If your platform connects to customer bank accounts or initiates payments through a third party, PSD2 applies to your operations -even if you hold no licence yourself. Most compliance obligations under PSD2 regulation flow to the authorised provider sitting underneath your platform. But some stay with you, and the split matters.
This guide maps which obligations fall to the provider, which remain with your platform, and what you need to evidence independently. It is written for compliance leads, product managers, and founders -not lawyers. Always seek your own regulatory advice on your specific situation.
Soft CTA: Explore how open banking providers UK handle the authorisation layer for platforms building on PSD2 infrastructure.
Key Takeaways
- Under PSD2 regulation UK, authorisation obligations sit with your provider -but consent management and purpose clarity remain your responsibility as the platform
- SCA is handled natively by the customer’s bank during the Open Banking Standards flow -your platform does not need to implement it separately
- The Data (Use and Access) Act 2025 and new FCA open banking powers update the UK’s post-Brexit position without removing the core PSD2 framework
- PSD2 FCA enforcement applies to the authorised firm -but your platform can face consequences if it facilitates non-compliant data access or consent practices
What Does PSD2 Actually Require UK Platforms to Do?
PSD2, implemented in the UK through the Payment Services Regulations 2017, created the legal framework for third-party providers (TPPs) to access customer bank accounts with consent. The regulation created two licensed roles: the AISP (Account Information Service Provider) for read-only data access, and the PISP (Payment Initiation Service Provider) for payment initiation.
Most UK platforms building on open banking infrastructure are not themselves licensed under PSD2 regulation. Instead, they integrate a licensed provider that holds the required permissions and sits within the Open Banking Standards framework.
Things PSD2 regulation UK requires from authorised providers
The licensed provider, not your platform, must:
- Hold FCA authorisation (AISP, PISP, or both) under the Payment Services Regulations
- Operate under the Open Banking Standards defined by the Open Banking Implementation Entity (OBIE)
- Maintain open banking API UK connectivity across participating banks
- Handle consent flows, re-authentication, and data scope
- Implement SCA-compliant authentication journeys
- Maintain operational resilience and incident reporting requirements
Things PSD2 regulation UK requires from your platform
Even without a licence, your platform holds obligations:
- Displaying a clear purpose statement before consent is granted
- Ensuring users understand what data is accessed and for how long
- Surfacing re-authentication prompts when consent approaches expiry
- Not requesting data beyond the scope of the stated purpose
- Operating a complaints process that meets PSD2 complaints standards
This division of consent and liability is the most commonly misunderstood aspect of PSD2 regulation UK, and the one most likely to cause issues in an FCA supervisory review.
The scale of the UK ecosystem also reflects the maturity of this regulated infrastructure. In June 2026, Open Banking Limited recorded more than 2.8 billion successful API calls, with 99.35% average API availability and a 99.50% successful API-call rate.
What Is the Obligation Map Under PSD2?
The table below maps each PSD2 obligation against the party responsible for it and what evidence is expected.
| Obligation | Held By | Evidence Expected |
|---|---|---|
| FCA authorisation (AISP/PISP) | Provider | FCA Register entry with valid FRN |
| Open Banking Standards compliance | Provider | OBIE registration and API conformance |
| SCA implementation | Customer’s bank (native) | No separate platform action required |
| Consent collection | Platform | Clear purpose statement before consent |
| Consent scope management | Platform + Provider | Data access limited to stated purpose |
| Re-authentication prompts | Platform (surface), Provider (execute) | Prompt shown before 90-day consent expires |
| Data handling obligations | Provider (primary) | GDPR-compliant processing, retention records |
| Incident reporting | Provider | FCA notification within required timeframes |
| PSD2 complaints handling | Platform (first line) | Complaint log, response within 15 business days |
| Liability for unauthorised transactions | Provider | Refund obligations under PSR 2017 |
For a detailed breakdown of the read versus write permission split, see what is an AISP.
How Does SCA Apply to an Open Banking API UK Integration?
Strong Customer Authentication (SCA) is a core PSD2 requirement. Under PSD2 regulation UK, SCA requires customers to verify their identity using at least two of three factors: knowledge (PIN or password), possession (mobile device), and inherence (biometric authentication).
For platforms using an open banking API UK integration, SCA is handled natively by the customer’s bank during the authentication step. When a customer connects their account or initiates a payment, the bank performs SCA directly. Your platform does not implement SCA, it relies on the bank’s own authentication journey, which already satisfies the PSD2 requirement.
SCA exemptions relevant to UK platforms
Not every transaction requires SCA. Under PSD2 regulation uk, the following are commonly exempt:
- Low-value payments (under £30 per transaction, up to a cumulative limit)
- Trusted beneficiaries the customer has previously whitelisted
- Merchant-initiated transactions (MIT) -where the customer set up prior authority
- Recurring transactions of a fixed amount to the same payee
Platforms need to understand which transaction types qualify for exemptions, because applying SCA unnecessarily creates friction without regulatory benefit.
What Are the PSD2 FCA Powers in 2026?
The UK’s PSD2 regulation framework has evolved since Brexit. The Payment Services Regulations 2017 -the UK’s domestic implementation- remain in force. However, HM Treasury confirmed in 2024 that the FCA would receive new powers to regulate open banking directly, moving supervision from the OBIE model toward FCA-led oversight.
In parallel, the Data (Use and Access) Act 2025 created a statutory basis for smart data schemes, giving the FCA authority to set open banking data standards through a new legislative framework. This does not replace PSD2 regulation uk but layers over it with strengthened FCA discretion.
