Open banking lets third-party financial service providers access customer data from banks and other financial institutions. Customers control who can access their information and must agree to share their data with third parties. This shared data, accessed through application programming interfaces (APIs), drives innovation and competition in the finance industry, enabling the rise of fintech and new financial services. The total transaction value of global open banking payments is projected to rise from nearly US$40 billion in 2025 to US$288 billion by 2033.

Safe, compliant open banking is built on a security foundation that protects sensitive financial data shared between entities. Below, we'll explain how open banking works and customer data is secured, including API security and identification and protection strategies.

Key takeaways

• Modern open banking relies on standardised, tokenised APIs and OAuth 2.0 rather than legacy screen scraping, ensuring users never share raw bank passwords with third parties.

• Users have total control over their data by granting explicit, time-bound permissions for specific information that they can revoke instantly through their bank or connected apps.

• Secure open banking combines Strong Customer Authentication (SCA), end-to-end encryption in transit and at rest, and rigorous third-party provider vetting to reduce fraud exposure and clarify liability.

What is open banking used for?

Open banking facilitates data sharing, enhancing financial services for customers and businesses.

Open banking has enabled a range of financial tools and features, including:

• Budgeting and saving apps: Open banking has enabled the creation of third-party apps that aggregate users' bank account data and provide tailored budgeting and savings recommendations.

• Better credit and loan decisions: Lenders can quickly access and analyse more financial data via open banking, which can lead to better credit decisions and faster loan approvals.

• Tailored banking services: Financial institutions can use the data accessed via open banking to offer customers personalised products and services, such as custom interest rates.

• Direct account payments: Open banking APIs can be used to initiate payments directly from a bank account, bypassing traditional payment systems such as credit cards, which can reduce transaction fees.

• Improved fraud detection: Access to real-time data helps financial institutions and service providers improve their fraud detection capabilities, reducing the risk of unauthorised transactions.

• Cash flow management: Businesses can use open banking solutions to integrate data from different accounts into one platform, gaining a better understanding of their cash flow.

• Market insights: Businesses can analyse banking data made available by open banking for customer behaviour, market trends, and economic conditions insights.

How does open banking work?

Open banking uses APIs to share financial data between banks and authorised third-party providers. Customer consent regulated under a variety of frameworks is required for data sharing.

Here's how open banking works:

• Banks build standardised APIs: Banks develop or adopt standardised APIs that let third-party providers access financial data. These APIs act as secure gateways for data requests and responses.

• Customers give consent: A customer gives explicit consent to a third-party provider to access their financial data. Consent is typically managed through a secure interface and legally required to be informed and explicit.

• Providers request data access: Once consent is given, the third-party provider integrates open banking APIs to request access to the customer's financial data from the bank. These APIs process requests securely and consistently.

• Banks manage authentication and authorisation: The bank verifies the identity of the customer and third-party provider authorisation to access the data. The process often involves authentication steps, such as logging in through the bank's portal or other security checks.

• Banks share data: After successful authentication and authorisation, the bank shares the requested data with the third-party provider through the API. Data can include account balances, transaction histories, payment initiation capabilities, and more.

• Data is provided in real time: APIs let apps retrieve up-to-date data directly from the customer's bank, whether it's latest transactions or verifying account ownership. This facilitates a wide variety of financial tech services, including budgeting apps and automated loan approvals.

• Providers use the data: The third-party provider uses data to offer services to the customer, such as financial management, personalised financial advice, easier lending processes, or payment services.

• Customers provide ongoing consent: Customers can manage or withdraw their consent at any time. Banks and third-party providers must comply with strict security measures to protect the data and ensure privacy.

• Regulators set and enforce rules: Open banking is regulated by government agencies and national legislation, which dictate security standards, customer consent procedures, and types of data that can be shared in open banking. Regulators continuously monitor banks and third-party providers to ensure they comply with open banking regulations.

• Communication is standardised: Open banking APIs follow specific standards, meaning they speak a "common language" used by different banks and apps. This ensures apps and services can work smoothly with different banks and financial institutions.

Open banking's core security challenges

Open banking increases exposure for sensitive financial data and requires advanced security measures to protect that data from unauthorised access. Security challenges require a combination of advanced technology, well-designed security processes, and ongoing vigilance.

Security challenges in open banking include:

Managing customer consent

Personal financial data can be accessed only when customers have clearly agreed to it, and customers can revoke that access at any time.

Solutions

• Implement state-of-the-art systems to manage consent.
  
• Give customers straightforward options to control their data.
  
• Maintain compliance with strict privacy laws such as the General Data Protection Regulation (GDPR).
  

Securing APIs against unauthorised access

APIs open doors to data and must be well-guarded against unauthorised access and attacks.

Solutions

• Use modern authorisation methods such as OAuth 2.0.
  
• Ensure APIs are fortified using tools such as mutual Transport Layer Security (TLS) for authentication.
  
• Monitor usage to prevent and detect unusual activities.
  

Vetting and monitoring third-party providers

Third-party services have varying levels of security.

