UK Open Banking Surpasses 100B API Calls, 1B Payments
The UK’s open banking framework has reached a significant milestone, surpassing 100 billion API calls and one billion payments across the CMA9 institutions. This achievement marks a shift in financial infrastructure, moving away from legacy payment systems. Financial technology leaders, IT security architects, and regulators now view these milestones as critical benchmarks for building high-throughput, real-time financial systems globally.
The Competition and Markets Authority (CMA) introduced open banking mandates for the UK’s nine largest current account providers over eight years ago. Since then, the ecosystem has shown steady growth in performance, resilience, and payment velocity, evolving from a compliance mandate into a cornerstone of enterprise infrastructure.
Infrastructure Scaling and Network Traffic
Data from Open Banking Limited reveals sustained growth in the core CMA9 banking infrastructure. In June 2026, the network saw a 4.4 percent month-on-month increase in volume, with a 50 ms latency improvement and a 99.35 percent unweighted system uptime. This growth shows the network’s ability to handle increasing transaction volumes while maintaining high performance and reliability, critical for both consumer and commercial environments.
The total number of account-to-account (A2A) transactions executed since the network’s inception has been steadily rising, alongside an increasing number of API requests processed across CMA9 institutions. These metrics reflect the deepening integration of open banking into everyday financial operations, from personal payments to complex corporate transactions.
Variable Recurring Payments Drive Growth
While Single Domestic Payments saw a slight dip in June, total payment volumes remained strong. The growth was primarily driven by the rapid adoption of Sweeping Variable Recurring Payments (sVRPs), which expanded by 6.7 percent month-on-month to reach 7.73 million transactions. This growth highlights the versatility of VRPs in automating diverse financial processes, from liquidity management to subscription payments, without the fees associated with traditional credit card schemes.
VRPs allow users to grant continuous consent for automated A2A funds transfers within predefined parameters. This innovation is being leveraged by enterprise merchants, fintech applications, and corporate treasury platforms to streamline operations and reduce costs. For instance, businesses use VRPs to automate recurring savings allocations and subscription processing, enhancing efficiency and customer satisfaction.
API Security and Operational Resilience
Processing 2.81 billion monthly API calls presents unique challenges for financial services IT security architects and DevSecOps teams. Maintaining an average response time of 349 milliseconds at scale requires strict API gateway rate-limiting, edge caching, and automated load balancing. Implement Real-Time Payload Inspection at Gateway: Given sub-350ms response benchmarks, traditional out-of-band fraud checks create unacceptable latency. IT architects must deploy inline, machine-learning-driven threat detection directly at the API gateway layer to flag anomalies in payment metadata before execution on instant rails.
As the use of VRPs grows, third-party providers must secure OAuth 2.0 and Financial-grade API (FAPI) token management systems against various threats, including credential stuffing and token hijacking. The instant settlement nature of open banking transfers also introduces fraud risks, with bad actors targeting the human layer through complex Authorised Push Payment (APP) fraud and social engineering. Security teams must upgrade FAPI implementations to support long-lived, multi-use consent tokens, isolate token endpoints via mutual TLS (mTLS), and monitor for unusual refresh rates that indicate credential harvest attempts.
Global Regulatory Approaches
In contrast, the US financial sector has historically relied on bilateral market agreements and screen scraping, leading to inefficiencies and security risks. However, recent rulemaking by the Consumer Financial Protection Bureau (CFPB) under Personal Financial Data Rights guidelines is driving US banks and fintechs toward standardized API frameworks. US institutions are now implementing technical architectures similar to those in the UK, eliminating risky credential sharing and building secure A2A networks.