PSD2 FCA enforcement posture in 2026
PSD2 FCA enforcement activity has focused on:
- Third-party providers operating without valid authorisation
- Platforms facilitating access beyond the scope of user consent
- Firms failing to meet Open Banking Standards for API availability
- Inadequate PSD2 complaints processes leaving customers without recourse
UK platforms should verify that their provider’s FCA registration remains valid on the FCA Register -not just at onboarding, but on a regular review cycle.
For more on open banking API UK security and data handling expectations, see open banking security.
What Are PSD2 Complaints Requirements for UK Platforms?
Under PSD2 regulation UK, payment service users have the right to raise PSD2 complaints against both the provider and the platform through which they accessed the service. Your platform’s obligations are:
- A complaints procedure that is clearly accessible to users
- Acknowledgement within 5 business days (in most cases)
- Full resolution within 15 business days, extendable to 35 business days in exceptional circumstances
- Escalation rights to the Financial Ombudsman Service (FOS) if the complaint is not resolved
PSD2 complaints that go unresolved can result in FOS referral and, in aggregate, FCA supervisory attention. Platforms that have not built a complaints route into their product -even if they rely entirely on a licensed provider -are non-compliant on this specific obligation.
How Does Finexer Align With PSD2 Compliance for UK Platforms?
Finexer operates as an FCA-authorised AISP and PISP under the payment services regulations (FRN 925695). For platforms building on Finexer’s infrastructure, the authorisation, Open Banking Standards conformance, SCA handling, data access controls, and incident reporting obligations sit with Finexer -not the platform.
Platforms using Finexer Data access real-time bank transaction data through Finexer’s consent layer, which manages the full consent lifecycle: initial authorisation, 90-day re-authentication, scope enforcement, and revocation.
Where Finexer specifically fills the gaps most platforms carry:
- FCA authorisation independently verifiable on the FCA Register (FRN 925695)
- Dual AISP and PISP permission -most providers hold one, not both
- Consent lifecycle managed end-to-end -platforms surface prompts, Finexer executes
- Open Banking Standards compliant across 99% of UK bank connections
- PCI DSS-compliant infrastructure for data handling obligations
- GDPR-aligned data processing with defined retention controls
- Built for mid-market SaaS and fintech platforms -not enterprise-only
Finexer’s position under PSD2 regulation UK means platforms can rely on Finexer’s permissions rather than seeking independent FCA authorisation, provided their use case falls within Finexer’s licensed scope. Firms should take their own legal advice to confirm this for their specific situation.
Bottom Line
PSD2 regulation UK divides compliance responsibilities between the authorised provider and the platform that builds on top. Providers handle authorisation, SCA, and Open Banking Standards conformance. Platforms handle consent presentation, purpose clarity, re-authentication prompts, and PSD2 complaints.
Most platforms underestimate this second list. Getting the obligation split right from the start avoids supervisory risk later. The 2026 UK position -with new PSD2 FCA powers and the Data (Use and Access) Act 2025 in force –raises the standard, not just for providers, but for the platforms that rely on them.
This content is for general information and should not be construed as legal or regulatory advice. Always seek independent legal advice for your specific situation.
What does PSD2 mean for a UK platform that doesn’t hold its own FCA licence?
Under PSD2 regulation uk, a platform without its own licence must integrate a licensed provider (AISP or PISP) to access bank data or initiate payments. The authorisation, Open Banking Standards compliance, and SCA handling sit with the provider. The platform retains responsibility for consent management, purpose clarity, and PSD2 complaints handling.
How does PSD2 FCA supervision affect UK platforms in 2026?
PSD2 FCA supervision in 2026 focuses on the authorised provider, but platforms can be drawn into enforcement where they facilitate data access beyond consent scope or operate without a compliant complaints process. The FCA’s new powers under the Data (Use and Access) Act 2025 extend oversight into the smart data layer that open banking API UK infrastructure operates within.
What are Open Banking Standards and do they apply to my platform?
Open Banking Standards are the technical and operational specifications that govern how providers connect to bank APIs, manage consent, and maintain availability. They apply directly to the authorised provider. Platforms that build on a provider’s infrastructure inherit the benefit of that compliance, but must ensure their user-facing consent flows and purpose statements meet the standards separately.
How should PSD2 complaints be handled on a platform?
PSD2 complaints must be acknowledged within 5 business days and resolved within 15 business days. Platforms must have a clearly accessible complaints route available to users and must escalate unresolved complaints to the Financial Ombudsman Service. Failure to meet this specific obligation is a platform-level risk, regardless of provider compliance.
Can a UK platform rely on an open banking API UK provider’s authorisation entirely?
For authorisation, SCA, and data access controls, yes. For consent presentation, purpose clarity, and PSD2 complaints, no. Platforms must satisfy these obligations independently. Firms should take their own regulatory advice on the precise scope of reliance for their specific business model.
Platforms building on Finexer’s infrastructure can rely on our authorisation, SCA handling, and Open Banking Standards compliance -while we help you understand what stays with you.
Explore with AI
About the Author
Clare Pearson
Clare Pearson is a senior payments professional with extensive experience across the global financial services and payments industry. She specialises in Open Banking, payment infrastructure, and financial technology transformation, with expertise spanning product delivery, operational strategy, regulatory compliance, and large-scale payments programmes. Clare currently serves as a Non-Executive Director at Finexer and a panel member for the Payment Systems Regulator (PSR), advising on the development of payment systems policy and innovation