How Open Infrastructure Connects Multiple Payment Providers

The Open Banking API Specifications define the methods and parameters that enable interactions between participants in the fintech ecosystem (1). In the UK, providers of payment accounts accessible online must give account information and payment initiation providers access to those accounts, with the user's consent and authentication (2). If your layer provides payment initiation services, it must be authorised before it connects.

How does open infrastructure let one integration connect to multiple payment providers?

The Open Banking API Specifications define the methods and parameters that let participants in the fintech ecosystem interact (1). Their Read/Write API is a set of RESTful APIs that lets third-party providers access information and initiate payments for customers by connecting to account servicing providers securely, efficiently and with customer consent.

Providers of payment accounts accessible online must allow third-party providers to access user accounts, with the user's explicit consent, so the access duty sits on the account side (2).

Access is limited to payment accounts that are accessible online, and every access requires the user's consent and authentication (2).

Which UK regulatory status does a layer need when it initiates payments from accounts held at other providers?

A layer that initiates payments from accounts held at another payment service provider needs to be a payment initiation service provider (2). Under the Payment Services Regulations 2017, a payment initiation service is an online service that initiates a payment order at the request of a payment service user, with that user's consent and authentication. The Regulations brought payment initiation and account information services under regulation for the first time.

The Financial Conduct Authority is responsible for ensuring that account information and payment initiation providers are registered or authorised (2). According to the FCA, a business providing payment initiation services must be authorised and must have a minimum of €50,000 in initial capital, or higher if it provides certain other payment services. You must also hold professional indemnity insurance, as both account information and payment initiation providers must.

The capital threshold applies to payment initiation providers, so check the status your layer actually performs before you assume a lighter registration (2).

What security, authentication and consent requirements apply when connecting providers through shared infrastructure?

Each payment service provider must maintain adequate security measures to protect the confidentiality and integrity of users' personalised security credentials (3).

An account servicing provider must let a payment initiation or account information provider rely on the authentication procedures it has provided to the user (3). Following the UK's withdrawal from the EU, the FCA made UK technical standards on strong customer authentication and common and secure methods of communication (SCA-RTS) (2). The EBA developed regulatory technical standards that introduce standards for common and secure communications between ASPSPs and AISPs or PISPs.

An account servicing provider may deny access to a payment initiation or account information provider only for reasonably justified and duly evidenced reasons relating to unauthorised or fraudulent access, including unauthorised or fraudulent initiation of a payment transaction (3). An account servicing payment service provider may deny access for reasonably justified and duly evidenced reasons relating to unauthorised or fraudulent access, so build your connection so that a denial can be traced to that kind of evidenced reason.

What are the effective dates for these standards and rules, as distinct from their issue dates?

The UK SCA-RTS instrument was made on 26 November 2020, published by the Financial Conduct Authority, and it came into force on IP completion day, which is 11pm on 31 December 2020, immediately after regulation 106A of the Payment Services Regulations 2017 came into force (4). The Financial Conduct Authority's operational resilience rules took effect on 31 March 2022, and a transitional provision gives firms until 31 March 2025 to remain within their impact tolerances (5). According to Open Banking Limited, the API Specifications page lists version 4.0.1 as the latest version, dated 18 Mar 2026, so confirm the version your integration targets against that listing (1).

The resilience duties themselves are covered in the earlier article on this site, so treat these dates as the timing constraints to check before you connect (5).

Key dates for the standards and rules behind a multi-provider connection

Sources

1. API Specifications, Open Banking Limited, 2019-07-26T00:00:00.000Z
2. Account information services (AIS) and payment initiation services (PIS), FCA, First published: 02/02/2017; Last updated: 17/09/2024
3. The Payment Services Regulations 2017, legislation.gov.uk, accessed 2 November 2026
4. TECHNICAL STANDARDS ON STRONG CUSTOMER AUTHENTICATION AND COMMON AND SECURE METHODS OF COMMUNICATION INSTRUMENT 2020, Financial Conduct Authority, 26 November 2020
5. OPERATIONAL RESILIENCE INSTRUMENT 2021, Financial Conduct Authority, 25 March 2021