Open Banking Grows a Brain: PSD3, Intelligent Cores and the Great API Reset of September 2026
Mambu ships an AI-native core, Temenos moves a Vietnamese giant to hybrid cloud, and Brussels edges PSD3 closer to the finish line. Welcome to the week open banking and core modernisation collided.
The middle of September has quietly become the most consequential week of the year for anyone building on top of a bank. In a matter of days, Mambu unveiled its most ambitious release since founding, Temenos wrapped a headline hybrid cloud migration for one of Vietnam's largest lenders, and the European Union edged closer to publishing the final PSD3 and PSR texts in the Official Journal. Combine that with Plaid and Mastercard sharpening their open banking toolkits earlier this year, and the picture becomes clear: 2026 is not the year of incremental change. It is the year the plumbing got smart.
Mambu Bolts an AI Layer Onto the Core
On 2 September 2026, Mambu launched Intelligent Core, a release that Finopotamus describes as bringing together Mambu Core, Mambu Payments and the newly announced Mambu Agentic into a single stack. Mambu Agentic is the headline act, a native intelligence layer that ships specialised agents and autonomous workflows directly inside the core, rather than bolting them on via external orchestration.
For banks that have spent five years wrestling with how to plug generative AI into monolithic legacy stacks, the pitch is compelling. Intelligent Core is not a marketplace of third-party bots; it is an attempt to embed reasoning inside the ledger itself. That has real implications for exception handling, fraud triage, dispute resolution and product configuration, all traditionally the graveyards of banking automation projects.
Whether Mambu's execution matches its ambition is a story that will unfold across the next few quarters, but the strategic direction is unmistakable. Cloud-native cores are no longer competing on speed of deployment; they are competing on how much cognitive lift they can absorb from the bank's operating model.
Temenos and SACOMBANK Prove Migration Is Doable
Not every bank wants to rip and replace. On 26 August 2026, according to Temenos, one of Vietnam's leading commercial lenders, SACOMBANK, completed an upgrade of its Temenos Core Banking platform, migrating from an on-premises deployment to a hybrid cloud environment in partnership with IBM. It is the kind of announcement that sounds unglamorous until you notice how many peer banks are still stuck on version-locked legacy setups.
Temenos itself has framed 2026 as the year of "progressive modernisation" rather than big-bang overhauls, and SACOMBANK is a strong data point for that view. Hybrid cloud is not the final destination for every institution, but it is the pragmatic bridge for banks that need modern APIs, faster release cycles and better resilience without the political appetite for a full core replacement.
Thought Machine Keeps Winning the Tier-1 Argument
The third leg of the cloud-native core story remains Thought Machine, whose Vault platform continues to power Tier-1 deployments at Lloyds Banking Group and Standard Chartered, as documented by 10x Banking's 2026 buyer's guide. That reference set matters. When incumbents ask whether truly event-driven, cloud-native cores can run at systemic scale, the honest answer in 2026 is yes, and here are the receipts.
The competitive dynamic across Mambu, Temenos and Thought Machine tells you something important: there is no single winning archetype. Cloud-native leaders like Mambu and Thought Machine, and modernised incumbents like Temenos, all now credibly service both scaled banks and challenger models. The question for buyers has shifted from "who is safe?" to "which architecture matches my target operating model?".
PSD3 Enters the Home Straight
Regulation is doing its bit to accelerate the shift. On 27 November 2025, the European Parliament and Council reached provisional agreement on PSD3 and the accompanying Payment Services Regulation (PSR), and the agreed texts were published on 23 April 2026. The Parliament's ECON Committee voted on 5 May 2026, according to Norton Rose Fulbright, with publication in the Official Journal anticipated for mid-2026. Once published, the PSR applies directly 21 months later, while PSD3 requires national transposition within 18 months.
For banks and non-bank PSPs, the operating implications are chunky. J.P. Morgan and Crassula both highlight the same headline changes: higher API performance standards, customer permission dashboards embedded in banking apps, and the end of screen-scraping fallback mechanisms. If your API is flaky, your dashboards are clunky or your data sharing still relies on scraping, the clock is now ticking loudly.
The compliance deadline is expected to land in mid to late 2027, but as the OpenBankingTracker readiness guide points out, the smart institutions are not waiting. API performance is a slow build, and customer-facing permission UX is a design job, not a compliance box tick.
Ozone API, Plumery and the Rise of Composability
While regulators tighten the frame, the private sector is filling in the picture. Open Banking Expo reported that Ozone API has announced a strategic partnership with Plumery, combining Ozone's specialist open banking platform with Plumery's Digital Success Fabric. The pitch is simple: give financial institutions a compliant, deployable, opinionated stack for next-gen digital banking without a two-year integration project.
That kind of composable partnership is telling. In 2024 and 2025, banks flirted with the idea of building everything themselves. In 2026, the emerging orthodoxy is that a curated combination of specialist providers, glued together via clean APIs, is faster, cheaper and less risky than a monolithic build.
The US Catches Up on Data Access
Across the Atlantic, the story is quieter but no less consequential. Truist Financial has announced a data-access agreement with Plaid, transitioning its customers to a secure tokenised API, according to reporting on open banking partnerships. That places Truist alongside JPMorgan Chase, Wells Fargo, Citi and other majors that have signed similar aggregator agreements.
Plaid itself expanded its open banking capabilities in February 2026 with enhanced identity verification and anti-fraud tools integrated into its data network, per multiple 2026 market analyses. And Mastercard, in January 2026, strengthened its open banking platform in North America with AI-powered data analytics for financial institutions. The US may not have a PSD3 equivalent yet, but the market is quietly building its own version of one.
The UK Milestone Nobody Should Miss
For a sense of just how far open banking has travelled, UK data shared through 2026 puts the country past one billion payments and 100 billion API calls across the CMA9 banks. Those are not marketing numbers; they are proof that a well-regulated, well-governed open banking regime scales to industrial volumes. Every regulator drafting its own framework, from São Paulo to Riyadh, is studying the UK receipts.
What It Means for the Next Six Months
Three practical takeaways for banks, fintechs and platform players.
First, if you sell or run a core banking system, the competitive frontier is now AI-native functionality, not deployment speed. Mambu has drawn a line in the sand with Intelligent Core; expect Temenos, Thought Machine, Finxact and 10x Banking to respond in kind before year end.
Second, if you operate under EU or UK open banking rules, treat PSD3 as a design deadline rather than a legal one. API SLAs, permission dashboards and post-scraping architectures need product owners now.
Third, if you are watching the US market, do not assume Washington's political flux means open banking is dead. The bilateral aggregator deals are quietly building the same outcome via commercial rails.
The plumbing has grown a brain. Now the interesting question is how banks choose to use it.
