CBK Issues Open Banking Regulatory Framework

For RegCanary subscribers, the signal is unambiguous: the CBK now expects regulated institutions to deliver open banking as a governed, consented and standards-aligned service line, not a pilot experiment. The framework leans on global best practice for security, technical and operational standards, which means local implementation will likely be benchmarked against international API and consent norms rather than bespoke local workarounds. Practically, banks need to map which account data they will expose, how explicit customer consent is captured, evidenced and revoked, and how authorised Account Information Service Providers and Payment Initiation Service Providers will be onboarded, authenticated and monitored on an ongoing basis.

Third-party risk, data protection and operational resilience frameworks will need refreshing to reflect this new distribution channel. Compliance teams should start now: gap-assess current data-sharing arrangements, review contractual and consent language, validate API security and incident reporting paths, and confirm which entities in the group may need authorisation. Competitive dynamics also shift, with fintechs and aggregators gaining a regulated route to customer-permissioned data, and incumbents gaining a channel to build single-view and embedded propositions.

Early movers that align governance, security and consent design will convert a compliance obligation into a product advantage, while laggards risk supervisory scrutiny and loss of customer experience ground.