Open banking is transforming financial services by enabling consumers to securely share their financial data with third-party providers (TPPs). While the core principles of open banking are consistent (i.e consumer data ownership, interoperability, innovation and fostering competition) the regulatory frameworks governing it vary significantly across the globe. There is a spectrum of regulatory approaches to open banking, from market-driven initiatives to highly prescriptive, government-mandated systems. However, there is no universally ‘correct’ model with each country’s approach shaped by its legal system, financial infrastructure, policy goals and consumer protection priorities.

Open banking is an evolving global phenomenon that promotes innovation, competition and customer-centricity in financial services. At its core, open banking enables consumers to authorise secure access to their banking data by third-party providers (TPPs), unlocking new services like personal finance tools, alternative lending and payment initiation.

Despite shared objectives, countries have adopted markedly different approaches to open banking regulation, ranging from market-led frameworks with minimal regulatory intervention to comprehensive government-mandated regimes.

Examples of Open Banking Regulatory Models

• Market-Driven (Non-Regulatory) Environments: USA, Japan, Singapore.
• Hybrid or Collaborative Models: Australia, Mexico, Hong Kong.
• Fully Regulated Mandated Environments: European Union, United Kingdom.

Regulatory Approaches

The key factors that determine the regulatory approach for a given jurisdiction include, but are not limited to: governmental policy goals, legal traditions, consumer protection priorities, financial market maturity and most importantly – stakeholder readiness.

No One-Size-Fits-All

Open banking has no universal blueprint. From the regulated open banking environments to the market-led models, each jurisdiction has crafted its own path based on its unique context. The diversity of approaches highlights the need for flexibility, stakeholder collaboration and continuous evolution.

There is no definitive ‘right’ or ‘wrong’ way to implement open banking. The success of an open banking initiative and ecosystem depends on:

• Alignment with national objectives and government policy
• Integrating with existing infrastructure
• Implementation strategy (phased vs. full-scale)
• Extent of Regulatory Reach/Regulatory Oversight (banks, fintechs, etc.)
• Participation model (voluntary vs. mandatory)

The approach taken may evolve, as demonstrated in India where they have moved from voluntary to structured, and the U.S. which has adopted formal rules (i.e Dodd-Frank 1033 Act) in place of a market-driven approach.

Open banking has no universal blueprint. From the regulated environment of the EU to the market-led model of Singapore and Japan, each jurisdiction has crafted its own path based on its unique market environment. The diversity of approaches highlights the need for flexibility, stakeholder collaboration and continuous review. Ultimately, the goal remains the same: to empower consumers, promote competition and foster innovation in financial services.

The Need for Open Banking Trust Frameworks

In a highly inter-connected environment, trust between participants is paramount. A Trust Framework defines the legal, technical, operational and governance foundations that allow disparate entities such as banks, fintechs, regulators and consumers to interact securely and reliably.

Without a coherent Trust Framework, inconsistencies in security, identity management, onboarding processes and data handling can lead to fragmentation, security vulnerabilities a decline in adoption and loss of consumer confidence. A well-defined framework mitigates these risks by establishing common expectations and requirements for all ecosystem participants.

Adopting International Standards and Rulebooks

A core component of any Trust Framework is the adoption of international standards and rulebooks. These define the roles, responsibilities and behaviours of participants, creating a predictable and interoperable environment.

• Standards: Open standards such as ISO 20022, OAuth 2.0, OpenID Connect and FAPI (Financial-grade API) ensure interoperability and secure data exchange across borders.
• Rulebooks: These codify obligations for data sharing, customer consent, liability models, dispute resolution and service level agreements (SLAs).

Using globally accepted standards reduces technical fragmentation, accelerates ecosystem maturity and enables cross-border collaboration. Rulebooks provide a unified guide for operations and compliance, promoting fairness and predictability.

Directory Services

In environments where regulatory oversight of open banking third-party providers (TPPs) is absent, Directory Services become essential to establish a level of transparency, trust, security, surety and operational efficiency. Directory Services help create a structured, accessible way to manage and authenticate participants within the open banking ecosystem. By implementing such services in a distributed manner, the ecosystem can maintain flexibility, scalability and reliability.

Directory Services are the cornerstone of the Trust Framework in the open banking ecosystem. They provide a verified register of all authorised participants, including banks, TPPs and regulatory entities.

Directory Services act as a central or distributed repository that holds information about entities (e.g., banks, TPPs, consumers, etc.) participating in the open banking ecosystem. The core purpose of these services is to enable seamless and secure connections between entities within open banking while ensuring compliance with technical and regulatory requirements. Key functions of Directory Services include:

• Participant Registration and Authentication
• Directory Listing and Discoverability
• Certification and Compliance Verification
• TPP Access Control and Permissions
• Real-time Updates and Monitoring

Directory Services support automated trust establishment and streamline technical integrations by serving as a single source of truth for participant metadata and digital certificates.

Central vs Distributed Directory Services

Countries such as the United Kingdom, Australia and Brazil have all implemented central Directory Services to support the implementation, development and growth of their open banking ecosystems giving the financial supervisor oversight of all legally regulated ecosystem participants.

In other countries, where financial supervisory oversight does not extend to third-party service providers, they have adopted a distributed approach to Directory Services (e.g. Chile & USA). In this scenario, the Competent Authority regulates the activities and accreditation of the Credit Institutions (i.e. banks), but the responsibility for ensuring third-party providers comply with the relevant regulatory requirements is passed to the Data Providers (i.e. banks) and/or nominated service providers. In this model construct, Directory Services are spread across multiple, federated systems, each owned by different stakeholders (e.g., banks, services providers etc.). These systems would maintain their own records but cooperate to create a unified directory accessible to all participants, giving each participant control over their own information while still enabling them to interact securely with other entities.