Open Banking Grows a Brain: PSD3, Intelligent Cores and the Great API Reset of September 2026
In seven days, Mambu wired agentic AI into its core, PSD3 edged closer to the Official Journal, and BaaS finally started sounding like a regulated business model rather than a marketing bet.
If you thought open banking had settled into a comfortable middle age, September 2026 wants a word. In the week to 30 September, three separate developments quietly rewrote what "open" is supposed to mean, and the answers now include autonomy, intelligence and a much shorter tolerance for legacy plumbing.
Mambu bolts an intelligent core onto the composable banking stack
On 2 September 2026, Mambu announced the launch of Intelligent Core, a rebundling of its composable banking platform that unites Mambu Core, Mambu Payments and a new layer called Mambu Agentic. The launch, covered by The Paypers, Tech Africa News and Finopotamus, is the clearest statement yet that "AI in banking" is moving out of pilot slide decks and into the ledger itself.
Mambu Agentic adds native AI connectivity, specialised agents and autonomous workflows directly at the core level. That is a very different proposition from bolting a chatbot onto a mobile app. It puts intelligence at the layer where decisions get made about balances, limits and payment routing, which is exactly where regulators, risk officers and technology teams have all been circling for the past 18 months.
Why "intelligent core" is not another vendor phrase
The composable banking movement, which Mambu has helped define for 15 years across deposits, lending and Islamic banking modernisation, was built on a very human premise: you can compose your bank out of best-of-breed modules, and humans will still make the interesting decisions. Intelligent Core edges that premise sideways. The interesting decisions get delegated to autonomous workflows, with the humans supervising rather than clicking.
For a bank chief operating officer, the pitch is straightforward. If your core can decide when to reroute a payment, which fraud rule to trigger, or how to segment a lending book, you are no longer paying humans to click through queues. FinanceX sees this as the beginning of a genuine architectural shift, and Mambu is the first big composable vendor to say so out loud.
PSD3 stops being a conference topic and becomes a countdown
While vendors rewired their cores, Brussels quietly kept moving. Publication of PSD3 in the Official Journal is now anticipated for mid-2026, with the accompanying PSR (Payment Services Regulation) applying directly 21 months after publication, according to guidance summarised this week by Embat, Open Banking Tracker and J.P. Morgan.
That timeline is the moment PSD3 shifts from thought leadership to project plan. Three shifts matter most.
API performance becomes a rule, not a hope
PSD3 introduces prescriptive API performance and uptime obligations that are more granular and more enforceable. In plain English: uptime is no longer a best-efforts conversation between a bank and its third-party providers. It is a metric with teeth, and account information service providers and payment initiation service providers finally get an SLA that looks like an actual SLA.
Fraud liability gets redistributed
PSD3 and the PSR move fraud liability between payers, payees and payment service providers in ways that will keep general counsels busy for months. Impersonation fraud, in particular, sits closer to the payment service provider than it did under PSD2, which is why UK and EU banks have quietly been investing in impersonation detection for the last two quarters.
Harmonisation, at last
Because the PSR is a regulation rather than a directive, national implementation gaps that plagued PSD2 will narrow. A German fintech will no longer need to run five variations of consent flows to serve five markets. For any cross-border BaaS or embedded finance business, this is the sleeper commercial story of PSD3.
The end of screen-scraping and the arrival of permission dashboards
The two consumer-facing changes worth flagging: screen-scraping ends, and customer permission dashboards get embedded directly in banking apps. That second change is easy to underestimate. Once every European retail bank shows customers a live map of who is reading their data, expect a wave of quiet unsubscribes from third parties that never explained themselves properly.
BaaS finally starts sounding like a regulated business
The third strand of the week's story is Banking-as-a-Service growing up. According to FintechFutures and industry coverage this month, Bank CenterCredit tapped Tuum to power its BaaS offering, and UK fintech Keel launched from stealth targeting the same infrastructure layer. The interesting detail is not who launched what, but the language. Both announcements lean into compliance architecture, capital adequacy and regulatory clarity rather than "developer velocity" and "time to market", the two phrases that dominated the last BaaS cycle.
BaaS is quietly repositioning as infrastructure rather than as a startup story, and the buyers reflect that. The webinar circuit on 17 September, covered under the theme "Embedded finance and BaaS unlocked: Navigating compliance, new technology and opportunity", was dominated by risk officers and heads of compliance, not growth marketers. That is the tell.
Why the buyer shift matters
When BaaS providers pitched growth teams, the winning demo was speed. When they pitch risk officers, the winning demo is auditability, on-balance-sheet clarity and regulatory pedigree. Providers who cannot answer, credibly, how they meet DORA, PSD3 and local prudential requirements are quietly being cut from procurement shortlists. That is a good thing for the market. It is a slightly stressful thing for anyone who built a BaaS business between 2021 and 2023.
The great API reset
Zoom out and the pattern is coherent. Mambu is putting intelligence inside the core, PSD3 is putting teeth into APIs, and BaaS is putting regulatory posture at the front of the pitch. Each thread reinforces the others: an intelligent core needs high-performance APIs to be useful, high-performance APIs need enforceable rules, and BaaS providers need both to sell to serious banks.
For financial institutions still running on batch processes and best-efforts SLAs, September 2026 is the polite warning shot. The stack around them is being upgraded, and the regulators are converging on the same expectations that vendors like Mambu are already building against.
What to watch next quarter
Three things to keep an eye on. First, whether the FIS Embedded Banking Platform pilots referenced in this week's beyond-banking coverage start filing early results. That will tell us whether banks or software vendors end up owning the embedded finance customer. Second, the precise wording of PSD3 as it lands in the Official Journal, particularly the API SLA metrics. Third, which core banking vendor announces the next "intelligent core" equivalent. If 10x Banking, Thought Machine or Temenos respond within 90 days, we will know Mambu has set the new bar.
Open banking used to be a slogan. In September 2026, it is starting to look like an operating model. About time.
