Open Banking Finally Bares Its Teeth: PSD3 Enters the Home Stretch, cVRP Goes Live, and Core Banking Stops Pretending

As of this week, "open banking" has stopped being a five-year plan and started being a compliance deadline. Here is what is landing on desks in Frankfurt, London, and every core banking vendor's roadmap.

For most of the last decade, "open banking" was a phrase people used to sound futuristic in a keynote. In August 2026, it has become an operational fact, a rulebook in draft, and, if you run a bank technology function, an urgent line on your capex plan. Three things happened this week that make the shift concrete: PSD3 continues its march toward publication, commercial variable recurring payments (cVRP) keep collecting real transactions in the UK, and core banking vendors are quietly winning the biggest rewiring contracts of the decade.

Grab a coffee. This one matters.

PSD3: The Regulation That Refuses to Wait

The proposed text of the Third Payment Services Directive (PSD3) and the new Payment Services Regulation (PSR) went before national representatives for approval on 22 April 2026, according to Morrison Foerster. The agreed texts were published a day later, with the European Parliament's ECON Committee voting on 5 May 2026. Publication in the Official Journal is anticipated for mid-2026, though a possible slip to September has not been ruled out, according to reporting by FinanceX Magazine.

Once in the Journal, the PSR will apply directly across the EU 21 months later, with PSD3 requiring national transposition within 18 months. High-impact Verification of Payee obligations kick in at roughly 27 months, per Norton Rose Fulbright's analysis of the near-final text.

Why the Structural Shift Is the Real Story

Everyone is talking about PSD3. The bigger story is the PSR sitting alongside it. Because PSR is a regulation and not a directive, it applies directly across all EU member states without national interpretation. As Adyen and TrustBuilder have both flagged this year, that structural change eliminates the divergent transpositions that plagued PSD2 and left open banking developers writing bespoke integrations for every market.

For banks, that means the compliance ambiguity is gone. For third-party providers, it means the operational scale case improves. And for payment orchestration providers, it means, in the words of FinanceX Magazine's July analysis, becoming universal API adapters, not single-rail processors.

Banking.Vision put it plainly this summer: PSD3 and PSR are "on the home stretch, now is the time to prepare." Firms that are still building their PSR readiness plan should stop reading think pieces and start reading their contracts.

cVRP: Recurring Payments Finally Have a Grown-Up Rail

Meanwhile, in the UK, commercial variable recurring payments have moved from "pilot" to "please invoice me." The FCA expected the first live payments under the UK Payments Initiative (UKPI) scheme to take place in Q1 2026, and 31 firms have now come together to drive VRP adoption across phase 1 use cases including utilities, financial services, and government payments.

Reporting from Open Banking Expo and UK Finance shows that industry proposals for a commercial model to underpin Wave 2 of cVRP are now on the table. This is exactly the sort of unglamorous plumbing that only matters when it fails, which is why the FCA and the Payment Systems Regulator have kept a joint eye on delivery timelines throughout 2025 and 2026.

The Numbers Are Suddenly Interesting

According to Plaid's UK cVRP briefing published this year, the UK made 351 million open banking payments in 2025, with VRP accounting for roughly 16% of all open banking transactions and growing 98% year on year. Fraud metrics are quietly staggering: in the first half of 2025, open banking payment fraud was roughly 3.5 times lower than other payment fraud types, per the same source.

That last statistic is the one banks and merchants should tattoo on their strategy documents. A recurring payment rail that is authenticated directly through the payer's bank, does not share card numbers, and cuts fraud by more than two thirds is not a niche use case. It is the future of subscription billing, direct debits, and, quite possibly, a large slice of consumer bill payments.

Stripe's technical writers, in their guide on open banking VRPs published this year, made the practical case: replacing stored card credentials with a single bank-authenticated mandate is not just cheaper, it is more portable. That matters for anyone building a modern billing engine.

FIDA and the Data Access Story

If PSD3 is the payments rewiring, the Financial Data Access framework (FIDA) is the open finance version. FIDA is expected to be formally adopted in mid-2026, though negotiations have faced delays, according to Sopra Steria and Konsentus. When it lands, it will extend open finance beyond payment accounts to include savings, investments, credit, insurance, mortgages, and pensions.

