Open Banking Grows a Brain: PSD3, Intelligent Cores, and the Great API Reset of September 2026
As of this week, the plumbing has stopped being the point. Mambu wired agentic AI into its core, PSD3 edged closer to the Official Journal, and BaaS finally started sounding like a regulated business model. Here is what that means for anyone still shipping APIs in 2026.
Open banking spent seven years being sold as a plumbing story. Standardised APIs, third party providers, screen scraping out, PSD2 in, the future is composable. As of September 2026, that pitch is quietly being replaced. The plumbing is now assumed. The question the market is asking, from Brussels to Berlin to Boston, is whether the intelligence sitting on top of the plumbing is actually good enough to run a bank. This week gave us three answers, and they were all "not yet, but closer than last month."
Mambu Wires AI Straight into the Core
The most audible piece of news came on 2 September 2026, when Mambu launched Intelligent Core. According to Mambu's press release and coverage from Fintech News SG, TechAfrica News, and Financial IT, Intelligent Core brings together Mambu Core, Mambu Payments and the new Mambu Agentic into a single open, composable platform. In plain English: agentic AI now lives inside the core, not around it.
That is a bigger shift than it sounds. For most of the last five years, "AI in banking" meant a model consuming an export, producing a score, and shipping it back over an API. Intelligent Core inverts the pattern. Mambu Agentic gives AI agents native access to real-time banking data, lets them operate inside predefined guardrails, and lets them take authorised actions, not just make recommendations.
Three new layers, one very clear intent
The launch, covered in detail by Arabian Reseller and TechAfrica News, introduces three capability layers worth naming. First, a Model Context Protocol (MCP) that connects enterprise AI agents directly to core banking and payments systems without a bespoke integration for each one. Second, an AI Insights layer that provides curated, trustworthy data for agent reasoning and surfaces growth, risk, and anomaly signals continuously. Third, Mambu Agentic itself, the layer that turns those insights into autonomous, permissioned workflows.
The strategic intent, per Mambu's own framing, is to help banks automate routine operational work and speed up decisions. The commercial intent, less politely, is to make the core the smartest thing in the stack. If you are Thought Machine, whose Vault Core and Vault Payments already power Lloyds and Standard Chartered with smart-contract product logic, this is a competitive shot across the bow. If you are a mid-market bank still running mainframe COBOL, it is a very expensive existential question.
PSD3 Inches Toward the Official Journal
Regulation moved less loudly but arguably further. On 22 April 2026, the proposed text of the Third Payment Services Directive (PSD3) and the new directly applicable Payment Services Regulation (PSR) were put before a meeting of national representatives for approval. Norton Rose Fulbright's tracker notes that the European Parliament's ECON Committee was scheduled to vote on 5 May 2026, with a Parliament plenary vote expected later that month, and publication in the Official Journal originally targeted for June or July, potentially slipping to September.
That "potentially slipping to September" line is why every open banking product manager in Europe was refreshing EUR-Lex this week. J.P. Morgan's PSD3 briefing and Morrison Foerster's client alert both confirm the same read: once the PSR is published, it comes into force 20 days later, and a single supervisory framework replaces PSD2 and the Electronic Money Directive (EMD2).
What actually changes, in one paragraph
The PSD3 and PSR package delivers improved open banking functionality, stronger fraud mitigation, fairer competition between banks and non-bank PSPs, and strengthened consumer rights, according to EY's global insights. Freshfields adds the practical read: firms that treated PSD2 as a compliance sprint and then went back to business as usual are going to spend most of 2027 and 2028 retro-fitting. That is the polite way of saying: the ones who built decent APIs will win, the ones who scraped their way through will refactor.
Layer on top the incoming Financial Data Access (FiDA) regulation, which extends open banking to mortgages, pensions, investments, and insurance and is expected around 2026 to 2027 per Spark's global open banking research, and you have the makings of true open finance. FiDA is the sequel where the API scope stops being "payments" and starts being "everything a customer holds."
BaaS Grows Out of Its Awkward Phase
The third piece is Banking as a Service, which has spent 18 months getting yelled at by US regulators and 18 minutes explaining itself at conferences. The category is finally settling.
Softjourn and Sumsub both size the global BaaS market at around $22.5 billion today, with projections of $70.8 billion by 2032. Crowdfund Insider's analysis published earlier this year argues that fintech focused BaaS is now reshaping bank stability and consumer expectations, not because the model is new, but because the model is finally being priced with realistic compliance overhead.
Why FIS matters here too
Here is where the week's stories intersect. FIS launched its Embedded Banking Platform on 3 September 2026 as a bank-native alternative to the classic BaaS pattern. FIS's release, along with Fintech Global and Stocktitan coverage, describes accounts sitting on the bank's balance sheet, not on a third-party ledger. That is a direct answer to the supervisory scrutiny that has followed several US BaaS-heavy banks over the last two years. Pilot banks Cogent Bank, Commercial Bank of California, and M&T Bank are expected to be live on account opening and payments in the fourth quarter of 2026.
If Mambu's Intelligent Core is about making the core smarter, FIS's platform is about making embedded distribution safer. Both are answers to the same question: how do you deliver bank-grade services outside the bank's own channels without the bank losing control?
The Global Numbers, Just Briefly
The market context matters. According to Openbankingtracker and Spark, the global open banking market was worth $394.9 billion in 2025 and is expected to grow to $460.8 billion in 2026. India's Account Aggregator framework reached 2.88 billion financial accounts enabled for data sharing by March 2026. Australia's non-bank lending obligations under the Consumer Data Right framework begin in July 2026. Everywhere you look, the perimeter is expanding.
Why "80 frameworks" is a warning
A widely shared DEV Community piece from earlier in September notes there are now more than 80 financial API frameworks worldwide, with, in the author's memorable phrase, "zero convergence." That is the risk hiding under the good news. Every jurisdiction is building the plumbing, and very few are talking to each other. If you are a cross-border bank or a multi-jurisdiction fintech, that is 80 sets of consent flows, 80 sets of dispute processes, and 80 sets of dashboards. The AI layer on top only works if the data underneath is coherent, and right now, coherence is not what the map shows.
What We Are Watching Next
Three things to track between now and year end. First, Mambu Agentic's first named production deployment: strategy decks are strategy decks, live customers are proof. Second, the actual publication date of PSD3 and PSR in the Official Journal, because the 20-day clock is the moment every payments product roadmap starts. Third, whether FIS's Q4 embedded banking go-live pushes other core vendors and BaaS providers into bank-native models fast enough to reset the regulatory temperature in the US.
Open banking is not going backwards. It is growing a brain, and a spine, in the same quarter. That is a lot to ask of any category, but it is exactly what September 2026 delivered.
