Open Banking Grows a Brain: PSD3, Intelligent Cores and the Great API Reset of September 2026
Mambu ships an agentic core, Temenos leans into progressive modernisation, and the EU's PSD3 file finally moves. This is the week the API stack picked a direction.
The open banking story used to be about who could dump the cleanest transaction feed into someone else's app. As of this week, that framing looks quaint. In the seven days to 23 September 2026, three separate developments quietly rewrote what "open" is supposed to mean, and the answer now includes autonomy, intelligence, and a much shorter tolerance for legacy plumbing.
Mambu's Intelligent Core: the shot across the bow
The headline came from Amsterdam. On 2 September 2026, Mambu launched Intelligent Core, a repositioning that folds Mambu Core, Mambu Payments and a new Mambu Agentic layer into a single stack, according to Mambu's own press release and coverage in Finopotamus, TechAfrica News and The Paypers. What is genuinely new is not the branding but the architecture: Mambu is embedding agentic AI directly into the core and payments infrastructure, not draping it over the top like a chatbot on a mainframe.
Three capability layers do the heavy lifting. The first is a Model Context Protocol (MCP) implementation that connects enterprise AI agents directly to core banking and payments systems with access to real-time data and context, no bespoke integration project required. The second, AI Insights, is a curated data layer that keeps those agents on well-lit rails. The third, Agents, ships pre-built agents that can gather data, reason within configurable guardrails, take authorised actions and, importantly, explain their decisions.
That third bullet, explainability, is not a soft feature. It is the price of admission to any regulated European deployment for the next two years.
Why "intelligent core" is a category, not a brand
Mambu's positioning claim ("most banks are still layering AI on legacy cores that were not built for real-time intelligence or autonomous action") is provocative on purpose. It draws a line in the sand for Temenos, Thought Machine, Finxact and 10x Banking, and analysts covering the space (per FinTech Futures) expect answers from each before year end. Temenos has already signalled its move, framing 2026 as the year of "progressive modernisation" rather than big-bang overhauls, with SACOMBANK's shift to hybrid cloud held up as an early data point. Thought Machine, meanwhile, continues to power Tier-1 deployments at Lloyds Banking Group and Standard Chartered, and its Vault architecture is well placed to layer in the same agentic hooks.
The interesting question is not who wins the "AI-native core" tagline. It is which vendor gets audited first, and how the regulator responds when a core that can act on its own goes into production.
PSD3 crosses the finish line, on paper
On the regulatory side, this week reads less like a plot twist and more like a slow motion arrival. Following the April 2026 provisional agreement between the European Parliament and Council, the proposed text of PSD3 and the new Payment Services Regulation (PSR) went to national representatives on 22 April 2026, with agreed texts published on 23 April 2026 and the ECON Committee vote scheduled for 5 May 2026, per Morrison Foerster and Norton Rose Fulbright. Publication in the Official Journal is anticipated for mid-2026, and the PSR applies directly 21 months after publication.
Translation for anyone with a payment services licence: the clock is running.
What actually changes
PSD3 and the PSR make three practical shifts that matter for open banking teams. First, prescriptive API performance and uptime: open banking obligations are more granular and more enforceable, with clearer contingency requirements. Uptime is no longer a best-efforts conversation. Second, fraud liability moves: the regime introduces sharper allocation of responsibility between payers, payees, and payment service providers, with knock-on effects for onboarding, strong customer authentication and consumer redress. Third, harmonisation, not just directive-level guidance: because the PSR is a regulation rather than a directive, national implementation gaps that plagued PSD2 should narrow, which is good news for cross-border BaaS.
For fintechs that spent the last five years complaining that PSD2 APIs were flaky and inconsistent, the arriving text is closer to what they asked for. The catch is that it also expects them to run to the same standards on the other side of the pipe.
FiDA looms in the background
Sitting just behind PSD3 is FiDA, the Financial Data Access framework, the piece of legislation that finally pushes open banking into open finance. According to Capco, KPMG and Konsentus, FiDA is still moving through the EU legislative process in 2026 following the April 2025 trilogue and continued work by the Parliament's ECON committee, with formal adoption expected mid-2026. Implementation begins in late 2027, with obligations phased in sector by sector through Financial Data Sharing Schemes (FDSS) that set common technical standards, reasonable compensation for data holders, and clear liability rules.
That last mechanism, industry-governed schemes with pricing and liability baked in, is the biggest structural change. It is also the one European banks are least ready for. FiDA extends compulsory data sharing beyond accounts and payments into mortgages, pensions, investments and insurance, and eventually crypto assets. Any Tier-2 European bank that still runs product silos in separate cores is now on a two-year runway to fix that.
BaaS grows up too
BaaS is no longer the shiny thing, and that is a compliment. Fintech Global cites a $22.5 billion global BaaS market in 2026, projected to hit $70.8 billion by 2032. The category is settling into two lanes: bank-owned platforms (FIS's new embedded stack for banks is a canonical example, per PYMNTS), and specialist BaaS providers doubling down on niche verticals. The scheduled industry webinar on 17 September 2026 titled "Embedded finance and BaaS unlocked: Navigating compliance, new technology, and opportunity" (per Fintech Futures) is symptomatic. The conversation has moved from "what is BaaS" to "how do you keep BaaS compliant at scale".
The market side: aggregators, incumbents and the UKPI wildcard
Even in the plumbing corners, the personalities are moving. TrueLayer's COO Rob Kerrigan has joined the newly formed UK Payments Initiative (UKPI), per TrueLayer's own site and Finextra. UKPI is one of several bodies aiming to give the UK a coherent industry voice on open banking commercials as the FCA and Bank of England shape a Payments Vision. Trustly, meanwhile, remains the profit story in the aggregator pack, with volumes up 54% to $85bn in 2024 and net revenue up 32% to $239m per its own disclosures cited by The Business of Payments, a reminder that monetising open banking is not a myth, just hard.
Reading the whole week
Put the three files side by side and the arrow points one way. Core: intelligence is moving inside the box (Mambu, and, imminently, the response wave from Temenos, Thought Machine, Finxact and 10x Banking). Regulation: the API contract is being tightened (PSD3 and PSR). Scope: the data perimeter is widening (FiDA). If you are running technology at a European bank, the practical read is that you can no longer pick and choose between these workstreams. An AI-native core with weak API SLAs breaks PSD3. A PSD3-ready API layer sitting on a batch-orientated core cannot serve FiDA use cases. A FiDA-ready data model without an intelligence layer is basically an expensive fax machine.
What to watch into Q4
Three concrete questions for the next 90 days. First: who is the second vendor to ship an agentic core in production? The answer will define the competitive shape of the category through 2027. Second: does the ECON Committee's May 2026 vote translate into a clean Official Journal publication? Slippage into 2027 would give banks another year of grace, and delay some very expensive procurement decisions. Third: do UKPI and its analogues manage to agree commercial terms for premium APIs? A workable commercial model for open banking data is still the missing puzzle piece, and it is what would unlock the next wave of BaaS margins.
The takeaway
September 2026 is the moment open banking stopped being a pipe and started acting like a nervous system. Mambu drew the line, PSD3 set the rules, and FiDA quietly widened the field. The banks that treat this as three unrelated projects will spend the next 18 months paying integrators. The banks that treat it as one reset will spend the next 18 months shipping.
