are sector-specific applications of it.
Consumer-permissioned data
Consumer-permissioned data is data shared because the consumer explicitly authorised that specific sharing, for a stated purpose and a defined period, with the ability to withdraw the authorisation at any time. It is the defining condition of open banking, as distinct from data obtained by credential sharing.
Consumer Data Right (CDR)
The Consumer Data Right is the Australian framework giving consumers the right to direct that data held about them be shared with an accredited third party. It commenced for banking in 2020, energy in 2022, and applies to non-bank lenders through staged commencement from 13 July 2026.
Data holder
A data holder is an organisation required to share data it holds about a consumer when the consumer directs it to. Under the CDR this includes banks, non-bank lenders and energy retailers. Data holders must expose standardised APIs, honour consent and revocation, and meet availability and reporting obligations.
Accredited data recipient (ADR)
An accredited data recipient is a business accredited by the ACCC to collect CDR data with consumer consent. There are two levels of accreditation, unrestricted and sponsored, and both apply across banking, non-bank lending and energy.
CDR representative
A CDR representative is a business that uses CDR data without being accredited itself, operating under a written arrangement with an accredited principal that remains responsible for compliance. It is the shortest route into the CDR for a business that does not want to hold accreditation.
Sponsored accreditation
Sponsored accreditation is the accreditation level that replaces the independent third-party information-security assurance report with a self-assessment and attestation, available where the applicant has an arrangement with an unrestricted accredited person acting as its sponsor.
FAPI
FAPI (Financial-grade API) is the OpenID Foundation security profile used to protect open banking APIs, adding requirements such as sender-constrained tokens, pushed authorisation requests and mutual TLS on top of OAuth 2.0. Regimes mandate specific FAPI versions — the CDR requires FAPI 1.0 Advanced.
Consent
Consent in open banking is the consumer’s explicit, informed and time-limited authorisation for specified data to be shared for a stated purpose. It cannot be bundled with unrelated terms, must be visible to the consumer on a dashboard, and must be revocable at any time with effect on revocation.
Product reference data
Product reference data is the non-customer-specific information a data holder publishes about the products it offers — rates, fees, features, eligibility and terms. It is published openly rather than per consumer, which is why it requires no consent and is the first obligation most data holders meet.
Open banking FAQs
Working out which model you need?
Tell us the markets you operate in and whether you need to access data, share it, or both. We will tell you which route fits — including when it is not us.