Solutions

• Thoroughly evaluate the security measures of all external providers.
  
• Continuously monitor third-party providers.
  
• Insist on compliance with high security standards.
  

Encrypting data in transit and at rest

Data must be encrypted to protect it from being tampered with or read if intercepted.

Solutions

• Use strong encryption techniques for data at rest and in transit.
  
• Check data integrity regularly using techniques such as digital signatures.
  

Detecting fraud

More data access can potentially lead to new types of fraud.

Solutions

• Use advanced machine learning to spot fraud as it happens.
  
• Set up a system to watch for and quickly react to suspicious actions.
  

Staying compliant

Regulations can vary by region and change over time, affecting how data must be handled.

Solutions

• Build a compliance strategy that can quickly adjust to new laws.
  
• Ensure your team stays informed about the latest requirements.
  
• Learn your region's regulations. The EU and UK have centralised mandates for open banking, while US open banking regulations are largely voluntary and industry-driven.
  

Verifying identities and managing access

Individual users must be verified, with their data access strictly controlled.

Solutions

• Implement SCA identity verification and multifactor authentication (MFA) systems.
  
• Set precise access controls.
  
• Clarify the legal and financial accountability framework when unauthorised payments or breaches occur. For example, different entities will be held liable depending on whether a transaction was unauthorised or authorised (e.g., through social engineering).
  

Responding to incidents

Services must run smoothly even when issues occur. Security breaches must be addressed quickly to minimize damage.

Solutions

• Prepare and regularly update incident response plans.
  
• Ensure backup systems are in place.
  
• Run regular security drills.
  

How to secure open banking APIs

API security in open banking requires a multilayered system to ensure all interactions among banks, third-party providers, and customers are secure and data integrity is maintained.

Key API security considerations include:

Authentication and authorisation

Authentication and authorisation protocols, like the Financial-grade API (FAPI), ensure APIs are accessible by only legitimate users and services.

• OAuth 2.0: OAuth 2.0 is an authorisation method that uses tokens instead of credentials. Each token grants access to a specific set of resources for a limited period, reducing the risk of token theft.

• OAuth: OAuth provides methods for getting tokens for different scenarios, such as authorisation codes for apps and client credentials for server-to-server interactions.

Encryption

Encryption is used to protect data as it moves between systems (in transit) and when it’s stored (at rest). Using strong, updated cryptographic protocols prevents interception by attackers.

• TLS: TLS protects data in transit, encrypting data exchanged between clients and servers.

• AES: Advanced encryption standards (AES) are applied to database entries and other data stores to protect data at rest.

API gateways

API gateways manage and secure the traffic toward the APIs. An API gateway acts as a reverse proxy to accept all API calls, aggregate the services required to fulfil them, and return the appropriate result. It handles rate limiting, IP whitelisting, and access control. Gateways can provide insights into traffic patterns and alert administrators to potential security threats.

Secure API development practices

APIs are secure by design. Developers should adhere to the Open Web Application Security Project (OWASP) API Security Top Ten, an awareness document for API security.

• Input validation: Input validation prevents SQL injection and cross-site scripting (XSS) attacks.

• API transaction logging: Detailed logging of API transactions ensures you're prepared in the event of an audit.

• Regular code reviews: Regular code reviews identify vulnerabilities before they lead to security breaches.

Rate limiting and throttling

Rate limiting and throttling prevent abuse of APIs. The process involves limiting how many requests a user or service can make in a certain period. If the number exceeds the limit, additional requests are delayed or blocked. Throttling helps manage load and ensures services remain available even in high traffic or attack scenarios.

Regular security audits and penetration testing

Regular security audits and penetration testing continuously evaluate the security posture of API infrastructures. These practices should be part of a regular security protocol and meet industry standards and compliance requirements. Routine audits and penetration testing can find vulnerabilities before they are exploited.

Anomaly detection and response systems

These systems detect and respond to unusual activity that could indicate a security breach, using machine learning and other advanced analytics to monitor API traffic patterns and automatically flag activities that deviate from the norm. They’re often integrated with incident response mechanisms to quickly isolate and mitigate potential threats.

How to build a risk-based security strategy

A risk-based security strategy involves prioritising security efforts and resources based on the likelihood and potential impact of various threats. It helps an organisation remain agile, responsive to new threats, and focus resources where they're needed most. This is particularly important when security budgets are limited or amid rapidly evolving technology landscapes.

Here’s how a risk-based security strategy typically works:

• Assess risks: Identify and evaluate risks based on their potential impact and the likelihood of occurrence. Map out the organisation's assets, and determine the threats each asset faces, assessing vulnerabilities and evaluating the potential impacts of those threats. Use techniques such as threat modelling and vulnerability scans.

• Prioritise risks: Determine which risks need immediate attention, which can be monitored, and which are acceptable. Rank risks based on their severity and likelihood, prioritising high-impact, high-probability risks for immediate mitigation.

• Implement controls: Apply the most appropriate and cost-effective controls to manage and mitigate the highest priority risks. Implement different types of controls (e.g., preventative, detective, corrective) depending on the risk. Controls might include technological solutions (e.g., firewalls and encryption), policies and procedures, and training and awareness programmes.

