UK Open Banking Hits 100B API Calls and 1B Payments Milestone

Financial infrastructure is undergoing a fundamental shift away from legacy payment rails. With account-to-account (A2A) payments passing the one billion mark and API calls exceeding 100 billion, open banking in the UK has officially evolved from a compliance mandate into critical enterprise infrastructure. For financial technology leaders, IT security architects, and regulators across the UK and US, this milestone provides key performance and security benchmarks for building high-throughput, real-time financial systems.

The Competition and Markets Authority (CMA) introduced open banking mandates for the UK’s nine largest current account providers (CMA9) over eight years ago. Data from Open Banking Limited confirms that ecosystem performance, network resilience, and payment velocity continue to scale steadily across both consumer and commercial environments.

Infrastructure Scaling and Network Traffic

Network operational data from Open Banking Limited illustrates sustained growth across the core CMA9 banking infrastructure:

Variable Recurring Payments Fuel Growth

While Single Domestic Payments saw a slight 1.2 percent dip in June to 32.43 million transactions, total payment volumes remained strong. Network growth was driven by rapid adoption in Sweeping Variable Recurring Payments (sVRPs), which expanded 6.7 percent month-on-month to hit 7.73 million transactions.

VRPs enable users to grant continuous consent for automated A2A funds transfers within predefined parameters. Enterprise merchants, fintech applications, and corporate treasury platforms are increasingly leveraging sVRPs to automate liquidity management, recurring savings allocations, and subscription processing without incurring traditional credit card scheme fees.

API Security and Operational Resilience

Processing 2.81 billion monthly API calls introduces distinct engineering, performance, and security requirements for financial services IT security architects and DevSecOps teams:

• High-Throughput Gateway Resilience: Maintaining an average response time of 349 milliseconds at scale requires strict API gateway rate-limiting, edge caching, and automated load balancing to mitigate latency spikes and prevent distributed denial-of-service (DDoS) vulnerabilities during peak traffic periods.

• Consent Management and Token Security: The rise of VRPs requires third-party providers to secure OAuth 2.0 and Financial-grade API (FAPI) token management systems against credential stuffing, token hijacking, and unauthorised consent alteration.

• Instant Settlement Fraud Risks: Open banking transfers settle instantly over real-time payment systems like the UK’s Faster Payments network. Because real-time settlement lacks native credit card chargeback mechanisms, bad actors frequently target the human layer through complex Authorised Push Payment (APP) fraud and social engineering rather than attempting technical API exploits.

US Data Rights versus UK Mandates

These metrics highlight contrasting regulatory approaches between European and American markets. The UK used top-down regulatory enforcement via the CMA9 to implement standardised APIs, creating a single technical baseline that accelerated institutional adoption.

Conversely, the US financial sector historically relied on bilateral market agreements and screen scraping. However, recent rulemaking by the Consumer Financial Protection Bureau (CFPB) under Personal Financial Data Rights guidelines is driving US banks and fintechs toward standardised API frameworks. US institutions are implementing technical architectures similar to those established in the UK to eliminate risky credential sharing and build secure account-to-account networks.

Roadmap for Engineering and Security Leaders

Crossing these infrastructure thresholds moves account-to-account payments from an alternative option into standard enterprise architecture. To maintain resilience as volumes scale toward open finance, technical decision-makers must act across three immediate priorities:

1. Harden Token Infrastructure for Commercial VRPs: Security teams must upgrade FAPI implementations from read-only architectures to support long-lived, multi-use consent tokens. Token endpoints must be isolated via mutual TLS (mTLS) and monitored for unusual refresh rates that indicate credential harvest attempts.

2. Implement Real-Time Payload Inspection at Gateway: Given sub-350ms response benchmarks, traditional out-of-band fraud checks create unacceptable latency. IT architects must deploy inline, machine-learning-driven threat detection directly at the API gateway layer to flag anomalies in payment metadata before execution on instant rails.

3. Audit Third-Party Consent Lifecycles: DevSecOps teams should audit their token revocation and consent lifecycle protocols. As the UK framework shifts toward commercial non-sweeping VRPs and broader open finance integrations, ensuring that stale permissions are automatically purged is vital to reducing the broader attack surface.