The FCA has published its open finance roadmap, expanding the principles of open banking to mortgages, investments, savings and pensions. The vision is right. The hard part is what regulation cannot do for you.
The FCA’s open finance roadmap is a significant moment. Extending the data-sharing principles that transformed current account access to the wider financial services sector – mortgages, investments, savings, pensions – sets a direction that the industry has been waiting for. The Smart Data Accelerator, the PRISM Taskforce, co-design with industry: the architecture of consultation is in place.
But regulation starts the clock. It does not build the infrastructure that makes the vision run.
Open finance creates multi-party chains. A bank holds data. An intermediary moves it. A lender acts on it. When something goes wrong in that chain – a breach, a misuse, an unauthorised disclosure – who is responsible?
That question does not have a clean answer yet. The FCA has committed to working with HM Treasury on a regulatory framework for open finance by the end of 2027. That is the right direction. But firms will be building and connecting in the meantime, on the basis of a framework that is still being written.
The confidence infrastructure – the layer that verifies who is in the network, monitors their risk in real time, and ensures liability lands in the right place – does not exist yet. And no amount of regulatory vision changes that until the market builds it.
The UK has run an open banking mandate for ten years. The lessons are visible to anyone who looks.
Regulation can mandate participation. It cannot mandate trust. The open banking ecosystem created connectivity but left the question of risk management largely to bilateral arrangements between institutions – duplicated due diligence, inconsistent standards, no shared view of who is safe to connect with at any given moment.
Open finance will move further and faster, across more sensitive data categories, with more participants. The risk surface is larger. The need for shared infrastructure to manage it is proportionally greater.
First: a consistent accreditation standard that covers the whole chain, not just the regulated part of it. The FCA regulates banks and authorised firms. It does not – and will not – regulate every participant in an open finance data chain. An aggregator moving data between a bank and a lender may sit outside direct FCA supervision. The third-party provider acting on that data may be registered but not fully supervised. The further down the chain you go, the thinner the regulatory coverage becomes.
This is not a criticism of the FCA. It is the structural reality of how open finance works. Data moves horizontally across institutions and sectors. Regulation governs vertically, within defined perimeters. The long tail of participants – the third-, fourth, and nth party providers – still needs to be monitored, assessed, and held to a consistent standard. That work cannot be done by a regulator. The market has to build it.
One of the lessons from Australia’s Consumer Data Right is that over-engineering accreditation kills adoption – smaller participants cannot absorb the compliance cost and the market stalls. The answer is not no standard. It is a proportionate, shared standard that operates once across the network rather than being replicated in every bilateral relationship, and that covers every participant in the chain, not just the ones with an FCA authorisation number.
Second: ongoing risk monitoring, not point-in-time certification. A firm that passes an assessment today is not automatically safe to connect with in six months. Open finance risk is dynamic. The infrastructure that manages it needs to be too.
These are not features that regulation can legislate into existence. They are market infrastructure – the kind that requires organisations to build it, invest in it, and use it consistently enough that it becomes the default.
The FCA has put the industry on notice: open finance is coming, and this time there will be genuine input into how the framework is designed. That is an opportunity and a responsibility.
Invela is building the open finance risk management network – standardised Accreditation, dynamic risk monitoring via the Invela Risk Indicator, and insurance-backed Warranty. The confidence infrastructure that the FCA’s roadmap requires is being built. The firms that start using it now will be best positioned when the regulatory framework arrives.
The clock is running.
___________________________________
Read the full Compliance Corylated analysis of the FCA open finance roadmap: The FCA sets out open finance strategy; the industry needs to respond (https://www.compliancecorylated.com/news/the-fca-sets-out-open-finance-strategy-the-industry-needs-to-respond/)
-p-2000.jpg)