The G+D Spotlight briefing this year put the scope shift plainly: FIDA opens a broader playing field by 2027, and the platforms that build clean, permissioned, and consent-managed access to that data will hold a defensible position.

The catch, as consultancy.uk highlighted in its 2026 outlook, is fragmentation. Open banking adoption remains uneven and is hindered by inconsistent API standards. Industry bodies must converge on developer experience standards, documentation, and minimal service level agreements so that integrations become predictable and reliable. Translation: pick a spec, publish it, and stop rewriting it every six months.

Core Banking: The Contracts Nobody Wants to Talk About but Everybody Is Signing

While the policy story dominates the press, a quieter transformation is playing out in the core banking modernisation market. The likes of Temenos, Thought Machine, and Mambu are being compared side by side as banks issue RFPs for platforms that can natively handle new payment obligations, real-time processing, and cloud-native deployment, per SDK.finance's core banking software rundown for 2026 and Zoolatech's core banking modernisation guide.

The shift is unmistakable. According to DXC and Aspire Systems, the infrastructure layer is moving to cloud or cloud-compatible deployment, driven by AI, real-time capabilities, and ecosystem-based innovation. Global Banking and Finance's mid-2026 assessment goes further, arguing that core banking modernisation is now reshaping the industry's competitive map, particularly across mid-market and challenger institutions.

The Boring Truth About Modernisation

Core banking modernisation is expensive, slow, and reputationally risky. That is why it has been postponed for so long. What has changed in 2026 is that the cost of not modernising has finally outrun the cost of modernising. Real-time payments, PSD3 obligations, and open finance data-sharing all require the sort of API surface, event-driven architecture, and cloud elasticity that a monolithic mainframe simply cannot deliver.

The result: mid-market banks are moving. Some are re-platforming outright. Others, according to Legacy Leap's 2026 briefing, are pursuing hollow-core strategies, gradually migrating capabilities off the mainframe while keeping the general ledger intact. Both approaches are viable. Neither is cheap.

BaaS and the Provider Consolidation Story

The Banking-as-a-Service story continues to sit on top of all of this. The global BaaS market is projected to exceed $75bn by 2030, growing at roughly 17% annually, according to Sumsub's 2026 embedded finance and BaaS analysis. For fintech startups, Unit, Railsr, and ConnectPay remain the go-to providers, offering developer-friendly APIs and structured compliance frameworks.

Notably, ClearBank has just hired former Uber executive Tristan Kirchner to lead its European expansion plans, according to reporting cited by Landbase this month. That is the sort of signal that suggests the BaaS provider map is about to get more crowded, not less. Expect further partnership news, particularly in the B2B eCommerce space, where niche financial products like BNPL for businesses, merchant financing, and trade credit insurance are all now table stakes.

The Provider Landscape: Tink, Plaid, TrueLayer

At the API integration layer, the picture is clarifying. Tink is strongest in the Nordics and DACH region, TrueLayer holds the UK and Ireland, and Plaid continues to improve everywhere while dominating US financial data connectivity, according to Fintegration FS's 2026 comparison. Plaid's February 2026 product update introduced enhanced identity verification and anti-fraud tools integrated with its data network, giving banks and fintechs improved secure account connectivity and better alignment with evolving US regulatory frameworks.

Meanwhile, Tink continues to leverage its 3,400+ institution coverage across 18 markets, courtesy of its Visa parentage. In a fragmented open banking Europe, breadth of coverage is starting to matter more than depth of feature set.

What This Week Really Means

Three things worth taking away as you plan the rest of Q3.

First, PSD3 and PSR are locked in. The dates may slip by weeks, but the direction is fixed. Every European payments team should have a costed readiness plan on the desk.

Second, cVRP is real. If your billing team is not planning for a shift away from stored cards toward bank-authenticated mandates, you will pay for it in higher fraud costs and higher processing fees.

Third, core banking modernisation has passed its tipping point. The RFPs are out. The vendors are winning. The question is no longer "if" but "who and when."

The Bottom Line

Open banking spent years being a story about permissions and portals. In August 2026, it is a story about payments, data, and infrastructure moving together. The banks that treat this as three separate projects will find themselves paying three times. The ones that treat it as a single architectural bet will find they are suddenly cheaper to run, easier to plug into, and, for the first time in a long time, competitive with the fintechs they have been chasing for a decade.

Now is not the time to look away.