UK Open Banking reaches major milestone

The UK Open Banking framework has reached significant operational scale, surpassing one billion account-to-account payments and 100 billion API calls. Open Banking Limited reports these figures, which mark a transition for the technology from a regulatory compliance requirement to a core component of enterprise financial infrastructure.

The network growth is concentrated among the CMA9, the nine largest current account providers in the United Kingdom. Infrastructure resilience and payment velocity have increased over the last eight years. In June 2026 alone, the system processed 2.81 billion API requests, representing a 4.4 percent month-on-month increase. During this period, the network maintained a weighted system uptime of 99.35 percent while achieving a 50 ms improvement in latency.

Digital payments are becoming faster and more reliable than traditional card networks for the average user.

Moving money between accounts allows for better cash flow management due to the lack of card scheme fees and the speed of real-time settlement. This setup removes the intermediaries that historically slowed down transfers and added unnecessary costs.

While single domestic payments saw a 1.2 percent decline in the summer to 32.43 million transactions, volume remains high. This dip was offset by the adoption of Sweeping Variable Recurring Payments, which grew 6.7 percent to 7.73 million transactions. These arrangements allow users to provide continuous consent for automated transfers within specific parameters, aiding in liquidity management and subscription processing.

The scale of monthly API calls creates new challenges for security teams. Maintaining an average response time of 349 milliseconds requires rigorous use of load balancing and edge caching. Technical architects are currently focused on protecting OAuth 2.0 and Financial-grade API token systems, as these are primary targets for credential hijacking and unauthorized consent changes.

Because these payments settle instantly over the Faster Payments network, the absence of traditional chargeback mechanisms makes fraud prevention a priority. Bad actors frequently target the human layer through complex Authorised Push Payment (APP) fraud and social engineering rather than attempting technical API exploits.

The UK experience provides a reference point for other markets, including the United States. While the former relied on top-down mandates for the CMA9 to create a unified technical baseline, the latter financial sector historically depended on bilateral agreements and screen scraping. Recent rulemaking by the Consumer Financial Protection Bureau is now pushing US institutions toward similar standardized frameworks to eliminate risky credential sharing.