The Financial Data Access Regulation (FiDA) marks a fundamental shift in Europe’s financial ecosystem. It extends beyond open banking under PSD2 to a truly open finance framework, where customer consent enables sharing of data across banking, insurance, pensions, investments and other financial products. No longer are consumers and businesses limited to sharing information only from “payment accounts” (i.e., PSD2).

While this regulatory expansion fosters competition and innovation, it also widens the attack surface and introduces new systemic risks. FiDA participants, from data holders (banks, insurers, asset managers, etc.) to Financial Information Service Providers (FISPs) now operate within a complex trust fabric that spans borders, sectors and systems.

The evolving trust, security and cybersecurity threats in the FiDA ecosystem highlight the implications for regulators, financial institutions, FISPs and ultimately consumers & businesses, and the need to implement practical steps to ensure resilience, trust and consumer protection.

The transition from PSD2, PSD3 & PSR to FiDA represents an evolution from transactional data sharing (e.g. payment accounts) to holistic financial transparency. Under FiDA, individuals and businesses can permit accredited FISPs to access data held across financial verticals that include, but are not limited to:

• Retail and corporate banking accounts
• Credit and loan data
• Investment portfolios and pensions
• Insurance and risk data

This expansion significantly increases both the volume and sensitivity of data exchanged. While PSD2, PSD3 & PSR primarily focused on payments, FiDA touches nearly every aspect of a consumer’s financial life.

With more participants, including new entrants from non-banking sectors, comes fragmentation in governance, variable technical maturity and complex identity management. The result is a fragile trust layer where a single compromised participant could cascade risk across multiple data holders and jurisdictions.

While some threats may not yet be visible within the open finance ecosystem today, history has shown that complacency is costly. Over the past 12–24 months, multiple industries, from healthcare to critical infrastructure, have suffered severe compromises that began as unseen or underestimated risks.

The same trajectory could easily unfold in financial data sharing if emerging vulnerabilities are ignored. The absence of immediate incidents should not be mistaken for safety; rather, it is a window of opportunity to strengthen defences before adversaries exploit the inevitable weaknesses. To disregard these potential threats is not prudent.

With the lack of incident, security and data-exposure reporting under PSD2 in Europe, it is understandable that many financial institutions underestimate the security and operational risks posed by open banking and, by extension, FiDA.

This under-reporting is not solely a regulatory issue; it is also an operational one. In many institutions, open banking-related customer complaints, fraud queries, or data-access concerns raised through call centres and customer service channels are not classified as open banking incidents at all, but are instead logged under generic online banking, payments or data-privacy categories. As a result, open banking-specific risk signals are diluted, obscured or lost entirely within broader incident reporting frameworks.

The lack of meaningful incident reporting under PSD2 has been further compounded by fragmented supervisory interpretation, ambiguous definitions of what constitutes a “major” operational or security incident and overlapping notification obligations with the GDPR. Faced with uncertainty, many organisations have defaulted to GDPR breach notifications alone, rather than treating open banking incidents as distinct operational or security events requiring dedicated reporting and analysis.

Combined with reputational and commercial disincentives, immature monitoring capabilities, unclear responsibilities between banks and third-party providers and historically limited regulatory enforcement, this has resulted in under reporting. Cultural factors and the absence of feedback or shared incident data further exacerbate the problem. However, the recently implemented EU Digital Operational Resilience Act (DORA) aims to take steps to standardise incident classification, reporting timelines and aggregation, hopefully addressing some of these shortcomings.

This combination of regulatory ambiguity and internal misclassification has created a structural blind spot: institutions lack reliable data on the frequency, nature and impact of open banking incidents. In the absence of clear evidence, open banking is often perceived as low risk. That perception does not reflect reality; it reflects a failure of visibility. As PSD3/PSR and FiDA expand data access, increase ecosystem complexity and raise supervisory expectations, this historic under-reporting becomes increasingly untenable.