• Monitor security systems: Continuously monitor risk management measures to ensure effectiveness. This might involve regular security audits, intrusion detection systems, and monitoring access logs and other security events.

• Learn and improve: Adjust measures in response to new threats, changes in the organisation, or lessons learned from ongoing monitoring. Use feedback from the monitoring and review phase to make improvements to security practices. Update risk assessments and controls as incidents occur and vulnerabilities are identified.

How to implement zero trust security policies

While traditional security models assume everything inside an organisation's network can be trusted, zero trust policies never assume trust. Zero trust requires rigorous identity verification for anyone trying to access network resources, whether they are inside or outside the network perimeter.

Here's how zero trust policies are typically implemented:

• Explicitly verify all requests: Every access request must be verified before access is granted, regardless of where the request originates or what resource it accesses. Use MFA, biometrics, and behavioural analytics to verify the identity of users, and employ context-based authentication that considers variables such as device health, location, and time of access.

• Use least privilege access: Minimise each user's exposure to sensitive parts of the network by granting users and devices the minimum level of access necessary to perform their tasks. Manage this through strict access control policies and roles, which are reviewed and updated regularly.

• Segment the network: Divide the network into segments to reduce lateral movement within the network by attackers. This creates micro-perimeters around sensitive data and systems, making it harder for an attacker to move through the network if they gain access.

• Implement layered defences: Implement multiple defensive layers an attacker must bypass to access resources. Use a combination of firewalls, intrusion detection and intrusion prevention systems (IDS/IPS), and data encryption in transit and at rest.

• Monitor and maintain security: Continuously monitor all network traffic and user activities to detect and respond to threats in real time. Use security information and event management (SIEM) systems to analyse and correlate logs for abnormal behaviour. Machine learning can help recognise patterns that deviate from the norm.

• Make security an integrated process: Ensure security is a key consideration in every IT project and business operation from the start. Engage in regular security training for all employees, and integrate security into the software development lifecycle (DevSecOps).

How to identify and protect against security vulnerabilities

Identification and protection against vulnerabilities involves systematically discovering, categorising, and addressing security holes or weaknesses in software and hardware that attackers could exploit. Here’s how it typically works:

• Scan systems for known vulnerabilities: Conduct regular vulnerability scans using automated tools that compare system configurations and installed software against known vulnerability databases. Penetration testing, where ethical hackers attempt to exploit vulnerabilities, also provides insights into system weaknesses.

• Assess and prioritise your findings: After vulnerabilities are identified, assess them based on factors such as the ease of exploitation, potential impact of an exploit, and extent of system exposure. That helps prioritise remediation efforts according to the nature and severity of the risk posed.

• Apply patches as soon as they're available: Software vendors provide patches or updates to fix vulnerabilities. Implement a systematic process for the timely application of security patches, updates, and hotfixes to ensure vulnerabilities are addressed as soon as fixes are available.

• Harden system configurations: Use configuration management tools to ensure systems are set up securely and maintained consistently. Regularly review and harden configurations to minimise attack surfaces and prevent vulnerabilities due to misconfigurations or default settings.

• Defend against unknown zero-day threats: Employ advanced threat detection technologies such as behaviour-based detection systems, which do not rely solely on known vulnerability signatures. Those can identify and mitigate unusual activity that might indicate an exploit in progress, defending against unknown vulnerabilities or those without an existing patch.

• Train employees on cybersecurity awareness: Conduct ongoing cybersecurity training for all employees, focusing on recognising phishing attempts, managing passwords securely, and understanding the importance of regular software updates. This helps minimise human error, which can introduce or exacerbate vulnerabilities.

• Audit security practices and compliance: Perform regular security audits and compliance checks to evaluate how well security policies are being followed and identify any gaps in the organisation's security posture. Doing so ensures security practices meet established standards and regulations.

• Establish and test an incident response plan: Develop and routinely test an incident response plan that outlines what steps to take when a security breach occurs. This should include procedures for containment, eradication, recovery, and post-incident analysis.

How Stripe Treasury can help

Stripe Treasury brings payments and finances together on Stripe, so businesses can receive, store, send, and spend funds in one place. It's built for startups and growing businesses that want to move money faster and spend less time managing financial operations. Platforms, marketplaces, and fintechs can also offer financial services to their users with Treasury for platforms.

Treasury can help you:

• Simplify your financial operations: Manage money, payments, card spend, payouts, and more from the Stripe Dashboard.

• Move money faster: Access settled Stripe earnings right away and send instant transfers to other businesses on Stripe without cost.

• Get more from your money: Earn cashback on card spend and Stripe fee credits on qualifying balances.

• Operate globally with ease: Hold balances in multiple currencies, convert only when needed, and send payouts to recipients in 160+ countries.

• Automate financial operations: Use agents to analyse cash flow and automate tasks such as paying invoices, moving money, and converting currencies within limits you set.

Learn more about how Stripe Treasury can help you manage your finances and payments in one place, or get started today.