Open Banking and Identity Verification

Open banking lets a person permit a third party to access specified data from their bank account, or in some cases initiate a payment, through application programming interfaces, known as APIs. APIs are controlled technical connections that allow systems to exchange data. The customer authenticates with their bank and chooses what information to share.

For identity verification, open banking can provide useful evidence that an applicant controls a bank account and that details supplied during onboarding are consistent with the bank's records. It should be treated as one signal in a risk-based verification process, not as proof that every element of a claimed identity is correct.

How open banking is regulated

In the European Union, open banking was established through the revised Payment Services Directive, or PSD2. PSD2 requires many account-servicing payment providers to make payment-account data access and payment initiation available to authorised third parties, with the customer's explicit consent. The framework is being updated through wider EU payments reforms, but PSD2 remains the foundation for current open-banking access.

The United Kingdom has a separate open banking regime, developed following competition remedies and overseen alongside payment-services rules by UK authorities. Its technical standards and implementation structure differ from the EU's, even though the customer experience can look similar.

In the United States, data sharing has historically relied more heavily on bilateral arrangements and data aggregators. Section 1033 of the Dodd-Frank Act directs the Consumer Financial Protection Bureau to support consumer access to financial data. Rulemaking and implementation under Section 1033 remain subject to legal, policy and operational developments, so US coverage and obligations are less uniform than in the EU or UK.

What it can add to identity verification

A typical flow asks the applicant to select their bank, sign in through the bank's own authentication journey, and approve a defined data request. The identity-verification provider or relying business then receives data permitted by that consent. This can support several checks.

• Account ownership and control: a successful bank authentication can indicate that the applicant controls the account. It does not necessarily establish that the person is the sole legal owner, particularly for joint or business accounts.
• Name matching: the account-holder name can be compared with the name claimed in an application. Matching systems need to account for middle names, abbreviations, transliteration, married names and legitimate joint-account holders.
• Bank onboarding as a signal: banks normally conduct know your customer, or KYC, checks when opening accounts. Reusing that result indirectly can strengthen an assessment, but bank KYC standards, timing and ongoing monitoring differ.
• Supporting financial evidence: where the customer authorises it and the law permits, transaction data may show account age, recurring income, salary payments or an address associated with payments. These are context-specific signals, not inherently reliable identity attributes.

Common uses

Fintechs and neobanks can use an open-banking connection during onboarding to link a funding account, check whether the stated name aligns with account data, and identify potential inconsistencies for review. In lending, account data can support affordability assessments by showing income and spending patterns with more current detail than a static document. Lenders must still apply applicable consumer-credit, fair-lending and data-protection rules, including requirements concerning automated decisions.

Another common use is confirming account ownership before a payout, such as an insurance claim, marketplace seller settlement or loan disbursement. This can reduce misdirected payments and some forms of account-substitution fraud, where a criminal changes a recipient's bank details. A connection to an account is not, by itself, a guarantee that a payout is safe: fraudsters may control accounts opened with stolen or synthetic identities.

Related approach: bank-based digital identity

Bank-based digital identity schemes take a different approach. Services such as BankID in Sweden and Norway allow people to authenticate or sign with credentials issued through participating banks. Instead of a business examining account data, the scheme provides an identity authentication event based on the bank credential. These systems have strong domestic reach in their home markets, but they are not equivalent to open banking and do not create a single cross-border identity standard for Europe.

Limits and regulatory expectations

Open banking does not eliminate the need for other verification methods. Financial-crime rules may require firms to identify and verify customers using independent and reliable sources. Depending on the product, risk and jurisdiction, a firm may still need government identification, a selfie or liveness check, a credit-bureau or public-record check, proof of address, or manual review.

Coverage also varies. Not every bank, account type or country exposes the same fields, and data quality can be inconsistent. Consent screens can create onboarding drop-off, especially when users do not understand why access is requested. A name mismatch may reflect fraud, but it may also result from a formatting difference or a legitimate change of name. Businesses need clear fallback routes rather than automatically rejecting applicants.

Privacy and payment-name checks

The central privacy principle is that consent must be specific and understandable. A business should request only the data needed for the stated purpose, retain it only as long as necessary, and avoid repurposing transaction data for unrelated profiling. In the EU, these practices align with General Data Protection Regulation principles including purpose limitation and data minimisation. UK data-protection rules have closely related requirements. US obligations vary by federal and state law, contractual terms and the evolving Section 1033 framework.

EU payments regulation is also moving toward payer-facing checks that compare a payee name with the account identifier before certain transfers. This payment name-check direction addresses a related problem: helping a payer spot a mismatch before sending money. Open-banking ownership checks can support similar fraud controls, but the two mechanisms are distinct. Name comparison should be designed with clear mismatch messages, appropriate customer recourse and safeguards for legitimate variations in account-holder names.