The UK Open Banking Standard is the machine-readable API specification created by the Open Banking Implementation Entity (OBIE, now Open Banking Limited) under the Competition and Markets Authority's remedy and the PSD2 mandate. It defines a common Read/Write API family — Account and Transaction Information (AIS), Payment Initiation (PIS), Confirmation of Funds (CBPII), and the unauthenticated Open Data APIs — that the CMA9 and other UK account providers implement to a single conformance-tested contract, secured with FAPI-grade OAuth2/OIDC, mTLS, and PSD2 strong customer authentication.
UK Open Banking Standard
The UK Open Banking Standard is the specification the Open Banking Implementation Entity (OBIE) wrote to deliver the Competition and Markets Authority’s open-banking remedy and the UK’s PSD2 obligations. Where PSD2 is the law, the OBIE standard is the machine-readable contract that made the law real — and, uniquely among the open-banking regimes I have scored, it was paired with conformance testing and a delivery body rather than left to each bank to interpret.
- A common Read/Write API family - Account and Transaction Information (AIS), Payment Initiation (PIS), and Confirmation of Funds (CBPII), plus a public, unauthenticated Open Data surface for ATMs, branches, and product reference data. Every CMA9 bank ships the same resource surface to the same spec.
- Payment initiation, not just data sharing - Unlike read-only regimes, the UK standard mandates write surfaces (PIS and, later, Variable Recurring Payments), so a third party can act on an account under consent, not merely read it. That is why idempotency and action-class semantics show up across the UK sector where they are absent elsewhere.
- A conformance-tested, FAPI-secured contract - Secured with FAPI, OAuth2/OIDC, mutual-TLS client authentication, PSD2 SCA, and dynamic client registration using eIDAS/OBIE certificates — with an implementation entity running certification, a directory, and a live conformance suite.
The UK standard is the model every other jurisdiction copies, and the lesson from scoring it is precise: it is the best-executed open-banking mandate on earth, and it still tops out short of a product an agent could adopt unassisted. A mandate reaches existence and even usefulness — a valid, conformant, actionable contract — but the governance, operational transparency, and product surface above the contract are left to each bank. When I read a UK bank and see the full OBIE Read/Write family expressed as machine-readable artifacts, that is the mandate having produced genuine substance; what it did not produce is a good product, and that gap is the market.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of UK Banking APIs
The mandated Read/Write contract every UK bank re-hosts — the gold-standard open-banking spec the whole report is measured against.
The State of US Banking APIs
The reference regime the US 1033/FDX effort is implicitly compared to — a mandate that paired the spec with conformance and a delivery body.
Governed by these regulations
A standard is the machine-readable contract; a regulation is the law that requires it. These are the regulations that mandate or drive this standard, catalogued at regulations.apievangelist.com.
CMA Open Banking Order
The competition remedy that ordered the CMA9 to adopt this common standard and funded OBIE to write it.
Revised Payment Services Directive (PSD2)
The directive whose access-to-account obligation this standard implements in the UK.
