Open Banking Development Guide UK — OBIE APIs, AISP, PISP & FCA Authorisation

If your product reads account data or initiates payments directly via the OBIE API (without using an aggregator), you need FCA AISP or PISP authorisation. Using an aggregator (TrueLayer, Plaid, Yapily) means the aggregator holds the FCA authorisation — your platform uses their regulated infrastructure. For most early-stage FinTechs, starting with an aggregator is faster and lower-cost than obtaining direct FCA authorisation.

Using TrueLayer or similar aggregator: 3–6 weeks for a basic AISP integration (account data display). 6–10 weeks for PISP (payment initiation) including state machine and error handling. Direct OBIE integration (after FCA authorisation): 12–20 weeks. The FCA authorisation process itself takes 3–12 months and runs in parallel with development.

Open Banking consent and UK GDPR consent are related but distinct. OBIE consent governs access to bank account data. UK GDPR consent (or legitimate interest) governs how you process that data once received. You need both: a valid OBIE consent grant from the customer, and a valid UK GDPR legal basis for processing the financial data you receive. Data portability (GDPR Article 20) applies to Open Banking data — customers can request their data in a machine-readable format.