The FiDA Security Landscape

FiDA introduces a new generation of cyber and security risks that extend beyond those experienced under European open banking.

Every financial institution designated as a “data holder” under FiDA will be required to expose API endpoints that enable regulated and customer-consented Financial Information Service Providers (FISPs) to access client data. While this enhances data portability and competition, it will also substantially increase the number of publicly exposed APIs, thereby expanding the overall attack surface. Each endpoint represents a potential entry point for exploitation if not properly secured, continuously monitored and rigorously governed.

Data sharing will no longer be limited to access to transactional bank accounts. Under FiDA, the range of datasets that may be shared, subject to consumer consent, will expand significantly to include pensions, investments, credit products, loans, insurance and other financial services data. With the dramatic proliferation of data holders, the data sets that can/will be shared will become extremely attractive to fraudsters and criminals alike. The inclusion of insurance, investment and pension data introduces richer and more valuable personal and financial information, heightening the risks of fraud, identity theft and large-scale data misuse.

The risk is further compounded by the fact that customer data may also be accessed by entities that are not themselves regulated. These “fourth parties” are organisations that receive or process financial data from a regulated Third-Party Provider (TPP), such as an AISP or PISP, but are not authorised under PSD3 or FiDA by a national competent authority. Despite this, they may access, store, or analyse customer financial data. Examples include cloud service providers, analytics firms and subcontracted developers.

Neither PSD3, the PSR nor FiDA allow “shadow data flows” to escape regulation, but they rely heavily on regulated organisations to police their extended digital supply chains.
However, ignoring the role of fourth parties is no longer tenable: liability, reputation and systemic trust all flow upstream to the regulated institution.

As data sharing scales under FiDA, the weakest link may not be a financial institution or FISP, but the unregulated analytics vendor, cloud platform, or subcontractor sitting quietly behind them. As financial sectors converge, attackers can exploit compromised credentials or authorisations in one domain (e.g., payments) to pivot into others (e.g. investments or insurance), amplifying systemic risk across the ecosystem.

The Evolving Threat Landscape

FiDA’s expansion beyond banks, to include insurers, investment firms, pension providers and other non-bank financial institutions, introduces significant systemic risk as many of these new participants lack the security maturity, capital strength and supervisory experience of traditional banks. This creates uneven resilience across the ecosystem.

Weaker entities may use less robust cybersecurity controls, depend heavily on third-party providers and fall under fragmented regulatory oversight. The result is a broader attack surface where a breach in one area could compromise others, undermining consumer trust and threatening the integrity of the open finance framework. In essence, FiDA’s success will hinge on ensuring that every participant, not just financial institutions, meets consistent, high-grade security and operational resilience standards.

Decentralised oversight under FiDA (unlike PSD2, which benefits from a single EBA register and a relatively unified supervisory structure) spans multiple financial sectors, each governed by different regulators such as the EBA, ESMA, EIOPA and various national competent authorities. This fragmentation risks creating blind spots in supervision, delays in authorisation revocation and poor coordination during security or data incidents. Without a centralised view or harmonised oversight, there is a real danger that an unauthorised or compromised entity could remain active in one part of the ecosystem while being suspended in another, undermining both regulatory control and trust in the open finance framework.

FiDA enables real-time data sharing through open APIs, but trust and authorisation mechanisms must operate at equivalent speed. If a FISP is compromised, it may continue using valid credentials until revocation propagates across all data holders, creating a window in which attackers can exploit legitimate access. This underscores the need for real-time, synchronised revocation and trust management across the open finance ecosystem.

As FiDA expands data sharing across multiple financial data categories, consumers face growing complexity in managing consent, often unclear about who holds their data, for how long and for what specific purpose(s). This lack of transparency and control increases vulnerability to social engineering and consent phishing attacks, where malicious actors exploit user confusion to gain unauthorised access to financial information, undermining both consumer trust and the integrity of the open finance ecosystem.